dsh-decision-layer 0.7.1 → 0.7.2

package/lib/host/config-store.js

@@ -0,0 +1,254 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { isObject as safeObject, isProbability as probability } from "./types.js";
+const DEFAULT_URL = "https://api.typesafe.ai";
+const DEFAULT_MODEL = "jev-latest";
+function configPath(env = process.env) {
+  return env.DSH_DECISION_CONFIG_PATH?.trim() || join(homedir(), ".config", "dsh-decision-layer", "config.json");
+}
+async function readStored(path) {
+  try {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    if (!safeObject(value)) throw new Error("Invalid decision configuration");
+    return value;
+  } catch (error) {
+    if (error?.code === "ENOENT") return {};
+    throw error;
+  }
+}
+function safeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function checkedUrl(value) {
+  if (!value) return "";
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error("Invalid URL: expected an HTTP(S) address without credentials, query or fragment");
+  }
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+const RULE_FIELDS = ["addToolNames", "removeToolNames", "addCommandPatterns", "addPathPatterns"];
+function validRules(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => !RULE_FIELDS.includes(key))) throw new Error("Invalid danger rules");
+  const rules = {};
+  for (const field of RULE_FIELDS) {
+    const raw = value[field];
+    if (raw !== void 0 && (!Array.isArray(raw) || raw.length > 64 || raw.some((item) => typeof item !== "string" || !item.trim() || item.length > 128))) {
+      throw new Error("Invalid danger rules");
+    }
+    if (raw !== void 0) rules[field] = raw.map((item) => item.trim());
+  }
+  return rules;
+}
+function validGate(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => key !== "minConfidence")) throw new Error("Invalid gate settings");
+  const gate = {};
+  if (value.minConfidence !== void 0) {
+    if (!probability(value.minConfidence)) throw new Error("Invalid gate settings");
+    gate.minConfidence = value.minConfidence;
+  }
+  return gate;
+}
+const CHECK_FIELDS = ["mode", "rubric", "lowScoreThreshold", "minConfidence", "trendMinConfidence", "trendRun", "trendSevereRun"];
+function validCheck(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => !CHECK_FIELDS.includes(key))) throw new Error("Invalid self-check settings");
+  const check = {};
+  if (value.mode !== void 0) {
+    if (value.mode !== "observe" && value.mode !== "steer") throw new Error("Invalid self-check settings");
+    check.mode = value.mode;
+  }
+  if (value.rubric !== void 0) {
+    if (!Array.isArray(value.rubric) || value.rubric.length > 10 || value.rubric.some((item) => typeof item !== "string" || !item.trim() || item.length > 256)) {
+      throw new Error("Invalid self-check settings");
+    }
+    check.rubric = value.rubric.map((item) => item.trim());
+  }
+  if (value.lowScoreThreshold !== void 0) {
+    if (!Number.isSafeInteger(value.lowScoreThreshold) || value.lowScoreThreshold < 0 || value.lowScoreThreshold > 9) throw new Error("Invalid self-check settings");
+    check.lowScoreThreshold = value.lowScoreThreshold;
+  }
+  if (value.minConfidence !== void 0) {
+    if (!probability(value.minConfidence)) throw new Error("Invalid self-check settings");
+    check.minConfidence = value.minConfidence;
+  }
+  if (value.trendMinConfidence !== void 0) {
+    if (!probability(value.trendMinConfidence)) throw new Error("Invalid self-check settings");
+    check.trendMinConfidence = value.trendMinConfidence;
+  }
+  if (value.trendRun !== void 0) {
+    if (!Number.isSafeInteger(value.trendRun) || value.trendRun < 2 || value.trendRun > 10) throw new Error("Invalid self-check settings");
+    check.trendRun = value.trendRun;
+  }
+  if (value.trendSevereRun !== void 0) {
+    if (!Number.isSafeInteger(value.trendSevereRun) || value.trendSevereRun < 2 || value.trendSevereRun > 20) throw new Error("Invalid self-check settings");
+    check.trendSevereRun = value.trendSevereRun;
+  }
+  if (check.trendSevereRun !== void 0) {
+    const warn = check.trendRun ?? 3;
+    if (check.trendSevereRun <= warn) throw new Error("Invalid self-check settings");
+  }
+  return check;
+}
+const NARROW_FIELDS = ["mode", "threshold", "keepPrefixes", "maxCandidates", "batchMode"];
+function validNarrow(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => !NARROW_FIELDS.includes(key))) throw new Error("Invalid narrowing settings");
+  const narrow = {};
+  if (value.mode !== void 0) {
+    if (value.mode !== "observe" && value.mode !== "enforce") throw new Error("Invalid narrowing settings");
+    narrow.mode = value.mode;
+  }
+  if (value.threshold !== void 0) {
+    if (!probability(value.threshold)) throw new Error("Invalid narrowing settings");
+    narrow.threshold = value.threshold;
+  }
+  if (value.keepPrefixes !== void 0) {
+    if (!Array.isArray(value.keepPrefixes) || value.keepPrefixes.length > 32 || value.keepPrefixes.some((item) => typeof item !== "string" || !item.trim() || item.length > 128)) {
+      throw new Error("Invalid narrowing settings");
+    }
+    narrow.keepPrefixes = value.keepPrefixes.map((item) => item.trim());
+  }
+  if (value.maxCandidates !== void 0) {
+    if (!Number.isSafeInteger(value.maxCandidates) || value.maxCandidates < 1 || value.maxCandidates > 200) throw new Error("Invalid narrowing settings");
+    narrow.maxCandidates = value.maxCandidates;
+  }
+  if (value.batchMode !== void 0) {
+    if (value.batchMode !== "auto" && value.batchMode !== "single" && value.batchMode !== "split") throw new Error("Invalid narrowing settings");
+    narrow.batchMode = value.batchMode;
+  }
+  return narrow;
+}
+const FEATURE_KEYS = Object.freeze(["gate", "check", "narrow", "complete"]);
+function validComplete(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => !["mode", "minConditions", "minConfidence"].includes(key))) throw new Error("Invalid task-completion settings");
+  const complete = {};
+  if (value.mode !== void 0) {
+    if (value.mode !== "observe" && value.mode !== "steer") throw new Error("Invalid task-completion settings");
+    complete.mode = value.mode;
+  }
+  if (value.minConditions !== void 0) {
+    if (!Number.isSafeInteger(value.minConditions) || value.minConditions < 2 || value.minConditions > 20) throw new Error("Invalid task-completion settings");
+    complete.minConditions = value.minConditions;
+  }
+  if (value.minConfidence !== void 0) {
+    if (!probability(value.minConfidence)) throw new Error("Invalid task-completion settings");
+    complete.minConfidence = value.minConfidence;
+  }
+  return complete;
+}
+function validFeatures(value) {
+  if (!safeObject(value)) return void 0;
+  if (Object.keys(value).some((key) => !FEATURE_KEYS.includes(key))) throw new Error("Invalid feature settings");
+  const features = {};
+  for (const key of FEATURE_KEYS) {
+    if (value[key] !== void 0) {
+      if (typeof value[key] !== "boolean") throw new Error("Invalid feature settings");
+      features[key] = value[key];
+    }
+  }
+  return features;
+}
+function featureEnabled(features, key) {
+  return !(safeObject(features) && features[key] === false);
+}
+function view(stored) {
+  const result = {
+    url: safeText(stored.url),
+    model: safeText(stored.model),
+    apiKeySet: Boolean(safeText(stored.apiKey)),
+    httpApprovedUrl: safeText(stored.httpApprovedUrl)
+  };
+  if (stored.dangerRules !== void 0) result.dangerRules = validRules(stored.dangerRules);
+  if (stored.gateSettings !== void 0) result.gateSettings = validGate(stored.gateSettings);
+  if (stored.checkSettings !== void 0) result.checkSettings = validCheck(stored.checkSettings);
+  if (stored.narrowSettings !== void 0) result.narrowSettings = validNarrow(stored.narrowSettings);
+  if (stored.completeSettings !== void 0) result.completeSettings = validComplete(stored.completeSettings);
+  if (stored.features !== void 0) result.features = validFeatures(stored.features);
+  return result;
+}
+async function loadConfig(path = configPath()) {
+  return view(await readStored(path));
+}
+async function resolveConfig({ path = configPath(), env = process.env } = {}) {
+  const stored = await readStored(path);
+  const url = checkedUrl(safeText(stored.url) || safeText(env.DSH_DECISION_BASE_URL) || safeText(env.TYPESAFE_BASE_URL) || DEFAULT_URL);
+  const resolved = {
+    url,
+    apiKey: safeText(stored.apiKey) || safeText(env.DSH_DECISION_API_KEY) || safeText(env.TYPESAFE_API_KEY),
+    model: safeText(stored.model) || safeText(env.DSH_DECISION_MODEL) || DEFAULT_MODEL,
+    httpApprovedUrl: safeText(stored.httpApprovedUrl)
+  };
+  if (stored.dangerRules !== void 0) resolved.dangerRules = validRules(stored.dangerRules);
+  if (stored.gateSettings !== void 0) resolved.gateSettings = validGate(stored.gateSettings);
+  if (stored.checkSettings !== void 0) resolved.checkSettings = validCheck(stored.checkSettings);
+  if (stored.narrowSettings !== void 0) resolved.narrowSettings = validNarrow(stored.narrowSettings);
+  if (stored.completeSettings !== void 0) resolved.completeSettings = validComplete(stored.completeSettings);
+  if (stored.features !== void 0) resolved.features = validFeatures(stored.features);
+  return resolved;
+}
+const SAVE_FIELDS = ["url", "apiKey", "model", "confirmHttpUrl", "dangerRules", "gateSettings", "checkSettings", "narrowSettings", "completeSettings", "features"];
+const TEXT_FIELDS = ["url", "apiKey", "model", "confirmHttpUrl"];
+async function saveConfig(input, path = configPath()) {
+  if (!safeObject(input) || Object.keys(input).some((key) => !SAVE_FIELDS.includes(key))) {
+    throw new Error("Invalid configuration fields");
+  }
+  for (const key of TEXT_FIELDS) {
+    if (input[key] !== void 0 && typeof input[key] !== "string") throw new Error(`Invalid ${key}`);
+  }
+  const previous = await readStored(path);
+  const url = checkedUrl(safeText(input.url === void 0 ? previous.url : input.url));
+  const apiKey = safeText(input.apiKey === void 0 ? previous.apiKey : input.apiKey);
+  const model = safeText(input.model === void 0 ? previous.model : input.model);
+  if (model.length > 128 || /[\r\n]/.test(input.model ?? "") || /[\r\n]/.test(input.apiKey ?? "")) {
+    throw new Error("Invalid model or API key");
+  }
+  const dangerRules = input.dangerRules === void 0 ? previous.dangerRules : validRules(input.dangerRules);
+  const gateSettings = input.gateSettings === void 0 ? previous.gateSettings : validGate(input.gateSettings);
+  const checkSettings = input.checkSettings === void 0 ? previous.checkSettings : validCheck(input.checkSettings);
+  const narrowSettings = input.narrowSettings === void 0 ? previous.narrowSettings : validNarrow(input.narrowSettings);
+  const completeSettings = input.completeSettings === void 0 ? previous.completeSettings : validComplete(input.completeSettings);
+  const features = input.features === void 0 ? previous.features : validFeatures(input.features);
+  const confirmed = url.startsWith("http://") && input.confirmHttpUrl !== void 0 && checkedUrl(safeText(input.confirmHttpUrl)) === url;
+  if (url.startsWith("http://") && !confirmed && previous.httpApprovedUrl !== url) {
+    throw new Error("HTTP URL requires explicit confirmation");
+  }
+  const next = { url, apiKey, model, httpApprovedUrl: url.startsWith("http://") ? url : "" };
+  if (dangerRules !== void 0) next.dangerRules = dangerRules;
+  if (gateSettings !== void 0) next.gateSettings = gateSettings;
+  if (checkSettings !== void 0) next.checkSettings = checkSettings;
+  if (narrowSettings !== void 0) next.narrowSettings = narrowSettings;
+  if (completeSettings !== void 0) next.completeSettings = completeSettings;
+  if (features !== void 0) next.features = features;
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(next)}
+`, { mode: 384, flag: "wx" });
+    await chmod(temporary, 384);
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+  return view(next);
+}
+export {
+  DEFAULT_MODEL,
+  DEFAULT_URL,
+  FEATURE_KEYS,
+  configPath,
+  featureEnabled,
+  loadConfig,
+  resolveConfig,
+  saveConfig
+};

package/lib/host/danger-gate.d.ts

@@ -0,0 +1,45 @@
+import type { AgentLike, DangerRuleAdditions, DangerRuleSet, Evaluator, SessionsFace, ToolExec } from './types.js';
+export declare const MIN_CONFIDENCE = 0.6;
+export declare const DEFAULT_DANGEROUS_RULES: DangerRuleSet;
+export declare function summarizeExecution(exec: ToolExec | undefined): {
+    tool: string;
+    command: string;
+    path: string;
+    inspectable: boolean;
+};
+export type RulesInput = DangerRuleSet | DangerRuleAdditions;
+export declare function normalizeDangerRules(input?: DangerRuleAdditions): DangerRuleSet;
+export declare function classifyDangerous(exec: ToolExec | undefined, rules?: RulesInput): {
+    dangerous: boolean;
+    reason: string;
+};
+type GateDecision = {
+    kind: 'deny';
+    reason: string;
+    modelSuggestion: string;
+};
+type RulesResolver = RulesInput | (() => Promise<RulesInput | undefined>);
+type MinConfidenceResolver = number | (() => Promise<number | undefined>);
+export type DangerGateOptions = {
+    evaluate?: Evaluator;
+    sessions?: SessionsFace;
+    rules?: RulesResolver;
+    minConfidence?: MinConfidenceResolver;
+    /**
+     * The turn's request text, used only for the bounded, masked excerpt attached
+     * to a decision row. Called lazily when a dangerous call is recorded, so the
+     * ordinary tool path never derives messages.
+     */
+    taskText?: (agent: AgentLike | undefined) => unknown;
+};
+export declare function createDangerGate({ evaluate, sessions, rules, minConfidence, taskText }?: DangerGateOptions): {
+    classify: (exec: ToolExec | undefined) => {
+        dangerous: boolean;
+        reason: string;
+    };
+    guardReason(exec: unknown): string | undefined;
+    observeResult(exec: ToolExec | undefined, result: unknown): void;
+    evaluate(exec: ToolExec): Promise<GateDecision | undefined>;
+    preExecute(exec: ToolExec, next: () => unknown): Promise<unknown>;
+};
+export {};

package/lib/host/danger-gate.js

@@ -0,0 +1,196 @@
+import { taskExcerpt } from "./excerpt.js";
+import { errorReason, isObject, isProbability } from "./types.js";
+const DEFAULT_COMMAND_PATTERNS = Object.freeze([
+  /\brm\b(?=[^\n]*(?:\s-r(?:f|fr)?\b|\s--recursive\b|\s--force\b))/i,
+  /\bgit\s+push\b[^\n]*(?:\s-f\b|\s--force(?:-with-lease)?\b)/i,
+  /\b(?:drop|truncate)\s+(?:table|database)\b/i,
+  /\bkubectl\s+delete\b/i,
+  /\b(?:prod|production)\b[^\n]*\b(?:write|deploy|config|secret)\b/i
+]);
+const DEFAULT_PATH_PATTERNS = Object.freeze([/(?:^|[\\/])(?:etc|production|prod)[\\/]/i, /(?:^|[\\/])\.env(?:$|\.)/i]);
+const COMMAND_KEYS = /* @__PURE__ */ new Set(["command", "cmd", "script", "query"]);
+const PATH_KEYS = /* @__PURE__ */ new Set(["path", "file_path", "filePath", "target", "file", "filename", "directory"]);
+const MAX_RULES = 64;
+const MAX_PATTERN_LENGTH = 128;
+const MAX_METADATA_LENGTH = 2048;
+const MIN_CONFIDENCE = 0.6;
+const DEFAULT_DANGEROUS_RULES = Object.freeze({
+  toolNames: Object.freeze(["bash", "pwsh", "shell", "exec", "terminal", "run_command", "write", "edit", "str_replace_editor", "file_write", "write_file"]),
+  commandPatterns: DEFAULT_COMMAND_PATTERNS,
+  pathPatterns: DEFAULT_PATH_PATTERNS
+});
+const redact = (value) => value.slice(0, MAX_METADATA_LENGTH).replace(/(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+/gi, "$1=[redacted]").replace(/(password|passwd|secret|token|api[_-]?key)\s+\S+/gi, "$1 [redacted]");
+const literalPattern = (value) => new RegExp(value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+const boundedList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && Boolean(item.trim()) && item.length <= MAX_PATTERN_LENGTH).slice(0, MAX_RULES) : [];
+function collectMetadata(value, depth = 0, commands = [], paths = []) {
+  if (depth > 4 || value === null || typeof value !== "object") return;
+  for (const [key, item] of Object.entries(value)) {
+    const normalized = key.toLowerCase();
+    if (typeof item === "string" && COMMAND_KEYS.has(normalized)) commands.push(redact(item));
+    else if (typeof item === "string" && PATH_KEYS.has(normalized)) paths.push(redact(item));
+    else if (item && typeof item === "object" && !["content", "body", "data", "metadata", "headers", "env", "value"].includes(normalized)) {
+      collectMetadata(item, depth + 1, commands, paths);
+    }
+  }
+  return { commands, paths };
+}
+function summarizeExecution(exec) {
+  const commands = [];
+  const paths = [];
+  const collected = collectMetadata(exec?.arguments, 0, commands, paths);
+  return {
+    tool: typeof exec?.name === "string" ? exec.name.slice(0, 128) : "",
+    command: commands.join("\n").slice(0, MAX_METADATA_LENGTH),
+    path: paths.join("\n").slice(0, MAX_METADATA_LENGTH),
+    inspectable: Boolean(collected)
+  };
+}
+function normalizeDangerRules(input = {}) {
+  const addTools = boundedList(input.addToolNames);
+  const removeTools = new Set(boundedList(input.removeToolNames));
+  const tools = [.../* @__PURE__ */ new Set([...DEFAULT_DANGEROUS_RULES.toolNames, ...addTools])].filter((tool) => !removeTools.has(tool));
+  const commands = [...DEFAULT_COMMAND_PATTERNS, ...boundedList(input.addCommandPatterns).map(literalPattern)];
+  const paths = [...DEFAULT_PATH_PATTERNS, ...boundedList(input.addPathPatterns).map(literalPattern)];
+  return { toolNames: tools, commandPatterns: commands, pathPatterns: paths };
+}
+const isRuleSet = (rules) => Array.isArray(rules.toolNames);
+function classifyDangerous(exec, rules = DEFAULT_DANGEROUS_RULES) {
+  const normalized = isRuleSet(rules) ? rules : normalizeDangerRules(rules);
+  const summary = summarizeExecution(exec);
+  if (!normalized.toolNames.includes(summary.tool)) return { dangerous: false, reason: "Tool is outside the dangerous-call rules" };
+  if (!summary.inspectable) return { dangerous: true, reason: "Dangerous call arguments could not be inspected" };
+  const byCommand = normalized.commandPatterns.some((pattern) => pattern.test(summary.command));
+  const byPath = normalized.pathPatterns.some((pattern) => pattern.test(summary.path));
+  return { dangerous: byCommand || byPath || !summary.command && !summary.path, reason: "Dangerous tool call requires a host decision" };
+}
+function suggestionQuestion(exec) {
+  return {
+    state: summarizeExecution(exec),
+    questions: { verdict: {
+      type: "choice",
+      instructions: "Classify this dangerous tool call. Never grant a permission the host has not already granted.",
+      criteria: { allow: "No additional intervention is recommended", ask: "Ask the host user for approval", deny: "Reject this dangerous call" }
+    } }
+  };
+}
+function createDangerGate({ evaluate, sessions, rules = DEFAULT_DANGEROUS_RULES, minConfidence = MIN_CONFIDENCE, taskText } = {}) {
+  if (typeof evaluate !== "function") throw new Error("Danger gate requires an evaluator");
+  const resolveRules = async () => {
+    if (typeof rules !== "function") return rules;
+    try {
+      return await rules() ?? DEFAULT_DANGEROUS_RULES;
+    } catch {
+      return DEFAULT_DANGEROUS_RULES;
+    }
+  };
+  const resolveMinConfidence = async () => {
+    if (typeof minConfidence !== "function") return isProbability(minConfidence) ? minConfidence : MIN_CONFIDENCE;
+    try {
+      const value = await minConfidence();
+      return isProbability(value) ? value : MIN_CONFIDENCE;
+    } catch {
+      return MIN_CONFIDENCE;
+    }
+  };
+  const deniedCalls = /* @__PURE__ */ new WeakSet();
+  const evaluatedCalls = /* @__PURE__ */ new WeakSet();
+  const record = (exec, outcome, detail = {}) => {
+    const id = exec?.agent?.session?.id;
+    if (!sessions || typeof id !== "string") return;
+    try {
+      sessions.record?.(id, "gate", outcome);
+    } catch {
+    }
+    if (typeof sessions.log !== "function") return;
+    const summary = summarizeExecution(exec);
+    const args = {};
+    if (summary.command) args.command = summary.command;
+    if (summary.path) args.path = summary.path;
+    let task;
+    if (typeof taskText === "function") {
+      try {
+        task = taskExcerpt(taskText(exec?.agent));
+      } catch {
+        task = void 0;
+      }
+    }
+    if (task) args.task = task;
+    try {
+      sessions.log(id, { kind: "gate", outcome, tool: exec?.name, ...args, ...detail });
+    } catch {
+    }
+  };
+  const passThrough = (exec, outcome, detail = {}) => {
+    record(exec, outcome, { action: "pass", ...detail });
+    if (exec && typeof exec === "object") evaluatedCalls.add(exec);
+    return void 0;
+  };
+  const gate = {
+    classify: (exec) => classifyDangerous(exec, typeof rules === "function" ? DEFAULT_DANGEROUS_RULES : rules),
+    guardReason(exec) {
+      if (!isObject(exec) || !deniedCalls.has(exec)) return void 0;
+      deniedCalls.delete(exec);
+      return "Dangerous call rejected by decision policy";
+    },
+    observeResult(exec, result) {
+      if (!exec || typeof exec !== "object" || !evaluatedCalls.has(exec) || !sessions || typeof sessions.recordActual !== "function") return;
+      const id = exec.agent?.session?.id;
+      if (typeof id !== "string") return;
+      const isError = isObject(result) && result.isError === true;
+      try {
+        sessions.recordActual(id, isError ? "deny" : "allow");
+      } catch {
+      }
+      evaluatedCalls.delete(exec);
+    },
+    async evaluate(exec) {
+      let result;
+      try {
+        result = await evaluate(suggestionQuestion(exec), { signal: exec.signal });
+      } catch (error) {
+        return passThrough(exec, "error", { reason: errorReason(error) });
+      }
+      const answer = result?.answers?.verdict;
+      const choice = typeof answer?.choice === "string" ? answer.choice : void 0;
+      const confidence = typeof answer?.confidence === "number" ? answer.confidence : void 0;
+      if (choice === void 0 || !["allow", "ask", "deny"].includes(choice)) return passThrough(exec, "error", { reason: "invalid-response" });
+      const minConfidenceNow = await resolveMinConfidence();
+      const confident = confidence !== void 0 && Number.isFinite(confidence) && confidence >= minConfidenceNow;
+      if (choice === "deny" && confident) {
+        record(exec, "deny", { suggestion: "deny", action: "deny" });
+        if (exec && typeof exec === "object") deniedCalls.add(exec);
+        return { kind: "deny", reason: "Dangerous call rejected by decision policy", modelSuggestion: choice };
+      }
+      const detail = { suggestion: choice };
+      if (!confident) {
+        detail.reason = "low-confidence";
+        if (confidence !== void 0 && Number.isFinite(confidence)) detail.confidence = confidence;
+      }
+      return passThrough(exec, "allow", detail);
+    },
+    async preExecute(exec, next) {
+      const classification = classifyDangerous(exec, await resolveRules());
+      if (!classification.dangerous) return next();
+      const id = exec?.agent?.session?.id;
+      if (sessions && typeof id === "string") {
+        try {
+          if (sessions.snapshot(id).enabled === false) return next();
+        } catch {
+          passThrough(exec, "error", { reason: "unreachable" });
+          return next();
+        }
+      }
+      const decision = await gate.evaluate(exec);
+      return decision ?? next();
+    }
+  };
+  return gate;
+}
+export {
+  DEFAULT_DANGEROUS_RULES,
+  MIN_CONFIDENCE,
+  classifyDangerous,
+  createDangerGate,
+  normalizeDangerRules,
+  summarizeExecution
+};

package/lib/host/excerpt.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The one bounded, redacted "what was this turn about" excerpt every decision
+ * row may carry into the local decision log.
+ *
+ * It is a human-review hint, never a dump of structured state: injected host
+ * context (memory blocks, system reminders) is stripped first, then common
+ * credential forms are masked, and only then is the text collapsed and cut.
+ * The same rules must hold for every decision point — the panel and the JSONL
+ * sink store what this returns, so a weaker copy elsewhere would leak.
+ *
+ * Masking deliberately errs toward over-redaction: a false positive only costs
+ * the reader some context, while a miss writes a secret to disk for 30 days.
+ * The rules cover labeled key/value pairs (`password`, `token`, Chinese
+ * 密码/令牌 …), HTTP credential headers, URL userinfo, CLI flags, copula forms
+ * (`token is …`), and well-known token shapes that appear without any label.
+ */
+export declare const TASK_EXCERPT_LIMIT = 512;
+/**
+ * Mask the credential forms that show up in a task excerpt. Exported so the
+ * storage layer can apply the same rules as a second boundary (it is cheap and
+ * idempotent), keeping a future caller that forgets `taskExcerpt` from writing
+ * a secret to the log.
+ */
+export declare function redactCredentials(input: string): string;
+export declare function taskExcerpt(state: unknown, limit?: number): string | undefined;

package/lib/host/excerpt.js

@@ -0,0 +1,62 @@
+const MAX_INPUT = 8 * 1024;
+const TASK_EXCERPT_LIMIT = 512;
+const TOKEN_KEYS = String.raw`token|api[ _-]*key`;
+const PHRASE_KEYS = String.raw`password|passwd|passphrase|secret`;
+const CN_KEYS = String.raw`密码|口令|密码短语|密钥|令牌|凭证|私钥`;
+const COMBINED_KEYS = String.raw`${PHRASE_KEYS}|${TOKEN_KEYS}`;
+const SEPARATOR = String.raw`[:=：＝]`;
+const VALUE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}，；、]+)`;
+const CLAUSE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\r\n,;，；、]*)`;
+const COPULA = String.raw`is|are|was|were|是|为`;
+const VALUE_LIKE = String.raw`(?=\S*(?:\d|[A-Za-z0-9_-]{12,}))`;
+const TOKEN_SHAPES = [
+  [/\b(sk|pk|rk)-[A-Za-z0-9_-]{8,}/gi, "$1-[redacted]"],
+  [/\b(gh[pousr]_)[A-Za-z0-9]{20,}/g, "$1[redacted]"],
+  [/\b(xox[baprs]-)[A-Za-z0-9-]{10,}/g, "$1[redacted]"],
+  [/\b(AKIA)[0-9A-Z]{16}\b/g, "$1[redacted]"],
+  [/\b(glpat-)[A-Za-z0-9_-]{10,}/g, "$1[redacted]"],
+  [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*/g, "[redacted]"]
+];
+const RULE = {
+  // Template placeholders (`{{SECRET_...}}`) hide a value inside braces the
+  // value rules deliberately do not consume, so mask the whole placeholder.
+  template: /\{\{[^{}\r\n]*\}\}/g,
+  bearer: /\bBearer\s+[^\s,;]+/gi,
+  urlUserinfo: /([a-z][a-z0-9+.-]*:\/\/)[^\s/]*@/gi,
+  header: new RegExp(String.raw`(\b(?:authorization|cookie|set-cookie)\b["']?\s*${SEPARATOR}\s*)[^\r\n]*`, "gi"),
+  phrase: new RegExp(String.raw`(\b(?:${PHRASE_KEYS})\b["']?\s*${SEPARATOR}\s*)${CLAUSE}`, "gi"),
+  cnKey: new RegExp(String.raw`((?:${CN_KEYS})\s*[:：＝]\s*)${VALUE}`, "g"),
+  token: new RegExp(String.raw`(\b(?:${TOKEN_KEYS})\b["']?\s*${SEPARATOR}\s*)${VALUE}`, "gi"),
+  asciiCopula: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s*(?:${COPULA})\s*)${VALUE_LIKE}${VALUE}`, "gi"),
+  cnCopula: new RegExp(String.raw`((?:${CN_KEYS})\s*(?:是|为)\s*)${VALUE_LIKE}${VALUE}`, "g"),
+  flag: new RegExp(String.raw`(^|\s)(--(?:${COMBINED_KEYS})(?:\s+|=))${VALUE}`, "gi"),
+  // Legacy space form (`token abc`), but never swallow a copula: the rule above
+  // masks the value that follows it.
+  loose: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s+)(?!(?:${COPULA})(?:\s|$)|${SEPARATOR})${VALUE}`, "gi")
+};
+function redactCredentials(input) {
+  let text = input.replace(RULE.template, "[redacted]");
+  text = text.replace(RULE.bearer, "Bearer [redacted]");
+  text = text.replace(RULE.urlUserinfo, "$1[redacted]@");
+  text = text.replace(RULE.header, "$1[redacted]");
+  text = text.replace(RULE.phrase, "$1[redacted]");
+  text = text.replace(RULE.cnKey, "$1[redacted]");
+  text = text.replace(RULE.token, "$1[redacted]");
+  text = text.replace(RULE.asciiCopula, "$1[redacted]");
+  text = text.replace(RULE.cnCopula, "$1[redacted]");
+  text = text.replace(RULE.flag, "$1$2[redacted]");
+  text = text.replace(RULE.loose, "$1[redacted]");
+  for (const [pattern, replacement] of TOKEN_SHAPES) text = text.replace(pattern, replacement);
+  return text;
+}
+function taskExcerpt(state, limit = TASK_EXCERPT_LIMIT) {
+  if (typeof state !== "string") return void 0;
+  const stripped = state.slice(0, MAX_INPUT).replace(/<(openviking-context|system-reminder)\b[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<(openviking-context|system-reminder)\b[\s\S]*$/i, " ");
+  const text = redactCredentials(stripped).replace(/\s+/g, " ").trim();
+  return text ? text.slice(0, limit) : void 0;
+}
+export {
+  TASK_EXCERPT_LIMIT,
+  redactCredentials,
+  taskExcerpt
+};

package/lib/host/index.d.ts

@@ -0,0 +1,6 @@
+import type { HostContext } from './types.js';
+export declare const name = "dsh-decision-layer";
+export declare const inject: string[];
+export declare function apply(ctx: HostContext, options?: {
+    configPath?: string;
+}): Promise<void>;