dsh-dlp 0.5.0 → 0.7.0

package/README.md

@@ -26,9 +26,14 @@ built as an out-of-repo plugin.
    credential.
 7. **Asks before a call switches off its own confirmation** — `non_interactive: true`,
    `approval_mode: auto`, an `apply` whose approval is still pending. Both `ask` tiers are
-   prompts rather than controls: they live at `tools/pre-execute` and can be neutralised.
-8. **Writes an audit record for every decision** — rule id, rule version, offsets, keyed hash.
-   Never the secret, never the path or command that matched. `dsh-dlp report` reads it back.
+   prompts rather than controls: they live at `tools/pre-execute`, they can be neutralised, and
+   they abstain wherever the approval seam prompts nobody — which includes every install under
+   `DSH_PERMISSION_MODE=danger-full-access` and a stock headless install under any mode.
+8. **Writes an audit record for every decision.** A redaction or denial names the rule, its
+   version, the offsets and a keyed hash; the three kinds with no matched region to describe —
+   an ask, a rewritten call, a neutralised image — carry a rule id, the changed field names or
+   the destination hostname instead. Never the secret, never the path or command that matched.
+   `dsh-dlp report` reads it back.
 
 ## What this is not
 
@@ -44,9 +49,12 @@ Three limits worth knowing before you rely on it:
 - **Only the guard floor is unconditional.** Every other seam can be neutralised by a listener
   registered ahead of ours. `ctx.tools.guard()` is order-independent only because it has no allow
   arm.
-- **The shell-command arm is advisory pattern-matching.** It catches an unobfuscated
-  `cat ~/.ssh/id_rsa` and nothing that tries — one glob character, a `$(printf …)` reassembly or
-  `python3 -c` all defeat it, each verified. **Do not count this arm as a control.**
+- **The shell-command arm is advisory pattern-matching.** It tests the whole command line and
+  each of its tokens, so a credential path left *spelled* in the command is caught whatever
+  program would open it: `python3 -c "open('~/.ssh/id_rsa')"` is denied. Changing the spelling
+  defeats it — one glob character, quote-splitting, `find -exec`, a substitution that assembles
+  the path from pieces, a base64 round-trip, each verified. **Do not count this arm as a
+  control.**
 - **Detection is pattern-based.** No entropy rule (measured, not assumed: at a false-positive-free
   threshold the miss rate is 100% below 22 characters). Encoded forms pass. A homoglyph defeats
   every rule in this package.
@@ -108,11 +116,14 @@ switch a pass on. Any downgrade makes the whole file invalid.
 ```sh
 dsh-dlp report                       # everything in the audit sink
 dsh-dlp report --since 24h
-dsh-dlp report --kind guard-deny
+dsh-dlp report --session <id>
+dsh-dlp report --would-have          # everything except the denials
 ```
 
-Every record carries a rule id, rule version, span offsets and a keyed hash — never the matched
-value.
+A redaction or denial record carries a rule id, rule version, span offsets and a keyed hash —
+never the matched value. An ask carries its rule id, a rewritten call the names of the fields
+that changed, and a neutralised remote image the destination hostname in the clear; none of
+those has a matched region to hash.
 
 [Audit record format →](https://charlotten7.github.io/dsh-dlp/audit.html)
 

package/SECURITY.md

@@ -4,12 +4,12 @@
 
 | Version | Supported |
 |---|---|
-| 0.3.x | yes |
-| < 0.3 | no |
+| 0.5.x | yes |
+| < 0.5 | no |
 
-Only the latest published `0.3.x` receives fixes. There is no long-term-support branch while
+Only the latest published `0.5.x` receives fixes. There is no long-term-support branch while
 the package is pre-1.0: each minor supersedes the one before it, and a fix ships as the next
-`0.3.x` patch or, if the minor has already moved on, as the next minor.
+`0.5.x` patch or, if the minor has already moved on, as the next minor.
 
 ## Reporting a vulnerability
 
@@ -32,8 +32,10 @@ This plugin is **not a containment boundary**. It runs in-process at the agent's
 anything the agent can execute can read the same files the guard denies. The following are
 documented limits, not vulnerabilities — they are described in README.md:
 
-- shell-command obfuscation defeating the `bash` path arm (globbing, quoting, substitution, a
-  different binary);
+- shell-command obfuscation defeating the `bash` path arm — anything that stops the path being
+  spelled in the command line: globbing, quote-splitting, `find -exec`, assembling the path
+  from pieces, a base64 round-trip. A command that spells the path is caught whatever program
+  it runs, so that is a gap worth reporting;
 - encoded or split secrets passing both detection tiers;
 - a secret with no recognisable structure going undetected;
 - a secret reaching the provider because it was already in the conversation.

package/lib/approval-reach.js

@@ -0,0 +1,144 @@
+/**
+ * Whether an `ask` this plugin returns can still reach a human.
+ *
+ * The `ask` tier is documented as a prompt and never a block: its rules have a
+ * real false-positive rate, so a developer who is asked about `CLAUDE.md` or
+ * `.github/workflows/**` says yes and carries on. The tool registry resolves an
+ * `ask` through `ctx.get('approval')`, and three states of that seam turn the
+ * prompt into a denial nobody ever saw:
+ *
+ * 1. **No service composed.** `ToolRegistry.serviceAsk` keeps the historical
+ *    degrade to `deny` when `ctx.get('approval')` is `undefined`.
+ * 2. **The policy in force is `'never'`.** `ApprovalService.decide` resolves
+ *    `'rejected'` before any dispatch — its own JSDoc calls this "never prompt
+ *    anyone". The shipped `dsh-base` bundle selects it for every install under
+ *    `DSH_PERMISSION_MODE=danger-full-access`, which is the unattended posture.
+ * 3. **Nothing composed on `approval/request`.** The waterfall falls through to
+ *    the fail-closed `'unavailable'`, which the registry maps to `deny`. The
+ *    shipped `dsh-headless` bundle composes no answerer, so this is the state
+ *    of a stock headless install under every other permission mode.
+ *
+ * In all three the call is stopped with no human involved, which is exactly
+ * what this tier was designed not to do. Each is decided here so the caller can
+ * abstain instead — the same thing it already did for (1) alone.
+ *
+ * **Every check reports "reachable" when it cannot tell.** Abstaining removes a
+ * prompt, so an unreadable service, a missing session, or a `ctx.get` that
+ * returned something other than the service read here all keep the ask. Only a
+ * positive reading of one of the three states above abstains.
+ * @module dsh-dlp/approval-reach
+ */
+/** The event `ApprovalService.decide` dispatches its answerer waterfall on. */
+const APPROVAL_REQUEST = 'approval/request';
+/**
+ * Whether every ask for this session resolves without prompting anyone.
+ *
+ * `'never'` is the only policy whose outcome is knowable without asking, and
+ * the service decides it before dispatch, so no composed answerer can change
+ * it. Anything else — including a value this build does not recognise — leaves
+ * the answerers to decide and is therefore not a positive reading.
+ * @param approval - whatever `ctx.get('approval')` returned.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns `true` only when the policy in force was read and is `'never'`.
+ */
+function policyIsNever(approval, session) {
+    // Without a session there is no override to fold, and the configured default
+    // alone cannot tell a session that never switched from one that switched to
+    // 'ask' — so an agent-less call keeps its prompt.
+    if (session === undefined)
+        return false;
+    const service = approval;
+    let policy;
+    try {
+        policy = service.overrideOf === undefined ? undefined : service.overrideOf(session) ?? service.config?.policy;
+    }
+    catch {
+        // Only a service without the members ApprovalSurface describes reaches
+        // here. It answers nothing about whether a human can be asked, and
+        // this runs inside a live tool call: a diagnostic read must not fail it.
+        return false;
+    }
+    return policy === 'never';
+}
+/**
+ * How many listeners are composed on the answerer waterfall.
+ *
+ * The count is read across the whole context tree, before the scope filter
+ * `ApprovalService.decide` applies. That over-counts — an agent-scoped answerer
+ * belonging to a different agent is included — and over-counting is the safe
+ * direction here, because only a count of zero abstains and zero listeners
+ * cannot be filtered into some.
+ *
+ * `EventsService._hooks` is a declared public field of the exported class, so a
+ * Cordis that stops carrying it fails `typecheck` and `build` in this package
+ * rather than being misread at a user's install; `@deepseek-ai/cordis` is
+ * pinned to one exact version (ADR §19) for the same reason.
+ * @param ctx - the plugin's context; every context in one tree shares the bus.
+ * @returns the number of composed answerers.
+ */
+function composedAnswerers(ctx) {
+    return ctx.events._hooks[APPROVAL_REQUEST]?.length ?? 0;
+}
+/**
+ * Decide whether an ask would reach a human, at the moment of the decision.
+ *
+ * Evaluated per call rather than at mount: a session switches policy mid-run
+ * through `approval/policy`, the override is per session, and an answerer can
+ * be composed or disposed while the harness runs. A mount-time answer would be
+ * a cached guess at all three.
+ * @param ctx - the plugin's context, for the service and the event bus.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns whether to ask, or which state stopped the ask from reaching anyone.
+ */
+export function askReach(ctx, session) {
+    const approval = ctx.get('approval');
+    if (approval === undefined)
+        return { kind: 'unreachable', cause: 'no-service' };
+    // Policy first, matching the service's own order: it decides 'never' before
+    // dispatching, so that is the state an operator sees reported.
+    if (policyIsNever(approval, session))
+        return { kind: 'unreachable', cause: 'policy-never' };
+    if (composedAnswerers(ctx) === 0)
+        return { kind: 'unreachable', cause: 'no-answerer' };
+    return { kind: 'reachable' };
+}
+/** What abstaining does, said once and identically for all three states. */
+const CONSEQUENCE = 'This tier abstains rather than becoming the silent hard deny it was designed not to be: a'
+    + ' write to a behaviour-changing config path, and a call that switches its own confirmation off, are allowed'
+    + ' through with no prompt, and each one is recorded in the audit sink as "pre-execute-ask-abstained". The'
+    + ' guard floor is unaffected. Set configWriteAsk: false and approvalSuppressionAsk: false to turn this tier'
+    + ' off entirely.';
+/**
+ * What to tell the operator when the ask tier has nowhere to ask.
+ *
+ * Each line names the state, what to change to get the prompt back, and the
+ * consequence. Reported on `process.stderr` as well as `ctx.logger` for the
+ * reason ADR §7 records: the logger's default exporter is an in-memory ring
+ * buffer and no shipped bundle mounts a console exporter.
+ * @param cause - the state {@link askReach} read.
+ * @returns the whole line to report.
+ */
+export function approvalSeamNotice(cause) {
+    const prefix = 'dsh-dlp: the ask tier (configWriteAsk, approvalSuppressionAsk) is enabled, but';
+    switch (cause) {
+        case 'no-service':
+            return `${prefix} no approval service is mounted, so the tool registry would resolve an ask as a denial`
+                + ' with nothing shown to anyone. Composing an approval service and an answerer puts the prompt back.'
+                + ` ${CONSEQUENCE}`;
+        case 'policy-never':
+            return `${prefix} the approval policy in force is "never", which resolves every ask as rejected without`
+                + ' prompting anyone. DSH_PERMISSION_MODE=danger-full-access selects that policy in the shipped dsh-base'
+                + ' bundle; run under another permission mode, or set the approval row\'s policy to "ask", for these'
+                + ` calls to be asked about. ${CONSEQUENCE}`;
+        case 'no-answerer':
+            return `${prefix} nothing is composed on the approval/request waterfall, which fails every ask closed as`
+                + ' unavailable and denies the call with nothing shown to anyone. The shipped dsh-headless bundle'
+                + ' composes no answerer; a surface that answers approvals, such as the Host API proxy or the ACP'
+                + ` bridge, puts the prompt back. ${CONSEQUENCE}`;
+        /* v8 ignore next 4 -- unreachable while `AskUnreachable` stays closed; the arm exists so adding a variant fails the build. */
+        default: {
+            const unhandled = cause;
+            throw new TypeError(`dsh-dlp: unhandled ask-tier state ${JSON.stringify(unhandled)}`);
+        }
+    }
+}

package/lib/approvals.js

@@ -30,7 +30,13 @@ import { isReadOnlyTool } from "./paths.js";
  * for the prompt.
  */
 const SUPPRESSING_TRUE = /^(?:true|yes|on|1)$/;
-/** Values of an approval-mode argument that name the absence of a prompt. */
+/**
+ * Values of an approval-mode argument that name the absence of a prompt.
+ *
+ * One spelling per mode, because the value is normalized the same way the key
+ * is: `full-auto` — which is what Codex writes — `full_auto` and `fullauto`
+ * are one entry rather than three.
+ */
 const SUPPRESSING_MODE = /^(?:auto|autoapprove|autoedit|never|none|bypass|fullauto|yolo)$/;
 /**
  * Arguments that turn off the human confirmation for the call carrying them.
@@ -51,7 +57,7 @@ export const APPROVAL_SUPPRESSION_RULES = [
     // CVE-2026-56075.
     {
         id: 'dsh-dlp/approval-mode-auto',
-        version: 1,
+        version: 2,
         condition: { key: /^approval(?:mode|policy|setting)$/, value: SUPPRESSING_MODE },
         effect: 'an approval mode that approves on the model\'s behalf instead of asking',
     },
@@ -66,25 +72,33 @@ export const APPROVAL_SUPPRESSION_RULES = [
     },
 ];
 /**
- * The spelling one argument key is matched under: lowercase, with the
+ * The spelling one key or value is matched under: lowercase, with the
  * separators that distinguish `non_interactive`, `nonInteractive` and
- * `non-interactive` removed.
- * @param key - the key as the tool declared it.
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
  * @returns the normalized spelling.
  */
-export function normalizeArgumentKey(key) {
-    return key.toLowerCase().replace(/[_.-]/g, '');
+export function normalizeArgumentToken(text) {
+    return text.toLowerCase().replace(/[_.-]/g, '');
 }
 /**
  * One argument value as a string, for the values a flag can take.
  * @param node - the value under one argument key.
- * @returns the lowercased rendering, or `undefined` for an object or a list.
+ * @returns the normalized rendering, or `undefined` for an object or a list.
  */
 function scalarValue(node) {
     if (typeof node === 'boolean' || typeof node === 'number')
         return String(node);
     if (typeof node === 'string')
-        return node.trim().toLowerCase();
+        return normalizeArgumentToken(node.trim());
     return undefined;
 }
 /** Whether one object carries a key and value the condition describes. */
@@ -121,7 +135,7 @@ export function matchApprovalSuppression(args, rules = APPROVAL_SUPPRESSION_RULE
         for (const [key, value] of Object.entries(node)) {
             const scalar = scalarValue(value);
             if (scalar !== undefined)
-                entries.set(normalizeArgumentKey(key), scalar);
+                entries.set(normalizeArgumentToken(key), scalar);
         }
         found = rules.find(rule => satisfies(entries, rule.condition)
             && (rule.alongside === undefined || satisfies(entries, rule.alongside)));

package/lib/cli.js

@@ -94,9 +94,9 @@ export const USAGE = [
     '  --since <when>   only decisions at or after an ISO timestamp, or a span back',
     '                   from now written as 30m, 24h or 7d',
     '  --session <id>   only decisions from one session',
-    '  --would-have     only the decisions that let the call through: the redactions',
-    '                   and invisible-character findings, which is what a policy that',
-    '                   denied instead of rewriting would have blocked',
+    '  --would-have     leave out the decisions that stopped a call, keeping the',
+    '                   redactions, the invisible-character findings, the asks and',
+    '                   the neutralised images',
     '  -h, --help       print this text',
 ].join('\n');
 /** Milliseconds in one `--since` suffix; {@link parseSince} accepts no other. */
@@ -250,7 +250,7 @@ export function formatReport(records, unreadable, options) {
     if (options.session !== undefined)
         lines.push(`  session ${options.session}`);
     if (options.wouldHave)
-        lines.push('  only decisions that let the call through');
+        lines.push('  decisions that stopped a call left out');
     if (unreadable > 0)
         lines.push(`  ${unreadable} line(s) were not readable as records`);
     if (selected.length === 0)

package/lib/config-writes.js

@@ -51,9 +51,11 @@ export const CONFIG_WRITE_RULES = [
     },
     {
         id: 'dsh-dlp/config-agent-hooks',
-        version: 1,
+        version: 2,
         match: 'path',
-        pattern: /(^|\/)\.(claude|gemini|codex|windsurf|continue)\/hooks(\/|$)/i,
+        // `.cursor` is in the sibling settings rule above and was missing here,
+        // which left one of the six agent directories' hooks unguarded.
+        pattern: /(^|\/)\.(claude|gemini|codex|cursor|windsurf|continue)\/hooks(\/|$)/i,
         effect: 'an agent hook, which runs on a session event without the model asking for it',
     },
     // Copilot reads these without any agent asking it to: VS Code documents

package/lib/index.js

@@ -13,7 +13,7 @@
  *    config paths and for calls carrying an argument that switches their own
  *    confirmation off. Deliberately here rather than on the floor: its rules
  *    have a real false-positive rate and the floor cannot ask. Neutralizable,
- *    and it abstains entirely when no approval service is mounted.
+ *    and it abstains entirely wherever the approval seam cannot prompt anyone.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.
@@ -43,6 +43,7 @@ import { neutralizeImageStream } from "./images.js";
 import { ExecutionSnapshots, mutationReason } from "./mutation.js";
 import { evaluateConfigWrite } from "./config-writes.js";
 import { evaluateApprovalSuppression } from "./approvals.js";
+import { approvalSeamNotice, askReach } from "./approval-reach.js";
 import { breadthTierDenial, evaluateBreadthTier, redactDecision } from "./results.js";
 import { redactRecord, telemetrySeamNotice } from "./telemetry.js";
 import { AuditSink, CallCorrelator, newDecisionId, RECORD_VERSION } from "./sink.js";
@@ -238,25 +239,20 @@ export function apply(ctx, config) {
         return verdict.reason;
     }), 'dsh-dlp guard floor');
     /**
-     * Report once that the `ask` tier has nowhere to ask.
+     * Report once per state that the `ask` tier has nowhere to ask.
      *
-     * The registry resolves an `ask` through `ctx.get('approval')` and keeps the
-     * historical degrade to *deny* when no service is composed. This tier exists
-     * because its rules are too false-positive-prone for a deny, so under a
-     * deployment with no approval channel it abstains instead of becoming the
-     * silent hard deny it was designed not to be. Evaluated at decision time
-     * rather than at mount, because by then the harness is running and an absent
-     * service is conclusive rather than a load order.
+     * Latched per state rather than once overall: the three states have
+     * different fixes, a session can move between them mid-run by switching its
+     * approval policy, and a single latch would leave the first one reported
+     * standing for a different one afterwards. `approval-reach.ts` records why
+     * each is a state in which an ask reaches nobody.
      */
-    let approvalSeamReported = false;
-    const discloseApprovalSeam = () => {
-        if (approvalSeamReported)
+    const approvalSeamReported = new Set();
+    const discloseApprovalSeam = (cause) => {
+        if (approvalSeamReported.has(cause))
             return;
-        approvalSeamReported = true;
-        notice(ctx, 'dsh-dlp: the ask tier (configWriteAsk, approvalSuppressionAsk) is enabled, but no approval service'
-            + ' is mounted, so an ask would degrade to a denial. This tier abstains instead: a write to a'
-            + ' behaviour-changing config path, and a call that switches its own confirmation off, are allowed through'
-            + ' with no prompt. The guard floor is unaffected.');
+        approvalSeamReported.add(cause);
+        notice(ctx, approvalSeamNotice(cause));
     };
     if (policy.configWriteAsk || policy.approvalSuppressionAsk) {
         // Registered ahead of the breadth tier, so a call that is both a config
@@ -280,8 +276,25 @@ export function apply(ctx, config) {
             // and would file the decision as an ask rather than as a guard denial.
             if (safeEvaluateGuard(exec, policy, hasher) !== undefined)
                 return decision;
-            if (ctx.get('approval') === undefined) {
-                discloseApprovalSeam();
+            // Asked at decision time, never at mount: the session's policy is a fold
+            // over its own log and can change mid-run, and an answerer can be
+            // composed or disposed while the harness runs.
+            const reach = askReach(ctx, exec.agent?.session);
+            if (reach.kind === 'unreachable') {
+                discloseApprovalSeam(reach.cause);
+                // An abstention allowed a call this tier would have asked about, so it
+                // is recorded rather than left silent. Its own kind, not a flag on
+                // `pre-execute-ask`: `dsh-dlp report` counts by kind, and an ask that
+                // reached nobody must not be counted as a prompt that happened.
+                sink.write({
+                    v: RECORD_VERSION,
+                    time: new Date().toISOString(),
+                    kind: 'pre-execute-ask-abstained',
+                    decisionId: newDecisionId(),
+                    ...identity(exec),
+                    ruleId: finding.rule.id,
+                    askUnreachable: reach.cause,
+                });
                 return decision;
             }
             sink.write({

package/lib/paths.js

@@ -40,7 +40,9 @@ export const CREDENTIAL_PATH_RULES = [
     { id: 'dsh-dlp/path-pypirc', version: 1, pattern: /(^|\/)\.pypirc$/i },
     { id: 'dsh-dlp/path-git-credentials', version: 1, pattern: /(^|\/)\.git-credentials$/i },
     { id: 'dsh-dlp/path-gh-config', version: 1, pattern: /(^|\/)\.config\/gh(\/|$)/i },
-    { id: 'dsh-dlp/path-kubeconfig', version: 2, pattern: /(^|\/)(\.kube\/[^/]*|kubeconfig[^/]*)$/i },
+    // `.kube` matches at any depth, like `.aws` and `.azure`: the cached OIDC and
+    // exec-plugin tokens sit under `~/.kube/cache/`, not beside the config file.
+    { id: 'dsh-dlp/path-kubeconfig', version: 3, pattern: /(^|\/)(\.kube(\/|$)|kubeconfig[^/]*$)/i },
     { id: 'dsh-dlp/path-kubernetes-conf', version: 1, pattern: /(^|\/)kubernetes\/[^/]*\.conf$/i },
     { id: 'dsh-dlp/path-docker-config', version: 2, pattern: /(^|\/)(\.docker\/config\.json|\.dockercfg)$/i },
     { id: 'dsh-dlp/path-gcloud-credentials', version: 1, pattern: /(^|\/)\.config\/gcloud\/[^/]*credential[^/]*$/i },
@@ -53,8 +55,10 @@ export const CREDENTIAL_PATH_RULES = [
     // token file whatever else the directory holds.
     { id: 'dsh-dlp/path-agent-auth', version: 1, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/auth\.json$/i },
     // An MCP manifest carries each server's `env`, which is where its API keys
-    // are written.
-    { id: 'dsh-dlp/path-agent-mcp-config', version: 1, pattern: /(^|\/)\.(cursor|windsurf|continue|codex|claude|gemini)\/mcp\.json$/i },
+    // are written. The directory alternation is the one above: an agent that
+    // keeps an `auth.json` keeps its manifest beside it, and Cursor's own
+    // directory is spelled without the dot under `~/.config`.
+    { id: 'dsh-dlp/path-agent-mcp-config', version: 2, pattern: /(^|\/)\.?(codex|cursor|composer|windsurf|continue|aider|claude|gemini)\/mcp\.json$/i },
     // Cursor keeps session tokens in a SQLite state database rather than a
     // credential file.
     { id: 'dsh-dlp/path-editor-state-db', version: 1, pattern: /(^|\/)state\.vscdb(-journal|-wal|-shm)?$/i },

package/lib/types/approval-reach.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Whether an `ask` this plugin returns can still reach a human.
+ *
+ * The `ask` tier is documented as a prompt and never a block: its rules have a
+ * real false-positive rate, so a developer who is asked about `CLAUDE.md` or
+ * `.github/workflows/**` says yes and carries on. The tool registry resolves an
+ * `ask` through `ctx.get('approval')`, and three states of that seam turn the
+ * prompt into a denial nobody ever saw:
+ *
+ * 1. **No service composed.** `ToolRegistry.serviceAsk` keeps the historical
+ *    degrade to `deny` when `ctx.get('approval')` is `undefined`.
+ * 2. **The policy in force is `'never'`.** `ApprovalService.decide` resolves
+ *    `'rejected'` before any dispatch — its own JSDoc calls this "never prompt
+ *    anyone". The shipped `dsh-base` bundle selects it for every install under
+ *    `DSH_PERMISSION_MODE=danger-full-access`, which is the unattended posture.
+ * 3. **Nothing composed on `approval/request`.** The waterfall falls through to
+ *    the fail-closed `'unavailable'`, which the registry maps to `deny`. The
+ *    shipped `dsh-headless` bundle composes no answerer, so this is the state
+ *    of a stock headless install under every other permission mode.
+ *
+ * In all three the call is stopped with no human involved, which is exactly
+ * what this tier was designed not to do. Each is decided here so the caller can
+ * abstain instead — the same thing it already did for (1) alone.
+ *
+ * **Every check reports "reachable" when it cannot tell.** Abstaining removes a
+ * prompt, so an unreadable service, a missing session, or a `ctx.get` that
+ * returned something other than the service read here all keep the ask. Only a
+ * positive reading of one of the three states above abstains.
+ * @module dsh-dlp/approval-reach
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session } from '@deepseek-ai/dsh-session';
+/** Which of the three states stopped an ask from reaching a human. */
+export type AskUnreachable = 
+/** Nothing is composed on `ctx.approval`. */
+'no-service'
+/** The policy in force for this session is `'never'`. */
+ | 'policy-never'
+/** Nothing is composed on the `approval/request` waterfall. */
+ | 'no-answerer';
+/** Whether an ask can reach a human, and when it cannot, which state stopped it. */
+export type AskReach = {
+    readonly kind: 'reachable';
+} | {
+    readonly kind: 'unreachable';
+    readonly cause: AskUnreachable;
+};
+/**
+ * Decide whether an ask would reach a human, at the moment of the decision.
+ *
+ * Evaluated per call rather than at mount: a session switches policy mid-run
+ * through `approval/policy`, the override is per session, and an answerer can
+ * be composed or disposed while the harness runs. A mount-time answer would be
+ * a cached guess at all three.
+ * @param ctx - the plugin's context, for the service and the event bus.
+ * @param session - the calling agent's session, or `undefined` when the call has no agent.
+ * @returns whether to ask, or which state stopped the ask from reaching anyone.
+ */
+export declare function askReach(ctx: Context, session: Session | undefined): AskReach;
+/**
+ * What to tell the operator when the ask tier has nowhere to ask.
+ *
+ * Each line names the state, what to change to get the prompt back, and the
+ * consequence. Reported on `process.stderr` as well as `ctx.logger` for the
+ * reason ADR §7 records: the logger's default exporter is an in-memory ring
+ * buffer and no shipped bundle mounts a console exporter.
+ * @param cause - the state {@link askReach} read.
+ * @returns the whole line to report.
+ */
+export declare function approvalSeamNotice(cause: AskUnreachable): string;
+//# sourceMappingURL=approval-reach.d.ts.map

package/lib/types/approvals.d.ts

@@ -26,7 +26,7 @@ import type { ToolExecution } from '@deepseek-ai/dsh-tools';
 export interface ArgumentCondition {
     /** Matched against the key lowercased with `_`, `-` and `.` removed. */
     readonly key: RegExp;
-    /** Matched against the value's scalar rendering, lowercased. */
+    /** Matched against the value under the same normalization as the key. */
     readonly value: RegExp;
 }
 /** One argument, or pair of arguments, that suppresses a confirmation. */
@@ -54,13 +54,21 @@ export interface ApprovalSuppressionRule {
  */
 export declare const APPROVAL_SUPPRESSION_RULES: readonly ApprovalSuppressionRule[];
 /**
- * The spelling one argument key is matched under: lowercase, with the
+ * The spelling one key or value is matched under: lowercase, with the
  * separators that distinguish `non_interactive`, `nonInteractive` and
- * `non-interactive` removed.
- * @param key - the key as the tool declared it.
+ * `non-interactive` — and `full-auto` from `full_auto` — removed.
+ *
+ * Values take the same normalization as keys, and that is the whole reason
+ * `approval_mode: full-auto`, which is the spelling Codex writes, reaches the
+ * table: enumerating the separator variants one at a time only ever covers the
+ * spellings someone already thought of. Every value the rules name is a single
+ * word with no legitimate hyphenated or dotted form, so folding the separators
+ * away cannot pull an ordinary value in — `on-demand` and `ask-every-time`
+ * stay outside the table.
+ * @param text - a key as the tool declared it, or a scalar value it carried.
  * @returns the normalized spelling.
  */
-export declare function normalizeArgumentKey(key: string): string;
+export declare function normalizeArgumentToken(text: string): string;
 /**
  * The first rule any object inside the arguments satisfies.
  *

package/lib/types/cli.d.ts

@@ -36,7 +36,7 @@ export interface ReportOptions {
     /** Epoch milliseconds; records before it are left out. */
     readonly since?: number;
     readonly session?: string;
-    /** Keep only the decisions that let the call through. */
+    /** Leave out the decisions that stopped a call; see {@link DENYING_KINDS}. */
     readonly wouldHave: boolean;
 }
 /** The outcome of reading the command line. */

package/lib/types/index.d.ts

@@ -13,7 +13,7 @@
  *    config paths and for calls carrying an argument that switches their own
  *    confirmation off. Deliberately here rather than on the floor: its rules
  *    have a real false-positive rate and the floor cannot ask. Neutralizable,
- *    and it abstains entirely when no approval service is mounted.
+ *    and it abstains entirely wherever the approval seam cannot prompt anyone.
  * 3. `tools/post-execute` — result redaction, applied before the `tool/result`
  *    session event is appended, so the durable log records the redacted copy;
  *    a result that cannot be cleaned is withheld rather than accepted.

package/lib/types/sink.d.ts

@@ -14,6 +14,7 @@
  * `callId`, and a producer-minted `decisionId`.
  * @module dsh-dlp/sink
  */
+import type { AskUnreachable } from './approval-reach.ts';
 import type { RedactedSpan } from './redaction.ts';
 declare const decisionIdBrand: unique symbol;
 /** Producer-minted id correlating one decision across records. */
@@ -28,7 +29,7 @@ export declare function newDecisionId(): DecisionId;
 /** Payload version carried inside every record this plugin writes. */
 export declare const RECORD_VERSION = 1;
 /** What produced one audit record. */
-export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
+export type AuditKind = 'guard-deny' | 'pre-execute-deny' | 'pre-execute-ask' | 'pre-execute-ask-abstained' | 'execution-mutation' | 'result-redaction' | 'telemetry-redaction' | 'assistant-image-neutralized' | 'audit-failure';
 /** One durable record. Never carries matched secret text. */
 export interface AuditRecord {
     readonly v: number;
@@ -66,6 +67,13 @@ export interface AuditRecord {
      * behaviour-changing file, not that any part of it matched a secret.
      */
     readonly ruleId?: string;
+    /**
+     * Which state left the ask tier with nowhere to ask, for a
+     * `pre-execute-ask-abstained`. An abstention allowed a call the tier would
+     * otherwise have asked about, so the state that caused it is the field an
+     * operator needs to change to get the prompt back.
+     */
+    readonly askUnreachable?: AskUnreachable;
     /** Telemetry record channel, for `telemetry-redaction`. */
     readonly channel?: string;
     /** Fields another plugin rewrote after the call was logged, for `execution-mutation`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-dlp",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction",
   "license": "MIT",
   "author": "Ivan Tyshchenko <nsof@protonmail.com>",