dsh-perm-gate 0.2.1-beta.2 → 0.2.1-beta.3

package/CHANGELOG.ja.md

@@ -7,11 +7,13 @@
 
 ## [Unreleased]
 
+## [0.2.1-beta.3] - 2026-09-10
+
 ### 追加
 
 - リスク判定 `llmAssist`：設定されたカスタム LLM（OpenAI 互換エンドポイント）が各 `ask` を
   `safe` / `risky:<カテゴリ>` で判定。ハードカテゴリ（deletion / credential / remote / system /
-  bulk）は常に人手へ、タイムアウトは 1 回リトライ、失敗は常に fail-closed。
+  bulk）は自動拒否、タイムアウトは 1 回リトライ、失敗は常に fail-closed。
 - 裁決学習（`riskLearning`、既定オフ、`riskThreshold` 1–10、既定 3）：人手で承認され実際に実行された
   neutral リスクをカウントし、指紋一致する同一操作のみ自動許可。`$DSH_HOME/perm-gate/learning.json`
   に永続化され、ユーザーの YAML ルールには書き込みません。
@@ -78,6 +80,16 @@
 
 ### 修正
 
+- **`llmAssist` の `safe` は記録されるだけで、実際には自動許可されていませんでした。**
+  `tools/pre-execute` リスナーは `ask` を即座に返してバックグラウンドで判定していましたが、ホストへ
+  渡した ask はすでに承認 answerer へ向かっており、DSH にはそれを取り消す API がありません
+  （リクエストの `signal` ができるのは `cancelled` での決着だけです）。そのためパネルは表示され続け、
+  フィードには `safe` の自動許可が出ているのに人手でのクリックが必須でした — さらにハードリスクの
+  `auto-deny` はホストにまったく届いていませんでした。リスナーは決定を返す**前に** `refineAsk` を
+  await するようになり（`makePreExecuteListener`）、`safe` は `next()` で委譲されパネルは出ず、
+  ハードカテゴリは自動拒否、`risky:neutral` / `unresolved` / 判定失敗のみが人手の ask を維持します
+  （fail-closed）。待機時間は `riskTimeoutMs`（既定 20 秒）で上限が決まり、すでにキャンセルされた
+  呼び出しは判定をスキップします。
 - **ユーザーが選んだ権限ティアをゲートが上書きしていました。** ゲートは独立した承認ティアを
   持ちますが *すべての* プリセットで動作し、あらゆる越境が `ask` になって DSH 承認シームへ
   転送され、`danger-full-access`（`approval: never`）ではそのシームが **どの answerer よりも

package/CHANGELOG.ko.md

@@ -7,11 +7,13 @@
 
 ## [Unreleased]
 
+## [0.2.1-beta.3] - 2026-09-10
+
 ### 추가
 
 - 위험 등급 `llmAssist`: 설정된 사용자 지정 LLM(OpenAI 호환 엔드포인트)이 각 `ask`를
   `safe` / `risky:<카테고리>`로 판정합니다. 하드 카테고리(deletion / credential / remote / system /
-  bulk)는 항상 사람에게 전달되고, 시간 초과는 1회 재시도하며, 모든 실패는 fail-closed를 유지합니다.
+  bulk)는 자동 거부되고, 시간 초과는 1회 재시도하며, 모든 실패는 fail-closed를 유지합니다.
 - 판정 학습(`riskLearning`, 기본 꺼짐, `riskThreshold` 1–10, 기본 3): 사람이 승인하고 실제 실행된
   neutral 위험은 카운트되어 지문이 일치하는 동일 작업만 자동 허용 — `$DSH_HOME/perm-gate/learning.json`에
   영속화되며 사용자 YAML 규칙에는 기록되지 않습니다.
@@ -77,6 +79,15 @@
 
 ### 수정
 
+- **`llmAssist`의 `safe`는 기록만 될 뿐 실제로 자동 허용되지 않았습니다.** `tools/pre-execute`
+  리스너가 `ask`를 즉시 반환하고 백그라운드에서 판정했지만, 호스트로 넘어간 ask는 이미 승인
+  answerer로 향하고 있고 DSH에는 이를 되돌릴 API가 없습니다(요청의 `signal`이 할 수 있는 일은
+  `cancelled`로 종결시키는 것뿐입니다). 그래서 패널은 계속 표시되었고, 피드에는 `safe` 자동 허용이
+  찍혔는데도 사람이 직접 클릭해야 했습니다 — 하드 위험의 `auto-deny`는 호스트에 아예 전달되지
+  않았습니다. 이제 리스너는 결정을 반환하기 **전에** `refineAsk`를 await하며
+  (`makePreExecuteListener`), `safe`는 `next()`로 위임되어 패널이 뜨지 않고, 하드 카테고리는 자동
+  거부되며, `risky:neutral` / `unresolved` / 판정 실패만 사람에게 ask로 남습니다(fail-closed).
+  대기 시간은 `riskTimeoutMs`(기본 20초)로 제한되며, 이미 취소된 호출은 판정을 건너뜁니다.
 - **사용자가 선택한 권한 티어를 게이트가 덮어썼습니다.** 게이트는 독립 승인 티어를 가지지만
   *모든* 프리셋에서 동작했고, 모든 경계가 `ask`가 되어 DSH 승인 시임으로 전달되었으며,
   `danger-full-access`(`approval: never`)에서는 그 시임이 **어떤 answerer보다도 먼저**

package/CHANGELOG.md

@@ -7,11 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1-beta.3] - 2026-09-10
+
 ### Added
 
 - Risk-graded `llmAssist`: the configured custom LLM (any OpenAI-compatible endpoint) grades each
   `ask` as `safe` / `risky:<category>`; hard categories (deletion / credential / remote / system /
-  bulk) always ask, timeouts retry once, and every failure stays fail-closed.
+  bulk) auto-deny, timeouts retry once, and every failure stays fail-closed.
 - Verdict learning (`riskLearning`, off by default; `riskThreshold` 1–10, default 3): neutral-risk
   asks confirmed by a human and actually executed count toward auto-allowing the exact same
   operation (fingerprint-matched) — persisted to `$DSH_HOME/perm-gate/learning.json`, never into
@@ -94,6 +96,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **`llmAssist` "safe" now actually auto-allows instead of only being recorded.** The
+  `tools/pre-execute` listener returned the `ask` immediately and graded the call in the
+  background, but an ask handed to the host is already on its way to the approval answerers and
+  DSH offers no API to retract it (the request's own `signal` can only settle it `cancelled`). The
+  panel therefore still appeared and the human still had to click, while the feed showed the
+  `safe` auto-allow — and a hard-risk `auto-deny` never reached the host at all. The listener now
+  awaits `refineAsk` **before** returning the decision (`makePreExecuteListener`): `safe` delegates
+  via `next()` with no panel, a hard-risk category auto-denies, and only `risky:neutral` /
+  `unresolved` / a grader failure keep the human ask (fail-closed). The wait is bounded by
+  `riskTimeoutMs` (default 20 s) and an already-cancelled call skips grading.
 - **The shell write-pattern layer never ran for DSH's primary shell tool.** `SHELL_TOOLS` listed
   `bash` / `pwsh` / `sh` / `cmd` / `powershell` but not **`shell`** (DSH's own tool name) or
   `terminal`, so `git push`, `chmod`, `tee`, redirects and every other write pattern fell through

package/INSTALL.ja.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` バージョン **0.1.0**。判定チェーン、ルールファイル形式、Permissive
+`dsh-perm-gate` バージョン **0.2.1-beta.3**。判定チェーン、ルールファイル形式、Permissive
 ティアについては [日本語 README](./README.ja.md) を参照してください。
 
 ## 必要条件

package/INSTALL.ko.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 버전 **0.1.0**. 결정 체인, 규칙 파일 형식, Permissive 티어는
+`dsh-perm-gate` 버전 **0.2.1-beta.3**. 결정 체인, 규칙 파일 형식, Permissive 티어는
 [한국어 README](./README.ko.md)를 참고하세요.
 
 ## 요구 사항

package/INSTALL.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` version **0.1.0**. Continue with the [README](./README.md) for the
+`dsh-perm-gate` version **0.2.1-beta.3**. Continue with the [README](./README.md) for the
 decision chain, the rules file format and the Permissive tier.
 
 ## Requirements

package/INSTALL.zh.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 版本 **0.1.0**。裁决链、规则文件格式与 Permissive 档位请见
+`dsh-perm-gate` 版本 **0.2.1-beta.3**。裁决链、规则文件格式与 Permissive 档位请见
 [中文 README](./README.zh.md)。
 
 ## 前置条件

package/README.ja.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **互換性に関する注記:** v0.1.0 は `ja` / `ko` 辞書を同梱しますが、公式 DSH の
+> **互換性に関する注記:** v0.2.1-beta.3 は `ja` / `ko` 辞書を同梱しますが、公式 DSH の
 > `LocaleRuntime` が公開するのは `zh` / `en` のみです（`LOCALE_IDS = ["zh", "en"]`）。
 > 素の DSH で `ja` / `ko` を選択すると `locale "<id>" is not registered` になります。
 > `LOCALE_IDS`（locale-settings.ts）と `LOCALES` ラベル（client/index.ts）を更新した
 > DSH fork を使って再ビルドしてください。
 
-バージョン **0.1.0** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
+バージョン **0.2.1-beta.3** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
 
 DeepSeek Harness 向けの、単一・自己完結・決定論優先・fail-closed な権限ゲートです。
 
@@ -181,10 +181,10 @@ Full access / `custom`）では、ゲートの判定フローは**一切実行
 
 ### リスク判定 llmAssist、裁決学習、イベントフィード
 
-`llmAssist` 有効時、設定された LLM（OpenAI 互換エンドポイントなら任意——`classifierEndpoint` / `classifierModel` / `classifierApiKey` を自分の API に向けてください）が構造化プロトコルで `ask` を 1 件ずつ判定します：
+`llmAssist` 有効時、設定された LLM（OpenAI 互換エンドポイントなら任意——`classifierEndpoint` / `classifierModel` / `classifierApiKey` を自分の API に向けてください）が構造化プロトコルで `ask` を 1 件ずつ判定します。**判定はゲートの `tools/pre-execute` ウォーターフォール内、決定がホストへ返る前に行われます**：`safe` はそのまま委譲されるため承認パネルは一切表示されず、本当に判断できない判定だけが人手に回ります。
 
-- `safe` → 自動許可（監査ソースは `classifier`）。
-- `risky` + **ハードリスクカテゴリ**（`deletion`、`credential`、`remote`、`system`、`bulk`）→ 常に人手へ。ハードリスクは自動許可も学習もされません。
+- `safe` → 自動許可（監査ソースは `classifier`）。パネルは表示されません。
+- `risky` + **ハードリスクカテゴリ**（`deletion`、`credential`、`remote`、`system`、`bulk`）→ **自動拒否**、パネルなし。ハードリスクは自動許可も学習もされません。
 - `risky:neutral` → `riskLearning` 有効時（設定カード内、既定オフ）、人手で承認され実際に実行された neutral リスクは `tool|カテゴリ` ごとにカウントされ、`riskThreshold`（既定 3）到達かつ新呼び出しの操作指紋（コマンド語＋対象の基底名）が確認済みサンプルに一致した場合、**同一操作のみ**自動許可されます。学習沈殿（`riskSediment`、既定オン）を有効にすると、しきい値に達したキーの確認サンプルは**決定論的な許可ルール**になります：指紋の正確一致は LLM を経由せず自動許可——llmAssist オフでも継続し、沈殿ルールは設定カードで確認・管理（終止 / サンプル削除）できます。
 - タイムアウト（`riskTimeoutMs`、既定 20 秒、1 回リトライ）、通信失敗、プロトコル外出力は元の `ask` を維持します。
 

package/README.ko.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **호환성 안내:** v0.1.0은 `ja` / `ko` 사전을 포함하지만, 공식 DSH의 `LocaleRuntime`은
+> **호환성 안내:** v0.2.1-beta.3은 `ja` / `ko` 사전을 포함하지만, 공식 DSH의 `LocaleRuntime`은
 > `zh` / `en`만 노출합니다(`LOCALE_IDS = ["zh", "en"]`). 기본 DSH에서 `ja` / `ko`를
 > 선택하면 `locale "<id>" is not registered` 오류가 발생합니다. `LOCALE_IDS`
 > (locale-settings.ts)와 `LOCALES` 라벨(client/index.ts)을 갱신한 DSH fork를 사용해
 > 다시 빌드하세요.
 
-버전 **0.1.0** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
+버전 **0.2.1-beta.3** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
 
 DeepSeek Harness용 단일·자족적·결정론 우선·fail-closed 권한 게이트입니다.
 
@@ -180,10 +180,10 @@ host는 네임스페이스를 live로 읽으므로 변경은 재시작 없이
 
 ### 위험 등급 llmAssist, 판정 학습, 이벤트 피드
 
-`llmAssist`가 켜져 있으면 설정된 LLM(OpenAI 호환 엔드포인트라면 무엇이든 — `classifierEndpoint` / `classifierModel` / `classifierApiKey`을 자신의 API로 지정)이 구조화된 프로토콜로 `ask`를 하나씩 판정합니다:
+`llmAssist`가 켜져 있으면 설정된 LLM(OpenAI 호환 엔드포인트라면 무엇이든 — `classifierEndpoint` / `classifierModel` / `classifierApiKey`을 자신의 API로 지정)이 구조화된 프로토콜로 `ask`를 하나씩 판정합니다. **판정은 게이트의 `tools/pre-execute` 워터폴 안에서, 결정이 호스트로 반환되기 전에 이루어집니다**: `safe`는 곧바로 위임되므로 승인 패널이 아예 표시되지 않고, 정말로 판단할 수 없는 판정만 사람에게 전달됩니다.
 
-- `safe` → 자동 허용(감사 소스 `classifier`).
-- `risky` + **하드 위험 카테고리**(`deletion`, `credential`, `remote`, `system`, `bulk`) → 항상 사람에게 전달. 하드 위험은 자동 허용도 학습도 되지 않습니다.
+- `safe` → 자동 허용(감사 소스 `classifier`), 패널 없음.
+- `risky` + **하드 위험 카테고리**(`deletion`, `credential`, `remote`, `system`, `bulk`) → **자동 거부**, 패널 없음. 하드 위험은 자동 허용도 학습도 되지 않습니다.
 - `risky:neutral` → `riskLearning` 활성 시(설정 카드, 기본 꺼짐), 사람이 승인하고 실제 실행된 neutral 위험은 `tool|카테고리` 키로 카운트되며, `riskThreshold`(기본 3) 도달 및 새 호출의 작업 지문(명령어 단어 + 대상 기본 이름)이 확인된 샘플과 일치하면 **동일 작업만** 자동 허용됩니다. 학습 침전(`riskSediment`, 기본 켜짐)을 사용하면 임계값에 도달한 키의 확인 샘플이 **결정론적 허용 규칙**이 됩니다: 지문이 정확히 일치하면 LLM 호출 없이 바로 허용——llmAssist가 꺼져도 유지되며, 침전 규칙은 설정 카드에서 확인·관리(종료 / 샘플 삭제)할 수 있습니다.
 - 시간 초과(`riskTimeoutMs`, 기본 20초, 1회 재시도), 전송 실패, 프로토콜 외 출력은 원래 `ask`를 유지합니다.
 

package/README.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **Compatibility note:** v0.1.0 ships `ja` / `ko` dictionaries, but official DSH exposes
+> **Compatibility note:** v0.2.1-beta.3 ships `ja` / `ko` dictionaries, but official DSH exposes
 > only `zh` / `en` through `LocaleRuntime` (`LOCALE_IDS = ["zh", "en"]`). On stock DSH,
 > selecting `ja` / `ko` fails with `locale "<id>" is not registered`. Use a DSH fork that
 > updates `LOCALE_IDS` (locale-settings.ts) and `LOCALES` labels (client/index.ts), then
@@ -34,7 +34,7 @@
 > bundle value-imports nothing from `@deepseek-ai/*`, so the 0.1.2
 > `dsh-client-runtime` → `dsh-client-store` rename cannot break it.
 
-Version **0.1.0** — see the [Changelog](./CHANGELOG.md).
+Version **0.2.1-beta.3** — see the [Changelog](./CHANGELOG.md).
 
 A single, self-sufficient, deterministic-first, fail-closed permission gate for DeepSeek Harness.
 
@@ -175,16 +175,19 @@ exactly as before.
 ### Risk-graded llmAssist, verdict learning, and the event feed
 
 When `llmAssist` is on, the configured LLM grades one `ask` at a time with a structured
-protocol. Two receiver sources are selectable in the settings card: a **custom API** (any
+protocol. Grading happens **inside the gate's `tools/pre-execute` waterfall, before the decision
+is returned to the host**: a `safe` verdict delegates the call straight through, so the approval
+panel never appears; only a genuinely uncertain verdict reaches you. Two receiver sources are
+selectable in the settings card: a **custom API** (any
 OpenAI-compatible endpoint — `classifierEndpoint` / `classifierModel` / `classifierApiKey`,
 with presets including Xiaomi MiMo `https://api.xiaomimimo.com/v1`), or the **DSH host model
 group** (the session's configured `llm` service, via `agentDefaultModel.currentSelection`,
 optionally overridden with `classifierProvider` / `classifierModel`). A **health test** button
 (`POST /api/dsh-perm-gate/health`) runs one minimal completion and reports latency.
 
-- `safe` → the ask is auto-allowed (audited as the `classifier` source).
-- `risky` + a **hard category** (`deletion`, `credential`, `remote`, `system`, `bulk`) →
-  the ask **always** reaches the human; hard risks are never auto-allowed and never learned.
+- `safe` → the call is auto-allowed (audited as the `classifier` source); no panel is shown.
+- `risky` + a **hard category** (`deletion`, `credential`, `remote`, `system`, `bulk`) → the call
+  is **auto-denied** without a panel; hard risks are never auto-allowed and never learned.
 - `risky:neutral` → with `riskLearning` enabled (Settings card, off by default), each human
   approval that actually executes (settled via the host's `tools/result` event) counts toward
   a `tool|category` key; once the count reaches `riskThreshold` (default 3) **and** the new

package/README.zh.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **兼容性说明：** v0.1.0 自带 `ja` / `ko` 字典，但官方 DSH 的 `LocaleRuntime`
+> **兼容性说明：** v0.2.1-beta.3 自带 `ja` / `ko` 字典，但官方 DSH 的 `LocaleRuntime`
 > 只暴露 `zh` / `en`（`LOCALE_IDS = ["zh", "en"]`）。在原版 DSH 上选择 `ja` / `ko`
 > 会报 `locale "<id>" is not registered`。请使用更新了 `LOCALE_IDS`
 > （locale-settings.ts）与 `LOCALES` 标签（client/index.ts）的 DSH fork 并重新构建。
@@ -31,7 +31,7 @@
 > 客户端 bundle 对 `@deepseek-ai/*` 无任何值导入，因此 0.1.2 的
 > `dsh-client-runtime` → `dsh-client-store` 改名不会影响它。
 
-版本 **0.1.0** —— 变更见 [Changelog](./CHANGELOG.md)。
+版本 **0.2.1-beta.3** —— 变更见 [Changelog](./CHANGELOG.md)。
 
 一个**单一自足、确定性优先、fail-closed** 的 DeepSeek Harness 权限门插件。
 
@@ -138,10 +138,10 @@ Full access 之间。DSH 的 bundle patch 对这个 map 是**整表替换**而
 
 ### 风险分级 llmAssist、裁决学习与事件流
 
-开启 `llmAssist` 后，接收 LLM（自定义 OpenAI 兼容端点，或 DSH 宿主模型组——见上文）按结构化协议逐条评估 `ask`：
+开启 `llmAssist` 后，接收 LLM（自定义 OpenAI 兼容端点，或 DSH 宿主模型组——见上文）按结构化协议逐条评估 `ask`。**判定发生在门禁的 `tools/pre-execute` 瀑布内部、决策返回宿主之前**：`safe` 直接放行，审批面板根本不会出现；只有真正无法确定的判定才会弹到你面前。
 
-- `safe` → 自动放行（审计来源为 `classifier`）。
-- `risky` + **硬风险类别**（`deletion`、`credential`、`remote`、`system`、`bulk`）→ 一律转人工；硬风险永不自动放行、也永不进入学习。
+- `safe` → 自动放行（审计来源为 `classifier`），不弹面板。
+- `risky` + **硬风险类别**（`deletion`、`credential`、`remote`、`system`、`bulk`）→ **自动拒绝**、不弹面板；硬风险永不自动放行、也永不进入学习。
 - `risky:neutral` → 若开启 `riskLearning`（设置卡片内，默认关闭），人工批准且真实执行的 neutral 风险会按 `tool|类别` 计数；计数达到 `riskThreshold`（默认 3）且新调用的操作指纹（命令词 + 目标基名）命中已确认样本时，**同一操作**自动放行。不同目标永不复用该放行。开启学习沉淀（`riskSediment`，默认开）后，满阈值 key 的确认样本会成为**确定性放行规则**：指纹精确命中即直接放行、无需再过 LLM——即使关闭 llmAssist 也继续生效；沉淀规则在设置卡片中可见、可管理（终止学习 / 删除样本）。
 - 超时（`riskTimeoutMs`，默认 20s，重试 1 次）、传输失败与协议外输出均维持原 `ask`——门禁绝不猜测。
 

package/lib/index.d.ts

@@ -7,7 +7,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { Config } from './config.js';
-import { PermGateRuntime } from './runtime.js';
+import { PermGateRuntime, type ToolExecutionLike } from './runtime.js';
 export declare const name = "dsh-perm-gate";
 /**
  * The `tools` service drives `tools/pre-execute`/`tools/result` (dsh-tools).
@@ -28,4 +28,19 @@ export declare const PERMISSIVE_NAMESPACE = "dsh-perm-gate";
  * the approval service to `unavailable` — a rejection on the human's behalf.
  */
 export declare function makeApprovalObserver(runtime: Pick<PermGateRuntime, 'settleAskOutcome'>): (req: unknown, next: () => Promise<unknown>) => Promise<unknown>;
+/**
+ * Build the `tools/pre-execute` waterfall listener (exported for tests).
+ *
+ * The llmAssist refinement is awaited **before** the decision leaves the
+ * waterfall. An ask that has been returned to the host is already on its way to
+ * the approval answerers, and DSH offers no API to retract it — the request's
+ * own `signal` can only settle it `cancelled` — so a `safe` verdict learned
+ * afterwards could be *recorded* but never acted on: the human still had to
+ * click. Grading here is what turns `safe` into a real auto-allow and keeps the
+ * prompt for the genuinely uncertain verdicts only (`risky:neutral`,
+ * `unresolved`, transport failure). The wait is bounded by the classifier's own
+ * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
+ * (fail-closed).
+ */
+export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk'>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
 export declare function apply(ctx: Context, config?: Record<string, unknown>): PermGateRuntime;

package/lib/index.js

@@ -97,6 +97,42 @@ export function makeApprovalObserver(runtime) {
         return outcome;
     };
 }
+/**
+ * Build the `tools/pre-execute` waterfall listener (exported for tests).
+ *
+ * The llmAssist refinement is awaited **before** the decision leaves the
+ * waterfall. An ask that has been returned to the host is already on its way to
+ * the approval answerers, and DSH offers no API to retract it — the request's
+ * own `signal` can only settle it `cancelled` — so a `safe` verdict learned
+ * afterwards could be *recorded* but never acted on: the human still had to
+ * click. Grading here is what turns `safe` into a real auto-allow and keeps the
+ * prompt for the genuinely uncertain verdicts only (`risky:neutral`,
+ * `unresolved`, transport failure). The wait is bounded by the classifier's own
+ * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
+ * (fail-closed).
+ */
+export function makePreExecuteListener(runtime) {
+    return async (exec, next) => {
+        const decision = runtime.decideExecution(exec);
+        // Passthrough (allow / stand-down) and a hard-deny need no grading.
+        if (decision === undefined)
+            return next();
+        if (decision.kind !== 'ask')
+            return decision;
+        // A cancelled call is never worth a model round-trip; the registry rechecks
+        // cancellation after this gate settles.
+        if (exec.signal?.aborted === true)
+            return decision;
+        let refined;
+        try {
+            refined = await runtime.refineAsk(exec, decision);
+        }
+        catch {
+            return decision; // fail-closed: keep the human ask
+        }
+        return refined ?? next();
+    };
+}
 export function apply(ctx, config = {}) {
     // Runtime-adjustable config: the composition entry is the base; the settings
     // namespace layers on top and `current()` always reads the active section.
@@ -329,28 +365,7 @@ export function apply(ctx, config = {}) {
     catch {
         // webServer unavailable: the feed remains disk-only, sediment is view-only in files
     }
-    const listener = async (exec, next) => {
-        const decision = runtime.decideExecution(exec);
-        if (decision === undefined)
-            return next();
-        // llmAssist: the panel MUST appear immediately after pre-execute returns.
-        // We NEVER await refineAsk here — return the original ask immediately so
-        // the approval panel pops up. The LLM classifier runs in the background
-        // and may auto-allow later via settleExecution.
-        if (decision.kind === 'ask') {
-            // Fire-and-forget: background LLM grading
-            runtime.refineAsk(exec, decision)
-                .then((refined) => {
-                if (refined === undefined) {
-                    // classifier said "safe" → auto-allow
-                    runtime.settleExecution(exec, { isError: false });
-                }
-            })
-                .catch(() => { });
-            return decision;
-        }
-        return decision;
-    };
+    const listener = makePreExecuteListener(runtime);
     // `tools/pre-execute` / `tools/result` / `approval/request` are service events,
     // not part of cordis core's typed `Events`, so they are registered through the
     // string overload.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "0.2.1-beta.2",
+  "version": "0.2.1-beta.3",
   "description": "DSH permission-gate: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
   "files": [