dsh-perm-gate 1.0.0 → 2.0.0

package/lib/runtime.d.ts

@@ -27,13 +27,21 @@ export interface ToolExecutionLike {
      * read from `agent.session.id` / `agent.session.header.cwd`.
      */
     readonly agent?: {
+        /** The agent's own session id (DSH ≥ 0.1.2 exposes it beside `session`). */
+        readonly sessionId?: string;
         readonly session?: {
             readonly id?: string;
             readonly header?: {
                 readonly cwd?: string;
             };
-            /** The durable event log; the permission-preset fold reads it. */
+            /**
+             * The durable event log, behind whichever accessor this DSH line ships:
+             * a plain `events` array (0.1.1), or the `snapshotEvents()` / `ownEvents()`
+             * readers 0.1.2 replaced it with. See {@link sessionEventsOf}.
+             */
             readonly events?: readonly SessionEventLike[];
+            readonly snapshotEvents?: () => readonly SessionEventLike[];
+            readonly ownEvents?: () => readonly SessionEventLike[];
         };
     };
 }
@@ -157,7 +165,14 @@ export declare class PermGateRuntime {
     private readonly gatePresets;
     /** Extra tool names the user classified as safe (config `autoAllowTools`). */
     private readonly autoAllowExtra;
-    /** Cache of the permission-preset fold, keyed by log identity + length. */
+    /**
+     * Cache of the permission-preset fold. The key is the log's length plus the
+     * identity of its LAST event: a session's log only appends, so "same length
+     * and same last event" means the last `permission/preset` event is unchanged.
+     * Identity of the tail — not of the array — is the key because DSH 0.1.2's
+     * `snapshotEvents()` answers every read with a fresh array over the same
+     * frozen events, which would otherwise re-fold on every tool call.
+     */
     private presetCache;
     private readonly learning;
     private readonly events?;
@@ -206,9 +221,11 @@ export declare class PermGateRuntime {
     private livePermissive;
     /**
      * The session's selected permission preset, folded from its event log. The
-     * fold is cached by the log array identity plus its length: a session's log
-     * is a stable, append-only array, so a changed reference or a grown log
-     * invalidates the cache while repeated calls on the same log stay cheap.
+     * fold is cached on the log's length plus the identity of its last event: a
+     * session's log only appends, so an unchanged tail means the last
+     * `permission/preset` event is unchanged too. Tail identity — rather than the
+     * array's — is the key because DSH 0.1.2's snapshot accessor returns a fresh
+     * array over the same frozen events on every read.
      */
     private presetOf;
     /**

package/lib/runtime.js

@@ -25,11 +25,50 @@ import { compileDocument, documentHash, extractPathCandidates, parsePermissionsD
 import { DEFAULT_DENY_KEYWORDS } from './deny-defaults.js';
 import { permissionPresetOf, presetInScope } from './preset.js';
 import { resolveGatePresets } from './config.js';
+/**
+ * One execution's session event log, or `undefined` when the host exposes none.
+ *
+ * The accessor moved between DSH lines: 0.1.1 exposed `session.events` as a
+ * plain array, while 0.1.2 made the log private behind `snapshotEvents()` /
+ * `ownEvents()`. Reading only `.events` therefore made {@link
+ * PermGateRuntime.presetOf} return `undefined` on 0.1.2, which silently stood
+ * the whole gate down (no rule, grant, deny-keyword, or P0 hard-deny decision,
+ * and no audit event). Every carrier is probed, array-first; a throwing or
+ * missing accessor just moves to the next one, so an unknown future shape
+ * degrades to "no events" instead of breaking the decision path.
+ *
+ * @param exec - the execution whose owning session is inspected.
+ * @returns the session's events in log order, or `undefined`.
+ */
+function sessionEventsOf(exec) {
+    const session = exec.agent?.session;
+    for (const carrier of [session, exec]) {
+        if (carrier === undefined)
+            continue;
+        const direct = carrier.events;
+        if (Array.isArray(direct))
+            return direct;
+        for (const read of ['snapshotEvents', 'ownEvents']) {
+            const accessor = carrier[read];
+            if (typeof accessor !== 'function')
+                continue;
+            try {
+                const events = accessor.call(carrier);
+                if (Array.isArray(events))
+                    return events;
+            }
+            catch {
+                // An accessor that throws is no accessor: try the next carrier.
+            }
+        }
+    }
+    return undefined;
+}
 /** The session id of one execution (direct field, else the agent's session). */
 function sessionIdOf(exec) {
     if (typeof exec.sessionId === 'string' && exec.sessionId !== '')
         return exec.sessionId;
-    const id = exec.agent?.session?.id;
+    const id = exec.agent?.sessionId ?? exec.agent?.session?.id;
     return typeof id === 'string' ? id : '';
 }
 /** The workspace cwd of one execution (direct field, else the session header). */
@@ -73,7 +112,14 @@ export class PermGateRuntime {
     gatePresets;
     /** Extra tool names the user classified as safe (config `autoAllowTools`). */
     autoAllowExtra;
-    /** Cache of the permission-preset fold, keyed by log identity + length. */
+    /**
+     * Cache of the permission-preset fold. The key is the log's length plus the
+     * identity of its LAST event: a session's log only appends, so "same length
+     * and same last event" means the last `permission/preset` event is unchanged.
+     * Identity of the tail — not of the array — is the key because DSH 0.1.2's
+     * `snapshotEvents()` answers every read with a fresh array over the same
+     * frozen events, which would otherwise re-fold on every tool call.
+     */
     presetCache;
     learning;
     events;
@@ -224,18 +270,21 @@ export class PermGateRuntime {
     }
     /**
      * The session's selected permission preset, folded from its event log. The
-     * fold is cached by the log array identity plus its length: a session's log
-     * is a stable, append-only array, so a changed reference or a grown log
-     * invalidates the cache while repeated calls on the same log stay cheap.
+     * fold is cached on the log's length plus the identity of its last event: a
+     * session's log only appends, so an unchanged tail means the last
+     * `permission/preset` event is unchanged too. Tail identity — rather than the
+     * array's — is the key because DSH 0.1.2's snapshot accessor returns a fresh
+     * array over the same frozen events on every read.
      */
     presetOf(exec) {
-        const events = exec.agent?.session?.events;
+        const events = sessionEventsOf(exec);
         const length = events?.length ?? -1;
+        const last = length > 0 ? events?.[length - 1] : undefined;
         const cached = this.presetCache;
-        if (cached !== undefined && cached.events === events && cached.length === length)
+        if (cached !== undefined && cached.length === length && cached.last === last)
             return cached.preset;
         const preset = permissionPresetOf(events);
-        this.presetCache = { events, length, preset };
+        this.presetCache = { length, last, preset };
         return preset;
     }
     /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-perm-gate",
-  "version": "1.0.0",
-  "description": "DSH permission-gate: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
+  "version": "2.0.0",
+  "description": "DSH permission-gate for the DeepSeek Harness 0.1.2+ line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
   "files": [
     "lib",
@@ -58,7 +58,7 @@
   },
   "engines": {
     "node": ">=20",
-    "dsh": ">=0.1.0-rc.7 <0.1.2-alpha.1"
+    "dsh": ">=0.1.2-alpha.1 <0.2.0-0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1"
@@ -69,10 +69,10 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
@@ -89,9 +89,10 @@
     "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
     "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
     "test": "vitest run",
-    "verify:line": "node scripts/verify-line.mjs legacy",
+    "verify:line": "node scripts/verify-line.mjs new",
     "verify:lines": "node scripts/verify-line.mjs both",
     "release:latest": "npm publish --tag latest",
+    "release:2x": "npm publish --tag 2.x",
     "release:legacy": "npm publish --tag legacy"
   },
   "license": "MIT",