dsh-perm-gate 2.0.0 → 2.1.0

package/README.ja.md

@@ -26,8 +26,8 @@
 >
 > | DSH バージョン | ブランチ | バージョン | npm タグ |
 > | --- | --- | --- | --- |
-> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` / `@dsh-0.1.1` |
-> | 0.1.2-alpha.1+（0.1.5-rc.2を含む） | `main` | `2.x` | `@latest` / `@2.x` / `@dsh-0.1.2` |
+> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
+> | 0.1.2-alpha.1+（0.1.5-rc.2を含む） | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` は範囲） |
 >
 > バージョン系列は **DSH ライン**を追います（`1.x` = DSH ≤ 0.1.1、`2.x` = DSH 0.1.2+）。
 > メジャー同士が互いを遮断するため、`^1.x` のインストールが `2.x` を解決することは

package/README.ko.md

@@ -26,8 +26,8 @@
 >
 > | DSH 버전 | 브랜치 | 버전 | npm 태그 |
 > | --- | --- | --- | --- |
-> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` / `@dsh-0.1.1` |
-> | 0.1.2-alpha.1+ (0.1.5-rc.2 포함) | `main` | `2.x` | `@latest` / `@2.x` / `@dsh-0.1.2` |
+> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
+> | 0.1.2-alpha.1+ (0.1.5-rc.2 포함) | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x`는 범위) |
 >
 > 버전 계열은 **DSH 라인**을 따릅니다(`1.x` = DSH ≤ 0.1.1, `2.x` = DSH 0.1.2+). 메이저
 > 버전이 서로를 차단하므로 `^1.x` 설치가 `2.x`를 해석하는 일은 없고 그 반대도

package/README.md

@@ -25,8 +25,8 @@
 >
 > | DSH version | Branch | Version | npm tag |
 > | --- | --- | --- | --- |
-> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` / `@dsh-0.1.1` |
-> | 0.1.2-alpha.1+ (incl. 0.1.5-rc.2) | `main` | `2.x` | `@latest` / `@2.x` / `@dsh-0.1.2` |
+> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
+> | 0.1.2-alpha.1+ (incl. 0.1.5-rc.2) | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x` is a range) |
 >
 > The series number tracks the **DSH line** (`1.x` = DSH ≤ 0.1.1, `2.x` = DSH 0.1.2+),
 > and the majors fence each other: a `^1.x` install never resolves a `2.x` release and

package/README.zh.md

@@ -24,8 +24,8 @@
 >
 > | DSH 版本 | 分支 | 版本号 | npm 标签 |
 > | --- | --- | --- | --- |
-> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` / `@dsh-0.1.1` |
-> | 0.1.2-alpha.1+（含 0.1.5-rc.2） | `main` | `2.x` | `@latest` / `@2.x` / `@dsh-0.1.2` |
+> | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
+> | 0.1.2-alpha.1+（含 0.1.5-rc.2） | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` 是范围） |
 >
 > 版本序列号跟的是 **DSH 线**（`1.x` = DSH ≤ 0.1.1，`2.x` = DSH 0.1.2+），两条大版本互
 > 相隔离：锁在 `^1.x` 的安装绝不会解析到 `2.x`，反之亦然。`engines.dsh` 表达同样的

package/cordis.patch.yml

@@ -14,8 +14,9 @@
 # stays `permissive`: it is the key `gatePresets` matches and the value the
 # permission projection reports, so only the label text is user-facing.
 #
-# The tier carries no icon. The built-in glyphs the composer draws are keyed by
-# the three built-in values, and a plugin tier deliberately has none.
+# The tier now carries a shield+eye icon in the composer glyph map (patched
+# into dsh-client-ui-conversation).  The permissive glyph sits alongside the
+# three built-in ones so both the trigger button and the dropdown rows show it.
 #
 # The DSH bundle patch REPLACES the whole `permission.config.presets` map (it
 # does not merge per key), so this file MUST restate every tier that should

package/lib/risk.js

@@ -43,9 +43,9 @@ const RISK_SYSTEM_PROMPT = [
     '  {"risk":"risky","category":"<category>","reason":"short"}',
     '',
     'category must be exactly one of:',
-    '  deletion  — deletes or overwrites data that cannot be regenerated',
+    '  deletion  — deletes or overwrites data that cannot be regenerated (IMPORTANT: see exclusion rules below)',
     '  credential — creates/modifies/exposes credentials, keys, tokens, auth config',
-    '  remote    — affects remote systems, production, databases, messaging, billing, publishing',
+    '  remote    — WRITES to or MODIFIES remote systems (git push, git deploy, kubectl apply, terraform apply, production database writes, messaging, billing, publishing). Must have a write/modify/delete effect on the remote side.',
     '  system    — system-level paths or configuration (/etc, /usr, boot items), shutdown/reboot',
     '  bulk      — mass overwrite of many files, formatting, dd-style irreversible writes',
     '  neutral   — none of the above clearly applies (ordinary edits outside the obvious scope, or you are unsure but see no hard-risk sign)',
@@ -54,6 +54,17 @@ const RISK_SYSTEM_PROMPT = [
     '- safe is only for reversible, in-scope operations that touch no sensitive resource.',
     '- When unsure between safe and neutral, answer neutral; never guess safe.',
     '- Judge the operation content, not merely its location.',
+    '',
+    'DELETION exclusion rules (these override the deletion category):',
+    '- Cleanup of temporary files, build outputs, or failed clone directories is SAFE — even if using rm/rmdir/Remove-Item. Look for temp paths: paths containing "temp", "tmp", "test-clone", "node_modules", ".cache", "dist", "build", or numbered/timestamped directories.',
+    '- Removal of session-local artifacts (files the session itself created) is SAFE.',
+    '- rm -rf on node_modules, .next, __pycache__, .pytest_cache, .git, dist, build is SAFE — these are always regenerable.',
+    '- Deletion inside the workspace that targets non-existent or already-empty paths is SAFE (idempotent cleanup).',
+    '- Only flag as deletion when the target is: (a) user data with no backup, (b) configuration files, (c) database records, (d) files outside the workspace that were not created by this session, or (e) a destructive rm -rf on a directory containing unique, irreplaceable content.',
+    '',
+    'READ-ONLY remote operations are safe: git fetch, git pull, git clone, git log, git diff, git status, git show, npm install (read-only), pip install (read-only), apt-get update, curl/wget (read, no write flag).',
+    '- Operations that only READ from remote systems without modifying them are safe, even if they involve network traffic.',
+    '- Only flag as remote when the operation WRITES, DEPLOYS, PUSHES, or DELETES on the remote side.',
 ].join('\n');
 /** Parse one assistant message into a verdict; anything off-protocol → undefined (caller retries/fails). */
 export function parseRiskVerdict(content) {
@@ -92,9 +103,21 @@ export async function classifyRisk(cfg, req, nowFetch = fetch) {
 }
 /** The bounded user prompt for one risk grading (shared by every transport). */
 export function riskUserText(req) {
+    // Enrich the prompt with full path context so the LLM can judge
+    // whether a deletion targets a temporary/build artifact vs real data.
+    const raw = req.args ?? {};
+    const argsRecord = (typeof raw === 'object' && raw !== null ? raw : {});
+    const enriched = { ...argsRecord };
+    // Surface the working directory if present (helps LLM see temp paths).
+    if (typeof enriched.cwd === 'string' && enriched.cwd !== '') {
+        enriched.__cwd = enriched.cwd;
+    }
+    if (typeof enriched.workdir === 'string' && enriched.workdir !== '') {
+        enriched.__cwd = enriched.workdir;
+    }
     return JSON.stringify({
         tool: req.tool,
-        args: req.args ?? {},
+        args: enriched,
         reason: req.reason,
         instruction: 'Reply strictly as one JSON object: {"risk":"safe"} or {"risk":"risky","category":"..."} plus a short "reason".',
     });

package/lib/runtime.js

@@ -18,6 +18,7 @@ import { decideRules } from './evaluate.js';
 import { canonicalizeCall, GrantRegistry } from './grant.js';
 import { learnKey, operationFingerprint, RiskLearning } from './learning.js';
 import { ArtifactRegistry } from './path.js';
+import { decomposeShellCommand } from './shell.js';
 import { classifyRisk, classifyRiskWith } from './risk.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
 import { chatCompletion } from './classifier.js';
@@ -99,6 +100,70 @@ const CLEARED_CALL_TTL_MS = 5 * 60_000;
  * unrecognized wording fails closed (the request is forwarded to the human).
  */
 const SANDBOX_ESCALATION_REASON = /^escalate sandbox to (workspace-write|danger-full-access): /;
+// --- Deterministic cleanup pre-screen ----------------------------------------
+// Pattern for shell deletion commands (rm, rmdir, Remove-Item) with flags.
+const SHELL_DELETE_RE = /^(?:rm|rmdir|Remove-Item)\b/i;
+// Temp/build artifact directory name patterns (case-insensitive match on each path segment).
+const REGENERABLE_SEGMENT = /(?:^|[\\/])(?:temp|tmp|test[-_]clone|node_modules|\.cache|dist|build|__pycache__|\.pytest_cache|\.git|\.next|\.nuxt|coverage|\.tox|\.venv|venv|env|\.mypy_cache|\.parcel-cache)(?:[\\/]|$)/i;
+// Workspace-relative path tokens that are always regenerable.
+const REGENERABLE_TOKENS = /^(?:node_modules|\.next|__pycache__|\.cache|dist|build|\.git|coverage|\.pytest_cache|\.tox|\.venv|venv|env)$/i;
+/**
+ * Deterministic pre-screen for deletion commands. Returns a reason string when
+ * the deletion is clearly safe (targeting a regenerable/temp artifact inside the
+ * workspace), or undefined when the LLM should decide.
+ *
+ * This runs BEFORE the LLM risk grader to avoid the LLM's unconditional
+ * "Remove-Item → risky:deletion" bias. The LLM is still the fallback for
+ * ambiguous cases.
+ */
+function isCleanupSafe(exec) {
+    const tool = exec.name;
+    const args = exec.arguments ?? {};
+    // Only applies to shell/pwsh tools.
+    if (!/^(?:pwsh|bash|sh|cmd|shell|terminal)$/i.test(tool))
+        return undefined;
+    const commandText = typeof args.command === 'string' ? args.command : undefined;
+    if (commandText === undefined)
+        return undefined;
+    let commands = [];
+    try {
+        commands = decomposeShellCommand(commandText).commands;
+    }
+    catch {
+        return undefined;
+    }
+    const cwd = typeof args.cwd === 'string' ? args.cwd : cwdOf(exec) ?? '';
+    const posixCwd = cwd.replace(/\\/g, '/').toLowerCase();
+    for (const cmd of commands) {
+        if (!SHELL_DELETE_RE.test(cmd.command))
+            continue;
+        // Collect all non-flag argument tokens as potential targets.
+        const targets = cmd.args.filter((a) => !a.startsWith('-'));
+        if (targets.length === 0)
+            continue;
+        let allSafe = true;
+        for (const target of targets) {
+            const posixTarget = target.replace(/\\/g, '/').toLowerCase();
+            // Resolve relative to cwd.
+            const fullPath = posixTarget.startsWith('/') || /^[a-z]:\//i.test(posixTarget)
+                ? posixTarget
+                : posixCwd !== '' ? `${posixCwd}/${posixTarget}` : posixTarget;
+            // Check if the target path contains a regenerable segment.
+            if (REGENERABLE_SEGMENT.test(fullPath))
+                continue;
+            // Check bare token (e.g. "node_modules" without path separators).
+            if (REGENERABLE_TOKENS.test(target))
+                continue;
+            // Not clearly regenerable — let the LLM decide.
+            allSafe = false;
+            break;
+        }
+        if (allSafe) {
+            return `deletion targets regenerable/temp artifacts: ${targets.join(', ')}`;
+        }
+    }
+    return undefined;
+}
 export class PermGateRuntime {
     options;
     ruleset;
@@ -538,6 +603,19 @@ export class PermGateRuntime {
         };
         const raw = decide(ctx, { decide: (c) => decideRules(this.ruleset, c) }, grantResolver, this.autoAllowExtra);
         const decision = this.applyPermissive(raw);
+        // Deterministic cleanup pre-screen: if a deletion command targets a
+        // regenerable/temporary artifact inside the workspace, allow it directly.
+        // This runs BEFORE the ask/passthrough logic so it works even under
+        // `approval: never` (where refineAsk is never called).
+        if (decision.action === 'ask') {
+            const cleanupSafe = isCleanupSafe(exec);
+            if (cleanupSafe !== undefined) {
+                const reason = `cleanup-safe: ${cleanupSafe}`;
+                this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
+                this.recordEvent(exec, 'auto', reason, { risk: 'safe', verdict: 'cleanup-safe', category: 'safe' });
+                return undefined; // passthrough (allow)
+            }
+        }
         let outcome;
         let source;
         switch (decision.stage) {
@@ -644,6 +722,19 @@ export class PermGateRuntime {
                 return undefined;
             }
         }
+        // Defensive cleanup pre-screen: normally this is handled in decideExecution
+        // before refineAsk is ever called, but refineAsk is public and may be called
+        // directly by tests or future embedders. Keep the same deterministic check
+        // here as a safety net — identical logic to decideExecution's pre-screen.
+        const cleanupSafe = isCleanupSafe(exec);
+        if (cleanupSafe !== undefined) {
+            const reason = `cleanup-safe: ${cleanupSafe}`;
+            this.audit.append(makeEntry({ callId: randomId(), tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
+            this.recordEvent(exec, 'auto', reason, { risk: 'safe', verdict: 'cleanup-safe', category: 'safe' });
+            this.untrackAsk(exec);
+            this.clearCall(exec, reason, 'cleanup-safe', 'classifier');
+            return undefined;
+        }
         if (!permissive.strategies.llmAssist)
             return decision;
         // One live read of the classifier setup. Without a usable receiver (a
@@ -656,7 +747,14 @@ export class PermGateRuntime {
             && (cfg?.endpoint === undefined || cfg?.endpoint === '' || cfg?.model === undefined || cfg?.model === '')) {
             return decision;
         }
-        const req = { tool: exec.name, args: exec.arguments ?? {}, reason: decision.reason };
+        // Inject cwd into the risk request so the LLM can see the full path context
+        // (e.g. that a Remove-Item targets a temp directory, not user data).
+        const riskArgs = { ...(exec.arguments ?? {}) };
+        const cwd = cwdOf(exec);
+        if (typeof cwd === 'string' && cwd !== '' && typeof riskArgs.cwd !== 'string') {
+            riskArgs.cwd = cwd;
+        }
+        const req = { tool: exec.name, args: riskArgs, reason: decision.reason };
         let risk;
         if (this.options.riskHook !== undefined) {
             risk = await this.options.riskHook(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.2+ line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
   "files": [