dsh-perm-gate 5.2.0 → 5.3.0

package/cordis.patch.yml

@@ -1,7 +1,7 @@
 # dsh-perm-gate profile patch.
 #
 # Two jobs:
-# 1) Add the plugin's own "自动审查" session approval tier to the DSH
+# 1) Add the plugin's own "自动审查" session approval tiers to the DSH
 #    permission picker, and restate the built-in tiers it must not drop.
 # 2) Insert the plugin itself (host half) into the profile.
 #
@@ -77,6 +77,21 @@
         approval: ask
         name: 自动审查（高权限）
         description: 只由本插件的审批门过滤 —— 文件修改与子进程网络访问不再受沙箱限制，审批仍逐次生效，但没有系统沙箱兜底。
+      permissive-snet:
+        sandbox: workspace-write
+        approval: ask
+        name: 自动审查·机械过滤
+        description: 不调用审查模型 —— 确定性机械审查器先筛并列出疑点，剩下的仍然交人工确认。适用于无审查 LLM 可用、或不习惯模型替你拿主意的场景（不常用）。
+      permissive-mech:
+        sandbox: danger-full-access
+        approval: ask
+        name: 自动审查·机械直通
+        description: 无人确认 —— 确定性机械审查器替代人工：命中不可逆 / 不可沉淀 / 读不懂的载荷即拦截，并把理由回喂主模型，其余照常执行。不调用审查模型，零 token。
+      permissive-yolo:
+        sandbox: danger-full-access
+        approval: ask
+        name: 自动审查·YOLO
+        description: 无人确认 —— 审查模型逐条替代人工裁决，报硬风险即拦截并回喂理由；模型未配置或未能给出裁决时退回机械处置。永不升级人工。
       danger-full-access:
         sandbox: danger-full-access
         approval: never

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/ask-context.d.ts

@@ -10,6 +10,17 @@ export type Reversibility =
  | 'R';
 /** What the call is aimed at. */
 export type TargetKind = 'read' | 'write' | 'delete' | 'remote-write' | 'exec-external' | 'unknown';
+/**
+ * One script body handed to the reviewers, as the runtime read it. Structural here so
+ * this module keeps its dependency-free contract (the fs half lives in `script-review.ts`).
+ */
+export interface ScriptContentIn {
+    readonly ref: string;
+    readonly path: string;
+    readonly body: string;
+    readonly truncated: boolean;
+    readonly unreadable?: string;
+}
 /** The session's three tier knobs, folded out of the durable session log. */
 export interface SessionKnobs {
     readonly permissionPreset?: string;
@@ -28,6 +39,18 @@ export interface AskContextSource {
     readonly files?: readonly string[];
     /** The deterministic layer's own conclusion, kept for the human, not the grader. */
     readonly ruleReason?: string;
+    /**
+     * The scripts this call runs, with the body the reviewer is given. Read by the node
+     * runtime (`script-review.ts`) — this module stays filesystem-free, so the text
+     * arrives pre-fetched. Absent means either no script is named or review is off.
+     */
+    readonly scriptContents?: readonly ScriptContentIn[];
+    /**
+     * True when *every* script the call names was read, i.e. what will execute is now
+     * visible. That is what lifts a script run out of the opaque/`U` tier: the reviewer
+     * is no longer judging a filename. One unreadable script keeps the opacity.
+     */
+    readonly scriptsCovered?: boolean;
     /** Correlation key, mixed into the event digest. */
     readonly callId?: string;
     /** Per-session salt so `inputDigest` cannot be dictionary-reversed or joined across sessions. */
@@ -64,7 +87,24 @@ export interface GraderPayload {
     readonly reason: string;
     readonly target_resolvable: boolean;
     readonly workspace_root?: string;
+    /**
+     * The bodies of the scripts this call runs, redacted like any other egress text.
+     * Without them the grader judges a filename and can say `safe` about code it never
+     * saw; with them the answer is about what will execute.
+     */
+    readonly script_contents?: readonly GraderScript[];
 }
+/** One attached script, as it leaves the host. */
+export interface GraderScript {
+    readonly ref: string;
+    readonly path: string;
+    /** Absent when `unreadable` names why there is no body. */
+    readonly body?: string;
+    readonly truncated?: boolean;
+    readonly unreadable?: string;
+}
+/** Budget for one script body on the wire: a real script, one round-trip. */
+export declare const GRADER_SCRIPT_BODY_CHARS = 20000;
 /**
  * Project for egress to the grader. Tier knobs and the rule layer's own verdict
  * are stripped by design — see the module comment.
@@ -136,6 +176,14 @@ export declare const DOUBT_COPY: {
         readonly zh: "会执行工作区之外的代码，本次调用无法静态看清它做什么";
         readonly en: "it runs code from outside the workspace, which this call cannot inspect";
     };
+    readonly 'script-attached': {
+        readonly zh: "它要跑的脚本正文已读出来、随本次审查附上（模型看到的和你看到的是同一份）";
+        readonly en: "the script it runs was read and attached to this review — the model and you see the same text";
+    };
+    readonly 'script-unreadable': {
+        readonly zh: "脚本正文没读到（缺失/过大/二进制），没有人看见真正要执行的代码";
+        readonly en: "a script body could not be read (missing, over budget, or binary) — nobody has seen the code that will run";
+    };
     readonly 'outside-paths': {
         readonly zh: "涉及工作区之外的路径";
         readonly en: "it touches paths outside the workspace";
@@ -171,7 +219,7 @@ export declare function askDoubtKinds(ctx: AskContext, extra?: {
  * The event still carries the command separately (`humanCommand`) because the
  * review list has no host-provided command block next to it.
  */
-export declare function humanBrief(ctx: AskContext, lang: 'zh' | 'en', kinds?: ("write" | "delete" | "remote-write" | "exec-external" | "never-learn" | "no-rule" | "opaque" | "irreversible" | "outside-paths" | "model-flagged")[]): string;
+export declare function humanBrief(ctx: AskContext, lang: 'zh' | 'en', kinds?: ("write" | "delete" | "remote-write" | "exec-external" | "never-learn" | "no-rule" | "opaque" | "irreversible" | "script-attached" | "script-unreadable" | "outside-paths" | "model-flagged")[]): string;
 /** The redacted command alone, for the channels that have nowhere else to show it. */
 export declare function humanCommand(ctx: AskContext): string;
 /** What goes on the durable event, for later attribution. */

package/lib/ask-context.js

@@ -124,6 +124,48 @@ function unseenScript(text, root) {
     }
     return text.match(/(?:^|[\s"'`(])\.\.[\/][^\s"']*\.(?:py|mjs|js|sh)\b/i) !== null;
 }
+/**
+ * The statements a script body actually contains, for the deterministic nets.
+ *
+ * Judging a whole file as one string is too coarse: `irreversible.ts` matches a delete
+ * verb, a force flag and a home-variable *anywhere* in the text, and a 300-line build
+ * script is full of all three in unrelated places (`cd "$HOME"` at the top,
+ * `rm -rf ./node_modules` at the bottom). So the body is cut into statements (newline
+ * and `;` are the shell separators) and each is judged on its own.
+ *
+ * But the incident shape is a **block**, and one line of it says nothing:
+ * `for f in ~/.*; do` / `rm -rf "$f"` / `done`, or `if (Test-Path $home) {` on its own
+ * line. So a line that *ends* in a continuation (`do`, `then`, `{`, `&&`, `;`, a
+ * trailing backslash) is joined with the lines it hands off to, up to a small depth.
+ * Joining is keyed on the continuation, not on a fixed window: an arbitrary two-line
+ * window is exactly the collision the split avoids (`cd "$HOME"` followed by
+ * `rm -rf ./build`).
+ *
+ * The cost of an over-match here is a human ask, never a silent deny: this feeds the
+ * `I` tier, which the model cannot clear.
+ */
+const LINE_CONTINUATION = /(?:&\s*&\s*$|\|\s*\|\s*$|;\s*(?:do|then|fi|else)\s*$|[{}]\s*$|;\s*$|\\\s*$|\b(?:do|then|else|begin)\s*$)/;
+function bodyStatements(bodies) {
+    const out = [];
+    for (const body of bodies) {
+        const lines = body.split('\n');
+        for (let i = 0; i < lines.length; i += 1) {
+            let group = lines[i] ?? '';
+            // A block opener swallows the lines it governs (max 3 more), so a loop or an `if`
+            // wrapping a destructive statement is judged as the one act it is.
+            for (let j = 1; j <= 3 && i + j < lines.length && LINE_CONTINUATION.test(group); j += 1) {
+                group = `${group}\n${lines[i + j] ?? ''}`;
+            }
+            for (const stmt of [group, ...group.split(/[;\n]+/)]) {
+                if (stmt.trim() !== '')
+                    out.push(stmt);
+            }
+            // The individual statements of the swallowed lines are still judged separately on
+            // their own turn, so nothing is *only* seen as part of a block.
+        }
+    }
+    return out;
+}
 /** Classify what the call targets, and whether its payload is inspectable. */
 function inspect(source) {
     const text = (source.commandText ?? '').trim();
@@ -132,10 +174,14 @@ function inspect(source) {
     // hiding `Remove-Item -Recurse -Force C:\` is irreversible even though the
     // visible text is opaque, and the human must see both facts.
     const decoded = executableVariants(normalizeCommandText(text));
-    const irreversible = irreversibleReason(cmd) !== undefined
-        || decoded.some((variant) => irreversibleReason(variant) !== undefined);
-    const unlearnable = neverClearReason(cmd) !== undefined
-        || decoded.some((variant) => neverClearReason(variant) !== undefined);
+    // A script run is judged on the file too: `bash ./clean-home.sh` is a filename, the
+    // *body* is the operation. This is the clause that closes the incident the whole
+    // feature exists for — a script that wipes the profile while the command line says
+    // nothing dangerous, judged deterministically so no grader `safe` can clear it.
+    const read = (source.scriptContents ?? []).filter((c) => c.unreadable === undefined && c.body !== '');
+    const judged = [cmd, ...decoded, ...bodyStatements(read.map((c) => `${c.ref}\n${c.body}`))];
+    const irreversible = judged.some((t) => irreversibleReason(t) !== undefined);
+    const unlearnable = judged.some((t) => neverClearReason(t) !== undefined);
     if (cmd.trim() === '{}') {
         // A tool invoked with no arguments at all: nothing to read, nothing to trust.
         return { kind: 'unknown', resolvable: false, readOnly: false, irreversible, unlearnable };
@@ -156,7 +202,12 @@ function inspect(source) {
     })();
     const first = text.split(/\s/)[0] ?? '';
     const runner = /\b(?:python|node|pwsh|powershell|bash|sh|zsh|npx|deno|ruby|perl)\b/i.test(cmd);
-    const execExternal = runner && (outsideWorkspace(cmd, source.workspaceRoot) || unseenScript(cmd, source.workspaceRoot));
+    // "Cannot see the script" is what the U tier existed for. Once every script the call
+    // names has been read and attached, the reviewer *can* see it — so the call stops
+    // being unknowable and becomes an ordinary graded call (whose body the nets have just
+    // judged above). One unreadable file keeps the whole call opaque.
+    const covered = source.scriptsCovered === true && read.length > 0;
+    const execExternal = runner && !covered && (outsideWorkspace(cmd, source.workspaceRoot) || unseenScript(cmd, source.workspaceRoot));
     const unnamed = text !== '' && unnamedOperation(text);
     const opaque = OPAQUE.test(cmd) || execExternal;
     if (irreversible)
@@ -216,18 +267,28 @@ export function buildAskContext(source) {
         reversibility: grade(seen),
     };
 }
+/** Budget for one script body on the wire: a real script, one round-trip. */
+export const GRADER_SCRIPT_BODY_CHARS = 20_000;
 /**
  * Project for egress to the grader. Tier knobs and the rule layer's own verdict
  * are stripped by design — see the module comment.
  */
 export function toGraderPayload(ctx) {
     const root = ctx.workspaceRoot;
+    const scripts = (ctx.scriptContents ?? []).map((c) => ({
+        ref: c.ref,
+        path: c.path,
+        ...(c.unreadable === undefined
+            ? { body: redactCommandText(c.body, { maxChars: GRADER_SCRIPT_BODY_CHARS }), truncated: c.truncated }
+            : { unreadable: c.unreadable }),
+    }));
     return {
         tool: ctx.tool,
         args: redactArgs(ctx.args ?? {}),
         reason: ctx.ruleReason ?? '',
         target_resolvable: ctx.targetResolvable,
         ...(root === undefined || root === '' ? {} : { workspace_root: root }),
+        ...(scripts.length === 0 ? {} : { script_contents: scripts }),
     };
 }
 /**
@@ -285,6 +346,11 @@ export function humanCardLine(ctx, maxFiles = 3) {
         bits.push('payload=opaque');
     if (ctx.unlearnable)
         bits.push('never-learn');
+    const scripts = ctx.scriptContents ?? [];
+    if (scripts.length > 0) {
+        const unread = scripts.filter((c) => c.unreadable !== undefined).length;
+        bits.push(unread === 0 ? `scripts=${scripts.length}:body-attached` : `scripts=${scripts.length}:unread=${unread}`);
+    }
     if (card.fileCount > 0) {
         const shown = card.files.length;
         bits.push(shown < card.fileCount ? `files=${shown}/${card.fileCount}` : `files=${card.fileCount}`);
@@ -334,6 +400,14 @@ export const DOUBT_COPY = {
         zh: '会执行工作区之外的代码，本次调用无法静态看清它做什么',
         en: 'it runs code from outside the workspace, which this call cannot inspect',
     },
+    'script-attached': {
+        zh: '它要跑的脚本正文已读出来、随本次审查附上（模型看到的和你看到的是同一份）',
+        en: 'the script it runs was read and attached to this review — the model and you see the same text',
+    },
+    'script-unreadable': {
+        zh: '脚本正文没读到（缺失/过大/二进制），没有人看见真正要执行的代码',
+        en: 'a script body could not be read (missing, over budget, or binary) — nobody has seen the code that will run',
+    },
     'outside-paths': {
         zh: '涉及工作区之外的路径',
         en: 'it touches paths outside the workspace',
@@ -395,6 +469,16 @@ export function askDoubtKinds(ctx, extra = {}) {
     }
     if (extra.modelFlagged === true)
         kinds.push('model-flagged');
+    // Whether the code that will run was actually looked at is a fact the human decides
+    // with, and it is not implied by any other clause: an attached body means the
+    // judgment covered it, an unreadable one means nothing ever will.
+    const scripts = ctx.scriptContents ?? [];
+    if (scripts.length > 0) {
+        if (scripts.some((c) => c.unreadable !== undefined))
+            kinds.push('script-unreadable');
+        else
+            kinds.push('script-attached');
+    }
     if (ctx.ruleReason !== undefined && /no rule matched|default action/i.test(ctx.ruleReason))
         kinds.push('no-rule');
     const root = ctx.workspaceRoot;