dsh-perm-gate 5.4.1 → 5.4.3

package/lib/runtime.js

@@ -28,7 +28,7 @@ import { redactCommandText } from './redact.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
 import { chatCompletion } from './classifier.js';
-import { compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
+import { coerceRuleAction, compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
 import { decomposeShellCommand } from './shell.js';
 import { extractAgentCandidates } from './agent-identity.js';
 import { resolveRuleChain } from './rule-chain.js';
@@ -289,10 +289,17 @@ export class PermGateRuntime {
     }
     compileInline(options) {
         const empty = {
-            defaultAction: options.defaultAction ?? 'ask',
+            defaultAction: this.effectiveDefaultAction(options),
             deny: [], allow: [], ask: [],
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         };
+        // Every other path yields a ruleset whose default came from a document; a
+        // document is validated, but the action is still coerced so one bad source
+        // can never hand the runtime an action it has no branch for.
+        const settle = (rs) => {
+            const action = coerceRuleAction(rs.defaultAction);
+            return action === rs.defaultAction ? rs : { ...rs, defaultAction: action };
+        };
         // Settings-first (dual-source): a configured `dsh-perm-gate-rules`
         // namespace overrides every file path — the gate then loads with zero
         // filesystem dependency. Bare defaults (nothing configured) fall through
@@ -303,20 +310,20 @@ export class PermGateRuntime {
             const hash = documentHash(JSON.stringify(settingsDoc));
             const hit = this.cache.get(hash);
             if (hit !== undefined)
-                return hit;
+                return settle(hit);
             const compiled = compileRulesObject(settingsDoc, {
                 maxGlobStars: 2,
                 caseInsensitivePaths: options.caseInsensitivePaths ?? true,
             });
             this.cache.set(hash, compiled);
-            return compiled;
+            return settle(compiled);
         }
         // Chain mode: when searchUp is enabled, use the multi-file chain resolver.
         if (options.searchUp === true) {
             const cwd = options.cwd ?? process.cwd();
             const rulesFile = options.rulesFile !== undefined ? options.rulesFile : 'rules.yml';
             try {
-                return resolveRuleChain(cwd, {
+                return settle(resolveRuleChain(cwd, {
                     rulesFile,
                     searchUp: true,
                     fallbackPath: options.fallbackPath,
@@ -325,7 +332,7 @@ export class PermGateRuntime {
                 }, {
                     maxGlobStars: 2,
                     caseInsensitivePaths: options.caseInsensitivePaths ?? true,
-                });
+                }));
             }
             catch {
                 return empty;
@@ -338,14 +345,27 @@ export class PermGateRuntime {
         const hash = documentHash(text);
         const hit = this.cache.get(hash);
         if (hit !== undefined)
-            return hit;
+            return settle(hit);
         const doc = parsePermissionsDocument(text);
         const compiled = compileDocument(doc, {
             maxGlobStars: 2,
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         });
         this.cache.set(hash, compiled);
-        return compiled;
+        return settle(compiled);
+    }
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    effectiveDefaultAction(options) {
+        const raw = options.readDefaultAction !== undefined
+            ? options.readDefaultAction()
+            : options.defaultAction;
+        return coerceRuleAction(raw);
     }
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload() {
@@ -659,6 +679,15 @@ export class PermGateRuntime {
         const sel = this.options.readHostModel?.();
         return sel !== undefined && sel.provider !== '' && sel.model !== '' ? sel : undefined;
     }
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    hostEffort() {
+        const effort = this.options.readClassifyEffort?.();
+        return typeof effort === 'string' && effort !== '' ? effort : undefined;
+    }
     livePermissive() {
         return this.options.readPermissive !== undefined
             ? this.options.readPermissive()
@@ -1422,7 +1451,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -1624,7 +1653,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -2010,7 +2039,7 @@ export class PermGateRuntime {
                 if (this.options.hostLlm === undefined)
                     return done(false, 'host llm service unavailable');
                 const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000);
+                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() });
                 return r.ok ? done(true, `${selection.provider}/${selection.model} → ${r.content.trim().slice(0, 60) || 'ok'}`) : done(false, r.error ?? 'host llm call failed');
             }
             if (cfg?.endpoint === undefined || cfg.endpoint === '' || cfg?.model === undefined || cfg.model === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.4.1",
+  "version": "5.4.3",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"