dsh-perm-gate 5.4.2 → 5.4.3

package/lib/config.d.ts

@@ -22,6 +22,8 @@ export declare function dataDirReady(dataDir: string): boolean;
  * applies `defaultAction`), so the fallback never fails the plugin load.
  */
 export declare function resolveRulesFile(configured: string | undefined, dataDir: string): string;
+/** Reasoning effort the host reviewer may request; empty = let the host decide. */
+export type ClassifierEffort = '' | 'off' | 'low' | 'medium' | 'high';
 export interface PermGateConfig {
     /** Absolute or `./`-relative path to the YAML permissions document. */
     readonly rulesFile?: string;
@@ -34,7 +36,19 @@ export interface PermGateConfig {
     /** Enable the optional LLM semantic classifier (P3). Default false. */
     readonly classifierEnabled?: boolean;
     readonly classifierEndpoint?: string;
+    /**
+     * Model id for the llmAssist receiver. Unset in host mode means **inherit the
+     * host model-group selection** — an inherited default here (the old
+     * `deepseek-chat`) pinned the reviewer to an unrelated model while the provider
+     * followed the host (issue #8). Custom-endpoint mode still falls back to
+     * `deepseek-chat` at request time.
+     */
     readonly classifierModel?: string;
+    /**
+     * Reasoning effort for host reviews (`off` | `low` | `medium` | `high`).
+     * Empty omits the field so the host model configuration decides (issue #8).
+     */
+    readonly classifierEffort?: ClassifierEffort;
     readonly classifierApiKey?: string;
     /** Abort the llmAssist risk call after this many milliseconds. Default 20000. */
     readonly riskTimeoutMs?: number;
@@ -483,7 +497,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -557,7 +572,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -568,7 +583,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -642,7 +658,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -650,12 +666,12 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierEffort", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */
 export declare function resolveVolatileConfig(config: object): Record<string, unknown>;
-export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
+export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierEffort' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
     readonly permissiveStrategies: PermissiveStrategies;
     readonly gatePresets: readonly string[];
 };

package/lib/config.js

@@ -180,7 +180,8 @@ export const Config = z.object({
     caseInsensitivePaths: vol(z.boolean().default(true)),
     classifierEnabled: vol(z.boolean().default(false)),
     classifierEndpoint: vol(z.string()),
-    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierModel: vol(z.string()),
+    classifierEffort: vol(z.union(['', 'off', 'low', 'medium', 'high']).default('')),
     classifierApiKey: vol(z.string()),
     riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
     riskLearning: vol(z.boolean().default(true)),
@@ -264,7 +265,7 @@ export const Config = z.object({
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
 export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
-    'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
+    'classifierModel', 'classifierEffort', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
     'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
@@ -303,7 +304,9 @@ export function resolveConfig(config = {}) {
         caseInsensitivePaths: parsed.caseInsensitivePaths ?? true,
         classifierEnabled: parsed.classifierEnabled ?? false,
         classifierEndpoint: parsed.classifierEndpoint,
-        classifierModel: parsed.classifierModel ?? 'deepseek-chat',
+        // Not defaulted on purpose: unset means "inherit the host model" (issue #8).
+        classifierModel: parsed.classifierModel,
+        classifierEffort: parsed.classifierEffort ?? '',
         classifierApiKey: parsed.classifierApiKey,
         riskTimeoutMs: parsed.riskTimeoutMs ?? 20_000,
         riskLearning: parsed.riskLearning ?? false,

package/lib/events.js

@@ -822,7 +822,14 @@ export function registerHealthRoute(server, provider) {
                 json(res, 405, { ok: false, error: 'method not allowed' });
                 return;
             }
-            provider.check().then((result) => json(res, 200, { ...result, ok: true }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
+            provider.check().then(
+            // The check's own `ok` decides the answer. Spelling `ok: true` after the
+            // spread overwrote a resolved `{ ok: false }` and reported a dead review
+            // connection as healthy (issue #8).
+            (result) => json(res, 200, {
+                ...result,
+                ok: result?.ok === true,
+            }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
         },
     });
 }

package/lib/host-llm.d.ts

@@ -47,12 +47,29 @@ export interface HostModelSelection {
 }
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export declare const DEFAULT_HOST_MODEL: HostModelSelection;
+/** Optional knobs for one host completion. */
+export interface HostCallOptions {
+    /**
+     * Reasoning effort to request. Empty/undefined **omits** the field entirely so
+     * the host's own model configuration decides — a hardcoded value is rejected by
+     * host validation when the selected model does not advertise it (issue #8).
+     */
+    readonly effort?: string;
+    readonly maxTokens?: number;
+}
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number): Promise<{
+export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number, opts?: HostCallOptions): Promise<{
     ok: true;
     content: string;
 } | {

package/lib/host-llm.js

@@ -10,35 +10,58 @@
  */
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export const DEFAULT_HOST_MODEL = { provider: 'deepseek-official', model: 'deepseek-v4-flash' };
+/**
+ * Finish kinds that mean "what you got is not the whole answer". Graded as a
+ * failure: a truncated or filtered stream is not a verdict (issue #7).
+ */
+const TRUNCATED_FINISH_KINDS = new Set([
+    'max-tokens', 'max_tokens', 'length', 'truncated', 'content-filter', 'content_filter',
+]);
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export async function completeViaHost(hostLlm, selection, system, user, timeoutMs) {
+export async function completeViaHost(hostLlm, selection, system, user, timeoutMs, opts = {}) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
         let text = '';
+        let finishKind;
+        const effort = typeof opts.effort === 'string' && opts.effort !== '' ? opts.effort : undefined;
         const stream = hostLlm.stream({
             provider: selection.provider,
             model: selection.model,
             messages: [{ role: 'user', content: [{ type: 'text', text: user }] }],
             system,
             temperature: 0,
-            reasoningEffort: 'off',
-            maxTokens: 256,
+            ...(effort !== undefined ? { reasoningEffort: effort } : {}),
+            maxTokens: opts.maxTokens ?? 256,
             signal: controller.signal,
         });
         for await (const chunk of stream) {
-            if ((chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') && typeof chunk.text === 'string') {
+            if (chunk.type === 'text-delta' && typeof chunk.text === 'string') {
                 text += chunk.text;
             }
-            else if (chunk.type === 'finish' && chunk.reason !== undefined && (chunk.reason.kind === 'error' || chunk.reason.kind === 'aborted')) {
-                const failure = chunk.reason.failure?.message;
-                return { ok: false, error: failure ?? chunk.reason.kind };
+            else if (chunk.type === 'finish') {
+                const kind = chunk.reason?.kind;
+                if (kind === 'error' || kind === 'aborted') {
+                    const failure = chunk.reason?.failure?.message;
+                    return { ok: false, error: failure ?? kind };
+                }
+                finishKind = kind;
             }
         }
+        if (finishKind !== undefined && TRUNCATED_FINISH_KINDS.has(finishKind)) {
+            return { ok: false, error: `truncated answer (finish: ${finishKind})` };
+        }
         if (text.trim() === '')
             return { ok: false, error: 'empty answer' };
         return { ok: true, content: text };

package/lib/index.js

@@ -510,7 +510,15 @@ export function apply(ctx, config = {}) {
     // channel in buildSessionSender.
     let approvalService;
     const runtime = new PermGateRuntime({
-        ...config,
+        // The host hands `.volatile()` fields to apply() as **live refs**. Resolve
+        // them once before spreading, or a ref object becomes a static option — the
+        // ruleset default among them, where no deny/ask branch matches it and every
+        // unmatched call was allowed unreviewed (issue #6). Anything that must stay
+        // live is read through its own `read*` hook below.
+        ...resolveVolatileConfig(config),
+        // Read live *and* validated: `coerceRuleAction` refuses a non-literal value
+        // instead of letting it fall through the runtime's action branches.
+        readDefaultAction: () => current().defaultAction,
         hostLlm,
         // Raise a network approval through the DSH approval seam. The service
         // applies the session policy, routes the prompt to the agent, and appends
@@ -582,13 +590,26 @@ export function apply(ctx, config = {}) {
         // same namespace, so editing the settings card applies to the next tool call.
         readClassifyConfig: () => {
             const c = current();
+            const source = c.classifierSource === 'host' ? 'host' : 'custom';
             return {
                 endpoint: c.classifierEndpoint,
-                model: c.classifierModel,
+                // Host mode: an unset model means "inherit the host selection" — the old
+                // schema default (`deepseek-chat`) came back on every clear and was then
+                // treated as an explicit override, so provider and model diverged (issue
+                // #8). Custom-endpoint mode keeps the historical default.
+                model: typeof c.classifierModel === 'string' && c.classifierModel !== ''
+                    ? c.classifierModel
+                    : source === 'custom' ? 'deepseek-chat' : undefined,
                 apiKey: c.classifierApiKey,
                 timeoutMs: c.riskTimeoutMs ?? 20_000,
             };
         },
+        // Host reviews: an empty effort sends no `reasoningEffort` at all, so the host
+        // model configuration decides instead of a value it may reject (issue #8).
+        readClassifyEffort: () => {
+            const effort = current().classifierEffort;
+            return typeof effort === 'string' && effort !== '' ? effort : undefined;
+        },
         // Read the verdict-learning switch and threshold live.
         readRiskLearning: () => {
             const c = current();
@@ -751,6 +772,9 @@ export function apply(ctx, config = {}) {
     // The host no longer seeds settings (there is no write path): an empty
     // `allowlist` keeps the rules-file default via `runtime.allowlist()`.
     let lastRulesDocKey;
+    // Root compile-time inputs (default action, path case-fold). Seeded on the first
+    // pass so a startup value is not mistaken for an edit.
+    let lastStaticKey;
     function applyVolatileUpdate() {
         const next = asSurface(current());
         if (next !== undefined) {
@@ -779,6 +803,17 @@ export function apply(ctx, config = {}) {
             if (changed)
                 runtime.reload();
         }
+        // The root `defaultAction` (and the path case-fold) are compile-time inputs of
+        // the ruleset. Without this the settings switch persisted but never reached the
+        // live ruleset — "default value changes also miss invalidation" (issue #6).
+        const staticKey = `${String(current().defaultAction)}\u0000${String(current().caseInsensitivePaths)}`;
+        if (lastStaticKey === undefined) {
+            lastStaticKey = staticKey;
+        }
+        else if (lastStaticKey !== staticKey) {
+            lastStaticKey = staticKey;
+            runtime.reload();
+        }
     }
     ;
     ctx.on('loader/volatile-update', () => {

package/lib/risk.js

@@ -135,13 +135,11 @@ export function parseRiskVerdict(content) {
         return undefined;
     }
     catch {
-        // Lenient fallback for models that ignore response_format: bare keyword scan.
-        // A bare "risky" carries no trustworthy category, so it stays unresolved —
-        // the caller keeps the human ask rather than guessing a category.
-        if (/\brisky\b/i.test(trimmed))
-            return undefined;
-        if (/\bsafe\b/i.test(trimmed))
-            return { kind: 'safe' };
+        // No lenient keyword scan. A bare `safe` used to be accepted from prose such
+        // as "not safe" or from a half-written JSON object, which is exactly how a
+        // truncated stream could be read as an all-clear (issue #7). Anything that is
+        // not the protocol object is `undefined` — the caller keeps the human ask
+        // and learns nothing.
         return undefined;
     }
 }

package/lib/rule.d.ts

@@ -86,6 +86,17 @@ export interface CompileOptions {
     readonly maxGlobStars?: number;
     readonly caseInsensitivePaths?: boolean;
 }
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export declare function coerceRuleAction(value: unknown, fallback?: RuleAction): RuleAction;
 export declare class RuleError extends Error {
     constructor(message: string);
 }

package/lib/rule.js

@@ -12,6 +12,19 @@ import { parse } from 'yaml';
 import { compileGlob, compileBranchPattern, hashText } from './compiler.js';
 import { parseParamsDimension, parseAbsentDimension, parseAgentsDimension, parseWhenDimension, parseArgvDimension, parseNetworkDimension, parseBranchDimension, } from './rule-dims.js';
 const VALID_ACTIONS = ['allow', 'ask', 'deny'];
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export function coerceRuleAction(value, fallback = 'ask') {
+    return VALID_ACTIONS.includes(value) ? value : fallback;
+}
 const PATH_CANDIDATE_KEYS = [
     'path', 'paths', 'file', 'files', 'file_path', 'dir', 'directory', 'directories',
     'cwd', 'workspace', 'root', 'target', 'targets', 'output',

package/lib/runtime.d.ts

@@ -131,6 +131,13 @@ interface PendingAsk {
     readonly doubtKinds?: readonly string[];
 }
 export interface PermGateRuntimeOptions extends PermGateConfig {
+    /**
+     * Live read of the root `defaultAction`. The host hands `.volatile()` fields to
+     * `apply` as refs, so the value spread into these options may be a ref object —
+     * read through this hook at (re)compile time instead, and let
+     * `coerceRuleAction` refuse anything that is not a literal action (issue #6).
+     */
+    readonly readDefaultAction?: () => unknown;
     /** Workspace root for chain resolution. Defaults to process.cwd(). */
     readonly cwd?: string;
     readonly onRulesChanged?: (ruleset: CompiledRuleset) => void;
@@ -177,8 +184,13 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
      * Defaults to on (`config.scriptReview`).
      */
     readonly readScriptReview?: () => boolean;
-    /** Optional live source of the llmAssist classifier setup. */
+    /** Optional live source of the llmAssist receiver setup (endpoint/model/secret/timeout). */
     readonly readClassifyConfig?: () => ClassifierConfig;
+    /**
+     * Optional live source of the host-review reasoning effort. Undefined/empty
+     * omits the field entirely — see {@link hostEffort} (issue #8).
+     */
+    readonly readClassifyEffort?: () => string | undefined;
     /**
      * Optional live receiver source: `'custom'` (an OpenAI-compatible endpoint,
      * default) or `'host'` (the DSH host `llm` service — the model-group setup
@@ -389,6 +401,14 @@ export declare class PermGateRuntime {
     private readonly cleared;
     constructor(options?: PermGateRuntimeOptions);
     private compileInline;
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    private effectiveDefaultAction;
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload(): boolean;
     get auditEntries(): readonly AuditEntry[];
@@ -462,6 +482,12 @@ export declare class PermGateRuntime {
     private liveClassifySource;
     /** The host model-group selection, or undefined when unusable. */
     private hostModel;
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    private hostEffort;
     private livePermissive;
     /** Whether YOLO mode is live (never human-confirm). */
     isYolo(): boolean;

package/lib/runtime.js

@@ -28,7 +28,7 @@ import { redactCommandText } from './redact.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
 import { chatCompletion } from './classifier.js';
-import { compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
+import { coerceRuleAction, compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
 import { decomposeShellCommand } from './shell.js';
 import { extractAgentCandidates } from './agent-identity.js';
 import { resolveRuleChain } from './rule-chain.js';
@@ -289,10 +289,17 @@ export class PermGateRuntime {
     }
     compileInline(options) {
         const empty = {
-            defaultAction: options.defaultAction ?? 'ask',
+            defaultAction: this.effectiveDefaultAction(options),
             deny: [], allow: [], ask: [],
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         };
+        // Every other path yields a ruleset whose default came from a document; a
+        // document is validated, but the action is still coerced so one bad source
+        // can never hand the runtime an action it has no branch for.
+        const settle = (rs) => {
+            const action = coerceRuleAction(rs.defaultAction);
+            return action === rs.defaultAction ? rs : { ...rs, defaultAction: action };
+        };
         // Settings-first (dual-source): a configured `dsh-perm-gate-rules`
         // namespace overrides every file path — the gate then loads with zero
         // filesystem dependency. Bare defaults (nothing configured) fall through
@@ -303,20 +310,20 @@ export class PermGateRuntime {
             const hash = documentHash(JSON.stringify(settingsDoc));
             const hit = this.cache.get(hash);
             if (hit !== undefined)
-                return hit;
+                return settle(hit);
             const compiled = compileRulesObject(settingsDoc, {
                 maxGlobStars: 2,
                 caseInsensitivePaths: options.caseInsensitivePaths ?? true,
             });
             this.cache.set(hash, compiled);
-            return compiled;
+            return settle(compiled);
         }
         // Chain mode: when searchUp is enabled, use the multi-file chain resolver.
         if (options.searchUp === true) {
             const cwd = options.cwd ?? process.cwd();
             const rulesFile = options.rulesFile !== undefined ? options.rulesFile : 'rules.yml';
             try {
-                return resolveRuleChain(cwd, {
+                return settle(resolveRuleChain(cwd, {
                     rulesFile,
                     searchUp: true,
                     fallbackPath: options.fallbackPath,
@@ -325,7 +332,7 @@ export class PermGateRuntime {
                 }, {
                     maxGlobStars: 2,
                     caseInsensitivePaths: options.caseInsensitivePaths ?? true,
-                });
+                }));
             }
             catch {
                 return empty;
@@ -338,14 +345,27 @@ export class PermGateRuntime {
         const hash = documentHash(text);
         const hit = this.cache.get(hash);
         if (hit !== undefined)
-            return hit;
+            return settle(hit);
         const doc = parsePermissionsDocument(text);
         const compiled = compileDocument(doc, {
             maxGlobStars: 2,
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         });
         this.cache.set(hash, compiled);
-        return compiled;
+        return settle(compiled);
+    }
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    effectiveDefaultAction(options) {
+        const raw = options.readDefaultAction !== undefined
+            ? options.readDefaultAction()
+            : options.defaultAction;
+        return coerceRuleAction(raw);
     }
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload() {
@@ -659,6 +679,15 @@ export class PermGateRuntime {
         const sel = this.options.readHostModel?.();
         return sel !== undefined && sel.provider !== '' && sel.model !== '' ? sel : undefined;
     }
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    hostEffort() {
+        const effort = this.options.readClassifyEffort?.();
+        return typeof effort === 'string' && effort !== '' ? effort : undefined;
+    }
     livePermissive() {
         return this.options.readPermissive !== undefined
             ? this.options.readPermissive()
@@ -1422,7 +1451,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -1624,7 +1653,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -2010,7 +2039,7 @@ export class PermGateRuntime {
                 if (this.options.hostLlm === undefined)
                     return done(false, 'host llm service unavailable');
                 const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000);
+                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() });
                 return r.ok ? done(true, `${selection.provider}/${selection.model} → ${r.content.trim().slice(0, 60) || 'ok'}`) : done(false, r.error ?? 'host llm call failed');
             }
             if (cfg?.endpoint === undefined || cfg.endpoint === '' || cfg?.model === undefined || cfg.model === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.4.2",
+  "version": "5.4.3",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"