dsh-perm-gate 5.4.2 → 5.4.4

package/lib/config.d.ts

@@ -22,6 +22,8 @@ export declare function dataDirReady(dataDir: string): boolean;
  * applies `defaultAction`), so the fallback never fails the plugin load.
  */
 export declare function resolveRulesFile(configured: string | undefined, dataDir: string): string;
+/** Reasoning effort the host reviewer may request; empty = let the host decide. */
+export type ClassifierEffort = '' | 'off' | 'low' | 'medium' | 'high';
 export interface PermGateConfig {
     /** Absolute or `./`-relative path to the YAML permissions document. */
     readonly rulesFile?: string;
@@ -34,7 +36,19 @@ export interface PermGateConfig {
     /** Enable the optional LLM semantic classifier (P3). Default false. */
     readonly classifierEnabled?: boolean;
     readonly classifierEndpoint?: string;
+    /**
+     * Model id for the llmAssist receiver. Unset in host mode means **inherit the
+     * host model-group selection** — an inherited default here (the old
+     * `deepseek-chat`) pinned the reviewer to an unrelated model while the provider
+     * followed the host (issue #8). Custom-endpoint mode still falls back to
+     * `deepseek-chat` at request time.
+     */
     readonly classifierModel?: string;
+    /**
+     * Reasoning effort for host reviews (`off` | `low` | `medium` | `high`).
+     * Empty omits the field so the host model configuration decides (issue #8).
+     */
+    readonly classifierEffort?: ClassifierEffort;
     readonly classifierApiKey?: string;
     /** Abort the llmAssist risk call after this many milliseconds. Default 20000. */
     readonly riskTimeoutMs?: number;
@@ -80,6 +94,11 @@ export interface PermGateConfig {
      * the model never answered instead of letting the tier quietly become a different one.
      */
     readonly yolo?: boolean;
+    /**
+     * YOLO only: relax the "target unpinnable" opaque signal. Never relaxes invisible
+     * content, deletes, remote writes, P0, credentials or irreversible acts. Default false.
+     */
+    readonly yoloWorkspaceExempt?: boolean;
     /**
      * `safenet-pass` — the switch behind the `permissive-mech` tier: the deterministic
      * mechanical screen plus the preset opinions take over the ask. Named danger is blocked
@@ -483,7 +502,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -497,6 +517,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
     yolo: z<boolean, boolean, "defined">;
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: z<boolean, boolean, "defined">;
     rulesFallback: z<boolean, boolean, "defined">;
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -557,7 +584,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -568,7 +595,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -582,6 +610,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
     yolo: z<boolean, boolean, "defined">;
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: z<boolean, boolean, "defined">;
     rulesFallback: z<boolean, boolean, "defined">;
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -642,7 +677,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -650,12 +685,12 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierEffort", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "yoloWorkspaceExempt", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */
 export declare function resolveVolatileConfig(config: object): Record<string, unknown>;
-export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
+export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierEffort' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
     readonly permissiveStrategies: PermissiveStrategies;
     readonly gatePresets: readonly string[];
 };

package/lib/config.js

@@ -180,7 +180,8 @@ export const Config = z.object({
     caseInsensitivePaths: vol(z.boolean().default(true)),
     classifierEnabled: vol(z.boolean().default(false)),
     classifierEndpoint: vol(z.string()),
-    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierModel: vol(z.string()),
+    classifierEffort: vol(z.union(['', 'off', 'low', 'medium', 'high']).default('')),
     classifierApiKey: vol(z.string()),
     riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
     riskLearning: vol(z.boolean().default(true)),
@@ -194,6 +195,13 @@ export const Config = z.object({
     grantMaxUses: vol(z.number().min(1).default(1)),
     permissive: vol(z.boolean().default(false)),
     yolo: vol(z.boolean().default(false)),
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: vol(z.boolean().default(false)),
     rulesFallback: vol(z.boolean().default(false)),
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -264,9 +272,9 @@ export const Config = z.object({
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
 export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
-    'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
+    'classifierModel', 'classifierEffort', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
+    'permissive', 'yolo', 'yoloWorkspaceExempt', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',
@@ -303,7 +311,9 @@ export function resolveConfig(config = {}) {
         caseInsensitivePaths: parsed.caseInsensitivePaths ?? true,
         classifierEnabled: parsed.classifierEnabled ?? false,
         classifierEndpoint: parsed.classifierEndpoint,
-        classifierModel: parsed.classifierModel ?? 'deepseek-chat',
+        // Not defaulted on purpose: unset means "inherit the host model" (issue #8).
+        classifierModel: parsed.classifierModel,
+        classifierEffort: parsed.classifierEffort ?? '',
         classifierApiKey: parsed.classifierApiKey,
         riskTimeoutMs: parsed.riskTimeoutMs ?? 20_000,
         riskLearning: parsed.riskLearning ?? false,

package/lib/events.js

@@ -822,7 +822,14 @@ export function registerHealthRoute(server, provider) {
                 json(res, 405, { ok: false, error: 'method not allowed' });
                 return;
             }
-            provider.check().then((result) => json(res, 200, { ...result, ok: true }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
+            provider.check().then(
+            // The check's own `ok` decides the answer. Spelling `ok: true` after the
+            // spread overwrote a resolved `{ ok: false }` and reported a dead review
+            // connection as healthy (issue #8).
+            (result) => json(res, 200, {
+                ...result,
+                ok: result?.ok === true,
+            }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
         },
     });
 }

package/lib/host-llm.d.ts

@@ -47,12 +47,29 @@ export interface HostModelSelection {
 }
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export declare const DEFAULT_HOST_MODEL: HostModelSelection;
+/** Optional knobs for one host completion. */
+export interface HostCallOptions {
+    /**
+     * Reasoning effort to request. Empty/undefined **omits** the field entirely so
+     * the host's own model configuration decides — a hardcoded value is rejected by
+     * host validation when the selected model does not advertise it (issue #8).
+     */
+    readonly effort?: string;
+    readonly maxTokens?: number;
+}
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number): Promise<{
+export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number, opts?: HostCallOptions): Promise<{
     ok: true;
     content: string;
 } | {

package/lib/host-llm.js

@@ -10,35 +10,58 @@
  */
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export const DEFAULT_HOST_MODEL = { provider: 'deepseek-official', model: 'deepseek-v4-flash' };
+/**
+ * Finish kinds that mean "what you got is not the whole answer". Graded as a
+ * failure: a truncated or filtered stream is not a verdict (issue #7).
+ */
+const TRUNCATED_FINISH_KINDS = new Set([
+    'max-tokens', 'max_tokens', 'length', 'truncated', 'content-filter', 'content_filter',
+]);
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export async function completeViaHost(hostLlm, selection, system, user, timeoutMs) {
+export async function completeViaHost(hostLlm, selection, system, user, timeoutMs, opts = {}) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
         let text = '';
+        let finishKind;
+        const effort = typeof opts.effort === 'string' && opts.effort !== '' ? opts.effort : undefined;
         const stream = hostLlm.stream({
             provider: selection.provider,
             model: selection.model,
             messages: [{ role: 'user', content: [{ type: 'text', text: user }] }],
             system,
             temperature: 0,
-            reasoningEffort: 'off',
-            maxTokens: 256,
+            ...(effort !== undefined ? { reasoningEffort: effort } : {}),
+            maxTokens: opts.maxTokens ?? 256,
             signal: controller.signal,
         });
         for await (const chunk of stream) {
-            if ((chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') && typeof chunk.text === 'string') {
+            if (chunk.type === 'text-delta' && typeof chunk.text === 'string') {
                 text += chunk.text;
             }
-            else if (chunk.type === 'finish' && chunk.reason !== undefined && (chunk.reason.kind === 'error' || chunk.reason.kind === 'aborted')) {
-                const failure = chunk.reason.failure?.message;
-                return { ok: false, error: failure ?? chunk.reason.kind };
+            else if (chunk.type === 'finish') {
+                const kind = chunk.reason?.kind;
+                if (kind === 'error' || kind === 'aborted') {
+                    const failure = chunk.reason?.failure?.message;
+                    return { ok: false, error: failure ?? kind };
+                }
+                finishKind = kind;
             }
         }
+        if (finishKind !== undefined && TRUNCATED_FINISH_KINDS.has(finishKind)) {
+            return { ok: false, error: `truncated answer (finish: ${finishKind})` };
+        }
         if (text.trim() === '')
             return { ok: false, error: 'empty answer' };
         return { ok: true, content: text };

package/lib/index.js

@@ -510,7 +510,15 @@ export function apply(ctx, config = {}) {
     // channel in buildSessionSender.
     let approvalService;
     const runtime = new PermGateRuntime({
-        ...config,
+        // The host hands `.volatile()` fields to apply() as **live refs**. Resolve
+        // them once before spreading, or a ref object becomes a static option — the
+        // ruleset default among them, where no deny/ask branch matches it and every
+        // unmatched call was allowed unreviewed (issue #6). Anything that must stay
+        // live is read through its own `read*` hook below.
+        ...resolveVolatileConfig(config),
+        // Read live *and* validated: `coerceRuleAction` refuses a non-literal value
+        // instead of letting it fall through the runtime's action branches.
+        readDefaultAction: () => current().defaultAction,
         hostLlm,
         // Raise a network approval through the DSH approval seam. The service
         // applies the session policy, routes the prompt to the agent, and appends
@@ -556,6 +564,9 @@ export function apply(ctx, config = {}) {
         // call. It is the switch behind the `permissive-yolo` tier only — never a flow added to
         // sessions that did not select it.
         readYolo: () => current().yolo ?? false,
+        // YOLO-only narrowing: stop treating "the target could not be pinned down" as danger.
+        // Invisible content, deletes, remote writes and every deterministic floor stay armed.
+        readYoloWorkspaceExempt: () => current().yoloWorkspaceExempt === true,
         // The two `safenet` switches, read live: each controls whether one implementation
         // exists, and each implementation owns one preset, so presets never cross.
         readSafenetPass: () => current().safenetPass ?? true,
@@ -582,13 +593,26 @@ export function apply(ctx, config = {}) {
         // same namespace, so editing the settings card applies to the next tool call.
         readClassifyConfig: () => {
             const c = current();
+            const source = c.classifierSource === 'host' ? 'host' : 'custom';
             return {
                 endpoint: c.classifierEndpoint,
-                model: c.classifierModel,
+                // Host mode: an unset model means "inherit the host selection" — the old
+                // schema default (`deepseek-chat`) came back on every clear and was then
+                // treated as an explicit override, so provider and model diverged (issue
+                // #8). Custom-endpoint mode keeps the historical default.
+                model: typeof c.classifierModel === 'string' && c.classifierModel !== ''
+                    ? c.classifierModel
+                    : source === 'custom' ? 'deepseek-chat' : undefined,
                 apiKey: c.classifierApiKey,
                 timeoutMs: c.riskTimeoutMs ?? 20_000,
             };
         },
+        // Host reviews: an empty effort sends no `reasoningEffort` at all, so the host
+        // model configuration decides instead of a value it may reject (issue #8).
+        readClassifyEffort: () => {
+            const effort = current().classifierEffort;
+            return typeof effort === 'string' && effort !== '' ? effort : undefined;
+        },
         // Read the verdict-learning switch and threshold live.
         readRiskLearning: () => {
             const c = current();
@@ -751,6 +775,9 @@ export function apply(ctx, config = {}) {
     // The host no longer seeds settings (there is no write path): an empty
     // `allowlist` keeps the rules-file default via `runtime.allowlist()`.
     let lastRulesDocKey;
+    // Root compile-time inputs (default action, path case-fold). Seeded on the first
+    // pass so a startup value is not mistaken for an edit.
+    let lastStaticKey;
     function applyVolatileUpdate() {
         const next = asSurface(current());
         if (next !== undefined) {
@@ -779,6 +806,17 @@ export function apply(ctx, config = {}) {
             if (changed)
                 runtime.reload();
         }
+        // The root `defaultAction` (and the path case-fold) are compile-time inputs of
+        // the ruleset. Without this the settings switch persisted but never reached the
+        // live ruleset — "default value changes also miss invalidation" (issue #6).
+        const staticKey = `${String(current().defaultAction)}\u0000${String(current().caseInsensitivePaths)}`;
+        if (lastStaticKey === undefined) {
+            lastStaticKey = staticKey;
+        }
+        else if (lastStaticKey !== staticKey) {
+            lastStaticKey = staticKey;
+            runtime.reload();
+        }
     }
     ;
     ctx.on('loader/volatile-update', () => {

package/lib/risk.js

@@ -135,13 +135,11 @@ export function parseRiskVerdict(content) {
         return undefined;
     }
     catch {
-        // Lenient fallback for models that ignore response_format: bare keyword scan.
-        // A bare "risky" carries no trustworthy category, so it stays unresolved —
-        // the caller keeps the human ask rather than guessing a category.
-        if (/\brisky\b/i.test(trimmed))
-            return undefined;
-        if (/\bsafe\b/i.test(trimmed))
-            return { kind: 'safe' };
+        // No lenient keyword scan. A bare `safe` used to be accepted from prose such
+        // as "not safe" or from a half-written JSON object, which is exactly how a
+        // truncated stream could be read as an all-clear (issue #7). Anything that is
+        // not the protocol object is `undefined` — the caller keeps the human ask
+        // and learns nothing.
         return undefined;
     }
 }

package/lib/rule.d.ts

@@ -86,6 +86,17 @@ export interface CompileOptions {
     readonly maxGlobStars?: number;
     readonly caseInsensitivePaths?: boolean;
 }
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export declare function coerceRuleAction(value: unknown, fallback?: RuleAction): RuleAction;
 export declare class RuleError extends Error {
     constructor(message: string);
 }

package/lib/rule.js

@@ -12,6 +12,19 @@ import { parse } from 'yaml';
 import { compileGlob, compileBranchPattern, hashText } from './compiler.js';
 import { parseParamsDimension, parseAbsentDimension, parseAgentsDimension, parseWhenDimension, parseArgvDimension, parseNetworkDimension, parseBranchDimension, } from './rule-dims.js';
 const VALID_ACTIONS = ['allow', 'ask', 'deny'];
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export function coerceRuleAction(value, fallback = 'ask') {
+    return VALID_ACTIONS.includes(value) ? value : fallback;
+}
 const PATH_CANDIDATE_KEYS = [
     'path', 'paths', 'file', 'files', 'file_path', 'dir', 'directory', 'directories',
     'cwd', 'workspace', 'root', 'target', 'targets', 'output',

package/lib/runtime.d.ts

@@ -131,6 +131,13 @@ interface PendingAsk {
     readonly doubtKinds?: readonly string[];
 }
 export interface PermGateRuntimeOptions extends PermGateConfig {
+    /**
+     * Live read of the root `defaultAction`. The host hands `.volatile()` fields to
+     * `apply` as refs, so the value spread into these options may be a ref object —
+     * read through this hook at (re)compile time instead, and let
+     * `coerceRuleAction` refuse anything that is not a literal action (issue #6).
+     */
+    readonly readDefaultAction?: () => unknown;
     /** Workspace root for chain resolution. Defaults to process.cwd(). */
     readonly cwd?: string;
     readonly onRulesChanged?: (ruleset: CompiledRuleset) => void;
@@ -144,6 +151,12 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
     readonly readPermissive?: () => PermissiveState;
     /** Optional live source of the YOLO tier switch (never human-confirm; block-on-danger). */
     readonly readYolo?: () => boolean;
+    /**
+     * Optional live source of the YOLO workspace exemption: stop treating "the target could
+     * not be pinned down" as a danger signal. Only `permissive-yolo` reads it, and only a
+     * *location*-kind opacity qualifies — invisible content, deletes and remote writes never do.
+     */
+    readonly readYoloWorkspaceExempt?: () => boolean;
     /**
      * Optional live source of the degraded-review switch: with no reviewer able to grade
      * an ask, decide on the deterministic nets instead of parking it on a human.
@@ -177,8 +190,13 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
      * Defaults to on (`config.scriptReview`).
      */
     readonly readScriptReview?: () => boolean;
-    /** Optional live source of the llmAssist classifier setup. */
+    /** Optional live source of the llmAssist receiver setup (endpoint/model/secret/timeout). */
     readonly readClassifyConfig?: () => ClassifierConfig;
+    /**
+     * Optional live source of the host-review reasoning effort. Undefined/empty
+     * omits the field entirely — see {@link hostEffort} (issue #8).
+     */
+    readonly readClassifyEffort?: () => string | undefined;
     /**
      * Optional live receiver source: `'custom'` (an OpenAI-compatible endpoint,
      * default) or `'host'` (the DSH host `llm` service — the model-group setup
@@ -389,6 +407,14 @@ export declare class PermGateRuntime {
     private readonly cleared;
     constructor(options?: PermGateRuntimeOptions);
     private compileInline;
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    private effectiveDefaultAction;
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload(): boolean;
     get auditEntries(): readonly AuditEntry[];
@@ -462,9 +488,27 @@ export declare class PermGateRuntime {
     private liveClassifySource;
     /** The host model-group selection, or undefined when unusable. */
     private hostModel;
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    private hostEffort;
     private livePermissive;
     /** Whether YOLO mode is live (never human-confirm). */
     isYolo(): boolean;
+    /**
+     * Whether the YOLO tier should stop blocking on "target unpinnable" alone.
+     * Default false: 5.4.3 behaviour, one switch away.
+     */
+    private liveYoloWorkspaceExempt;
+    /**
+     * The one narrowing the exemption is allowed to make: the call is ordinary and visible,
+     * only its *location* was unpinnable, and everything it names is inside the workspace.
+     * Delete, remote write, invisible content, P0/irreversible and unlearnable acts are all
+     * refused here — this method can only *skip* the opaque signal, never clear a danger.
+     */
+    private yoloExemptsLocation;
     /** Whether degraded review is live (no reviewer ⇒ rule-only gate). */
     isRulesFallback(): boolean;
     /** Whether script-body review is live (default on). */