dsh-perm-gate 5.4.2 → 5.4.4

package/lib/runtime.js

@@ -24,11 +24,12 @@ import { ArtifactRegistry } from './path.js';
 import { classifyRisk, classifyRiskWith, graderNote, RISK_SYSTEM_PROMPT_VERSION } from './risk.js';
 import { askDoubtKinds, buildAskContext, humanBrief, humanCardLine, humanCommand, toEventFields, toGraderPayload } from './ask-context.js';
 import { readScriptContents, scriptRefs, scriptsFullyCovered } from './script-review.js';
+import { pathsRealInsideWorkspace } from './workspace-bound.js';
 import { redactCommandText } from './redact.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
 import { chatCompletion } from './classifier.js';
-import { compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
+import { coerceRuleAction, compileDocument, compileRulesObject, documentHash, extractPathCandidates, parsePermissionsDocument, } from './rule.js';
 import { decomposeShellCommand } from './shell.js';
 import { extractAgentCandidates } from './agent-identity.js';
 import { resolveRuleChain } from './rule-chain.js';
@@ -289,10 +290,17 @@ export class PermGateRuntime {
     }
     compileInline(options) {
         const empty = {
-            defaultAction: options.defaultAction ?? 'ask',
+            defaultAction: this.effectiveDefaultAction(options),
             deny: [], allow: [], ask: [],
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         };
+        // Every other path yields a ruleset whose default came from a document; a
+        // document is validated, but the action is still coerced so one bad source
+        // can never hand the runtime an action it has no branch for.
+        const settle = (rs) => {
+            const action = coerceRuleAction(rs.defaultAction);
+            return action === rs.defaultAction ? rs : { ...rs, defaultAction: action };
+        };
         // Settings-first (dual-source): a configured `dsh-perm-gate-rules`
         // namespace overrides every file path — the gate then loads with zero
         // filesystem dependency. Bare defaults (nothing configured) fall through
@@ -303,20 +311,20 @@ export class PermGateRuntime {
             const hash = documentHash(JSON.stringify(settingsDoc));
             const hit = this.cache.get(hash);
             if (hit !== undefined)
-                return hit;
+                return settle(hit);
             const compiled = compileRulesObject(settingsDoc, {
                 maxGlobStars: 2,
                 caseInsensitivePaths: options.caseInsensitivePaths ?? true,
             });
             this.cache.set(hash, compiled);
-            return compiled;
+            return settle(compiled);
         }
         // Chain mode: when searchUp is enabled, use the multi-file chain resolver.
         if (options.searchUp === true) {
             const cwd = options.cwd ?? process.cwd();
             const rulesFile = options.rulesFile !== undefined ? options.rulesFile : 'rules.yml';
             try {
-                return resolveRuleChain(cwd, {
+                return settle(resolveRuleChain(cwd, {
                     rulesFile,
                     searchUp: true,
                     fallbackPath: options.fallbackPath,
@@ -325,7 +333,7 @@ export class PermGateRuntime {
                 }, {
                     maxGlobStars: 2,
                     caseInsensitivePaths: options.caseInsensitivePaths ?? true,
-                });
+                }));
             }
             catch {
                 return empty;
@@ -338,14 +346,27 @@ export class PermGateRuntime {
         const hash = documentHash(text);
         const hit = this.cache.get(hash);
         if (hit !== undefined)
-            return hit;
+            return settle(hit);
         const doc = parsePermissionsDocument(text);
         const compiled = compileDocument(doc, {
             maxGlobStars: 2,
             caseInsensitivePaths: options.caseInsensitivePaths ?? true,
         });
         this.cache.set(hash, compiled);
-        return compiled;
+        return settle(compiled);
+    }
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    effectiveDefaultAction(options) {
+        const raw = options.readDefaultAction !== undefined
+            ? options.readDefaultAction()
+            : options.defaultAction;
+        return coerceRuleAction(raw);
     }
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload() {
@@ -659,6 +680,15 @@ export class PermGateRuntime {
         const sel = this.options.readHostModel?.();
         return sel !== undefined && sel.provider !== '' && sel.model !== '' ? sel : undefined;
     }
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    hostEffort() {
+        const effort = this.options.readClassifyEffort?.();
+        return typeof effort === 'string' && effort !== '' ? effort : undefined;
+    }
     livePermissive() {
         return this.options.readPermissive !== undefined
             ? this.options.readPermissive()
@@ -668,6 +698,34 @@ export class PermGateRuntime {
     isYolo() {
         return this.options.readYolo !== undefined ? this.options.readYolo() : (this.options.yolo ?? false);
     }
+    /**
+     * Whether the YOLO tier should stop blocking on "target unpinnable" alone.
+     * Default false: 5.4.3 behaviour, one switch away.
+     */
+    liveYoloWorkspaceExempt() {
+        return this.options.readYoloWorkspaceExempt !== undefined
+            ? this.options.readYoloWorkspaceExempt()
+            : (this.options.yoloWorkspaceExempt ?? false);
+    }
+    /**
+     * The one narrowing the exemption is allowed to make: the call is ordinary and visible,
+     * only its *location* was unpinnable, and everything it names is inside the workspace.
+     * Delete, remote write, invisible content, P0/irreversible and unlearnable acts are all
+     * refused here — this method can only *skip* the opaque signal, never clear a danger.
+     */
+    yoloExemptsLocation(ctx) {
+        return this.liveYoloWorkspaceExempt()
+            && ctx.opaqueKind === 'location'
+            && ctx.targetKind !== 'delete'
+            && ctx.targetKind !== 'remote-write'
+            && !ctx.irreversible
+            && !ctx.unlearnable
+            && ctx.workspaceBound === true
+            // `workspaceBound` is lexical (the shared module cannot touch the filesystem); the
+            // relaxation also has to survive link resolution, so a link inside the workspace
+            // that points outside is still refused here.
+            && pathsRealInsideWorkspace(ctx.workspaceRoot, ctx.files ?? []);
+    }
     /** Whether degraded review is live (no reviewer ⇒ rule-only gate). */
     isRulesFallback() {
         return this.options.readRulesFallback !== undefined
@@ -1422,7 +1480,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -1540,7 +1598,11 @@ export class PermGateRuntime {
     async resolveYolo(exec, decision) {
         const callId = randomId();
         const askCtx = this.unattendedContextFor(exec, decision);
-        const judged = this.mechanicalJudge(askCtx);
+        // The workspace exemption narrows exactly one signal: "the target could not be pinned
+        // down". It is decided before the screen so an exempted call reaches the reviewer (or
+        // the mechanical conclusion) as an ordinary one; every other danger signal still fires.
+        const exempt = this.yoloExemptsLocation(askCtx);
+        const judged = exempt ? null : this.mechanicalJudge(askCtx);
         let riskCategory;
         // Whether the reviewer actually spoke. YOLO advertises "the model answers in the
         // person's place"; when there is no grader, or it gave up, the tier still refuses to ask
@@ -1565,11 +1627,15 @@ export class PermGateRuntime {
         }
         const danger = judged !== null || riskCategory !== undefined;
         if (!danger) {
-            const reason = reviewerAnswered
+            const exemptTag = exempt ? ' [exempt:opaque-location]' : '';
+            const reason = (reviewerAnswered
                 ? `yolo: allow (no danger signal) — ${decision.reason}`
-                : `yolo: allow (no reviewer answered; mechanical screen found nothing) — ${decision.reason}`;
+                : `yolo: allow (no reviewer answered; mechanical screen found nothing) — ${decision.reason}`) + exemptTag;
+            const verdict = exempt
+                ? (reviewerAnswered ? 'yolo-allow-opaque-location-exempt' : 'yolo-allow-opaque-location-exempt-no-reviewer')
+                : (reviewerAnswered ? 'yolo-allow' : 'yolo-allow-no-reviewer');
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
-            this.recordEvent(exec, 'auto', reason, { verdict: reviewerAnswered ? 'yolo-allow' : 'yolo-allow-no-reviewer', risk: 'safe' });
+            this.recordEvent(exec, 'auto', reason, { verdict, risk: 'safe' });
             this.untrackAsk(exec);
             return undefined;
         }
@@ -1624,7 +1690,7 @@ export class PermGateRuntime {
         }
         else if (useHost) {
             const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() }), req);
         }
         else {
             risk = await classifyRisk(cfg ?? {}, req);
@@ -2010,7 +2076,7 @@ export class PermGateRuntime {
                 if (this.options.hostLlm === undefined)
                     return done(false, 'host llm service unavailable');
                 const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
-                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000);
+                const r = await completeViaHost(this.options.hostLlm, selection, 'Reply with exactly: OK', 'ping', cfg?.timeoutMs ?? 20_000, { effort: this.hostEffort() });
                 return r.ok ? done(true, `${selection.provider}/${selection.model} → ${r.content.trim().slice(0, 60) || 'ok'}`) : done(false, r.error ?? 'host llm call failed');
             }
             if (cfg?.endpoint === undefined || cfg.endpoint === '' || cfg?.model === undefined || cfg.model === '') {

package/lib/workspace-bound.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Whether every named path resolves inside `root`, after following links.
+ *
+ * An empty list is `true` (the call named nothing), a missing root is `false`, and any
+ * path that cannot be resolved is `false`.
+ */
+export declare function pathsRealInsideWorkspace(root: string | undefined, paths: readonly string[]): boolean;

package/lib/workspace-bound.js

@@ -0,0 +1,48 @@
+/**
+ * Node-side containment check for the YOLO workspace exemption.
+ *
+ * `ask-context.ts` stays dependency-free (the browser half imports its types), so its
+ * `workspaceBound` is a **lexical** prefix test. That is the right answer for the fact
+ * layer but not sufficient to *relax* a safety screen: a link inside the workspace can
+ * point anywhere. This module resolves the paths the call actually names and answers the
+ * same question through the filesystem, and it is deliberately pessimistic — a path that
+ * cannot be resolved (missing, unreadable, permission denied) answers `false`, because
+ * "I could not prove it stays inside" must never read as "it stays inside".
+ *
+ * Node half only: never imported by the client bundle.
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve, sep } from 'node:path';
+/** Windows paths are case-insensitive; the other supported lines are not. */
+function fold(path) {
+    return process.platform === 'win32' ? path.toLowerCase() : path;
+}
+/**
+ * Whether every named path resolves inside `root`, after following links.
+ *
+ * An empty list is `true` (the call named nothing), a missing root is `false`, and any
+ * path that cannot be resolved is `false`.
+ */
+export function pathsRealInsideWorkspace(root, paths) {
+    if (root === undefined || root === '')
+        return false;
+    if (paths.length === 0)
+        return true;
+    let realRoot;
+    try {
+        realRoot = fold(realpathSync.native(root));
+    }
+    catch {
+        return false;
+    }
+    return paths.every((candidate) => {
+        try {
+            const absolute = isAbsolute(candidate) ? candidate : resolve(root, candidate);
+            const real = fold(realpathSync.native(absolute));
+            return real === realRoot || real.startsWith(`${realRoot}${sep}`);
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.4.2",
+  "version": "5.4.4",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"