dsh-perm-gate 5.4.3 → 5.4.4

package/lib/config.d.ts

@@ -94,6 +94,11 @@ export interface PermGateConfig {
      * the model never answered instead of letting the tier quietly become a different one.
      */
     readonly yolo?: boolean;
+    /**
+     * YOLO only: relax the "target unpinnable" opaque signal. Never relaxes invisible
+     * content, deletes, remote writes, P0, credentials or irreversible acts. Default false.
+     */
+    readonly yoloWorkspaceExempt?: boolean;
     /**
      * `safenet-pass` — the switch behind the `permissive-mech` tier: the deterministic
      * mechanical screen plus the preset opinions take over the ask. Named danger is blocked
@@ -512,6 +517,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
     yolo: z<boolean, boolean, "defined">;
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: z<boolean, boolean, "defined">;
     rulesFallback: z<boolean, boolean, "defined">;
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -598,6 +610,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
     yolo: z<boolean, boolean, "defined">;
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: z<boolean, boolean, "defined">;
     rulesFallback: z<boolean, boolean, "defined">;
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -666,7 +685,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierEffort", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierEffort", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "yoloWorkspaceExempt", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -195,6 +195,13 @@ export const Config = z.object({
     grantMaxUses: vol(z.number().min(1).default(1)),
     permissive: vol(z.boolean().default(false)),
     yolo: vol(z.boolean().default(false)),
+    /**
+     * YOLO only: stop treating "the target could not be pinned down" as a danger signal
+     * (no-argument tool calls, a script outside the workspace whose body was not read).
+     * Invisible *content* — encoded payloads, unreadable bodies, prose — is still blocked,
+     * and delete/remote-write never qualify. Default false keeps the 5.4.3 behaviour.
+     */
+    yoloWorkspaceExempt: vol(z.boolean().default(false)),
     rulesFallback: vol(z.boolean().default(false)),
     /**
      * Retired (2026-10-17): the per-preset mode table that briefly mapped
@@ -267,7 +274,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierEffort', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
+    'permissive', 'yolo', 'yoloWorkspaceExempt', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/index.js

@@ -564,6 +564,9 @@ export function apply(ctx, config = {}) {
         // call. It is the switch behind the `permissive-yolo` tier only — never a flow added to
         // sessions that did not select it.
         readYolo: () => current().yolo ?? false,
+        // YOLO-only narrowing: stop treating "the target could not be pinned down" as danger.
+        // Invisible content, deletes, remote writes and every deterministic floor stay armed.
+        readYoloWorkspaceExempt: () => current().yoloWorkspaceExempt === true,
         // The two `safenet` switches, read live: each controls whether one implementation
         // exists, and each implementation owns one preset, so presets never cross.
         readSafenetPass: () => current().safenetPass ?? true,

package/lib/runtime.d.ts

@@ -151,6 +151,12 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
     readonly readPermissive?: () => PermissiveState;
     /** Optional live source of the YOLO tier switch (never human-confirm; block-on-danger). */
     readonly readYolo?: () => boolean;
+    /**
+     * Optional live source of the YOLO workspace exemption: stop treating "the target could
+     * not be pinned down" as a danger signal. Only `permissive-yolo` reads it, and only a
+     * *location*-kind opacity qualifies — invisible content, deletes and remote writes never do.
+     */
+    readonly readYoloWorkspaceExempt?: () => boolean;
     /**
      * Optional live source of the degraded-review switch: with no reviewer able to grade
      * an ask, decide on the deterministic nets instead of parking it on a human.
@@ -491,6 +497,18 @@ export declare class PermGateRuntime {
     private livePermissive;
     /** Whether YOLO mode is live (never human-confirm). */
     isYolo(): boolean;
+    /**
+     * Whether the YOLO tier should stop blocking on "target unpinnable" alone.
+     * Default false: 5.4.3 behaviour, one switch away.
+     */
+    private liveYoloWorkspaceExempt;
+    /**
+     * The one narrowing the exemption is allowed to make: the call is ordinary and visible,
+     * only its *location* was unpinnable, and everything it names is inside the workspace.
+     * Delete, remote write, invisible content, P0/irreversible and unlearnable acts are all
+     * refused here — this method can only *skip* the opaque signal, never clear a danger.
+     */
+    private yoloExemptsLocation;
     /** Whether degraded review is live (no reviewer ⇒ rule-only gate). */
     isRulesFallback(): boolean;
     /** Whether script-body review is live (default on). */

package/lib/runtime.js

@@ -24,6 +24,7 @@ import { ArtifactRegistry } from './path.js';
 import { classifyRisk, classifyRiskWith, graderNote, RISK_SYSTEM_PROMPT_VERSION } from './risk.js';
 import { askDoubtKinds, buildAskContext, humanBrief, humanCardLine, humanCommand, toEventFields, toGraderPayload } from './ask-context.js';
 import { readScriptContents, scriptRefs, scriptsFullyCovered } from './script-review.js';
+import { pathsRealInsideWorkspace } from './workspace-bound.js';
 import { redactCommandText } from './redact.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
@@ -697,6 +698,34 @@ export class PermGateRuntime {
     isYolo() {
         return this.options.readYolo !== undefined ? this.options.readYolo() : (this.options.yolo ?? false);
     }
+    /**
+     * Whether the YOLO tier should stop blocking on "target unpinnable" alone.
+     * Default false: 5.4.3 behaviour, one switch away.
+     */
+    liveYoloWorkspaceExempt() {
+        return this.options.readYoloWorkspaceExempt !== undefined
+            ? this.options.readYoloWorkspaceExempt()
+            : (this.options.yoloWorkspaceExempt ?? false);
+    }
+    /**
+     * The one narrowing the exemption is allowed to make: the call is ordinary and visible,
+     * only its *location* was unpinnable, and everything it names is inside the workspace.
+     * Delete, remote write, invisible content, P0/irreversible and unlearnable acts are all
+     * refused here — this method can only *skip* the opaque signal, never clear a danger.
+     */
+    yoloExemptsLocation(ctx) {
+        return this.liveYoloWorkspaceExempt()
+            && ctx.opaqueKind === 'location'
+            && ctx.targetKind !== 'delete'
+            && ctx.targetKind !== 'remote-write'
+            && !ctx.irreversible
+            && !ctx.unlearnable
+            && ctx.workspaceBound === true
+            // `workspaceBound` is lexical (the shared module cannot touch the filesystem); the
+            // relaxation also has to survive link resolution, so a link inside the workspace
+            // that points outside is still refused here.
+            && pathsRealInsideWorkspace(ctx.workspaceRoot, ctx.files ?? []);
+    }
     /** Whether degraded review is live (no reviewer ⇒ rule-only gate). */
     isRulesFallback() {
         return this.options.readRulesFallback !== undefined
@@ -1569,7 +1598,11 @@ export class PermGateRuntime {
     async resolveYolo(exec, decision) {
         const callId = randomId();
         const askCtx = this.unattendedContextFor(exec, decision);
-        const judged = this.mechanicalJudge(askCtx);
+        // The workspace exemption narrows exactly one signal: "the target could not be pinned
+        // down". It is decided before the screen so an exempted call reaches the reviewer (or
+        // the mechanical conclusion) as an ordinary one; every other danger signal still fires.
+        const exempt = this.yoloExemptsLocation(askCtx);
+        const judged = exempt ? null : this.mechanicalJudge(askCtx);
         let riskCategory;
         // Whether the reviewer actually spoke. YOLO advertises "the model answers in the
         // person's place"; when there is no grader, or it gave up, the tier still refuses to ask
@@ -1594,11 +1627,15 @@ export class PermGateRuntime {
         }
         const danger = judged !== null || riskCategory !== undefined;
         if (!danger) {
-            const reason = reviewerAnswered
+            const exemptTag = exempt ? ' [exempt:opaque-location]' : '';
+            const reason = (reviewerAnswered
                 ? `yolo: allow (no danger signal) — ${decision.reason}`
-                : `yolo: allow (no reviewer answered; mechanical screen found nothing) — ${decision.reason}`;
+                : `yolo: allow (no reviewer answered; mechanical screen found nothing) — ${decision.reason}`) + exemptTag;
+            const verdict = exempt
+                ? (reviewerAnswered ? 'yolo-allow-opaque-location-exempt' : 'yolo-allow-opaque-location-exempt-no-reviewer')
+                : (reviewerAnswered ? 'yolo-allow' : 'yolo-allow-no-reviewer');
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
-            this.recordEvent(exec, 'auto', reason, { verdict: reviewerAnswered ? 'yolo-allow' : 'yolo-allow-no-reviewer', risk: 'safe' });
+            this.recordEvent(exec, 'auto', reason, { verdict, risk: 'safe' });
             this.untrackAsk(exec);
             return undefined;
         }

package/lib/workspace-bound.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Whether every named path resolves inside `root`, after following links.
+ *
+ * An empty list is `true` (the call named nothing), a missing root is `false`, and any
+ * path that cannot be resolved is `false`.
+ */
+export declare function pathsRealInsideWorkspace(root: string | undefined, paths: readonly string[]): boolean;

package/lib/workspace-bound.js

@@ -0,0 +1,48 @@
+/**
+ * Node-side containment check for the YOLO workspace exemption.
+ *
+ * `ask-context.ts` stays dependency-free (the browser half imports its types), so its
+ * `workspaceBound` is a **lexical** prefix test. That is the right answer for the fact
+ * layer but not sufficient to *relax* a safety screen: a link inside the workspace can
+ * point anywhere. This module resolves the paths the call actually names and answers the
+ * same question through the filesystem, and it is deliberately pessimistic — a path that
+ * cannot be resolved (missing, unreadable, permission denied) answers `false`, because
+ * "I could not prove it stays inside" must never read as "it stays inside".
+ *
+ * Node half only: never imported by the client bundle.
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve, sep } from 'node:path';
+/** Windows paths are case-insensitive; the other supported lines are not. */
+function fold(path) {
+    return process.platform === 'win32' ? path.toLowerCase() : path;
+}
+/**
+ * Whether every named path resolves inside `root`, after following links.
+ *
+ * An empty list is `true` (the call named nothing), a missing root is `false`, and any
+ * path that cannot be resolved is `false`.
+ */
+export function pathsRealInsideWorkspace(root, paths) {
+    if (root === undefined || root === '')
+        return false;
+    if (paths.length === 0)
+        return true;
+    let realRoot;
+    try {
+        realRoot = fold(realpathSync.native(root));
+    }
+    catch {
+        return false;
+    }
+    return paths.every((candidate) => {
+        try {
+            const absolute = isAbsolute(candidate) ? candidate : resolve(root, candidate);
+            const real = fold(realpathSync.native(absolute));
+            return real === realRoot || real.startsWith(`${realRoot}${sep}`);
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.4.3",
+  "version": "5.4.4",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"