opencode-shell-safety 0.2.3 → 0.4.0

package/README.md

@@ -78,6 +78,7 @@ Get an API key from [TypeSafe AI](https://docs.typesafe.ai/introduction/quicksta
 | `cache.capacity`                 | Maximum number of cached classification results.                                                       |
 | `cache.ttlMs`                    | Successful classification cache lifetime in milliseconds.                                              |
 | `agents.<name>.enabled`          | Enables classification for an agent.                                                                   |
+| `agents.<name>.fallback`         | Optional. Effect applied when classification rejects the command or the request fails: `ask` or `deny`. Defaults to `deny`. |
 | `agents.<name>.thresholds`       | Optional per-agent probability thresholds.                                                             |
 | `agents.<name>.http`             | Optional. Omission permits no HTTP methods or credential hosts.                                        |
 | `agents.<name>.http.methods`     | HTTP methods the policy permits.                                                                       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-shell-safety",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "OpenCode plugin that classifies shell permission requests against agent policy.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -33,6 +33,8 @@ const ThresholdsSchema = Schema.Struct({
   violationProbability: Probability,
 })
 
+const FallbackEffectSchema = Schema.Literals(["ask", "deny"])
+
 const HttpPolicySchema = Schema.Struct({
   methods: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
   credentials: Schema.Record(Schema.String, Schema.Array(Schema.String))
@@ -41,6 +43,7 @@ const HttpPolicySchema = Schema.Struct({
 
 const AgentPolicySchema = Schema.Struct({
   enabled: Schema.Boolean,
+  fallback: Schema.optionalKey(FallbackEffectSchema),
   thresholds: Schema.optionalKey(ThresholdsSchema),
   http: HttpPolicySchema.pipe(Schema.withDecodingDefaultKey(Effect.succeed({ methods: [], credentials: {} }))),
 })
@@ -75,6 +78,7 @@ export const OptionsSchema = Schema.Struct({
 
 export type Options = typeof OptionsSchema.Type
 export type AgentPolicy = typeof AgentPolicySchema.Type
+export type FallbackEffect = typeof FallbackEffectSchema.Type
 export type Thresholds = typeof ThresholdsSchema.Type
 
 const NoulAnswerSchema = Schema.Struct({
@@ -161,10 +165,12 @@ export const resolveAgentDefinition = (agent: Agent.Info): ResolvedAgentDefiniti
     .map((rule) => ({ resource: rule.resource, effect: rule.effect })),
 })
 
+export type ClassificationVerdict = "allow" | "deny"
+
 export const permissionFromAssessment = (
   assessment: SafetyAssessment,
   thresholds: Thresholds,
-): PermissionEffect => {
+): ClassificationVerdict => {
   const hasViolation =
     assessment.filesystemViolation.noul >= thresholds.violationProbability ||
     assessment.remoteMutation.noul >= thresholds.violationProbability ||
@@ -172,6 +178,8 @@ export const permissionFromAssessment = (
   return assessment.withinPolicy.noul >= thresholds.allowProbability && !hasViolation ? "allow" : "deny"
 }
 
+export const fallbackEffect = (fallback: FallbackEffect | undefined): PermissionEffect => fallback ?? "deny"
+
 const noulQuestion = (instructions: string, yes: string, no: string): NoulQuestion => ({
   type: "noul",
   instructions,
@@ -221,7 +229,6 @@ export const buildRequest = (
         |
         |Rules:
         |- Decide whether "shellCommand" complies with those instructions and with "state.policy".
-        |- OpenCode invokes this classifier only after permission resolution returns "ask".
         |- An "ask" rule means this classifier must decide from the command's actual effects; it is not a violation.
         |- Shell deny rules remain final.
         |- Apply ordered permission rules with the last matching rule winning.
@@ -387,16 +394,17 @@ const findPolicy = (options: Options, agent: string): AgentPolicy | undefined =>
 const hasShellControlSyntax = (resources: ReadonlyArray<string>): boolean =>
   resources.some((resource) => /[;&|<>`$]/.test(resource))
 
-const summary = (assessment: SafetyAssessment, effect: PermissionEffect): string => {
+const summary = (assessment: SafetyAssessment, verdict: ClassificationVerdict, effect: PermissionEffect): string => {
   const classification =
-    `Jev shell classification: ${effect} (` +
+    `Jev shell classification: ${verdict} (` +
     `withinPolicy=${assessment.withinPolicy.noul.toFixed(3)}, ` +
     `filesystemViolation=${assessment.filesystemViolation.noul.toFixed(3)}, ` +
     `remoteMutation=${assessment.remoteMutation.noul.toFixed(3)}, ` +
     `credentialViolation=${assessment.credentialViolation.noul.toFixed(3)})`
+  if (verdict === "allow") return classification
   return effect === "deny"
     ? `${classification}. Rewrite the command to comply with your system prompt and permissions, or report the limitation if no compliant form exists.`
-    : classification
+    : `${classification}. Jev rejected this command.`
 }
 
 const classificationSucceeded = (assessment: SafetyAssessment): ClassificationResult => ({ ok: true, assessment })
@@ -443,19 +451,22 @@ export const createPermissionEvaluator = (
       const policy = findPolicy(options, agent)
       if (!policy?.enabled) return Effect.void
       const classifiedEvent = { ...event, agent }
+      const fallback = fallbackEffect(policy.fallback)
 
       return Effect.gen(function* () {
-        event.effect = "deny"
         if (!projectDirectory) {
+          event.effect = fallback
           event.message = "Jev could not classify this command because the session directory is unavailable."
           return
         }
         if (!assessmentCache) {
+          event.effect = fallback
           event.message = "Jev could not classify this command because no OpenCode Zen credential is available."
           return
         }
         const agentDefinition = yield* resolveAgentDefinition(agent)
         if (!agentDefinition) {
+          event.effect = fallback
           event.message = `Jev could not classify this command because the resolved ${agent} definition is unavailable.`
           return
         }
@@ -468,12 +479,14 @@ export const createPermissionEvaluator = (
           Effect.catch((error) => Effect.succeed(classificationFailed(error))),
         )
         if (!result.ok) {
+          event.effect = fallback
           event.message = `Jev could not classify this command (${requestFailure(result.error, options)}).`
           return
         }
 
-        event.effect = permissionFromAssessment(result.assessment, policy.thresholds ?? options)
-        event.message = summary(result.assessment, event.effect)
+        const verdict = permissionFromAssessment(result.assessment, policy.thresholds ?? options)
+        event.effect = verdict === "allow" ? "allow" : fallback
+        event.message = summary(result.assessment, verdict, event.effect)
       })
     }
   })