dsh-tool-policy

Configuration

defaultDecision: deny # deny (default), ask, or allow
rules:
  # First matching rule wins.
  - tool: 'bash'
    decision: deny
    reason: 'Destructive shell commands are disabled.'
    argument:
      path: /command
      contains: 'rm -rf'

  - tool: 'record.update'
    decision: deny
    reason: 'System records are immutable.'
    argument:
      path: /scope
      equals: system

  - tool: 'safe_*'
    decision: allow

  - tool: '*'
    decision: ask
    reason: 'Unlisted tools require approval.'

tool is an anchored name pattern with one wildcard, *. Other regular-expression metacharacters are treated literally. argument.path is an RFC 6901 JSON Pointer into parsed tool arguments. A condition uses exactly one of equals (JSON scalar equality) or contains (non-empty substring on a string). Rule order is explicit and deterministic.

Decision semantics:

• deny returns a normal Harness tool error before the body runs;
• ask returns { kind: 'ask' } and lets ctx.approval decide; without an approval channel Harness fails closed;
• allow calls next() and therefore does not override a prior or later policy listener;
• defaultDecision applies only when no rule matches.

Reasons never interpolate the call arguments. This avoids copying secrets or large payloads into model-visible approval feedback.