# Security

## What this plugin protects

`@j0ss077/dsh-always-require-tools-approval` is an **approval gate**, not a sandbox. It sits in the tool-dispatch pipeline and pauses every execution whose tool name is on the watchlist, waiting for an explicit one-shot user approval before the tool body runs.

The guarantees it makes:

- **One-shot.** Each approval authorizes exactly one execution; the next call prompts again.
- **Fail closed.** When no approval channel is available — headless run, unmounted approval service, an agent-less call, or a broken subagent lineage — the watched execution is denied, never silently allowed.
- **No auto-approve.** For a watched tool the plugin only asks; it never approves on its own.
- **No interference.** Unwatched tools delegate to the next plugin unchanged.

## What it does not protect

- **Unwatched tools.** Tools outside the `tools` watchlist are not gated by this plugin.
- **The sandbox itself.** The plugin does not enforce filesystem, network, or process boundaries; it only asks before a watched tool runs.
- **Other approval channels.** The plugin relies on the harness's approval service to surface the prompt; it does not replace or harden that service.

## Threat model

The gate is a policy decision made in the same process as the agent. A same-process attacker who can call tools directly, or a plugin registered downstream that rewrites decisions, is outside this plugin's boundary. The value the plugin adds is a deterministic, default-safe policy for the configured tool names, including inside delegated subagents (whose approval asks the harness would otherwise reject automatically).

## Reporting a vulnerability

To report a security issue, open a private disclosure channel with the maintainer (see the repository contact information) rather than a public issue. Include the affected version, a minimal reproduction, and whether the issue can allow a watched tool to run without an explicit user approval.