@dsh-cc/permission-rules 0.5.0

package/lib/auto-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-stage.d.ts","sourceRoot":"","sources":["../src/auto-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,+GAA+G;AAC/G,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,0BAA0B,CAAA;AAEvD,kIAAkI;AAClI,eAAO,MAAM,4BAA4B,IAAI,CAI5C;AAED,qGAAqG;AACrG,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,GAAG,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAQD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAG9F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,wBAAwB,EAAE,CAQ3F;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,uEAAuE;IACvE,YAAY,IAAI;QAAE,QAAQ,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC/C;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7J,uEAAuE;IACvE,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAClF,sDAAsD;IACtD,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gEAAgE;IAChE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC9D;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC,CAAA;AAED,+GAA+G;AAC/G,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpE,MAAM,MAAM,SAAS,GAAG;IACtB,2FAA2F;IAC3F,OAAO,IAAI,IAAI,CAAA;IACf;;;;;OAKG;IACH,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;CAC5F,CAAA;AA6BD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,wBAAwB,EAAE,EAC3C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,CASR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CA2L9D"}

package/lib/auto-stage.js

@@ -0,0 +1,284 @@
+/**
+ * The async LLM-classifier stage for `auto` mode: owns arming (per call, from
+ * the live `permissions.autoMode` settings slice), the memoized
+ * `createLlmClassifier` instance, and the `permission/classifier` session
+ * audit event. The plugin's `tools/pre-execute` listener (index.ts) only
+ * wires this stage — the escalate-only decision flow lives here.
+ *
+ * Arming predicate (§4.4): `autoMode.classifier.enabled === true` AND an llm
+ * stream capability is wired AND the alias route resolves. Enabled but
+ * unarmable ⇒ disarm with ONE warning per process (plus an `unarmed` audit
+ * event when a session is available) and the legacy decision path runs.
+ *
+ * @module @dsh-cc/permission-rules/auto-stage
+ */
+import { KNOWN_SESSION_EVENT_TYPES } from '@deepseek-ai/dsh-session';
+import { createLlmClassifier, expandSoftDeny } from "./llm-classifier.js";
+/** The session event type carrying one classifier verdict audit record. */
+export const CLASSIFIER_EVENT = 'permission/classifier';
+/** Consecutive per-route classifier failures before that route's breaker opens (module constant — no settings knob by design). */
+export const CLASSIFIER_BREAKER_THRESHOLD = 3;
+KNOWN_SESSION_EVENT_TYPES.add(CLASSIFIER_EVENT);
+/**
+ * Append one `permission/classifier` audit record through the widened session
+ * append face (same cross-pin strategy as `./mode.ts` and
+ * `./session-allowlist.ts`).
+ */
+export function appendSessionClassifier(session, data) {
+    session.append(CLASSIFIER_EVENT, data);
+}
+/**
+ * Fold a session log into the classifier verdict records it carries, in log
+ * order. Foreign event types are skipped; resume/replay reconstructs why a
+ * call did or did not prompt.
+ */
+export function foldClassifiers(events) {
+    const out = [];
+    for (const event of events) {
+        const wire = event;
+        if (wire.type !== CLASSIFIER_EVENT || typeof wire.data !== 'object' || wire.data === null)
+            continue;
+        out.push(wire.data);
+    }
+    return out;
+}
+function readSlice(settings) {
+    const autoMode = settings.autoMode;
+    const classifier = autoMode?.classifier;
+    const softDeny = expandSoftDeny(autoMode?.soft_deny ?? ['$defaults']);
+    return {
+        softDeny,
+        route: classifier?.route ?? 'haiku',
+        timeoutMs: classifier?.timeoutMs ?? 8000,
+        cacheMaxEntries: classifier?.cacheMaxEntries ?? 256,
+        enabled: classifier?.enabled === true,
+        raw: JSON.stringify([autoMode?.soft_deny, classifier]),
+    };
+}
+/** The failure tags the breaker counts; `cancelled`/`unarmed` are host noise and never count. */
+const BREAKER_FAILURE_TAGS = ['malformed', 'error', 'timeout'];
+/**
+ * Trailing consecutive per-route failure streak over attributed classifier
+ * audit records (R3, pure fold — unit-testable). Only events carrying
+ * `provider`/`model` attribution matching `routeKey` count (unattributed
+ * legacy events predate route keying — skipped entirely); a parsed verdict or
+ * cache hit resets the streak; malformed/error/timeout increment it; other
+ * tags (`cancelled`, `breaker`, `unarmed`) are neutral. Capped at `threshold`.
+ */
+export function trailingRouteFailureStreak(events, routeKey, threshold) {
+    let streak = 0;
+    for (const event of events) {
+        if (event.provider === undefined || event.model === undefined)
+            continue;
+        if (`${event.provider}/${event.model}` !== routeKey)
+            continue;
+        if (event.failure === undefined)
+            streak = 0;
+        else if (BREAKER_FAILURE_TAGS.includes(event.failure))
+            streak = Math.min(streak + 1, threshold);
+    }
+    return streak;
+}
+/**
+ * Build the stage. The classifier instance is memoized per autoMode slice:
+ * `rebuild()` (wired to the plugin's settings onChange/reload) drops it, and
+ * the next armed call rebuilds from the fresh slice — never per call.
+ */
+export function createAutoStage(deps) {
+    let slice = readSlice(deps.settingsRead());
+    /** The raw autoMode slice the memoized classifier was built from. */
+    let builtRaw = slice.raw;
+    let classifier;
+    /** Warned-once flag for enabled-but-unarmable (per process). */
+    let warnedUnarmed = false;
+    /** Consecutive classifier failures per route (`${provider}/${model}`); any success resets the route to 0. */
+    const routeFailures = new Map();
+    /** Routes whose breaker is open: maybeEscalate returns undefined without touching the stream. */
+    const breakerOpen = new Set();
+    /** Session ids that already recorded one `breaker` audit event (one per session). */
+    const breakerAudited = new Set();
+    /** Warned-once flag for an opened breaker (per process). */
+    let warnedBreaker = false;
+    /** Session ids whose durable log already seeded this process's breaker state (R3). */
+    const seededSessions = new Set();
+    const ensureClassifier = () => {
+        if (classifier !== undefined && builtRaw === slice.raw)
+            return classifier;
+        classifier = createLlmClassifier({
+            // The route for each call is passed as data to classify() (per-call
+            // argument, never ambient state) and the caller audits from the returned
+            // classification — no session/route fields live on this stage, so
+            // concurrent calls cannot cross-contaminate audit attribution.
+            stream: (opts) => {
+                const stream = deps.stream;
+                if (stream === undefined)
+                    throw new Error('llm service unmounted');
+                return stream(opts);
+            },
+            softDeny: slice.softDeny,
+            timeoutMs: slice.timeoutMs,
+            cacheMaxEntries: slice.cacheMaxEntries,
+            ...(deps.debug === undefined ? {} : { debug: deps.debug }),
+        });
+        builtRaw = slice.raw;
+        return classifier;
+    };
+    const disarmUnarmed = (exec) => {
+        if (!warnedUnarmed) {
+            warnedUnarmed = true;
+            deps.warn('permission classifier: enabled but unarmable (llm service or model route unavailable); stage disarmed, auto mode uses the legacy path');
+        }
+        const session = exec.agent?.session;
+        if (session !== undefined) {
+            deps.audit(session, {
+                tool: exec.name,
+                verdict: 'ask',
+                failure: 'unarmed',
+                latencyMs: 0,
+                cacheHit: false,
+            });
+        }
+    };
+    /**
+     * Seed the per-route breaker state from the session's durable log (R3) —
+     * lazily, once per session, on its first breaker-eligible call. Synchronous
+     * guard: the session id enters `seededSessions` BEFORE any suspension and
+     * the fold is over in-memory events, so concurrent first-calls cannot
+     * double-seed. A restored streak ≥ threshold opens the route at seed time
+     * (its first real call then audits/warns/notices exactly once); a log that
+     * already holds a `breaker` event pre-joins `breakerAudited` so replay never
+     * re-audits the same open. Never overwrites a live counter: seed only when
+     * the session is unseen AND the route counter is 0/absent — in-process
+     * accrual is fresher (fail-open undercounting is the accepted direction).
+     */
+    function seedBreakerFromLog(exec, routeKey, route) {
+        const session = exec.agent?.session;
+        if (session === undefined)
+            return;
+        const sessionId = String(session.header.id);
+        if (seededSessions.has(sessionId))
+            return;
+        seededSessions.add(sessionId);
+        if ((routeFailures.get(routeKey) ?? 0) > 0)
+            return;
+        const events = foldClassifiers(session.events);
+        if (events.some(event => event.failure === 'breaker'))
+            breakerAudited.add(sessionId);
+        const streak = trailingRouteFailureStreak(events, routeKey, CLASSIFIER_BREAKER_THRESHOLD);
+        if (streak <= 0)
+            return;
+        routeFailures.set(routeKey, streak);
+        if (streak < CLASSIFIER_BREAKER_THRESHOLD)
+            return;
+        breakerOpen.add(routeKey);
+        if (!warnedBreaker) {
+            warnedBreaker = true;
+            deps.warn(`permission classifier: route ${routeKey} restored with ${streak} consecutive failures from the session log; breaker open for this route, auto mode uses the legacy path`);
+        }
+        auditBreakerOnce(exec, routeKey, route);
+    }
+    return {
+        rebuild() {
+            // Drop the memoized classifier only when the autoMode slice actually
+            // changed — an onChange for unrelated keys keeps the instance.
+            const current = readSlice(deps.settingsRead());
+            if (current.raw !== builtRaw) {
+                slice = current;
+                classifier = undefined;
+            }
+            // A settings change is the operator's "I fixed the lane": reset ALL
+            // breaker state — route counters, open routes, the per-session audit
+            // de-dup set, and the per-process warn-once flag.
+            routeFailures.clear();
+            breakerOpen.clear();
+            breakerAudited.clear();
+            warnedBreaker = false;
+        },
+        async maybeEscalate(decided, exec) {
+            slice = readSlice(deps.settingsRead());
+            if (!slice.enabled)
+                return undefined;
+            if (deps.stream === undefined) {
+                disarmUnarmed(exec);
+                return undefined;
+            }
+            // The route for this call is passed to classify as data; the audit event
+            // is appended from this call's own exec session — no ambient fields.
+            const route = deps.resolveRoute(exec);
+            if (route === undefined) {
+                disarmUnarmed(exec);
+                return undefined;
+            }
+            // Eligibility (§4.1): only auto + LOW + ask/passthrough reaches the LLM.
+            // These gates precede the read-only exemption and the breaker gate.
+            if (decided.mode !== 'auto' || decided.risk.level !== 'LOW')
+                return undefined;
+            if (decided.decision.kind !== 'ask' && decided.decision.kind !== 'passthrough')
+                return undefined;
+            // F2 read-only exemption: read-only calls cannot mutate, so the LLM
+            // round-trip adds latency with zero safety — the legacy path applies.
+            if (decided.isReadOnly)
+                return undefined;
+            const routeKey = `${route.provider}/${route.model}`;
+            seedBreakerFromLog(exec, routeKey, route);
+            if (breakerOpen.has(routeKey)) {
+                auditBreakerOnce(exec, routeKey, route);
+                return undefined;
+            }
+            const verdict = await ensureClassifier().classify(exec, { route });
+            // F4 per-route breaker bookkeeping, attributed to THIS call's route:
+            // any success (parsed verdict, cache hit included) resets the streak;
+            // malformed/error/timeout increment it; `cancelled` is caller noise and
+            // `unarmed` is a disarm outcome — neither is counted (nor resets).
+            if (verdict.failure === undefined) {
+                routeFailures.set(routeKey, 0);
+            }
+            else if (BREAKER_FAILURE_TAGS.includes(verdict.failure)) {
+                const count = (routeFailures.get(routeKey) ?? 0) + 1;
+                routeFailures.set(routeKey, count);
+                if (count >= CLASSIFIER_BREAKER_THRESHOLD) {
+                    breakerOpen.add(routeKey);
+                    if (!warnedBreaker) {
+                        warnedBreaker = true;
+                        deps.warn(`permission classifier: route ${routeKey} failed ${CLASSIFIER_BREAKER_THRESHOLD} consecutive classifications; breaker open for this route, auto mode uses the legacy path`);
+                    }
+                    auditBreakerOnce(exec, routeKey, route);
+                }
+            }
+            const session = exec.agent?.session;
+            if (session !== undefined) {
+                deps.audit(session, {
+                    tool: verdict.tool,
+                    digest: verdict.digest,
+                    verdict: verdict.verdict,
+                    ...(verdict.failure === undefined ? {} : { failure: verdict.failure }),
+                    ...(verdict.routeAlias === undefined ? {} : { route: verdict.routeAlias, provider: verdict.provider, model: verdict.model }),
+                    latencyMs: verdict.latencyMs,
+                    cacheHit: verdict.cacheHit,
+                });
+            }
+            return verdict.verdict === 'allow' ? 'allow' : { kind: 'ask', reason: verdict.reason };
+        },
+    };
+    /** One `breaker` audit event per session (de-dup by session id), no stream involved. */
+    function auditBreakerOnce(exec, routeKey, route) {
+        const session = exec.agent?.session;
+        if (session === undefined)
+            return;
+        const sessionId = String(session.header.id);
+        if (breakerAudited.has(sessionId))
+            return;
+        breakerAudited.add(sessionId);
+        deps.audit(session, {
+            tool: exec.name,
+            verdict: 'ask',
+            failure: 'breaker',
+            route: routeKey,
+            provider: route.provider,
+            model: route.model,
+            latencyMs: 0,
+            cacheHit: false,
+        });
+    }
+}
+//# sourceMappingURL=auto-stage.js.map

package/lib/auto-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-stage.js","sourceRoot":"","sources":["../src/auto-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAGpE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA4C,MAAM,qBAAqB,CAAA;AA2BnH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEvD,kIAAkI;AAClI,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAI5C;AAAC,yBAAyC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;AAuBjE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB,EAAE,IAA8B;IAEpF,OAAiC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA+B;IAC7D,MAAM,GAAG,GAA+B,EAAE,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAkC,CAAA;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,SAAQ;QACnG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAqDD,SAAS,SAAS,CAAC,QAAyC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAClC,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAA;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IACrE,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,OAAO;QACnC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,IAAI;QACxC,eAAe,EAAE,UAAU,EAAE,eAAe,IAAI,GAAG;QACnD,OAAO,EAAE,UAAU,EAAE,OAAO,KAAK,IAAI;QACrC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;KACvD,CAAA;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,oBAAoB,GAAgE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAE3H;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2C,EAC3C,QAAgB,EAChB,SAAiB;IAEjB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,SAAQ;QACvE,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,QAAQ;YAAE,SAAQ;QAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC,CAAA;aACtC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IAC1C,qEAAqE;IACrE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;IACxB,IAAI,UAAqC,CAAA;IACzC,gEAAgE;IAChE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,6GAA6G;IAC7G,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,iGAAiG;IACjG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,qFAAqF;IACrF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,4DAA4D;IAC5D,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,sFAAsF;IACtF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,MAAM,gBAAgB,GAAG,GAAkB,EAAE;QAC3C,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,CAAC,GAAG;YAAE,OAAO,UAAU,CAAA;QACzE,UAAU,GAAG,mBAAmB,CAAC;YAC/B,oEAAoE;YACpE,yEAAyE;YACzE,kEAAkE;YAClE,+DAA+D;YAC/D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;gBAC1B,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;gBAClE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;YACrB,CAAC;YACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC3D,CAAC,CAAA;QACF,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;QACpB,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,IAAmB,EAAQ,EAAE;QAClD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,IAAI,CAAA;YACpB,IAAI,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAA;QACpJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAA;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED;;;;;;;;;;;OAWG;IACH,SAAS,kBAAkB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAsB;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAA;QACnC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAM;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAM;QACzC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,OAAM;QAClD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpF,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QACzF,IAAI,MAAM,IAAI,CAAC;YAAE,OAAM;QACvB,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACnC,IAAI,MAAM,GAAG,4BAA4B;YAAE,OAAM;QACjD,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,IAAI,CAAA;YACpB,IAAI,CAAC,IAAI,CAAC,gCAAgC,QAAQ,kBAAkB,MAAM,yGAAyG,CAAC,CAAA;QACtL,CAAC;QACD,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACzC,CAAC;IAED,OAAO;QACL,OAAO;YACL,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAC9C,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC7B,KAAK,GAAG,OAAO,CAAA;gBACf,UAAU,GAAG,SAAS,CAAA;YACxB,CAAC;YACD,oEAAoE;YACpE,qEAAqE;YACrE,kDAAkD;YAClD,aAAa,CAAC,KAAK,EAAE,CAAA;YACrB,WAAW,CAAC,KAAK,EAAE,CAAA;YACnB,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,aAAa,GAAG,KAAK,CAAA;QACvB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAoB,EAAE,IAAmB;YAC3D,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,CAAC,CAAA;gBACnB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,KAAK,GAAgC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,CAAA;gBACnB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,yEAAyE;YACzE,oEAAoE;YACpE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,SAAS,CAAA;YAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAA;YAChG,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAO,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAA;YACxC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAA;YACnD,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;YACzC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;gBACvC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAClE,qEAAqE;YACrE,sEAAsE;YACtE,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAChC,CAAC;iBAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;gBACpD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAClC,IAAI,KAAK,IAAI,4BAA4B,EAAE,CAAC;oBAC1C,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBACzB,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,aAAa,GAAG,IAAI,CAAA;wBACpB,IAAI,CAAC,IAAI,CAAC,gCAAgC,QAAQ,WAAW,4BAA4B,2FAA2F,CAAC,CAAA;oBACvL,CAAC;oBACD,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAA;YACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;oBACtE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC5H,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QACxF,CAAC;KACF,CAAA;IAED,wFAAwF;IACxF,SAAS,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAsB;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAA;QACnC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAM;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAM;QACzC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/lib/classifier.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Pure risk classifier for tool calls, a conservative port of Claude Code's
+ * `dangerousPatterns` / `pathValidation` heuristics. High-risk shell commands
+ * and protected/externally-scoped file writes escalate before the normal rule
+ * waterfall. Pure functions — no Cordis/session coupling — mirroring the
+ * {@link evaluatePermission} style, so hosts can classify a call directly.
+ * @module @dsh-cc/permission-rules/classifier
+ */
+/** The severity a classifier assigns to one call. */
+export type RiskLevel = 'LOW' | 'MEDIUM' | 'HIGH';
+/** The outcome of classifying one call, with the reasons that raised it. */
+export interface RiskAssessment {
+    /** The raised risk level for the call. */
+    level: RiskLevel;
+    /** Human-readable reasons for a non-`LOW` level; empty for `LOW`. */
+    reasons: string[];
+}
+/** One curated dangerous-command pattern and the reason it is high risk. */
+export interface DangerousPattern {
+    readonly regex: RegExp;
+    readonly reason: string;
+}
+/**
+ * The curated conservative set of catastrophic shell command patterns. Matched
+ * against a command string; any match raises the command to `HIGH`. Ports the
+ * spirit of Claude Code's table, deliberately conservative (catastrophic only).
+ */
+export declare const DEFAULT_DANGEROUS_PATTERNS: readonly DangerousPattern[];
+/**
+ * The curated set of protected file paths — dotfiles, credential stores, and
+ * sensitive config. Simple wildcard matching: `**` matches any depth, `*`
+ * matches a single path segment. A match raises a file write to `HIGH`.
+ */
+export declare const DEFAULT_PROTECTED_FILES: readonly string[];
+/**
+ * Classify a shell command by its riskiness. HIGH when any dangerous pattern
+ * matches, otherwise LOW. When `patterns` is given (raw regex sources, e.g.
+ * from `permissions.dangerousPatterns`), they replace the curated defaults.
+ * @param command - the shell command string to classify.
+ * @param patterns - optional raw regex sources to use instead of the defaults.
+ * @returns the assessment — HIGH with the matching reasons, else LOW.
+ */
+export declare function assessBashCommand(command: string, patterns?: string[]): RiskAssessment;
+/**
+ * Classify the target path of a file write. HIGH when it matches a protected
+ * file; MEDIUM when it resolves outside the working directory and its
+ * additional directories (an escape from the permission scope); else LOW.
+ * @param filePath - the target file path (absolute or relative).
+ * @param opts - the working directory scope and classification overrides.
+ * @returns the assessment with the matching reasons, or LOW.
+ */
+export declare function assessFilePath(filePath: string, opts: {
+    cwd: string;
+    additionalDirectories?: string[];
+    protectedFiles?: string[];
+}): RiskAssessment;
+//# sourceMappingURL=classifier.d.ts.map

package/lib/classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,qDAAqD;AACrD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEjD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,KAAK,EAAE,SAAS,CAAA;IAChB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,gBAAgB,EAUjE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAYpD,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,CAWtF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACjF,cAAc,CAYhB"}

package/lib/classifier.js

@@ -0,0 +1,129 @@
+/**
+ * Pure risk classifier for tool calls, a conservative port of Claude Code's
+ * `dangerousPatterns` / `pathValidation` heuristics. High-risk shell commands
+ * and protected/externally-scoped file writes escalate before the normal rule
+ * waterfall. Pure functions — no Cordis/session coupling — mirroring the
+ * {@link evaluatePermission} style, so hosts can classify a call directly.
+ * @module @dsh-cc/permission-rules/classifier
+ */
+import { isAbsolute, relative, resolve } from 'node:path';
+/**
+ * The curated conservative set of catastrophic shell command patterns. Matched
+ * against a command string; any match raises the command to `HIGH`. Ports the
+ * spirit of Claude Code's table, deliberately conservative (catastrophic only).
+ */
+export const DEFAULT_DANGEROUS_PATTERNS = [
+    { regex: /\brm\s+-[a-z]*[rf][a-z]*\s+(?:\/(?:\s|$)|~(?:\s|$|\/))/, reason: 'force/recursive remove of root or home' },
+    { regex: /\bsudo\s+/i, reason: 'privilege escalation' },
+    { regex: /\bchmod\s+[^\n]*\b777\b/, reason: 'world-writable permission change' },
+    { regex: /\bdd\b[^\n]*\bof=\/dev\//, reason: 'write directly to a block device' },
+    { regex: /\bmkfs(?:\.|$|\s)/, reason: 'create a file system (destructive)' },
+    { regex: /\bshutdown\b|\breboot\b|\bhalt\b/, reason: 'system shutdown or reboot' },
+    { regex: /\bkill\s+-9\s+1\b/, reason: 'kill PID 1 (system init)' },
+    { regex: /\b(?:curl|wget)\b[^\n]*\|\s*(?:sh|bash)\b/i, reason: 'pipe a remote script into a shell' },
+    { regex: /(?:^|[;&\n|\s])\s*\b(?:echo|printf|cat|tee)\b[^\n]*>\s*(?:\/etc\/|\/usr\/|\/bin\/)/, reason: 'redirect output into a system path' },
+];
+/**
+ * The curated set of protected file paths — dotfiles, credential stores, and
+ * sensitive config. Simple wildcard matching: `**` matches any depth, `*`
+ * matches a single path segment. A match raises a file write to `HIGH`.
+ */
+export const DEFAULT_PROTECTED_FILES = [
+    '.gitconfig',
+    '.bashrc',
+    '.zshrc',
+    '.profile',
+    '.bash_profile',
+    '.zprofile',
+    '.ssh/**',
+    '.aws/**',
+    '.netrc',
+    '.git-credentials',
+    '.mcp.json',
+];
+/**
+ * Classify a shell command by its riskiness. HIGH when any dangerous pattern
+ * matches, otherwise LOW. When `patterns` is given (raw regex sources, e.g.
+ * from `permissions.dangerousPatterns`), they replace the curated defaults.
+ * @param command - the shell command string to classify.
+ * @param patterns - optional raw regex sources to use instead of the defaults.
+ * @returns the assessment — HIGH with the matching reasons, else LOW.
+ */
+export function assessBashCommand(command, patterns) {
+    const source = patterns ?? [];
+    const list = source.length > 0
+        ? source.map(pattern => ({ regex: compileSafe(pattern), reason: `command matches configured pattern ${JSON.stringify(pattern)}` }))
+        : DEFAULT_DANGEROUS_PATTERNS;
+    const reasons = [];
+    for (const { regex, reason } of list) {
+        regex.lastIndex = 0;
+        if (regex.test(command))
+            reasons.push(reason);
+    }
+    return reasons.length > 0 ? { level: 'HIGH', reasons } : { level: 'LOW', reasons: [] };
+}
+/**
+ * Classify the target path of a file write. HIGH when it matches a protected
+ * file; MEDIUM when it resolves outside the working directory and its
+ * additional directories (an escape from the permission scope); else LOW.
+ * @param filePath - the target file path (absolute or relative).
+ * @param opts - the working directory scope and classification overrides.
+ * @returns the assessment with the matching reasons, or LOW.
+ */
+export function assessFilePath(filePath, opts) {
+    const protectedFiles = opts.protectedFiles ?? DEFAULT_PROTECTED_FILES;
+    if (protectedMatch(filePath, protectedFiles)) {
+        return { level: 'HIGH', reasons: [`path matches a protected file pattern`] };
+    }
+    // A non-empty cwd enables the escape check; without one we cannot scope the
+    // path and conservatively leave the escape determination at LOW.
+    const scope = [opts.cwd, ...(opts.additionalDirectories ?? [])];
+    if (opts.cwd !== '' && !inScope(resolve(opts.cwd, filePath), scope)) {
+        return { level: 'MEDIUM', reasons: ['path resolves outside the permission scope'] };
+    }
+    return { level: 'LOW', reasons: [] };
+}
+/** Whether a path (or its basename) matches any protected wildcard pattern. */
+function protectedMatch(filePath, protectedFiles) {
+    const base = filePath.split('/').at(-1) ?? filePath;
+    const candidates = [
+        filePath,
+        filePath.replace(/^~\/?/, ''),
+        base,
+    ];
+    for (const pattern of protectedFiles) {
+        const regex = wildcardToRegExp(pattern);
+        for (const candidate of candidates) {
+            regex.lastIndex = 0;
+            if (regex.test(candidate))
+                return true;
+        }
+    }
+    return false;
+}
+/** Translate a `**`/`*` wildcard pattern into a whole-string matcher. */
+function wildcardToRegExp(pattern) {
+    const body = pattern
+        .split('/')
+        .map(segment => (segment === '**' ? '.*' : segment === '*' ? '[^/]*' : segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('/');
+    return new RegExp(`^${body}$`);
+}
+/** Whether `target` is at or under any of `dirs` (all pre-resolved absolute). */
+function inScope(target, dirs) {
+    return dirs.some(dir => {
+        const rel = relative(dir, target);
+        return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+    });
+}
+/** Compile a raw pattern source into a RegExp, ignoring an invalid one. */
+function compileSafe(source) {
+    try {
+        return new RegExp(source);
+    }
+    catch {
+        // An invalid pattern must not crash classification; the defaults still run.
+        return /(?!)/; // never matches
+    }
+}
+//# sourceMappingURL=classifier.js.map

package/lib/classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAmBzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAgC;IACrE,EAAE,KAAK,EAAE,wDAAwD,EAAE,MAAM,EAAE,wCAAwC,EAAE;IACrH,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACvD,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,kCAAkC,EAAE;IAChF,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,kCAAkC,EAAE;IACjF,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,oCAAoC,EAAE;IAC5E,EAAE,KAAK,EAAE,kCAAkC,EAAE,MAAM,EAAE,2BAA2B,EAAE;IAClF,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,0BAA0B,EAAE;IAClE,EAAE,KAAK,EAAE,4CAA4C,EAAE,MAAM,EAAE,mCAAmC,EAAE;IACpG,EAAE,KAAK,EAAE,oFAAoF,EAAE,MAAM,EAAE,oCAAoC,EAAE;CAC9I,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,eAAe;IACf,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,WAAW;CACZ,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAmB;IACpE,MAAM,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAgC,MAAM,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC,CAAC,0BAA0B,CAAA;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAA;QACnB,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,IAAkF;IAElF,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAA;IACrE,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAA;IAC9E,CAAC;IACD,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,4CAA4C,CAAC,EAAE,CAAA;IACrF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACtC,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,QAAgB,EAAE,cAAiC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;IACnD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7B,IAAI;KACL,CAAA;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAA;YACnB,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;SACtH,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;AAChC,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,MAAc,EAAE,IAAuB;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,MAAM,CAAA,CAAE,gBAAgB;IACjC,CAAC;AACH,CAAC"}

package/lib/decide.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The decision waterfall for one tool call, extracted from the service so the
+ * engine core stays modular. Pure functions over a structural dependency face
+ * (`DecideDeps`) that `PermissionRulesService` supplies in its constructor.
+ *
+ * Stage order: the risk-classifier escalation runs first (a hard-deny HIGH in
+ * every mode; an ask MEDIUM outside bypassPermissions, with session-scoped
+ * grants overriding the ask), then the normal mode-aware waterfall proceeds.
+ * Under `auto`, a classifier-LOW call whose waterfall decision is `ask` is
+ * auto-allowed (the classifier proxies the prompt); MEDIUM/HIGH already
+ * returned above.
+ *
+ * @module @dsh-cc/permission-rules/decide
+ */
+import type { ToolExecution } from '@dsh-cc/tools';
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox';
+import { type RiskAssessment } from './classifier.ts';
+import type { PermissionDecision, PermissionMode, PermissionRuleSet } from './types.ts';
+/**
+ * Structural dependency face the service supplies to the decision waterfall.
+ * `settings()` returns the classifier-relevant slice of the settings-resolved
+ * section; `defaultMode()`/`rules()` read the live merged state so a settings
+ * reload is observed on the next call.
+ */
+export type DecideDeps = {
+    /** Whether the risk-classifier escalation stage runs. */
+    classifierEnabled: boolean;
+    /** Whether sandboxed bash skips a whole-tool `ask`. */
+    exemptSandboxedBashFromToolAsk: boolean;
+    /** The shell-command tool name for content extraction. */
+    bashToolName: string;
+    /** File-edit tool names auto-allowed under `acceptEdits` mode. */
+    fileEditTools: ReadonlySet<string>;
+    /** Read-only tool names auto-allowed under `plan` mode. */
+    readOnlyTools: ReadonlySet<string>;
+    /** The classifier-relevant slice of the current settings section. */
+    settings(): {
+        dangerousPatterns?: string[];
+        additionalDirectories?: string[];
+        protectedFiles?: string[];
+    };
+    /** The fallback (deployment-default) permission mode. */
+    defaultMode(): PermissionMode;
+    /** The live merged rule set. */
+    rules(): PermissionRuleSet;
+    /** Whether switching to `bypassPermissions` is disabled. */
+    bypassDisabled(): boolean;
+    /** Session-scoped allowlist match (seed-once handled inside the service). */
+    sessionAllowMatches(exec: ToolExecution): boolean;
+    /** The host shell service's sandbox mode, when mounted. */
+    shellMode(): SandboxMode | undefined;
+};
+/**
+ * The verbose result of the decision waterfall: the raw waterfall decision
+ * (BEFORE any auto-mode proxying) plus the computed risk and effective mode.
+ * The async classifier stage (§4.1 of the LLM risk-classifier design) needs
+ * all three to decide whether to consult the LLM and how to escalate.
+ */
+export type DecidedCall = {
+    decision: PermissionDecision;
+    risk: RiskAssessment;
+    mode: PermissionMode;
+    isReadOnly: boolean;
+};
+/**
+ * The sync, pure waterfall WITHOUT the auto-proxy conversion. Under `auto`, a
+ * classifier-LOW call whose waterfall decision is `ask` is returned as `ask`
+ * here — `decideCall` applies the proxy on top.
+ */
+export declare function decideCallVerbose(deps: DecideDeps, exec: ToolExecution): DecidedCall;
+/**
+ * Fold the engine decision for one call. Bypass-immune matches fall to the
+ * guard layer, not here. The risk-classifier escalation runs first (a
+ * hard-deny HIGH in every mode; an ask MEDIUM outside bypassPermissions),
+ * then the normal waterfall proceeds unchanged. Under `auto`, a classifier-LOW
+ * call whose waterfall decision is `ask` is auto-allowed (the classifier
+ * proxies the prompt); MEDIUM/HIGH already returned above.
+ */
+export declare function decideCall(deps: DecideDeps, exec: ToolExecution): PermissionDecision;
+//# sourceMappingURL=decide.d.ts.map

package/lib/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../src/decide.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAIxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEvF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,yDAAyD;IACzD,iBAAiB,EAAE,OAAO,CAAA;IAC1B,uDAAuD;IACvD,8BAA8B,EAAE,OAAO,CAAA;IACvC,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,2DAA2D;IAC3D,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,qEAAqE;IACrE,QAAQ,IAAI;QAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACzG,yDAAyD;IACzD,WAAW,IAAI,cAAc,CAAA;IAC7B,gCAAgC;IAChC,KAAK,IAAI,iBAAiB,CAAA;IAC1B,4DAA4D;IAC5D,cAAc,IAAI,OAAO,CAAA;IACzB,6EAA6E;IAC7E,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAA;IACjD,2DAA2D;IAC3D,SAAS,IAAI,WAAW,GAAG,SAAS,CAAA;CACrC,CAAA;AA2CD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAA;AAE3H;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAwCpF;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAQpF"}