@dsh-cc/permission-rules 0.5.0

package/lib/decide.js

@@ -0,0 +1,127 @@
+/**
+ * The decision waterfall for one tool call, extracted from the service so the
+ * engine core stays modular. Pure functions over a structural dependency face
+ * (`DecideDeps`) that `PermissionRulesService` supplies in its constructor.
+ *
+ * Stage order: the risk-classifier escalation runs first (a hard-deny HIGH in
+ * every mode; an ask MEDIUM outside bypassPermissions, with session-scoped
+ * grants overriding the ask), then the normal mode-aware waterfall proceeds.
+ * Under `auto`, a classifier-LOW call whose waterfall decision is `ask` is
+ * auto-allowed (the classifier proxies the prompt); MEDIUM/HIGH already
+ * returned above.
+ *
+ * @module @dsh-cc/permission-rules/decide
+ */
+import { evaluatePermission } from "./evaluate.js";
+import { assessBashCommand, assessFilePath } from "./classifier.js";
+import { isBashToolName, subjectOf } from "./matchers.js";
+import { foldPlanMode } from '@deepseek-ai/dsh-plan-mode';
+import { foldPermissionMode } from "./mode.js";
+/**
+ * The effective mode for one call: plan overlays, else the session override.
+ */
+function effectiveMode(deps, exec) {
+    const agent = exec.agent;
+    if (agent !== undefined && foldPlanMode(agent.session.events))
+        return 'plan';
+    const recorded = agent === undefined ? undefined : foldPermissionMode(agent.session.events);
+    return recorded ?? deps.defaultMode();
+}
+/** Whether a call is sandboxed bash for the whole-tool-ask exemption. */
+function sandboxedBash(deps, exec) {
+    if (!deps.exemptSandboxedBashFromToolAsk)
+        return false;
+    if (!isBashToolName(exec.name, deps.bashToolName))
+        return false;
+    const mode = deps.shellMode();
+    return mode !== undefined && mode !== 'danger-full-access';
+}
+/**
+ * Classify the risk of one call for the escalation stage. Bash-like tools
+ * classify their command; file-edit tools classify their target path; other
+ * tools are LOW. Skipped entirely when `classifierEnabled` is false.
+ */
+function classify(deps, exec) {
+    if (!deps.classifierEnabled)
+        return { level: 'LOW', reasons: [] };
+    const args = exec.arguments;
+    const session = exec.agent?.session;
+    if (isBashToolName(exec.name, deps.bashToolName) && typeof args.command === 'string') {
+        return assessBashCommand(args.command, deps.settings().dangerousPatterns);
+    }
+    if (deps.fileEditTools.has(exec.name) && typeof args.file_path === 'string') {
+        const settings = deps.settings();
+        return assessFilePath(args.file_path, {
+            cwd: session?.header?.cwd ?? '',
+            ...settings.additionalDirectories === undefined ? {} : { additionalDirectories: settings.additionalDirectories },
+            ...settings.protectedFiles === undefined ? {} : { protectedFiles: settings.protectedFiles },
+        });
+    }
+    return { level: 'LOW', reasons: [] };
+}
+/**
+ * The sync, pure waterfall WITHOUT the auto-proxy conversion. Under `auto`, a
+ * classifier-LOW call whose waterfall decision is `ask` is returned as `ask`
+ * here — `decideCall` applies the proxy on top.
+ */
+export function decideCallVerbose(deps, exec) {
+    const risk = classify(deps, exec);
+    const isReadOnly = deps.readOnlyTools.has(exec.name);
+    if (risk.level === 'HIGH') {
+        return {
+            decision: { kind: 'deny', reason: `blocked by risk classifier: ${risk.reasons.join('; ')}` },
+            risk,
+            mode: effectiveMode(deps, exec),
+            isReadOnly,
+        };
+    }
+    const mode = effectiveMode(deps, exec);
+    if (risk.level === 'MEDIUM') {
+        if (mode === 'bypassPermissions')
+            return { decision: { kind: 'allow' }, risk, mode, isReadOnly };
+        // Session-scoped approval memory (WS4-PR-B): a rule the user granted via
+        // "Allow for this session" overrides the MEDIUM early-return ask. Checked
+        // after the HIGH safety deny, before the MEDIUM ask. `plan` still asks —
+        // read-only confinement outranks a session grant.
+        if (mode !== 'plan' && deps.sessionAllowMatches(exec))
+            return { decision: { kind: 'allow' }, risk, mode, isReadOnly };
+        return {
+            decision: { kind: 'ask', reason: `requires approval by risk classifier: ${risk.reasons.join('; ')}` },
+            risk,
+            mode,
+            isReadOnly,
+        };
+    }
+    const subject = subjectOf(exec, deps.bashToolName);
+    const decision = evaluatePermission({
+        toolName: exec.name,
+        ...subject === undefined ? {} : { subject },
+        // Bypass-immune rules are enforced by the monotonic guard layer, not the
+        // waterfall — pass an empty bypassImmune so the guard is authoritative.
+        rules: { ...deps.rules(), bypassImmune: [] },
+        mode,
+        ...deps.bypassDisabled() ? { bypassDisabled: true } : {},
+        isFileEdit: deps.fileEditTools.has(exec.name),
+        isReadOnly,
+        sandboxedBashExempt: sandboxedBash(deps, exec),
+    });
+    return { decision, risk, mode, isReadOnly };
+}
+/**
+ * Fold the engine decision for one call. Bypass-immune matches fall to the
+ * guard layer, not here. The risk-classifier escalation runs first (a
+ * hard-deny HIGH in every mode; an ask MEDIUM outside bypassPermissions),
+ * then the normal waterfall proceeds unchanged. Under `auto`, a classifier-LOW
+ * call whose waterfall decision is `ask` is auto-allowed (the classifier
+ * proxies the prompt); MEDIUM/HIGH already returned above.
+ */
+export function decideCall(deps, exec) {
+    const { decision, risk, mode } = decideCallVerbose(deps, exec);
+    // auto proxies every LOW-risk ask: at this point the call is classifier-LOW
+    // (MEDIUM and HIGH returned above), so low-risk asks auto-allow.
+    if (mode === 'auto' && risk.level === 'LOW' && decision.kind === 'ask') {
+        return { kind: 'allow' };
+    }
+    return decision;
+}
+//# sourceMappingURL=decide.js.map

package/lib/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../src/decide.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAkC9C;;GAEG;AACH,SAAS,aAAa,CAAC,IAAgB,EAAE,IAAmB;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC5E,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3F,OAAO,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAA;AACvC,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAgB,EAAE,IAAmB;IAC1D,IAAI,CAAC,IAAI,CAAC,8BAA8B;QAAE,OAAO,KAAK,CAAA;IACtD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC7B,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,oBAAoB,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAgB,EAAE,IAAmB;IACrD,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAoC,CAAA;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAA;IACnC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,iBAAiB,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAChC,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE;YACpC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE;YAC/B,GAAG,QAAQ,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;YAChH,GAAG,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;SAC5F,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACtC,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,IAAmB;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YAC5F,IAAI;YACJ,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;YAC/B,UAAU;SACX,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,mBAAmB;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QAChG,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,kDAAkD;QAClD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrH,OAAO;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACrG,IAAI;YACJ,IAAI;YACJ,UAAU;SACX,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE;QAC3C,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QAC5C,IAAI;QACJ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACxD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,UAAU;QACV,mBAAmB,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;KAC/C,CAAC,CAAA;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB,EAAE,IAAmB;IAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9D,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/lib/domain.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Domain permission rules for WebFetch: `WebFetch(domain:example.com)`
+ * content rules matched against the canonicalized URL hostname. Browser-safe
+ * (pure URL/string logic, no harness or alias imports) so the parser and the
+ * TUI can both import this module.
+ * @module @dsh-cc/permission-rules/domain
+ */
+import type { ContentMatcher } from './types.ts';
+/**
+ * Whether a rule tool name governs the WebFetch tool (either its CC spelling
+ * or the harness `web_fetch` spelling).
+ * @param name - the authored or harness tool name.
+ * @returns true for `WebFetch` and `web_fetch`.
+ */
+export declare function isWebFetchRuleTool(name: string): boolean;
+/**
+ * Canonicalize the hostname of a URL for domain matching: lowercase, trailing
+ * dots stripped, IPv6 `[…]` wrapping removed. The port is ignored (Claude
+ * matches hostname only). An invalid URL yields `undefined` so the permission
+ * falls through to whole-tool / passthrough instead of inventing a host.
+ * @param url - the URL whose host to canonicalize.
+ * @returns the canonical hostname, or `undefined` when the URL is invalid.
+ */
+export declare function canonicalizeHostname(url: string): string | undefined;
+/**
+ * Parse a `domain:<host>` rule content into a {@link ContentMatcher}. The
+ * captured text is treated as a bare hostname (never a URL): schemes, paths,
+ * ports, empty hosts, and `*` off a label boundary are rejected by throwing
+ * so an invalid rule fails loud at load time. A leading `*.` is stored as
+ * part of the hostname.
+ * @param content - the rule content, expected to start with `domain:`.
+ * @returns the domain matcher with the canonical hostname.
+ * @throws a `TypeError` when the content is not a valid domain rule.
+ */
+export declare function parseDomainContent(content: string): ContentMatcher;
+/**
+ * Whether a call hostname matches a domain pattern, following Claude Code's
+ * WebFetch domain semantics: a plain pattern is exact-only; a leading `*.`
+ * matches the bare domain and any subdomain depth; a `*` in any other label
+ * position matches exactly one dot-separated label.
+ * @param pattern - the parsed rule hostname (may carry a leading `*.`).
+ * @param hostname - the canonical call hostname.
+ * @returns true on a match.
+ */
+export declare function domainMatches(pattern: string, hostname: string): boolean;
+//# sourceMappingURL=domain.d.ts.map

package/lib/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAyBlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAcxE"}

package/lib/domain.js

@@ -0,0 +1,103 @@
+/**
+ * Domain permission rules for WebFetch: `WebFetch(domain:example.com)`
+ * content rules matched against the canonicalized URL hostname. Browser-safe
+ * (pure URL/string logic, no harness or alias imports) so the parser and the
+ * TUI can both import this module.
+ * @module @dsh-cc/permission-rules/domain
+ */
+/**
+ * Whether a rule tool name governs the WebFetch tool (either its CC spelling
+ * or the harness `web_fetch` spelling).
+ * @param name - the authored or harness tool name.
+ * @returns true for `WebFetch` and `web_fetch`.
+ */
+export function isWebFetchRuleTool(name) {
+    return name === 'WebFetch' || name === 'web_fetch';
+}
+/**
+ * Canonicalize the hostname of a URL for domain matching: lowercase, trailing
+ * dots stripped, IPv6 `[…]` wrapping removed. The port is ignored (Claude
+ * matches hostname only). An invalid URL yields `undefined` so the permission
+ * falls through to whole-tool / passthrough instead of inventing a host.
+ * @param url - the URL whose host to canonicalize.
+ * @returns the canonical hostname, or `undefined` when the URL is invalid.
+ */
+export function canonicalizeHostname(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    let host = parsed.hostname.toLowerCase();
+    while (host.endsWith('.'))
+        host = host.slice(0, -1);
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    return host === '' ? undefined : host;
+}
+/**
+ * Parse a `domain:<host>` rule content into a {@link ContentMatcher}. The
+ * captured text is treated as a bare hostname (never a URL): schemes, paths,
+ * ports, empty hosts, and `*` off a label boundary are rejected by throwing
+ * so an invalid rule fails loud at load time. A leading `*.` is stored as
+ * part of the hostname.
+ * @param content - the rule content, expected to start with `domain:`.
+ * @returns the domain matcher with the canonical hostname.
+ * @throws a `TypeError` when the content is not a valid domain rule.
+ */
+export function parseDomainContent(content) {
+    const match = /^domain:\s*(.+)$/i.exec(content);
+    if (match === null || match[1] === undefined) {
+        throw new TypeError(`invalid WebFetch domain rule content "${content}"`);
+    }
+    let host = match[1].trim().toLowerCase();
+    // A hostname is never a URL: reject schemes, paths, ports, and fragments.
+    if (host.includes('://') || host.includes('/') || host.includes(':') || host.includes('?') || host.includes('#')) {
+        throw new TypeError(`WebFetch domain rule host "${host}" must be a bare hostname`);
+    }
+    while (host.endsWith('.'))
+        host = host.slice(0, -1);
+    if (host === '') {
+        throw new TypeError('WebFetch domain rule host cannot be empty');
+    }
+    const labels = host.split('.');
+    for (const label of labels) {
+        if (label !== '*' && label.includes('*')) {
+            throw new TypeError(`WebFetch domain rule host "${host}" has a "*" off a label boundary`);
+        }
+    }
+    if (labels.every(label => label === '*')) {
+        throw new TypeError(`WebFetch domain rule host "${host}" must name a concrete domain`);
+    }
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    return { kind: 'domain', hostname: host };
+}
+/**
+ * Whether a call hostname matches a domain pattern, following Claude Code's
+ * WebFetch domain semantics: a plain pattern is exact-only; a leading `*.`
+ * matches the bare domain and any subdomain depth; a `*` in any other label
+ * position matches exactly one dot-separated label.
+ * @param pattern - the parsed rule hostname (may carry a leading `*.`).
+ * @param hostname - the canonical call hostname.
+ * @returns true on a match.
+ */
+export function domainMatches(pattern, hostname) {
+    const patternHost = pattern.toLowerCase().replace(/\.+$/, '');
+    const callHost = hostname.toLowerCase().replace(/\.+$/, '');
+    const patternLabels = patternHost.split('.');
+    // Leading `*.` (with no other wildcards) matches the bare domain itself
+    // and any subdomain depth; a pattern with additional `*` labels falls to
+    // the per-label single-label wildcard comparison below.
+    if (patternLabels[0] === '*' && patternLabels.length >= 2 && !patternLabels.slice(1).includes('*')) {
+        const rest = patternLabels.slice(1).join('.');
+        return callHost === rest || callHost.endsWith(`.${rest}`);
+    }
+    const callLabels = callHost.split('.');
+    if (patternLabels.length !== callLabels.length)
+        return false;
+    return patternLabels.every((label, index) => label === '*' || label === callLabels[index]);
+}
+//# sourceMappingURL=domain.js.map

package/lib/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW,CAAA;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,yCAAyC,OAAO,GAAG,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACxC,0EAA0E;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,SAAS,CAAC,8BAA8B,IAAI,2BAA2B,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,8BAA8B,IAAI,kCAAkC,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CAAC,8BAA8B,IAAI,+BAA+B,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5C,wEAAwE;IACxE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC5D,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5F,CAAC"}

package/lib/evaluate.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Pure permission evaluation: given a tool call, a source-labelled rule set,
+ * and a mode, fold the decision. The same function backs the plugin's
+ * `tools/pre-execute` listener and the host UI's rule preview. Browser-safe.
+ *
+ * Order (spec): tool-wide deny → tool-wide ask (sandboxed-bash exempt) →
+ * source-priority content rules → mode rules (acceptEdits/plan/bypass) →
+ * whole-tool allow → passthrough. A final plan-mode wrap converts leftover
+ * `ask`/`passthrough` on a non-read-only call into a deny (allow and deny
+ * decisions stand). Bypass-immune rules are evaluated first and always deny;
+ * the plugin additionally enforces them through the monotonic guard layer.
+ * @module @dsh-cc/permission-rules/evaluate
+ */
+import { type EvaluationInput, type PermissionDecision, type PermissionRuleSet } from './types.ts';
+/**
+ * Merge several rule sets into one, consulting rules by source priority. On a
+ * tie (same source), earlier rule-set entries win (earlier sets are treated as
+ * higher within a source). The result preserves each rule's original source
+ * for later priority decisions.
+ * @param sets - rule sets ordered from highest to lowest priority within each source.
+ * @returns a single merged rule set.
+ */
+export declare function mergeRuleSets(...sets: readonly PermissionRuleSet[]): PermissionRuleSet;
+/**
+ * Fold the decision for one call. Pure: every mode/exemption input is passed
+ * in so hosts can resolve them (from plan state, shell sandbox, tool sets)
+ * themselves or let the plugin do so.
+ * @param input - the call, rule set, mode, and exemption flags.
+ * @returns the decision; `passthrough` means no rule matched and mode allowed.
+ */
+export declare function evaluatePermission(input: EvaluationInput): PermissionDecision;
+//# sourceMappingURL=evaluate.d.ts.map

package/lib/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAEvB,KAAK,iBAAiB,EAEvB,MAAM,YAAY,CAAA;AAGnB;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,IAAI,EAAE,SAAS,iBAAiB,EAAE,GAAG,iBAAiB,CAOtF;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAa7E"}

package/lib/evaluate.js

@@ -0,0 +1,176 @@
+/**
+ * Pure permission evaluation: given a tool call, a source-labelled rule set,
+ * and a mode, fold the decision. The same function backs the plugin's
+ * `tools/pre-execute` listener and the host UI's rule preview. Browser-safe.
+ *
+ * Order (spec): tool-wide deny → tool-wide ask (sandboxed-bash exempt) →
+ * source-priority content rules → mode rules (acceptEdits/plan/bypass) →
+ * whole-tool allow → passthrough. A final plan-mode wrap converts leftover
+ * `ask`/`passthrough` on a non-read-only call into a deny (allow and deny
+ * decisions stand). Bypass-immune rules are evaluated first and always deny;
+ * the plugin additionally enforces them through the monotonic guard layer.
+ * @module @dsh-cc/permission-rules/evaluate
+ */
+import { ccToolAliases } from '@dsh-cc/tools';
+import { PLAN_READONLY_REASON, SOURCE_PRIORITY, } from "./types.js";
+import { contentMatches } from "./parser.js";
+/**
+ * Merge several rule sets into one, consulting rules by source priority. On a
+ * tie (same source), earlier rule-set entries win (earlier sets are treated as
+ * higher within a source). The result preserves each rule's original source
+ * for later priority decisions.
+ * @param sets - rule sets ordered from highest to lowest priority within each source.
+ * @returns a single merged rule set.
+ */
+export function mergeRuleSets(...sets) {
+    return {
+        allow: mergeByPriority(sets.map(set => set.allow)),
+        deny: mergeByPriority(sets.map(set => set.deny)),
+        ask: mergeByPriority(sets.map(set => set.ask)),
+        bypassImmune: mergeByPriority(sets.map(set => set.bypassImmune)),
+    };
+}
+/** Concatenate each behavior's lists, then stable-sort by source priority (high first). */
+function mergeByPriority(lists) {
+    const flat = lists.flat();
+    return flat.slice().sort((a, b) => rankOf(a.source) - rankOf(b.source));
+}
+/** The numeric rank of a source in {@link SOURCE_PRIORITY} (lower rank = higher priority). */
+function rankOf(source) {
+    const index = SOURCE_PRIORITY.indexOf(source);
+    return index === -1 ? SOURCE_PRIORITY.length : index;
+}
+/**
+ * Fold the decision for one call. Pure: every mode/exemption input is passed
+ * in so hosts can resolve them (from plan state, shell sandbox, tool sets)
+ * themselves or let the plugin do so.
+ * @param input - the call, rule set, mode, and exemption flags.
+ * @returns the decision; `passthrough` means no rule matched and mode allowed.
+ */
+export function evaluatePermission(input) {
+    const { toolName, subject, rules, mode } = input;
+    const effectiveMode = (input.bypassDisabled ?? false) && mode === 'bypassPermissions' ? 'default' : mode;
+    const decision = foldDecision(input, effectiveMode, toolName, subject, rules);
+    // Plan is read-only: leftover ask/passthrough on a mutating call become a
+    // deny pointing at exit_plan_mode. Allow (including a matching allow rule)
+    // and deny (including deny rules) stand.
+    if (effectiveMode === 'plan' && input.isReadOnly !== true
+        && (decision.kind === 'ask' || decision.kind === 'passthrough')) {
+        return { kind: 'deny', reason: PLAN_READONLY_REASON };
+    }
+    return decision;
+}
+/** The inner waterfall, before the plan-mode wrap. */
+function foldDecision(input, effectiveMode, toolName, subject, rules) {
+    // Bypass-immune content rules always deny, regardless of mode — including
+    // bypassPermissions. The plugin also enforces these through the guard layer
+    // so a later (non-waterfall) override cannot flip the denial.
+    const immuneDeny = firstBypassImmune(rules.bypassImmune, toolName, subject);
+    if (immuneDeny !== undefined) {
+        return denyOf(immuneDeny);
+    }
+    // (a) whole-tool deny beats everything except bypass-immune.
+    const toolDeny = firstToolLevel(rules.deny, toolName);
+    if (toolDeny !== undefined) {
+        return denyOf(toolDeny);
+    }
+    // (e) bypassPermissions allows everything once a mode-level override applies.
+    if (effectiveMode === 'bypassPermissions') {
+        return { kind: 'allow' };
+    }
+    // (b) whole-tool ask, except an exempted sandboxed bash (which allows instead).
+    const toolAsk = firstToolLevel(rules.ask, toolName);
+    if (toolAsk !== undefined) {
+        if (ccToolAliases(toolName).includes('Bash') && input.sandboxedBashExempt === true) {
+            return { kind: 'allow' };
+        }
+        return askOf(toolAsk);
+    }
+    // (c) content-level allow/deny/ask by source priority. The first matching
+    // rule across all three behaviors (in source-priority order) decides.
+    for (const source of SOURCE_PRIORITY) {
+        for (const behavior of ['allow', 'deny', 'ask']) {
+            const matched = firstContentMatch(rules[behavior], toolName, subject, source);
+            if (matched !== undefined)
+                return decisionOf(behavior, matched);
+        }
+    }
+    // (e) acceptEdits auto-allows file-edit calls; plan auto-allows read-only calls.
+    if (effectiveMode === 'acceptEdits' && input.isFileEdit === true) {
+        return { kind: 'allow' };
+    }
+    if (effectiveMode === 'plan' && input.isReadOnly === true) {
+        return { kind: 'allow' };
+    }
+    // A whole-tool allow is the coarse default for that tool: no more-specific
+    // deny/ask matched, so a bare `Bash` allow admits the call.
+    const toolAllow = firstToolLevel(rules.allow, toolName);
+    if (toolAllow !== undefined) {
+        return { kind: 'allow' };
+    }
+    // (f) nothing matched — delegate downstream (ultimately the approval seam).
+    return { kind: 'passthrough' };
+}
+/** The first whole-tool rule for `toolName` in a behavior list. */
+function firstToolLevel(list, toolName) {
+    return list.find(rule => rule.content === undefined && ruleMatchesTool(rule, toolName));
+}
+/** Whether an authored rule's tool name answers to the harness call's tool name. */
+function ruleMatchesTool(rule, toolName) {
+    // The harness exec.name is lowercase; the rule preserves its authored CC
+    // spelling, so compare through the CC↔harness alias map.
+    return ccToolAliases(toolName).includes(rule.toolName);
+}
+/** The first content rule for `toolName`/`subject` at exactly one source, or undefined. */
+function firstContentMatch(list, toolName, subject, source) {
+    if (subject === undefined)
+        return undefined;
+    for (const rule of list) {
+        if (rule.source !== source)
+            continue;
+        if (rule.content === undefined || rule.matcher === undefined)
+            continue;
+        if (ruleMatchesTool(rule, toolName) && contentMatches(rule.matcher, subject))
+            return rule;
+    }
+    return undefined;
+}
+/**
+ * The first bypass-immune content rule matching `toolName`/`subject`; bypass-
+ * immune rules deny regardless of source priority or mode.
+ */
+function firstBypassImmune(list, toolName, subject) {
+    if (subject === undefined)
+        return undefined;
+    for (const rule of list) {
+        if (rule.content === undefined || rule.matcher === undefined)
+            continue;
+        if (!ruleMatchesTool(rule, toolName))
+            continue;
+        if (contentMatches(rule.matcher, subject))
+            return rule;
+    }
+    return undefined;
+}
+/** Map a matched rule's behavior to a decision. */
+function decisionOf(behavior, match) {
+    if (behavior === 'allow')
+        return { kind: 'allow' };
+    if (behavior === 'deny')
+        return denyOf(match);
+    return askOf(match);
+}
+/** Deny decision for a matched rule. */
+function denyOf(match) {
+    return { kind: 'deny', reason: `denied by permission rule ${ruleLabel(match)}` };
+}
+/** Ask decision for a matched rule. */
+function askOf(match) {
+    return { kind: 'ask', reason: `requires approval by permission rule ${ruleLabel(match)}` };
+}
+/** Human-readable rule label including its source. */
+function ruleLabel(match) {
+    const content = match.content === undefined ? '' : `(${match.content})`;
+    return `${match.toolName}${content} [${match.source}]`;
+}
+//# sourceMappingURL=evaluate.js.map

package/lib/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,eAAe,GAMhB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAG,IAAkC;IACjE,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;KACjE,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CAAC,KAA6C;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACzB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,8FAA8F;AAC9F,SAAS,MAAM,CAAC,MAA4B;IAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAChD,MAAM,aAAa,GACjB,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;WACpD,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sDAAsD;AACtD,SAAS,YAAY,CACnB,KAAsB,EACtB,aAAsC,EACtC,QAAgB,EAChB,OAA2B,EAC3B,KAAwB;IAExB,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAED,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,IAAI,aAAa,KAAK,mBAAmB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,aAAa,KAAK,aAAa,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,IAAI,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,4EAA4E;IAC5E,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;AAChC,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,IAA+B,EAAE,QAAgB;IACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;AACzF,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAAoB,EAAE,QAAgB;IAC7D,yEAAyE;IACzE,yDAAyD;IACzD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACxD,CAAC;AAED,2FAA2F;AAC3F,SAAS,iBAAiB,CACxB,IAA+B,EAC/B,QAAgB,EAChB,OAA2B,EAC3B,MAAgC;IAEhC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,SAAQ;QACpC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,SAAQ;QACtE,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IAC3F,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,IAA+B,EAC/B,QAAgB,EAChB,OAA2B;IAE3B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,SAAQ;QACtE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,SAAQ;QAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,mDAAmD;AACnD,SAAS,UAAU,CAAC,QAAkC,EAAE,KAAqB;IAC3E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAClD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;AACrB,CAAC;AAED,wCAAwC;AACxC,SAAS,MAAM,CAAC,KAAqB;IACnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;AAClF,CAAC;AAED,uCAAuC;AACvC,SAAS,KAAK,CAAC,KAAqB;IAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;AAC5F,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,KAAqB;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAA;IACvE,OAAO,GAAG,KAAK,CAAC,QAAQ,GAAG,OAAO,KAAK,KAAK,CAAC,MAAM,GAAG,CAAA;AACxD,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Claude Code-compatible permission-rule engine. Owns a source-labelled rule
+ * set (Config `rules` merged with the optional `permissions` settings section),
+ * a `tools/pre-execute` listener that folds a mode-aware decision, and the
+ * monotonic guard layer that enforces bypass-immune content rules so neither a
+ * mode switch nor `bypassPermissions` can override them. A risk-classifier
+ * escalation stage hard-denies catastrophic commands and asks on protected or
+ * out-of-scope file writes before the normal waterfall. Rules fail loud at
+ * load; settings hot-reloads by rebuilding merged state and re-registering
+ * guards.
+ *
+ * @module @dsh-cc/permission-rules
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+import type z from '@deepseek-ai/schemastery';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type SettingsNamespace } from '@deepseek-ai/dsh-settings';
+import { type PermissionMode, type PermissionRuleSet } from './types.ts';
+export { SESSION_ALLOW_EVENT, SessionAllowlist, appendSessionAllow, foldSessionAllows, type SessionAllowEventData, } from './session-allowlist.ts';
+export { createSandboxApprovalListener, isSandboxEscalation, type SandboxApprovalListenerConfig, } from './approval-listener.ts';
+export { foldPermissionMode, foldResumeSandbox, setPermissionMode, PERMISSION_MODE_EVENT, } from './mode.ts';
+export { CLASSIFIER_EVENT, appendSessionClassifier, foldClassifiers, createAutoStage, type AutoModeSettings, type AutoModeClassifierSettings, type ClassifierAuditEventData, } from './auto-stage.ts';
+export { createLlmClassifier, expandSoftDeny, DEFAULT_SOFT_DENY, type LlmVerdict, type LlmClassification, type ClassifierAuditEvent, type ClassifierFailure, } from './llm-classifier.ts';
+export { PERMISSION_MODES, SWITCHABLE_PERMISSION_MODES, PLAN_READONLY_REASON, type PermissionMode, type SwitchablePermissionMode, } from './types.ts';
+export { parseRuleString, ruleString, contentMatches, } from './parser.ts';
+export { canonicalizeHostname, isWebFetchRuleTool } from './domain.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /** The mounted permission-rule engine, when this plugin is composed. */
+        permissionRules: PermissionRulesService;
+    }
+}
+/** The settings namespace carrying `permissions.allow/deny/ask/defaultMode`. */
+export declare const PERMISSION_SETTINGS_NAMESPACE: SettingsNamespace;
+export { permissionSettingsSchema, ConfigSchema, DEFAULT_FILE_EDIT_TOOLS, DEFAULT_READ_ONLY_TOOLS, type PermissionSettings, type ConfigRules, type Config, } from './settings-schema.ts';
+import { type Config } from './settings-schema.ts';
+/** The engine's Service Definition plus the mode/rule write and read surface. */
+export declare class PermissionRulesService extends Service {
+    config: Config;
+    static Config: z<Config>;
+    static inject: string[];
+    private readonly bashToolName;
+    private readonly fileEditTools;
+    private readonly readOnlyTools;
+    private readonly settingsSource;
+    private readonly rulesConfig;
+    private readonly bypassImmuneRules;
+    /** Reads the currently authoritative settings section (swapped by the settings hook). */
+    private settingsRead;
+    /** Live merged state; rebuilt on settings change so listeners read a fresh snapshot. */
+    private state;
+    /** Disposers for the currently registered monotonic guards. */
+    private guardDisposers;
+    /** Session-scoped approval memory (WS4-PR-B): rules granted via the UI's "Allow for this session". */
+    private readonly sessionAllowlist;
+    /** Session ids already seeded from their log's `permission/session-allow` audit events. */
+    private readonly allowlistSeeded;
+    /** The optional LLM classifier stage (armed per call from the live settings slice). */
+    private autoStage;
+    constructor(ctx: Context, config: Config);
+    /** The current settings-resolved section, defaulting to the schema default. */
+    private settingsSection;
+    /** Reject a settings section the engine could not act on — fail loud at the settings boundary. */
+    private validateSettings;
+    /** Rebuild merged state and re-register guards (mount and settings change). */
+    private reload;
+    /** Parse the Config `rules` block into a source-`config` rule set. */
+    private configRuleSet;
+    /** (Re)register monotonic guards for the bypass-immune rules, idempotent. */
+    private registerGuards;
+    /**
+     * Whether the session-scoped allowlist matches this call. The session's
+     * rules are seeded once from its log's `permission/session-allow` audit
+     * events, so a resumed session keeps its grants. Agent-less calls never
+     * match (there is no session to scope to).
+     */
+    private sessionAllowMatches;
+    /**
+     * The session's workspace root: the durable `worktree/entered` fold
+     * (session-cwd, WS1), falling back to the session header cwd. Undefined
+     * when the session never recorded a cwd — the sandbox listener then cannot
+     * verify an escalation is in-scope and falls through to the normal ask.
+     */
+    private sessionWorkspaceOf;
+    /**
+     * Grant a session-scoped allow rule on the agent's session: in-memory match
+     * for the rest of this session plus a `permission/session-allow` audit
+     * event. Never touches the `permissions` settings namespace.
+     * @param agent - the agent whose session is granted the rule.
+     * @param rule - the rule string (e.g. `Bash(npm )` or a whole-tool name).
+     */
+    addSessionAllow(agent: Agent, rule: string): void;
+    /**
+     * Drop every session-scoped rule for the agent's session (audited clear
+     * record in the session log).
+     */
+    clearSessionAllows(agent: Agent): void;
+    /**
+     * Whether switching to `bypassPermissions` is disabled by Config or the
+     * settings section.
+     */
+    private bypassDisabled;
+    /**
+     * The LIVE merged settings default (`config.defaultMode`, overridden by the
+     * settings section): rebuilt on every settings reload, so display surfaces
+     * reading this always follow the currently authoritative default.
+     */
+    get defaultMode(): PermissionMode;
+    /**
+     * Switch a session's permission mode durably. Semantics live in
+     * `switchSessionPermissionMode` (./mode.ts): `plan` is owned by plan-mode
+     * and throws; entering `bypassPermissions` pins the session sandbox to
+     * `danger-full-access` and records the prior mode for restore; unknown or
+     * disabled modes throw.
+     * @param agent - the live agent whose session mode is changing.
+     * @param mode - the new permission mode.
+     */
+    setMode(agent: Agent, mode: PermissionMode): void;
+    /** The currently merged rule set (for introspection and host preview). */
+    get ruleSet(): PermissionRuleSet;
+}
+export default PermissionRulesService;
+//# sourceMappingURL=index.d.ts.map