@dsh-cc/permission-rules 0.5.0

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,CAAC,MAAM,0BAA0B,CAAA;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AASnD,OAAO,EAA6C,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAS7G,OAAO,EAEL,KAAK,cAAc,EAEnB,KAAK,iBAAiB,EAEvB,MAAM,YAAY,CAAA;AAUnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,KAAK,6BAA6B,GACnC,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,wBAAwB,GAC9B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,wEAAwE;QACxE,eAAe,EAAE,sBAAsB,CAAA;KACxC;CACF;AAED,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,EAAE,iBAAoD,CAAA;AAEhG,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,MAAM,GACZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAGL,KAAK,MAAM,EAGZ,MAAM,sBAAsB,CAAA;AAqB7B,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,OAAO;IAwBhB,MAAM,EAAE,MAAM;IAvB/C,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAe;IAEvC,MAAM,CAAC,MAAM,WAAY;IAEzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,yFAAyF;IACzF,OAAO,CAAC,YAAY,CAAuC;IAC3D,wFAAwF;IACxF,OAAO,CAAC,KAAK,CAA2D;IACxE,+DAA+D;IAC/D,OAAO,CAAC,cAAc,CAAqB;IAC3C,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IAC1D,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoB;IACpD,uFAAuF;IACvF,OAAO,CAAC,SAAS,CAAuB;gBAE5B,GAAG,EAAE,OAAO,EAAS,MAAM,EAAE,MAAM;IAmL/C,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAIvB,kGAAkG;IAClG,OAAO,CAAC,gBAAgB;IASxB,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAYd,sEAAsE;IACtE,OAAO,CAAC,aAAa;IAUrB,6EAA6E;IAC7E,OAAO,CAAC,cAAc;IAWtB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIjD;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAItC;;;OAGG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;OAIG;IACH,IAAI,WAAW,IAAI,cAAc,CAEhC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI;IAUjD,0EAA0E;IAC1E,IAAI,OAAO,IAAI,iBAAiB,CAE/B;CACF;AAED,eAAe,sBAAsB,CAAA"}

package/lib/index.js

@@ -0,0 +1,380 @@
+/**
+ * Claude Code-compatible permission-rule engine. Owns a source-labelled rule
+ * set (Config `rules` merged with the optional `permissions` settings section),
+ * a `tools/pre-execute` listener that folds a mode-aware decision, and the
+ * monotonic guard layer that enforces bypass-immune content rules so neither a
+ * mode switch nor `bypassPermissions` can override them. A risk-classifier
+ * escalation stage hard-denies catastrophic commands and asks on protected or
+ * out-of-scope file writes before the normal waterfall. Rules fail loud at
+ * load; settings hot-reloads by rebuilding merged state and re-registering
+ * guards.
+ *
+ * @module @dsh-cc/permission-rules
+ */
+import { Service } from '@deepseek-ai/cordis';
+import { BlockAssembler, createUserMessage } from '@deepseek-ai/dsh-llm';
+import { foldPlanMode } from '@deepseek-ai/dsh-plan-mode';
+import { effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
+import { foldSessionCwd } from '@dsh-cc/session-cwd';
+import { resolveAlias, toOneShotRoute } from '@dsh-cc/model-aliases';
+import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { parseRule, ruleString } from "./parser.js";
+import { mergeRuleSets } from "./evaluate.js";
+import { decideCallVerbose } from "./decide.js";
+import { createAutoStage, appendSessionClassifier } from "./auto-stage.js";
+import { PERMISSION_MODES, } from "./types.js";
+import { foldPermissionMode, setPermissionMode, switchSessionPermissionMode, } from "./mode.js";
+import { ruleMatches, subjectOf } from "./matchers.js";
+import { SessionAllowlist, foldSessionAllows } from "./session-allowlist.js";
+import { createSandboxApprovalListener } from "./approval-listener.js";
+export { SESSION_ALLOW_EVENT, SessionAllowlist, appendSessionAllow, foldSessionAllows, } from "./session-allowlist.js";
+export { createSandboxApprovalListener, isSandboxEscalation, } from "./approval-listener.js";
+export { foldPermissionMode, foldResumeSandbox, setPermissionMode, PERMISSION_MODE_EVENT, } from "./mode.js";
+export { CLASSIFIER_EVENT, appendSessionClassifier, foldClassifiers, createAutoStage, } from "./auto-stage.js";
+export { createLlmClassifier, expandSoftDeny, DEFAULT_SOFT_DENY, } from "./llm-classifier.js";
+export { PERMISSION_MODES, SWITCHABLE_PERMISSION_MODES, PLAN_READONLY_REASON, } from "./types.js";
+export { parseRuleString, ruleString, contentMatches, } from "./parser.js";
+export { canonicalizeHostname, isWebFetchRuleTool } from "./domain.js";
+/** The settings namespace carrying `permissions.allow/deny/ask/defaultMode`. */
+export const PERMISSION_SETTINGS_NAMESPACE = settingsNamespace('permissions');
+export { permissionSettingsSchema, ConfigSchema, DEFAULT_FILE_EDIT_TOOLS, DEFAULT_READ_ONLY_TOOLS, } from "./settings-schema.js";
+import { ConfigSchema, permissionSettingsSchema, } from "./settings-schema.js";
+/** Build a settings-resolved rule set from a settings section. */
+function settingsRuleSet(settings, source) {
+    return {
+        allow: (settings.allow ?? []).map(raw => parseRule(raw, 'allow', source)),
+        deny: (settings.deny ?? []).map(raw => parseRule(raw, 'deny', source)),
+        ask: (settings.ask ?? []).map(raw => parseRule(raw, 'ask', source)),
+        bypassImmune: [],
+    };
+}
+/** One short model-facing sentence per permission mode for the prompt context. */
+const MODE_SENTENCE = {
+    default: 'Permission mode: default. Tool calls follow allow/deny/ask rules; unmatched calls pass through.',
+    acceptEdits: 'Permission mode: acceptEdits. File edits are auto-allowed; other calls follow the rules.',
+    plan: 'Permission mode: plan. Only read-only tools may run; submit the plan via exit_plan_mode.',
+    auto: 'Permission mode: auto. Low-risk approval prompts are auto-allowed; medium-risk prompts still ask the user.',
+    bypassPermissions: 'Permission mode: bypassPermissions. Permission prompts are skipped and the sandbox is full access, except bypass-immune and catastrophic commands which remain denied.',
+};
+/** The engine's Service Definition plus the mode/rule write and read surface. */
+export class PermissionRulesService extends Service {
+    config;
+    static Config = ConfigSchema;
+    static inject = ['tools'];
+    bashToolName;
+    fileEditTools;
+    readOnlyTools;
+    settingsSource;
+    rulesConfig;
+    bypassImmuneRules;
+    /** Reads the currently authoritative settings section (swapped by the settings hook). */
+    settingsRead = () => ({});
+    /** Live merged state; rebuilt on settings change so listeners read a fresh snapshot. */
+    state;
+    /** Disposers for the currently registered monotonic guards. */
+    guardDisposers = [];
+    /** Session-scoped approval memory (WS4-PR-B): rules granted via the UI's "Allow for this session". */
+    sessionAllowlist = new SessionAllowlist();
+    /** Session ids already seeded from their log's `permission/session-allow` audit events. */
+    allowlistSeeded = new Set();
+    /** The optional LLM classifier stage (armed per call from the live settings slice). */
+    autoStage;
+    constructor(ctx, config) {
+        super(ctx, 'permissionRules');
+        this.config = config;
+        // The schema applied the defaults, so these are non-optional at runtime.
+        this.bashToolName = config.bashToolName;
+        this.fileEditTools = new Set(config.fileEditTools);
+        this.readOnlyTools = new Set(config.readOnlyTools);
+        this.settingsSource = config.settingsSource;
+        this.rulesConfig = config.rules ?? {};
+        this.bypassImmuneRules = (this.rulesConfig.bypassImmune ?? []).map(raw => parseRule(raw, 'deny', 'config'));
+        this.state = { rules: this.configRuleSet(), defaultMode: config.defaultMode };
+        // Monotonic guard layer for bypass-immune rules: never overridable.
+        this.registerGuards();
+        // Optional settings inject: absent `ctx.settings` leaves only the Config
+        // rules in force, exactly as the fallback contract requires. A stored
+        // change re-enters reload() to rebuild merged state and the guards.
+        installSettingsSection(ctx, PERMISSION_SETTINGS_NAMESPACE, permissionSettingsSchema(), {}, {
+            setSource: (current) => { this.settingsRead = current; },
+            onChange: () => this.reload(),
+            validate: value => this.validateSettings(value),
+        });
+        // The decision waterfall lives in ./decide.ts as pure functions over this
+        // structural dependency face; the closures read live fields so a settings
+        // reload is observed on the next call.
+        const decideDeps = {
+            classifierEnabled: config.classifierEnabled !== false,
+            exemptSandboxedBashFromToolAsk: config.exemptSandboxedBashFromToolAsk === true,
+            bashToolName: this.bashToolName,
+            fileEditTools: this.fileEditTools,
+            readOnlyTools: this.readOnlyTools,
+            settings: () => this.settingsSection(),
+            defaultMode: () => this.state.defaultMode,
+            rules: () => this.state.rules,
+            bypassDisabled: () => this.bypassDisabled(),
+            sessionAllowMatches: (exec) => this.sessionAllowMatches(exec),
+            shellMode: () => this.ctx.get('shell')?.sandboxMode,
+        };
+        // The optional LLM classifier stage (§4.1/§4.4 of the LLM risk-classifier
+        // design). The llm stream seam is wired via ctx.inject so a missing llm
+        // service is a silent no-op rather than a required dependency (same
+        // optional-availability pattern as the systemPrompt injection below).
+        let llmStream;
+        ctx.inject(['llm'], (scope) => {
+            llmStream = async (opts) => {
+                const assembler = new BlockAssembler();
+                for await (const chunk of scope.llm.stream({
+                    provider: opts.provider,
+                    model: opts.model,
+                    system: opts.system,
+                    messages: [createUserMessage({
+                            content: [{ type: 'text', text: opts.prompt }],
+                            source: { kind: 'plugin', plugin: 'permission-rules' },
+                        })],
+                    maxTokens: opts.maxTokens,
+                    ...(opts.signal === undefined ? {} : { signal: opts.signal }),
+                })) {
+                    assembler.push(chunk);
+                }
+                return assembler.blocks()
+                    .filter(block => block.type === 'text')
+                    .map(block => block.text)
+                    .join(' ')
+                    .trim();
+            };
+        });
+        const autoStage = createAutoStage({
+            settingsRead: () => this.settingsSection(),
+            get stream() {
+                return llmStream;
+            },
+            resolveRoute: (exec) => {
+                const route = this.settingsSection().autoMode?.classifier?.route ?? 'haiku';
+                // The calling agent's logged request header fills the provider for a
+                // string-form (model-only) alias; a complete {provider, model} alias
+                // needs no parent (toOneShotRoute flow, session-title-provider precedent).
+                const parent = exec.agent?.session.requestHeader()?.config;
+                return toOneShotRoute(resolveAlias(this.ctx, route), parent);
+            },
+            warn: (message) => this.ctx.logger.warn(message),
+            // R5 debug channel: opt-in via DSH_PERMISSION_CLASSIFIER_DEBUG=1, from
+            // the plugin's scoped process logger — raw classifier output NEVER
+            // enters session events (the digest-only audit contract stands). Raw
+            // output may echo tool input (including secrets), so this stays an
+            // explicitly opt-in channel with no redaction machinery.
+            ...(process.env.DSH_PERMISSION_CLASSIFIER_DEBUG === '1'
+                ? { debug: (message) => this.ctx.logger.debug?.(`[permission-rules] ${message}`) }
+                : {}),
+            audit: (session, event) => {
+                appendSessionClassifier(session, event);
+            },
+        });
+        this.autoStage = autoStage;
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            const decided = decideCallVerbose(decideDeps, exec);
+            // Armed + auto + LOW + ask/passthrough ⇒ the LLM stage decides (§4.1):
+            // verdict allow ⇒ allow, verdict ask/failure ⇒ ask(reason). Every other
+            // path falls through to today's exact mapping (disarmed ⇒ bit-for-bit).
+            const escalated = await autoStage.maybeEscalate(decided, exec);
+            if (escalated !== undefined) {
+                return escalated === 'allow' ? { kind: 'allow' } : { kind: 'ask', reason: escalated.reason };
+            }
+            const { decision, risk, mode } = decided;
+            if (decision.kind === 'allow')
+                return { kind: 'allow' };
+            if (decision.kind === 'deny')
+                return { kind: 'deny', reason: decision.reason };
+            if (decision.kind === 'ask') {
+                // auto proxies every LOW-risk ask (MEDIUM/HIGH returned above):
+                // identical to the previous decideCall post-processing.
+                if (mode === 'auto' && risk.level === 'LOW')
+                    return { kind: 'allow' };
+                return { kind: 'ask', ...decision.reason === undefined ? {} : { reason: decision.reason } };
+            }
+            return next();
+        });
+        // WS3 sandbox integration: the approval-seam listener auto-approves
+        // sandbox escalations in `auto` mode when the session has a resolvable
+        // workspace root. Registered ahead of any UI provider so an eligible
+        // escalation never reaches the modal queue; every auto-approval is
+        // audit-logged to the session log (`scope: 'sandbox-auto'`).
+        ctx.on('approval/request', createSandboxApprovalListener({
+            modeOf: (agent) => {
+                if (foldPlanMode(agent.session.events))
+                    return 'plan';
+                return foldPermissionMode(agent.session.events) ?? this.state.defaultMode;
+            },
+            workspaceOf: (agent) => this.sessionWorkspaceOf(agent),
+        }));
+        // Pin sessions created while the deployment default is a sandbox-affecting or
+        // plan mode so a fresh session inherits the default durably.
+        ctx.on('session/created', (session) => {
+            if (foldPermissionMode(session.events) !== undefined)
+                return;
+            if (foldPlanMode(session.events))
+                return;
+            const mode = this.state.defaultMode;
+            if (mode === 'bypassPermissions') {
+                if (this.bypassDisabled())
+                    return;
+                const resume = effectiveSandboxMode(session.events)
+                    ?? this.ctx.get('shell')?.sandboxMode;
+                setPermissionMode(session, 'bypassPermissions', resume);
+                if ((effectiveSandboxMode(session.events) ?? this.ctx.get('shell')?.sandboxMode) !== 'danger-full-access') {
+                    setSandboxMode(session, 'danger-full-access');
+                }
+                return;
+            }
+            if (mode === 'plan') {
+                session.append('plan/mode', { active: true });
+            }
+        });
+        // Optional model-facing mode sentence. Injected via ctx.inject so a missing
+        // system-prompt seam is a silent no-op rather than a required dependency.
+        ctx.inject(['systemPrompt'], (scope) => {
+            scope.systemPrompt.context({
+                name: 'permission:mode',
+                order: 116,
+                text: (context) => {
+                    const agent = context.agent;
+                    if (agent === undefined)
+                        return '';
+                    const mode = foldPlanMode(agent.session.events)
+                        ? 'plan'
+                        : (foldPermissionMode(agent.session.events) ?? this.state.defaultMode);
+                    return MODE_SENTENCE[mode];
+                },
+            });
+        });
+    }
+    /** The current settings-resolved section, defaulting to the schema default. */
+    settingsSection() {
+        return this.settingsRead();
+    }
+    /** Reject a settings section the engine could not act on — fail loud at the settings boundary. */
+    validateSettings(value) {
+        for (const raw of [...value.allow ?? [], ...value.deny ?? [], ...value.ask ?? []]) {
+            parseRule(raw, 'allow', this.settingsSource);
+        }
+        if (value.defaultMode !== undefined && !PERMISSION_MODES.includes(value.defaultMode)) {
+            throw new Error(`permission: unknown defaultMode ${JSON.stringify(value.defaultMode)}`);
+        }
+    }
+    /** Rebuild merged state and re-register guards (mount and settings change). */
+    reload() {
+        const settings = this.settingsSection();
+        this.state = {
+            rules: mergeRuleSets(settingsRuleSet(settings, this.settingsSource), this.configRuleSet()),
+            defaultMode: settings.defaultMode ?? this.config.defaultMode ?? 'default',
+        };
+        this.registerGuards();
+        // Drop the memoized LLM classifier when the autoMode slice changed, so
+        // the next armed call rebuilds it from fresh settings.
+        this.autoStage?.rebuild();
+    }
+    /** Parse the Config `rules` block into a source-`config` rule set. */
+    configRuleSet() {
+        const { allow = [], deny = [], ask = [] } = this.rulesConfig;
+        return {
+            allow: allow.map(raw => parseRule(raw, 'allow', 'config')),
+            deny: deny.map(raw => parseRule(raw, 'deny', 'config')),
+            ask: ask.map(raw => parseRule(raw, 'ask', 'config')),
+            bypassImmune: this.bypassImmuneRules,
+        };
+    }
+    /** (Re)register monotonic guards for the bypass-immune rules, idempotent. */
+    registerGuards() {
+        for (const dispose of this.guardDisposers)
+            dispose();
+        this.guardDisposers = this.bypassImmuneRules.map(rule => this.ctx.tools.guard((exec) => {
+            const subject = subjectOf(exec, this.bashToolName);
+            if (subject === undefined || !ruleMatches(rule, exec.name, subject))
+                return undefined;
+            return `denied by permission rule ${ruleString(rule.toolName, rule.content)} [${rule.source}] (bypass-immune)`;
+        }));
+    }
+    /**
+     * Whether the session-scoped allowlist matches this call. The session's
+     * rules are seeded once from its log's `permission/session-allow` audit
+     * events, so a resumed session keeps its grants. Agent-less calls never
+     * match (there is no session to scope to).
+     */
+    sessionAllowMatches(exec) {
+        const agent = exec.agent;
+        if (agent === undefined)
+            return false;
+        const id = String(agent.session.id);
+        if (!this.allowlistSeeded.has(id)) {
+            this.allowlistSeeded.add(id);
+            this.sessionAllowlist.seed(id, foldSessionAllows(agent.session.events));
+        }
+        return this.sessionAllowlist.matches(id, exec.name, subjectOf(exec, this.bashToolName));
+    }
+    /**
+     * The session's workspace root: the durable `worktree/entered` fold
+     * (session-cwd, WS1), falling back to the session header cwd. Undefined
+     * when the session never recorded a cwd — the sandbox listener then cannot
+     * verify an escalation is in-scope and falls through to the normal ask.
+     */
+    sessionWorkspaceOf(agent) {
+        return foldSessionCwd(agent.session.events) ?? agent.session.header?.cwd;
+    }
+    /**
+     * Grant a session-scoped allow rule on the agent's session: in-memory match
+     * for the rest of this session plus a `permission/session-allow` audit
+     * event. Never touches the `permissions` settings namespace.
+     * @param agent - the agent whose session is granted the rule.
+     * @param rule - the rule string (e.g. `Bash(npm )` or a whole-tool name).
+     */
+    addSessionAllow(agent, rule) {
+        this.sessionAllowlist.add(agent.session, rule);
+    }
+    /**
+     * Drop every session-scoped rule for the agent's session (audited clear
+     * record in the session log).
+     */
+    clearSessionAllows(agent) {
+        this.sessionAllowlist.clear(agent.session);
+    }
+    /**
+     * Whether switching to `bypassPermissions` is disabled by Config or the
+     * settings section.
+     */
+    bypassDisabled() {
+        return this.config.disableBypassPermissionsMode === true
+            || this.settingsSection().disableBypassPermissionsMode === 'disable';
+    }
+    /**
+     * The LIVE merged settings default (`config.defaultMode`, overridden by the
+     * settings section): rebuilt on every settings reload, so display surfaces
+     * reading this always follow the currently authoritative default.
+     */
+    get defaultMode() {
+        return this.state.defaultMode;
+    }
+    /**
+     * Switch a session's permission mode durably. Semantics live in
+     * `switchSessionPermissionMode` (./mode.ts): `plan` is owned by plan-mode
+     * and throws; entering `bypassPermissions` pins the session sandbox to
+     * `danger-full-access` and records the prior mode for restore; unknown or
+     * disabled modes throw.
+     * @param agent - the live agent whose session mode is changing.
+     * @param mode - the new permission mode.
+     */
+    setMode(agent, mode) {
+        switchSessionPermissionMode({
+            agent,
+            mode,
+            defaultMode: this.state.defaultMode,
+            bypassDisabled: this.bypassDisabled(),
+            shellMode: this.ctx.get('shell')?.sandboxMode,
+        });
+    }
+    /** The currently merged rule set (for introspection and host preview). */
+    get ruleSet() {
+        return this.state.rules;
+    }
+}
+export default PermissionRulesService;
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAW,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAGtF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAA0B,MAAM,2BAA2B,CAAA;AAK7G,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAmB,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAkB,MAAM,iBAAiB,CAAA;AAC1F,OAAO,EACL,gBAAgB,GAKjB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAA;AAEtE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,GAEpB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,eAAe,GAIhB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,GAKlB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAStE,gFAAgF;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAEhG,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,YAAY,EACZ,wBAAwB,GAIzB,MAAM,sBAAsB,CAAA;AAE7B,kEAAkE;AAClE,SAAS,eAAe,CAAC,QAA4B,EAAE,MAA4B;IACjF,OAAO;QACL,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnE,YAAY,EAAE,EAAE;KACjB,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,aAAa,GAAmC;IACpD,OAAO,EAAE,iGAAiG;IAC1G,WAAW,EAAE,0FAA0F;IACvG,IAAI,EAAE,0FAA0F;IAChG,IAAI,EAAE,4GAA4G;IAClH,iBAAiB,EAAE,wKAAwK;CAC5L,CAAA;AAED,iFAAiF;AACjF,MAAM,OAAO,sBAAuB,SAAQ,OAAO;IAwBhB;IAvBjC,MAAM,CAAC,MAAM,GAAc,YAAY,CAAA;IAEvC,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;IAER,YAAY,CAAQ;IACpB,aAAa,CAAqB;IAClC,aAAa,CAAqB;IAClC,cAAc,CAAsB;IACpC,WAAW,CAAa;IACxB,iBAAiB,CAA2B;IAC7D,yFAAyF;IACjF,YAAY,GAA6B,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,wFAAwF;IAChF,KAAK,CAA2D;IACxE,+DAA+D;IACvD,cAAc,GAAmB,EAAE,CAAA;IAC3C,sGAAsG;IACrF,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAA;IAC1D,2FAA2F;IAC1E,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IACpD,uFAAuF;IAC/E,SAAS,CAAuB;IAExC,YAAY,GAAY,EAAS,MAAc;QAC7C,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;QADE,WAAM,GAAN,MAAM,CAAQ;QAE7C,yEAAyE;QACzE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAsB,CAAA;QACjD,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAClD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAsC,CAAA;QACnE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAgC,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3G,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAA6B,EAAE,CAAA;QAE/F,oEAAoE;QACpE,IAAI,CAAC,cAAc,EAAE,CAAA;QAErB,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,sBAAsB,CAAC,GAAG,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,EAAE,EAAE,EAAE;YACzF,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA,CAAC,CAAC;YACvD,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;YAC7B,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChD,CAAC,CAAA;QAEF,0EAA0E;QAC1E,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM,UAAU,GAAe;YAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,KAAK;YACrD,8BAA8B,EAAE,MAAM,CAAC,8BAA8B,KAAK,IAAI;YAC9E,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE;YACtC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YACzC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;YAC7B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;YAC3C,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC7D,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAsC;SAC/E,CAAA;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,SAO8B,CAAA;QAClC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzB,MAAM,SAAS,GAAG,IAAI,cAAc,EAAE,CAAA;gBACtC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,CAAC,iBAAiB,CAAC;4BAC3B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;4BAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBACvD,CAAC,CAAC;oBACH,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;iBAC9D,CAA+B,EAAE,CAAC;oBACjC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACvB,CAAC;gBACD,OAAO,SAAS,CAAC,MAAM,EAAE;qBACtB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;qBACtC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;qBACxB,IAAI,CAAC,GAAG,CAAC;qBACT,IAAI,EAAE,CAAA;YACX,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,SAAS,GAAc,eAAe,CAAC;YAC3C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE;YAC1C,IAAI,MAAM;gBACR,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,IAAI,OAAO,CAAA;gBAC3E,qEAAqE;gBACrE,qEAAqE;gBACrE,2EAA2E;gBAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,MAEvC,CAAA;gBACb,OAAO,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAChD,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,mEAAmE;YACnE,yDAAyD;YACzD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;gBACrD,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAE,IAAI,CAAC,GAAG,CAAC,MAA4C,CAAC,KAAK,EAAE,CAAC,sBAAsB,OAAO,EAAE,CAAC,EAAE;gBACzH,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gBACxB,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACzC,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAE1B,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAA4B,EAAE;YACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACnD,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAA;YAC9F,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;YACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;YAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC5B,gEAAgE;gBAChE,wDAAwD;gBACxD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;YAC7F,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,oEAAoE;QACpE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,6DAA6D;QAC7D,GAAG,CAAC,EAAE,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;YACvD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChB,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,CAAA;gBACrD,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAA;YAC3E,CAAC;YACD,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;SACvD,CAAC,CAAC,CAAA;QAEH,8EAA8E;QAC9E,6DAA6D;QAC7D,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC5D,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAM;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAA;YACnC,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,cAAc,EAAE;oBAAE,OAAM;gBACjC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC;uBAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAuC,CAAA;gBACpE,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAuC,CAAC,KAAK,oBAAoB,EAAE,CAAC;oBACvI,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;gBAC/C,CAAC;gBACD,OAAM;YACR,CAAC;YACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,4EAA4E;QAC5E,0EAA0E;QAC1E,GAAG,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;YACrC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;gBACzB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,GAAG;gBACV,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;oBAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;oBAC3B,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,EAAE,CAAA;oBAClC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC7C,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;oBACxE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;gBAC5B,CAAC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IACvE,eAAe;QACrB,OAAO,IAAI,CAAC,YAAY,EAAE,CAAA;IAC5B,CAAC;IAED,kGAAkG;IAC1F,gBAAgB,CAAC,KAAyB;QAChD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAClF,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACvC,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1F,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS;SAC1E,CAAA;QACD,IAAI,CAAC,cAAc,EAAE,CAAA;QACrB,uEAAuE;QACvE,uDAAuD;QACvD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;IAED,sEAAsE;IAC9D,aAAa;QACnB,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;QAC5D,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1D,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,EAAE,IAAI,CAAC,iBAAiB;SACrC,CAAA;IACH,CAAC;IAED,6EAA6E;IACrE,cAAc;QACpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,EAAE,CAAA;QACpD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAClD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrF,OAAO,6BAA6B,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,mBAAmB,CAAA;QAChH,CAAC,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,IAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IACzF,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,KAAY;QACrC,OAAO,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAA;IAC1E,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAY,EAAE,IAAY;QACxC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAChD,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,KAAY;QAC7B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED;;;OAGG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,4BAA4B,KAAK,IAAI;eACnD,IAAI,CAAC,eAAe,EAAE,CAAC,4BAA4B,KAAK,SAAS,CAAA;IACxE,CAAC;IAED;;;;OAIG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAA;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAY,EAAE,IAAoB;QACxC,2BAA2B,CAAC;YAC1B,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAsC;SACzE,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAA;IACzB,CAAC;;AAGH,eAAe,sBAAsB,CAAA"}

package/lib/invariant.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Package-owned invariant companion for `@dsh-cc/permission-rules`.
+ * Guards the closed vocabulary of durable `permission/mode` session events and
+ * rejects illegal payloads at the session boundary.
+ * @module @dsh-cc/permission-rules/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+import type { InvariantFailure } from '@deepseek-ai/dsh-invariants';
+/** Cordis companion plugin name. */
+export declare const name = "cc-permission-rules-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Validate one `permission/mode` event against its closed vocabularies. `plan`
+ * is never writable through this event (it is owned by plan-mode's `plan/mode`),
+ * and `resumeSandbox` must be a known sandbox mode when present.
+ * @param event - the session event to validate.
+ * @param fail - reporter bound to this package, throwing on violation.
+ */
+export declare function assertPermissionModeEvent(event: SessionEvent, fail: InvariantFailure): void;
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/invariant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.d.ts","sourceRoot":"","sources":["../src/invariant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAsB,MAAM,6BAA6B,CAAA;AAMvF,oCAAoC;AACpC,eAAO,MAAM,IAAI,kCAAkC,CAAA;AACnD,2EAA2E;AAC3E,eAAO,MAAM,MAAM,UAAiB,CAAA;AAEpC;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAU3F;AAgBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,GAAI,KAAK,OAAO,KAAG,OAAO,CAAC,MAAM,IAAI,CACU,CAAA"}

package/lib/invariant.js

@@ -0,0 +1,54 @@
+/**
+ * Package-owned invariant companion for `@dsh-cc/permission-rules`.
+ * Guards the closed vocabulary of durable `permission/mode` session events and
+ * rejects illegal payloads at the session boundary.
+ * @module @dsh-cc/permission-rules/invariant
+ */
+import { SANDBOX_MODES } from '@deepseek-ai/dsh-sandbox-policy';
+import { SWITCHABLE_PERMISSION_MODES } from "./types.js";
+const PACKAGE_NAME = '@dsh-cc/permission-rules';
+/** Cordis companion plugin name. */
+export const name = 'cc-permission-rules-invariant';
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants'];
+/**
+ * Validate one `permission/mode` event against its closed vocabularies. `plan`
+ * is never writable through this event (it is owned by plan-mode's `plan/mode`),
+ * and `resumeSandbox` must be a known sandbox mode when present.
+ * @param event - the session event to validate.
+ * @param fail - reporter bound to this package, throwing on violation.
+ */
+export function assertPermissionModeEvent(event, fail) {
+    const wire = event;
+    if (wire.type !== 'permission/mode')
+        return;
+    const data = wire.data;
+    if (!SWITCHABLE_PERMISSION_MODES.includes(data.mode)) {
+        fail(`permission/mode carries unknown mode ${JSON.stringify(data.mode)} (plan is owned by plan-mode)`);
+    }
+    if (data.resumeSandbox !== undefined && !SANDBOX_MODES.includes(data.resumeSandbox)) {
+        fail(`permission/mode carries unknown resumeSandbox ${JSON.stringify(data.resumeSandbox)}`);
+    }
+}
+/** Install closed-vocabulary checks on durable permission/mode events. */
+const install = Object.assign((ctx, fail) => {
+    const seed = (session) => {
+        for (const event of session.events)
+            assertPermissionModeEvent(event, fail);
+    };
+    for (const session of ctx.sessions.list())
+        seed(session);
+    ctx.on('session/created', (session) => { seed(session); }, { global: true });
+    ctx.on('session/event', (session, event) => {
+        void session;
+        assertPermissionModeEvent(event, fail);
+    }, { global: true });
+}, { inject: ['sessions'] });
+/* jscpd:ignore-end */
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/lib/invariant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.js","sourceRoot":"","sources":["../src/invariant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AAE/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGxD,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAE/C,oCAAoC;AACpC,MAAM,CAAC,MAAM,IAAI,GAAG,+BAA+B,CAAA;AACnD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAmB,EAAE,IAAsB;IACnF,MAAM,IAAI,GAAG,KAAmE,CAAA;IAChF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAM;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,IAAI,CAAE,2BAAiD,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,GAAuB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAY,EAAE,IAAsB,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAQ,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;YAAE,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5E,CAAC,CAAA;IACD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACxD,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACzC,KAAK,OAAO,CAAA;QACZ,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AACtB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;AAC5B,sBAAsB;AAEtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAY,EAAuB,EAAE,CACzD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA"}

package/lib/llm-classifier.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The LLM risk classifier for `auto` mode: a one-shot auxiliary-model verdict
+ * (`allow` | `ask`) over the tool name plus rendered parameters, escalate-only
+ * and fail-safe (every failure ⇒ `ask`, never `allow`, never a throw).
+ *
+ * Dependency-light by design: the model seam (`stream`) is structural — the
+ * listener (Stage C) injects the real dsh-llm/alias wiring. The per-call route
+ * is passed as data (`classify(exec, { route })`), never resolved from ambient
+ * state, so concurrent calls cannot cross-contaminate. The result carries all
+ * digest/identity metadata the caller needs to audit; this module performs no
+ * session access and no I/O beyond the injected stream. Only `node:crypto` is
+ * imported.
+ *
+ * @module @dsh-cc/permission-rules/llm-classifier
+ */
+import type { ToolExecution } from '@dsh-cc/tools';
+/** A model verdict. `ask` is the only escalation the stage can produce. */
+export type LlmVerdict = {
+    verdict: 'allow';
+    reason: string;
+} | {
+    verdict: 'ask';
+    reason: string;
+};
+/**
+ * Why a classification failed. `unarmed` marks an unresolvable model route;
+ * `cancelled` marks a caller abort mid-flight (host noise, never a lane
+ * fault — the breaker stage never counts it).
+ */
+export type ClassifierFailure = 'timeout' | 'error' | 'malformed' | 'unarmed' | 'cancelled';
+/** The per-call route, passed as data instead of resolved from ambient state. */
+export type ClassifierRoute = {
+    provider: string;
+    model: string;
+};
+/** Durable audit record for one classify call. The raw input NEVER appears — only its digest. */
+export type ClassifierAuditEvent = {
+    tool: string;
+    /** sha256 of the rendered classifier input. */
+    digest: string;
+    verdict: 'allow' | 'ask';
+    failure?: ClassifierFailure;
+    /** The route identity used for the call (`provider/model`), when the route was armed. */
+    routeAlias?: string;
+    provider?: string;
+    model?: string;
+    latencyMs: number;
+    cacheHit: boolean;
+};
+/**
+ * A classification result: a verdict tagged with the failure kind when it did
+ * not come from a parseable model output, plus every digest/identity field the
+ * caller needs to build its audit record.
+ */
+export type LlmClassification = ClassifierAuditEvent & LlmVerdict;
+/** Structural face the listener injects. No dsh-llm imports in this module. */
+export type LlmClassifierDeps = {
+    stream(opts: {
+        provider: string;
+        model: string;
+        system: string;
+        prompt: string;
+        maxTokens: number;
+        signal?: AbortSignal;
+    }): Promise<string>;
+    /** Already $defaults-expanded prose rules. */
+    softDeny: readonly string[];
+    timeoutMs: number;
+    cacheMaxEntries: number;
+    /**
+     * Optional env-gated debug sink (process log — NEVER session events).
+     * When present, every raw model output is logged with the
+     * `[dsh:classifier:raw]` prefix, truncated to 2 KiB. Raw output may echo
+     * tool input (including secrets the agent was about to run), so this
+     * stays a deliberately opt-in channel with no redaction machinery.
+     */
+    debug?: (message: string) => void;
+};
+export type LlmClassifier = {
+    /**
+     * Never throws. Any failure ⇒ {verdict:'ask', reason} tagged with the
+     * failure kind. An undefined route ⇒ the 'unarmed' classification (the
+     * stream is never called).
+     */
+    classify(exec: ToolExecution, opts?: {
+        route?: ClassifierRoute;
+    }): Promise<LlmClassification>;
+};
+/**
+ * The documented CC classifier duties, as prose rules. Expanded into the
+ * config list wherever the literal `"$defaults"` appears (position-preserving).
+ */
+export declare const DEFAULT_SOFT_DENY: readonly string[];
+/**
+ * Expand the configured soft-deny list: every `"$defaults"` entry is replaced
+ * in place by {@link DEFAULT_SOFT_DENY}; a list without it replaces the
+ * built-ins entirely (CC semantics). Duplicates are preserved as written.
+ */
+export declare function expandSoftDeny(list: readonly string[]): string[];
+/** The session-scope cache key: tool, rendered input, and the soft-deny list all bust it. */
+export declare function classificationKey(toolName: string, renderedInput: string, softDeny: readonly string[]): string;
+/**
+ * Build the classifier. See the module doc for the contract: escalate-only,
+ * fail-to-ask, never throws, LRU-cached per (tool | input | soft-deny list).
+ */
+export declare function createLlmClassifier(deps: LlmClassifierDeps): LlmClassifier;
+//# sourceMappingURL=llm-classifier.d.ts.map

package/lib/llm-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-classifier.d.ts","sourceRoot":"","sources":["../src/llm-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAElG;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAA;AAE3F,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,iGAAiG;AACjG,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,GAAG,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,UAAU,CAAA;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3I,8CAA8C;IAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC9F,CAAA;AAeD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAO9C,CAAA;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOhE;AAMD,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE9G;AAmFD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA+F1E"}