@dsh-cc/permission-rules 0.5.0

package/lib/parser.js

@@ -0,0 +1,282 @@
+/**
+ * Rule-string syntax: `ToolName` or `ToolName(content)`, where `content` may
+ * escape `(`/`)`/`\` with a backslash, use `*` as a wildcard, or end in `:*`
+ * to declare a prefix rule. Parsing failures THROW so an invalid rule is
+ * reported at load time rather than silently mis-matching.
+ *
+ * Matching follows Claude Code shell-rule semantics on the CALL subject:
+ * `Bash(npm install)` is a prefix rule (any command starting with the text);
+ * `Bash(npm publish:*)` declares the prefix `npm publish:`; a `*` anywhere
+ * makes the content a wildcard glob. `\*` matches a literal asterisk.
+ *
+ * The module is browser-safe (pure string logic) so the host UI that previews
+ * rule hits can import it directly.
+ * @module @dsh-cc/permission-rules/parser
+ */
+import { domainMatches, isWebFetchRuleTool, parseDomainContent } from "./domain.js";
+/**
+ * Parse one rule string into a {@link ContentMatcher} for the given content.
+ * A content ending in `:*` yields a `prefix` matcher on the stem; otherwise
+ * an unescaped `*` yields a `wildcard` matcher; otherwise a `prefix` matcher
+ * on the whole content (the shell-rule convention).
+ * @param content - the unescaped rule content (may be empty for a whole-tool rule).
+ * @returns the matcher, or `undefined` for empty content (whole-tool rule).
+ */
+export function matchContent(content) {
+    if (content === '')
+        return undefined;
+    if (content.endsWith(':*')) {
+        // Legacy Claude Code prefix form: "npm publish:*" matches any command
+        // starting with "npm publish:" (the colon is part of the prefix).
+        return { kind: 'prefix', prefix: content.slice(0, -1) };
+    }
+    if (!hasUnescapedWildcard(content)) {
+        return { kind: 'prefix', prefix: content };
+    }
+    return { kind: 'wildcard', pattern: content };
+}
+/**
+ * Whether a content string holds an unescaped `*` (not `\*`).
+ * @param content - the string to inspect.
+ * @returns true when an asterisk is preceded by an even number of backslashes.
+ */
+export function hasUnescapedWildcard(content) {
+    for (let index = 0; index < content.length; index += 1) {
+        if (content[index] !== '*')
+            continue;
+        let backslashes = 0;
+        for (let j = index - 1; j >= 0 && content[j] === '\\'; j -= 1)
+            backslashes += 1;
+        if (backslashes % 2 === 0)
+            return true;
+    }
+    return false;
+}
+/** Whether an index is an unescaped occurrence of `char` (preceded by an even number of backslashes). */
+function isUnescapedAt(content, index, char) {
+    if (content[index] !== char)
+        return false;
+    let backslashes = 0;
+    for (let j = index - 1; j >= 0 && content[j] === '\\'; j -= 1)
+        backslashes += 1;
+    return backslashes % 2 === 0;
+}
+/** The first unescaped index of `char`, or -1. */
+function firstUnescaped(content, char) {
+    for (let index = 0; index < content.length; index += 1) {
+        if (isUnescapedAt(content, index, char))
+            return index;
+    }
+    return -1;
+}
+/** The last unescaped index of `char`, or -1. */
+function lastUnescaped(content, char) {
+    for (let index = content.length - 1; index >= 0; index -= 1) {
+        if (isUnescapedAt(content, index, char))
+            return index;
+    }
+    return -1;
+}
+/**
+ * Unescape rule content after parsing: `\(`→`(`, `\)`→`)`, then `\\`→`\`.
+ * Reverse of {@link escapeRuleContent}.
+ * @param content - escaped content, possibly containing `\(`, `\)`, `\\`.
+ * @returns the literal content.
+ */
+export function unescapeRuleContent(content) {
+    return content
+        .replace(/\\\(/g, '(')
+        .replace(/\\\)/g, ')')
+        .replace(/\\\\/g, '\\');
+}
+/**
+ * Escape rule content for safe storage in a `ToolName(content)` rule:
+ * `\`→`\\` first, then `(`→`\(` and `)`→`\)`.
+ * @param content - the literal content.
+ * @returns content with its parens and backslashes escaped.
+ */
+export function escapeRuleContent(content) {
+    return content
+        .replace(/\\/g, '\\\\')
+        .replace(/\(/g, '\\(')
+        .replace(/\)/g, '\\)');
+}
+/**
+ * Parse one rule string into a {@link RuleString}. Accepts `ToolName` or
+ * `ToolName(content)`. Rejects malformed input (empty tool name, unbalanced
+ * parens, trailing text after the closing paren) by throwing — the engine's
+ * fail-loud contract.
+ * @param rule - the rule string to parse.
+ * @returns the parsed tool name, optional content (unescaped), and optional matcher.
+ * @throws a `TypeError` describing the malformed rule.
+ */
+export function parseRuleString(rule) {
+    if (rule.trim() === '')
+        throw new TypeError('permission rule cannot be empty');
+    const open = firstUnescaped(rule, '(');
+    if (open === -1) {
+        return { toolName: rule.trim() };
+    }
+    const close = lastUnescaped(rule, ')');
+    if (close === -1) {
+        throw new TypeError(`permission rule "${rule}" has an opening "(" with no unescaped ")"`);
+    }
+    if (close !== rule.length - 1) {
+        throw new TypeError(`permission rule "${rule}" has content after its closing ")"`);
+    }
+    const toolName = rule.slice(0, open).trim();
+    if (toolName === '') {
+        throw new TypeError(`permission rule "${rule}" has content but no tool name`);
+    }
+    const rawContent = rule.slice(open + 1, close);
+    const content = unescapeRuleContent(rawContent);
+    if (content === '' || content === '*') {
+        // Empty or single-wildcard content is a whole-tool rule, as in Claude Code.
+        return { toolName };
+    }
+    // WebFetch domain rules take their own matcher shape; other tools (e.g.
+    // `Bash(domain:example.com)`) keep the plain prefix convention.
+    if (isWebFetchRuleTool(toolName) && /^domain:/i.test(content)) {
+        const matcher = parseDomainContent(content);
+        return { toolName, content, matcher };
+    }
+    const matcher = matchContent(content);
+    // Content is non-empty and not a bare `*`, so a matcher is always derived.
+    if (matcher === undefined)
+        return { toolName };
+    return { toolName, content, matcher };
+}
+/**
+ * Render a rule back to its canonical string form with content escaped.
+ * @param toolName - the tool name.
+ * @param content - optional content.
+ * @returns the round-trippable rule string.
+ */
+export function ruleString(toolName, content) {
+    return content === undefined || content === '' ? toolName : `${toolName}(${escapeRuleContent(content)})`;
+}
+/**
+ * Whether a call subject matches a content matcher.
+ * @param matcher - the rule's content matcher.
+ * @param matcher - subject to test.
+ * @returns true on a match.
+ */
+export function contentMatches(matcher, subject) {
+    if (matcher.kind === 'prefix')
+        return subject.startsWith(matcher.prefix);
+    if (matcher.kind === 'domain')
+        return domainMatches(matcher.hostname, subject);
+    return wildcardMatches(matcher.pattern, subject);
+}
+/**
+ * Whether a subject matches a `*` wildcard pattern; `\*` matches a literal
+ * asterisk and `\\` a literal backslash. `*` matches any run of characters.
+ * @param pattern - the wildcard pattern.
+ * @param subject - the string to test.
+ * @returns true when the pattern matches.
+ */
+export function wildcardMatches(pattern, subject) {
+    const tokens = tokenizeWildcard(pattern);
+    const hasStar = tokens.some(token => token.kind === 'star');
+    if (!hasStar) {
+        return literalSegments(tokens).reduce((acc, token) => acc + token.value, '') === subject;
+    }
+    const segments = literalSegments(tokens);
+    if (segments.length === 0)
+        return true;
+    const isStart = tokens[0]?.kind === 'literal';
+    const isEnd = tokens[tokens.length - 1]?.kind === 'literal';
+    let position = 0;
+    if (isStart) {
+        const first = segments[0];
+        if (first === undefined)
+            return false;
+        if (!subject.startsWith(first.value))
+            return false;
+        position = first.value.length;
+    }
+    const lastIndex = segments.length - 1;
+    const firstMiddle = isStart ? 1 : 0;
+    const lastMiddle = isEnd ? lastIndex - 1 : lastIndex;
+    for (let index = firstMiddle; index <= lastMiddle; index += 1) {
+        const segment = segments[index];
+        if (segment === undefined)
+            return false;
+        const at = subject.indexOf(segment.value, position);
+        if (at === -1)
+            return false;
+        position = at + segment.value.length;
+    }
+    if (isEnd) {
+        const endSegment = segments[lastIndex];
+        if (endSegment === undefined)
+            return false;
+        return subject.endsWith(endSegment.value) && position <= subject.length - endSegment.value.length;
+    }
+    return true;
+}
+/** The literal tokens of a token array, in order (star gaps removed). */
+function literalSegments(tokens) {
+    return tokens.filter((token) => token.kind === 'literal');
+}
+/** Split a wildcard pattern into star/literal tokens, expanding `\*` and `\\`. */
+function tokenizeWildcard(pattern) {
+    const tokens = [];
+    let buffer = '';
+    const flush = () => {
+        if (buffer !== '') {
+            tokens.push({ kind: 'literal', value: buffer });
+            buffer = '';
+        }
+    };
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === '\\' && index + 1 < pattern.length) {
+            const next = pattern[index + 1];
+            if (next === '*') {
+                buffer += '*';
+                index += 1;
+                continue;
+            }
+            if (next === '\\') {
+                buffer += '\\';
+                index += 1;
+                continue;
+            }
+            buffer += char;
+            continue;
+        }
+        if (char === '*') {
+            flush();
+            tokens.push({ kind: 'star' });
+            continue;
+        }
+        buffer += char;
+    }
+    flush();
+    return tokens;
+}
+/**
+ * Build a parsed, source-labelled rule from a rule string.
+ * @param rule - the rule string (`ToolName` or `ToolName(content)`).
+ * @param behavior - the behavior this rule prescribes.
+ * @param source - the rule's provenance, used for evaluation priority.
+ * @returns the parsed rule.
+ * @throws a `TypeError` when the rule string is malformed.
+ */
+export function parseRule(rule, behavior, source) {
+    const parsed = parseRuleString(rule);
+    if (parsed.content === undefined) {
+        return { toolName: parsed.toolName, behavior, source };
+    }
+    // parseRuleString derives a matcher for every non-empty content, so the
+    // optional types are co-present by construction.
+    return {
+        toolName: parsed.toolName,
+        content: parsed.content,
+        matcher: parsed.matcher,
+        behavior,
+        source,
+    };
+}
+//# sourceMappingURL=parser.js.map

package/lib/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sEAAsE;QACtE,kEAAkE;QAClE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,SAAQ;QACpC,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YAAE,WAAW,IAAI,CAAC,CAAA;QAC/E,IAAI,WAAW,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yGAAyG;AACzG,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY;IACjE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAAE,WAAW,IAAI,CAAC,CAAA;IAC/E,OAAO,WAAW,GAAG,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,kDAAkD;AAClD,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;IACvD,CAAC;IACD,OAAO,CAAC,CAAC,CAAA;AACX,CAAC;AAED,iDAAiD;AACjD,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;IACvD,CAAC;IACD,OAAO,CAAC,CAAC,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,OAAO;SACX,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO;SACX,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;IAC9E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,4CAA4C,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3C,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,gCAAgC,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACtC,4EAA4E;QAC5E,OAAO,EAAE,QAAQ,EAAE,CAAA;IACrB,CAAC;IACD,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACrC,2EAA2E;IAC3E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAgB;IAC3D,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAA;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB,EAAE,OAAe;IACrE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9E,OAAO,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAe;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAA;IAC3D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAClD,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAA;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpD,KAAK,IAAI,KAAK,GAAG,WAAW,EAAE,KAAK,IAAI,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3B,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAC1C,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAA;IACnG,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAOD,yEAAyE;AACzE,SAAS,eAAe,CAAC,MAAuB;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;AAClF,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,MAAM,GAAG,EAAE,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC/B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAA;gBACb,KAAK,IAAI,CAAC,CAAA;gBACV,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,IAAI,CAAA;gBACd,KAAK,IAAI,CAAC,CAAA;gBACV,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,IAAI,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,EAAE,CAAA;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7B,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,IAAI,CAAA;IAChB,CAAC;IACD,KAAK,EAAE,CAAA;IACP,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,QAA4B,EAC5B,MAA4B;IAE5B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IACxD,CAAC;IACD,wEAAwE;IACxE,iDAAiD;IACjD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAyB;QACzC,QAAQ;QACR,MAAM;KACP,CAAA;AACH,CAAC"}

package/lib/session-allowlist.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Session-scoped approval memory (WS4-PR-B). A per-session allowlist of
+ * permission rules the user granted through the "Allow for this session"
+ * approval option. Rules live in an in-memory `SessionAllowlist` map keyed by
+ * session id, and every grant (and clear) is also appended to the session log
+ * as a `permission/session-allow` audit event carrying a timestamp — the
+ * durable audit trail required by WS4. Session-scoped approvals never touch
+ * the `permissions` settings namespace, so they do not persist across
+ * sessions.
+ *
+ * Cross-repo event registration: this module adds `permission/session-allow`
+ * to the upstream `KNOWN_SESSION_EVENT_TYPES` set at load (same pattern as
+ * `permission/mode` in `./mode.ts`) so the persistence layer resumes logs
+ * containing it.
+ *
+ * @module @dsh-cc/permission-rules/session-allowlist
+ */
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session';
+import type { PermissionRule } from './types.ts';
+/** The session event type carrying a session-scoped approval audit record. */
+export declare const SESSION_ALLOW_EVENT = "permission/session-allow";
+/**
+ * The `permission/session-allow` payload as written by this plugin. `scope`
+ * distinguishes a user-granted session rule (`session`) from a sandbox
+ * escalation auto-approved by the WS3 approval-seam listener (`sandbox-auto`,
+ * which grants nothing — it only audits the auto-approval). `cleared` marks a
+ * session-allowlist wipe and folds by emptying the accumulated set.
+ */
+export interface SessionAllowEventData {
+    /** The permission rule granted, in `Bash(prefix )` / `Tool` string form. */
+    rule?: string;
+    /** What produced the record. */
+    scope: 'session' | 'sandbox-auto';
+    /** The tool the record is about (audit context). */
+    toolName: string;
+    /** Wall-clock time of the record (audit context). */
+    timestamp: number;
+    /** The asker's reason string, when the approval carried one. */
+    reason?: string;
+    /** Set on a clear record: everything before it is discarded by the fold. */
+    cleared?: boolean;
+}
+/**
+ * Append one `permission/session-allow` audit record to the session log.
+ * Goes through a widened append face (same cross-pin strategy as
+ * `./mode.ts`): the event type postdates the upstream session catalog.
+ */
+export declare function appendSessionAllow(session: Session, data: SessionAllowEventData): void;
+/**
+ * Fold a session log into the session-scoped allow rules it grants, in grant
+ * order. A `cleared` record empties the accumulated set (last-wins semantics
+ * for the clear). Sandbox-auto records carry no rule and contribute nothing.
+ * @param events - session events in log order (other event types are skipped).
+ * @returns the live session-scoped rules, source-labelled `session`.
+ */
+export declare function foldSessionAllows(events: readonly SessionEvent[]): PermissionRule[];
+/**
+ * The in-memory session-scoped allowlist: rules keyed by session id, checked
+ * by `decide()` before the MEDIUM early-return. Purely in-memory — a restart
+ * re-seeds from the session log's audit events (see {@link foldSessionAllows}),
+ * and a different session id sees nothing.
+ */
+export declare class SessionAllowlist {
+    private readonly bySession;
+    /** Grant one rule to a session (appends the audit event as a side effect). */
+    add(session: Session, rule: string): void;
+    /** Whether any session-scoped rule matches this call (tool name + subject). */
+    matches(sessionId: string, toolName: string, subject: string | undefined): boolean;
+    /** Drop every session-scoped rule for one session (appends a clear record). */
+    clear(session: Session): void;
+    /** Seed (or replace) one session's rules from its folded audit events. */
+    seed(sessionId: string, rules: readonly PermissionRule[]): void;
+    /** The parsed rules currently granted to one session (introspection). */
+    rulesOf(sessionId: string): readonly PermissionRule[];
+}
+//# sourceMappingURL=session-allowlist.d.ts.map

package/lib/session-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-allowlist.d.ts","sourceRoot":"","sources":["../src/session-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAGrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,6BAA6B,CAE5D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,KAAK,EAAE,SAAS,GAAG,cAAc,CAAA;IACjC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAaD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,cAAc,EAAE,CAYnF;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAEhE,8EAA8E;IAC9E,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAqBzC,+EAA+E;IAC/E,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAYlF,+EAA+E;IAC/E,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAY7B,0EAA0E;IAC1E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAQ/D,yEAAyE;IACzE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE;CAGtD"}

package/lib/session-allowlist.js

@@ -0,0 +1,122 @@
+/**
+ * Session-scoped approval memory (WS4-PR-B). A per-session allowlist of
+ * permission rules the user granted through the "Allow for this session"
+ * approval option. Rules live in an in-memory `SessionAllowlist` map keyed by
+ * session id, and every grant (and clear) is also appended to the session log
+ * as a `permission/session-allow` audit event carrying a timestamp — the
+ * durable audit trail required by WS4. Session-scoped approvals never touch
+ * the `permissions` settings namespace, so they do not persist across
+ * sessions.
+ *
+ * Cross-repo event registration: this module adds `permission/session-allow`
+ * to the upstream `KNOWN_SESSION_EVENT_TYPES` set at load (same pattern as
+ * `permission/mode` in `./mode.ts`) so the persistence layer resumes logs
+ * containing it.
+ *
+ * @module @dsh-cc/permission-rules/session-allowlist
+ */
+import { KNOWN_SESSION_EVENT_TYPES } from '@deepseek-ai/dsh-session';
+import { parseRule } from "./parser.js";
+import { ruleMatches, ruleMatchesTool } from "./matchers.js";
+/** The session event type carrying a session-scoped approval audit record. */
+export const SESSION_ALLOW_EVENT = 'permission/session-allow';
+KNOWN_SESSION_EVENT_TYPES.add(SESSION_ALLOW_EVENT);
+/** Read a log event through the extended `permission/session-allow` face. */
+function asAllowEvent(event) {
+    return event;
+}
+/**
+ * Append one `permission/session-allow` audit record to the session log.
+ * Goes through a widened append face (same cross-pin strategy as
+ * `./mode.ts`): the event type postdates the upstream session catalog.
+ */
+export function appendSessionAllow(session, data) {
+    session.append(SESSION_ALLOW_EVENT, data);
+}
+/**
+ * Fold a session log into the session-scoped allow rules it grants, in grant
+ * order. A `cleared` record empties the accumulated set (last-wins semantics
+ * for the clear). Sandbox-auto records carry no rule and contribute nothing.
+ * @param events - session events in log order (other event types are skipped).
+ * @returns the live session-scoped rules, source-labelled `session`.
+ */
+export function foldSessionAllows(events) {
+    const raw = [];
+    for (const event of events) {
+        const wire = asAllowEvent(event);
+        if (wire.type !== SESSION_ALLOW_EVENT)
+            continue;
+        if (wire.data?.cleared === true) {
+            raw.length = 0;
+            continue;
+        }
+        if (typeof wire.data?.rule === 'string' && wire.data.rule !== '')
+            raw.push(wire.data.rule);
+    }
+    return raw.map(ruleRaw => parseRule(ruleRaw, 'allow', 'session'));
+}
+/**
+ * The in-memory session-scoped allowlist: rules keyed by session id, checked
+ * by `decide()` before the MEDIUM early-return. Purely in-memory — a restart
+ * re-seeds from the session log's audit events (see {@link foldSessionAllows}),
+ * and a different session id sees nothing.
+ */
+export class SessionAllowlist {
+    bySession = new Map();
+    /** Grant one rule to a session (appends the audit event as a side effect). */
+    add(session, rule) {
+        const id = String(session.id);
+        const parsed = parseRule(rule, 'allow', 'session');
+        const rules = this.bySession.get(id) ?? [];
+        if (!rules.some(existing => existing.toolName === parsed.toolName
+            && existing.content === parsed.content
+            && existing.matcher === parsed.matcher
+            && existing.behavior === parsed.behavior)) {
+            rules.push(parsed);
+            this.bySession.set(id, rules);
+        }
+        appendSessionAllow(session, {
+            rule,
+            scope: 'session',
+            toolName: parsed.toolName,
+            timestamp: Date.now(),
+        });
+    }
+    /** Whether any session-scoped rule matches this call (tool name + subject). */
+    matches(sessionId, toolName, subject) {
+        const rules = this.bySession.get(sessionId);
+        if (rules === undefined)
+            return false;
+        // `ruleMatches` is content-only (a whole-tool rule never matches it), so
+        // whole-tool session grants match through `ruleMatchesTool` directly.
+        return rules.some(rule => rule.content === undefined
+            ? ruleMatchesTool(rule, toolName)
+            : subject !== undefined && ruleMatches(rule, toolName, subject));
+    }
+    /** Drop every session-scoped rule for one session (appends a clear record). */
+    clear(session) {
+        const id = String(session.id);
+        if (!this.bySession.has(id))
+            return;
+        this.bySession.delete(id);
+        appendSessionAllow(session, {
+            scope: 'session',
+            toolName: '*',
+            timestamp: Date.now(),
+            cleared: true,
+        });
+    }
+    /** Seed (or replace) one session's rules from its folded audit events. */
+    seed(sessionId, rules) {
+        if (rules.length === 0) {
+            this.bySession.delete(sessionId);
+            return;
+        }
+        this.bySession.set(sessionId, [...rules]);
+    }
+    /** The parsed rules currently granted to one session (introspection). */
+    rulesOf(sessionId) {
+        return this.bySession.get(sessionId) ?? [];
+    }
+}
+//# sourceMappingURL=session-allowlist.js.map

package/lib/session-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-allowlist.js","sourceRoot":"","sources":["../src/session-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAG5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAE5D;AAAC,yBAAyC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AA8BpE,6EAA6E;AAC7E,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,KAAoC,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB,EAAE,IAA2B;IAE5E,OAAiC,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAQ;QAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACV,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAA;IAEhE,8EAA8E;IAC9E,GAAG,CAAC,OAAgB,EAAE,IAAY;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACzB,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;eAClC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;eACnC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;eACnC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CACzC,EAAE,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,kBAAkB,CAAC,OAAO,EAAE;YAC1B,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE,OAA2B;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvB,IAAI,CAAC,OAAO,KAAK,SAAS;YACxB,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YACjC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAClE,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAgB;QACpB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,kBAAkB,CAAC,OAAO,EAAE;YAC1B,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,SAAiB,EAAE,KAAgC;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC5C,CAAC;CACF"}

package/lib/settings-schema.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Plugin-facing settings/config shapes for the permission-rule engine: the
+ * local `permissions` section schema (hand-mirroring the shared cascade
+ * schemas — no cross-package dependency), the Config-provided rule set, and
+ * the plugin Config schema. Kept separate from the service so the plugin
+ * entry stays under the file-size gate.
+ *
+ * @module @dsh-cc/permission-rules/settings-schema
+ */
+import z from '@deepseek-ai/schemastery';
+import { type PermissionMode, type PermissionRuleSource } from './types.ts';
+import type { AutoModeSettings } from './auto-stage.ts';
+/** The settings section resolved from the settings document. */
+export interface PermissionSettings {
+    /** Whole-tool or content rules that allow matching calls. */
+    allow?: string[];
+    /** Whole-tool or content rules that deny matching calls. */
+    deny?: string[];
+    /** Whole-tool or content rules that route matching calls to approval. */
+    ask?: string[];
+    /** Default permission mode for sessions without a recorded override. */
+    defaultMode?: PermissionMode;
+    /** `'disable'` turns off the ability to switch to `bypassPermissions`. */
+    disableBypassPermissionsMode?: 'disable';
+    /** Additional directories included in the permission scope (escape-check base). */
+    additionalDirectories?: string[];
+    /** Protected file wildcard patterns — writes to them are high risk. */
+    protectedFiles?: string[];
+    /** Raw dangerous-command regex sources replacing the curated defaults. */
+    dangerousPatterns?: string[];
+    /**
+     * Optional LLM risk-classifier configuration for `auto` mode (hand-mirrors
+     * the shared `AutoModeSchema`): `soft_deny` prose list plus a `classifier`
+     * sub-object. Absent ⇒ the stage stays disarmed (no defaults materialized).
+     */
+    autoMode?: AutoModeSettings;
+}
+/** The Config-provided rule set: strings parsed as source-`config` rules. */
+export interface ConfigRules {
+    /** Allow rules. */
+    allow?: string[];
+    /** Deny rules. */
+    deny?: string[];
+    /** Ask rules. */
+    ask?: string[];
+    /**
+     * Bypass-immune deny rules (e.g. `.git` internals, shell-config paths):
+     * enforced through the monotonic guard layer, never overridable by a mode
+     * switch or `bypassPermissions`.
+     */
+    bypassImmune?: string[];
+}
+/** Plugin config. All optional; the schema applies the defaults shown. */
+export interface Config {
+    /**
+     * The rule set provided directly by composition, parsed with source
+     * `config`. Merged with the optional settings section by source priority
+     * (settings rules win).
+     */
+    rules?: ConfigRules;
+    /** Settings namespace holding allow/deny/ask/defaultMode; defaults to `permissions`. */
+    settingsNamespace?: string;
+    /**
+     * The source label applied to settings-resolved rules; defaults to
+     * `userSettings`. Lets a deployment attribute settings rules to a different
+     * settings layer (project/local/…).
+     */
+    settingsSource?: PermissionRuleSource;
+    /** Default mode for sessions without an in-memory mode override; defaults to `default`. */
+    defaultMode?: PermissionMode;
+    /** Tool name treated as the shell-command tool for content extraction; defaults to `Bash`. */
+    bashToolName?: string;
+    /** File-edit tool names auto-allowed under `acceptEdits` mode. */
+    fileEditTools?: string[];
+    /** Read-only tool names auto-allowed under `plan` mode. */
+    readOnlyTools?: string[];
+    /**
+     * Skip a whole-tool `ask` for a sandboxed (confining, non-full-access)
+     * `Bash` call — allow instead. Defaults to `false`.
+     */
+    exemptSandboxedBashFromToolAsk?: boolean;
+    /** Whether `bypassPermissions` mode is disabled (falls back to `default`). */
+    disableBypassPermissionsMode?: boolean;
+    /**
+     * Whether the risk-classifier escalation stage runs inside the decision
+     * flow (catastrophic commands hard-deny; protected/out-of-scope file writes
+     * ask unless under `bypassPermissions`). Defaults to `true`.
+     */
+    classifierEnabled?: boolean;
+}
+/** The standard file-edit tool set, applied when {@link Config.fileEditTools} is omitted. */
+export declare const DEFAULT_FILE_EDIT_TOOLS: string[];
+/** The standard read-only tool set, applied when {@link Config.readOnlyTools} is omitted. */
+export declare const DEFAULT_READ_ONLY_TOOLS: string[];
+/** The shared settings schema (Config-facing and settings-provider-facing). */
+export declare function permissionSettingsSchema(): z<PermissionSettings>;
+/** The plugin Config schema (defaults applied by schemastery). */
+export declare const ConfigSchema: z<Config>;
+//# sourceMappingURL=settings-schema.d.ts.map

package/lib/settings-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-schema.d.ts","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAqC,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAC9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,cAAc,CAAA;IAC5B,0EAA0E;IAC1E,4BAA4B,CAAC,EAAE,SAAS,CAAA;IACxC,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,cAAc,CAAA;IAC5B,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAA;IACxC,8EAA8E;IAC9E,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,UAAyE,CAAA;AAE7G,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,UAAgE,CAAA;AAUpG,+EAA+E;AAC/E,wBAAgB,wBAAwB,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAqBhE;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,MAAM,CAgBjC,CAAA"}