@dsh-cc/permission-rules 0.5.0

package/lib/settings-schema.js

@@ -0,0 +1,64 @@
+/**
+ * Plugin-facing settings/config shapes for the permission-rule engine: the
+ * local `permissions` section schema (hand-mirroring the shared cascade
+ * schemas — no cross-package dependency), the Config-provided rule set, and
+ * the plugin Config schema. Kept separate from the service so the plugin
+ * entry stays under the file-size gate.
+ *
+ * @module @dsh-cc/permission-rules/settings-schema
+ */
+import z from '@deepseek-ai/schemastery';
+import { PERMISSION_MODES, SOURCE_PRIORITY } from "./types.js";
+/** The standard file-edit tool set, applied when {@link Config.fileEditTools} is omitted. */
+export const DEFAULT_FILE_EDIT_TOOLS = ['edit', 'write', 'multi_edit', 'notebook_edit', 'str_replace_editor'];
+/** The standard read-only tool set, applied when {@link Config.readOnlyTools} is omitted. */
+export const DEFAULT_READ_ONLY_TOOLS = ['read', 'glob', 'grep', 'search', 'web_fetch', 'web_search'];
+/** The classifier sub-object schema: defaults apply only when the object is present. */
+const autoModeClassifierSchema = z.object({
+    enabled: z.boolean().default(false),
+    route: z.string().default('haiku'),
+    timeoutMs: z.number().default(8000),
+    cacheMaxEntries: z.number().default(256),
+});
+/** The shared settings schema (Config-facing and settings-provider-facing). */
+export function permissionSettingsSchema() {
+    return z.object({
+        allow: z.array(z.string()),
+        deny: z.array(z.string()),
+        ask: z.array(z.string()),
+        defaultMode: z.union(PERMISSION_MODES),
+        disableBypassPermissionsMode: z.union(['disable']),
+        additionalDirectories: z.array(z.string()),
+        protectedFiles: z.array(z.string()),
+        dangerousPatterns: z.array(z.string()),
+        // Union with `undefined` keeps an absent `autoMode` key absent — no
+        // defaults materialized, the classifier stays disarmed (mirrors the
+        // shared AutoModeSchema union-with-undefined idiom).
+        autoMode: z.union([
+            z.object({
+                soft_deny: z.union([z.array(z.string()), z.const(undefined)]),
+                classifier: z.union([autoModeClassifierSchema, z.const(undefined)]),
+            }),
+            z.const(undefined),
+        ]),
+    });
+}
+/** The plugin Config schema (defaults applied by schemastery). */
+export const ConfigSchema = z.object({
+    rules: z.object({
+        allow: z.array(z.string()),
+        deny: z.array(z.string()),
+        ask: z.array(z.string()),
+        bypassImmune: z.array(z.string()),
+    }),
+    settingsNamespace: z.string().default('permissions'),
+    settingsSource: z.union(SOURCE_PRIORITY).default('userSettings'),
+    defaultMode: z.union(PERMISSION_MODES).default('default'),
+    bashToolName: z.string().default('Bash'),
+    fileEditTools: z.array(z.string()).default(DEFAULT_FILE_EDIT_TOOLS),
+    readOnlyTools: z.array(z.string()).default(DEFAULT_READ_ONLY_TOOLS),
+    exemptSandboxedBashFromToolAsk: z.boolean().default(false),
+    disableBypassPermissionsMode: z.boolean().default(false),
+    classifierEnabled: z.boolean().default(true),
+});
+//# sourceMappingURL=settings-schema.js.map

package/lib/settings-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-schema.js","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAkD,MAAM,YAAY,CAAA;AAoF9G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAA;AAE7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;AAEpG,wFAAwF;AACxF,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAEF,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAoC,CAAC;QAC1D,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAU,CAAC;QAC3D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,oEAAoE;QACpE,oEAAoE;QACpE,qDAAqD;QACrD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,MAAM,CAAC;gBACP,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;aACpE,CAAC;YACF,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;SACnB,CAAC;KACH,CAAqC,CAAA;AACxC,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAc,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,eAAyC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAoC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACnE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACnE,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1D,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC7C,CAAC,CAAA"}

package/lib/types.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Shared types for the permission-rule engine: rule, source, mode, and the
+ * pure evaluation decision. Browser-safe — no Cordis/session imports, so the
+ * host UI (which previews what a rule hits) can import this subpath directly.
+ * @module @dsh-cc/permission-rules/types
+ */
+/** Where a {@link PermissionRule} came from, in descending evaluation priority. */
+export type PermissionRuleSource = 
+/** Highest priority — a rule imposed by the delegation/session layer. */
+'session'
+/** A rule passed on the command line at launch. */
+ | 'cliArg'
+/** A rule imposed by an external policy document. */
+ | 'policySettings'
+/** A rule from a feature-flag or launch-flag settings layer. */
+ | 'flagSettings'
+/** A rule from the local (machine-scoped) settings layer. */
+ | 'localSettings'
+/** A rule from the project/workspace-scoped settings layer. */
+ | 'projectSettings'
+/** A rule from the user settings layer. */
+ | 'userSettings'
+/** Lowest priority — a rule from the plugin's composition `Config`. */
+ | 'config';
+/**
+ * Every {@link PermissionRuleSource} ordered highest-priority first. Content
+ * rules are consulted in this order; the first source with a matching rule
+ * decides. Ties within one source fall back to declaration order.
+ */
+export declare const SOURCE_PRIORITY: readonly PermissionRuleSource[];
+/** The behavior a rule prescribes when its tool (and content, when present) matches. */
+export type PermissionBehavior = 'allow' | 'deny' | 'ask';
+/** The engine's permission mode, controlling tool-class and safe-mode short-circuits. */
+export type PermissionMode = 'default' | 'acceptEdits' | 'plan' | 'bypassPermissions' | 'auto';
+/** Every {@link PermissionMode}, for option advertisement and runtime validation of untrusted strings. */
+export declare const PERMISSION_MODES: readonly PermissionMode[];
+/** Modes that may be written to a `permission/mode` event. `plan` is owned by plan-mode. */
+export type SwitchablePermissionMode = Exclude<PermissionMode, 'plan'>;
+export declare const SWITCHABLE_PERMISSION_MODES: readonly SwitchablePermissionMode[];
+/**
+ * Reason attached to a plan-mode denial of a non-read-only call. Lives here
+ * (not in `mode.ts`) so the browser-safe `evaluate` module can import it
+ * without pulling in the session-vocabulary side effect.
+ */
+export declare const PLAN_READONLY_REASON = "plan mode is read-only; submit via exit_plan_mode";
+/**
+ * One parsed permission rule. `toolName` is the exact tool the rule governs;
+ * `content` makes it a content-level rule (matched against the tool's subject
+ * string, e.g. a shell command or a file path) rather than a whole-tool rule.
+ */
+export interface PermissionRule {
+    /** The exact tool name this rule governs. */
+    readonly toolName: string;
+    /**
+     * The content subject, when present: matched against the tool call's
+     * subject string with the rule's {@link ContentMatcher}. Absent means the
+     * rule is whole-tool.
+     */
+    readonly content?: string;
+    /** How to compare a call's subject against {@link PermissionRule.content}. */
+    readonly matcher?: ContentMatcher;
+    /** The behavior this rule prescribes on a match. */
+    readonly behavior: PermissionBehavior;
+    /** Where this rule came from, used for priority when several match. */
+    readonly source: PermissionRuleSource;
+}
+/**
+ * How a content rule compares a call's subject against its declared content.
+ * A `wildcard` pattern uses `*` to match any run of characters (`\*` is a
+ * literal asterisk); a `prefix` rule matches any subject starting with the
+ * string; a `domain` rule (WebFetch only) matches the call's canonicalized
+ * URL hostname against a domain pattern (exact, `*.suffix` subdomain-tree, or
+ * single-label `*` wildcards).
+ */
+export type ContentMatcher = {
+    kind: 'wildcard';
+    pattern: string;
+} | {
+    kind: 'prefix';
+    prefix: string;
+} | {
+    kind: 'domain';
+    hostname: string;
+};
+/** A group of rules by behavior, used as the engine's rule input. */
+export interface PermissionRuleSet {
+    /** Rules that allow matching calls. */
+    readonly allow: readonly PermissionRule[];
+    /** Rules that deny matching calls. */
+    readonly deny: readonly PermissionRule[];
+    /** Rules that route matching calls to an approval question. */
+    readonly ask: readonly PermissionRule[];
+    /**
+     * Bypass-immune deny rules, consulted BEFORE any mode logic and enforced
+     * through the monotonic guard layer so neither a mode switch nor
+     * `bypassPermissions` can override them (e.g. dotfiles, shell config paths,
+     * `.git` internals).
+     */
+    readonly bypassImmune: readonly PermissionRule[];
+}
+/** A rule set with empty arrays (the no-rules input). */
+export declare const EMPTY_RULE_SET: PermissionRuleSet;
+/**
+ * The engine's decision for one call, consumed by the `tools/pre-execute`
+ * listener. `passthrough` falls through to downstream listeners (ultimately
+ * the approval seam).
+ */
+export type PermissionDecision = {
+    kind: 'allow';
+} | {
+    kind: 'deny';
+    reason: string;
+} | {
+    kind: 'ask';
+    reason?: string;
+} | {
+    kind: 'passthrough';
+};
+/** The input the pure {@link evaluatePermission} folds a decision from. */
+export interface EvaluationInput {
+    /** The tool being called. */
+    readonly toolName: string;
+    /** The call's subject string (shell command, file path), when it has one. */
+    readonly subject?: string;
+    /** The rules to evaluate, already parsed and source-labelled. */
+    readonly rules: PermissionRuleSet;
+    /** The active permission mode. */
+    readonly mode: PermissionMode;
+    /** Whether `bypassPermissions` mode is disabled (fall back to `default`). */
+    readonly bypassDisabled?: boolean;
+    /**
+     * Whether the call is a file-edit tool (auto-allowed under `acceptEdits`).
+     * Resolved from a configured tool-name set by the plugin, or provided
+     * directly by a host UI caller.
+     */
+    readonly isFileEdit?: boolean;
+    /**
+     * Whether a sandboxed bash call should skip a whole-tool `ask` (allowed
+     * instead). The plugin resolves this from the shell's confining sandbox;
+     * host callers may compute it directly.
+     */
+    readonly sandboxedBashExempt?: boolean;
+    /**
+     * Whether the call is read-only (auto-allowed under `plan` mode). Resolved
+     * from a configured tool-name set by the plugin.
+     */
+    readonly isReadOnly?: boolean;
+}
+export default PermissionRule;
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,mFAAmF;AACnF,MAAM,MAAM,oBAAoB;AAC9B,yEAAyE;AACvE,SAAS;AACX,mDAAmD;GACjD,QAAQ;AACV,qDAAqD;GACnD,gBAAgB;AAClB,gEAAgE;GAC9D,cAAc;AAChB,6DAA6D;GAC3D,eAAe;AACjB,+DAA+D;GAC7D,iBAAiB;AACnB,2CAA2C;GACzC,cAAc;AAChB,uEAAuE;GACrE,QAAQ,CAAA;AAEZ;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,oBAAoB,EAS1D,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEzD,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,mBAAmB,GAAG,MAAM,CAAA;AAE9F,0GAA0G;AAC1G,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAoE,CAAA;AAE1H,4FAA4F;AAC5F,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AACtE,eAAO,MAAM,2BAA2B,EAAE,SAAS,wBAAwB,EAA4D,CAAA;AAEvI;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,sDAAsD,CAAA;AAEvF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAExC,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAA;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,SAAS,cAAc,EAAE,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;CACjD;AAED,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,iBAAsE,CAAA;AAEnG;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAA;AAE3B,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,eAAe,cAAc,CAAA"}

package/lib/types.js

@@ -0,0 +1,33 @@
+/**
+ * Shared types for the permission-rule engine: rule, source, mode, and the
+ * pure evaluation decision. Browser-safe — no Cordis/session imports, so the
+ * host UI (which previews what a rule hits) can import this subpath directly.
+ * @module @dsh-cc/permission-rules/types
+ */
+/**
+ * Every {@link PermissionRuleSource} ordered highest-priority first. Content
+ * rules are consulted in this order; the first source with a matching rule
+ * decides. Ties within one source fall back to declaration order.
+ */
+export const SOURCE_PRIORITY = [
+    'session',
+    'cliArg',
+    'policySettings',
+    'flagSettings',
+    'localSettings',
+    'projectSettings',
+    'userSettings',
+    'config',
+];
+/** Every {@link PermissionMode}, for option advertisement and runtime validation of untrusted strings. */
+export const PERMISSION_MODES = ['default', 'acceptEdits', 'plan', 'bypassPermissions', 'auto'];
+export const SWITCHABLE_PERMISSION_MODES = ['default', 'acceptEdits', 'bypassPermissions', 'auto'];
+/**
+ * Reason attached to a plan-mode denial of a non-read-only call. Lives here
+ * (not in `mode.ts`) so the browser-safe `evaluate` module can import it
+ * without pulling in the session-vocabulary side effect.
+ */
+export const PLAN_READONLY_REASON = 'plan mode is read-only; submit via exit_plan_mode';
+/** A rule set with empty arrays (the no-rules input). */
+export const EMPTY_RULE_SET = { allow: [], deny: [], ask: [], bypassImmune: [] };
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqBH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,SAAS;IACT,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,QAAQ;CACT,CAAA;AAQD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAA;AAI1H,MAAM,CAAC,MAAM,2BAA2B,GAAwC,CAAC,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAA;AAEvI;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mDAAmD,CAAA;AAsDvF,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAsB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@dsh-cc/permission-rules",
+  "description": "Claude Code-compatible permission rule engine for DeepSeek Harness: rule parsing, mode-aware pre-execute evaluation, monotonic bypass-immune guards, and optional settings config",
+  "version": "0.5.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dsh-cc/dsh-cc.git",
+    "directory": "packages/interaction/permission-rules"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./types": {
+      "types": "./lib/types.d.ts",
+      "default": "./lib/types.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib"
+  ],
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@deepseek-ai/dsh-agent": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-plan-mode": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-scope": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-shell": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": ">=0.1.1-rc.2",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.1-rc.2",
+    "@deepseek-ai/cordis": ">=0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@dsh-cc/model-aliases": "^0.5.0",
+    "@dsh-cc/session-cwd": "^0.5.0",
+    "@dsh-cc/tools": "^0.5.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-agent": "link:../../../../deepseek-harness/packages/core/agent",
+    "@deepseek-ai/dsh-invariants": "link:../../../../deepseek-harness/packages/runtime-diagnostics/invariants",
+    "@deepseek-ai/dsh-plan-mode": "link:../../../../deepseek-harness/packages/plan/plan-mode",
+    "@deepseek-ai/dsh-sandbox": "link:../../../../deepseek-harness/packages/sandbox/sandbox",
+    "@deepseek-ai/dsh-sandbox-policy": "link:../../../../deepseek-harness/packages/sandbox/sandbox-policy",
+    "@deepseek-ai/dsh-scope": "link:../../../../deepseek-harness/packages/core/scope",
+    "@deepseek-ai/dsh-session": "link:../../../../deepseek-harness/packages/core/session",
+    "@deepseek-ai/dsh-shell": "link:../../../../deepseek-harness/packages/shell/shell",
+    "@deepseek-ai/dsh-settings": "link:../../../../deepseek-harness/packages/settings/settings",
+    "@dsh-cc/session-cwd": "link:../../workspace/session-cwd",
+    "@deepseek-ai/dsh-user-approval": "link:../../../../deepseek-harness/packages/interaction/user-approval",
+    "@deepseek-ai/cordis": "link:../../../../deepseek-harness/vendor/cordis",
+    "@deepseek-ai/schemastery": "link:../../../../deepseek-harness/vendor/schemastery",
+    "@deepseek-ai/dsh-llm": "link:../../../../deepseek-harness/packages/llm/llm",
+    "@deepseek-ai/dsh-system-prompt": "link:../../../../deepseek-harness/packages/core/system-prompt",
+    "@dsh-cc/tools": "^0.5.0",
+    "@dsh-cc/model-aliases": "^0.5.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}