@netcatty/dsh-guard 0.0.0-stage → 0.2.0

package/policy.json

@@ -0,0 +1,289 @@
+{
+  "$schema": "./policy.schema.json",
+  "permission": {
+    "*": "allow",
+    "approvalMode": "question",
+    "wrappers": "allow",
+    "redact": true,
+    "sessionApprovals": false,
+    "denyTools": [],
+    "path": {
+      "*": "allow",
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "*.env.example": "allow",
+      "*.pfx": "deny",
+      "*.p12": "deny",
+      "*/id_rsa": "deny",
+      "*/id_ed25519": "deny",
+      "*/id_ecdsa": "deny",
+      "*/id_dsa": "deny",
+      "~/.ssh/*": "deny",
+      "*/.ssh/*": "deny",
+      "~/.aws/*": "deny",
+      "*/.aws/*": "deny",
+      "~/.gnupg/*": "deny",
+      "*/.gnupg/*": "deny",
+      "~/.netrc": "deny",
+      "*/.netrc": "deny",
+      "~/.git-credentials": "deny",
+      "*/.git-credentials": "deny",
+      "~/.npmrc": "deny",
+      "*/.npmrc": "deny",
+      "~/.pypirc": "deny",
+      "~/.docker/config.json": "deny",
+      "*/.docker/config.json": "deny",
+      "~/.kube/config": "deny",
+      "*/.kube/config": "deny",
+      "~/.config/gh/hosts.yml": "deny",
+      "*/.config/gh/hosts.yml": "deny",
+      "~/.pi/agent/auth.json": "deny",
+      "~/.pi/agent/models.json": "deny",
+      "~/.pi/agent/models-store.json": "deny",
+      "~/.pi/agent/mcp.json": "deny",
+      "*/.dsh/.credentials.yaml": "deny"
+    },
+    "pathRead": {},
+    "pathWrite": {
+      "*": "allow",
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "*.env.example": "allow",
+      "*.pfx": "deny",
+      "*.p12": "deny",
+      "*/id_rsa": "deny",
+      "*/id_ed25519": "deny",
+      "*/id_ecdsa": "deny",
+      "*/id_dsa": "deny",
+      "~/.ssh/*": "deny",
+      "*/.ssh/*": "deny",
+      "~/.aws/*": "deny",
+      "*/.aws/*": "deny",
+      "~/.gnupg/*": "deny",
+      "*/.gnupg/*": "deny",
+      "~/.netrc": "deny",
+      "*/.netrc": "deny",
+      "~/.git-credentials": "deny",
+      "*/.git-credentials": "deny",
+      "~/.npmrc": "deny",
+      "*/.npmrc": "deny",
+      "~/.pypirc": "deny",
+      "~/.docker/config.json": "deny",
+      "*/.docker/config.json": "deny",
+      "~/.kube/config": "deny",
+      "*/.kube/config": "deny",
+      "~/.config/gh/hosts.yml": "deny",
+      "*/.config/gh/hosts.yml": "deny",
+      "~/.pi/agent/auth.json": "deny",
+      "~/.pi/agent/models.json": "deny",
+      "~/.pi/agent/models-store.json": "deny",
+      "~/.pi/agent/mcp.json": "deny",
+      "~/.pi/agent/settings.json": "ask",
+      "~/.pi/agent/trust.json": "ask",
+      "~/.pi/agent/SYSTEM.md": "ask",
+      "~/.pi/agent/APPEND_SYSTEM.md": "ask",
+      "~/.pi/agent/npm/package.json": "ask",
+      "~/.pi/agent/npm/package-lock.json": "ask",
+      "~/.pi/agent/extensions/*": "ask"
+    },
+    "externalDirectory": {
+      "*": "allow"
+    },
+    "bash": {
+      "*": "allow",
+      "rm *": "ask",
+      "del *": "ask",
+      "erase *": "ask",
+      "rd *": "ask",
+      "rmdir *": "ask",
+      "mv *": "ask",
+      "ren *": "ask",
+      "rename *": "ask",
+      "format *": "ask",
+      "reg delete *": "ask",
+      "git push *": "ask",
+      "git reset --hard *": "ask",
+      "git checkout -- *": "ask",
+      "git restore *": "ask",
+      "git clean *": "ask",
+      "git branch -D *": "ask",
+      "git stash drop *": "ask",
+      "git stash clear *": "ask",
+      "curl *": "ask",
+      "wget *": "ask",
+      "iwr *": "ask",
+      "irm *": "ask",
+      "Invoke-WebRequest *": "ask",
+      "Invoke-RestMethod *": "ask",
+      "ssh *": "ask",
+      "scp *": "ask",
+      "sftp *": "ask",
+      "rsync *": "ask",
+      "npm install *": "ask",
+      "npm i *": "ask",
+      "npm ci *": "ask",
+      "npm update *": "ask",
+      "pnpm install *": "ask",
+      "pnpm i *": "ask",
+      "pnpm add *": "ask",
+      "pnpm update *": "ask",
+      "yarn install *": "ask",
+      "yarn add *": "ask",
+      "yarn up *": "ask",
+      "bun install *": "ask",
+      "bun i *": "ask",
+      "bun add *": "ask",
+      "pip install *": "ask",
+      "pip3 install *": "ask",
+      "python -m pip install *": "ask",
+      "python3 -m pip install *": "ask",
+      "py -m pip install *": "ask",
+      "uv add *": "ask",
+      "uv sync *": "ask",
+      "uv pip install *": "ask",
+      "cargo install *": "ask",
+      "go install *": "ask",
+      "gem install *": "ask",
+      "npx *": "ask",
+      "pnpm dlx *": "ask",
+      "yarn dlx *": "ask",
+      "bunx *": "ask",
+      "uvx *": "ask",
+      "pipx install *": "ask",
+      "pipx run *": "ask",
+      "npm publish *": "ask",
+      "pnpm publish *": "ask",
+      "yarn npm publish *": "ask",
+      "cargo publish *": "ask",
+      "twine upload *": "ask",
+      "gh pr create *": "ask",
+      "gh pr merge *": "ask",
+      "gh pr close *": "ask",
+      "gh release create *": "ask",
+      "gh release delete *": "ask",
+      "sudo *": "ask",
+      "doas *": "ask",
+      "runas *": "ask",
+      "env *": "ask",
+      "xargs *": "ask",
+      "eval *": "ask",
+      "cmd *": "ask",
+      "cmd.exe *": "ask",
+      "CMD *": "ask",
+      "CMD.exe *": "ask",
+      "powershell *": "ask",
+      "powershell.exe *": "ask",
+      "PowerShell *": "ask",
+      "PowerShell.exe *": "ask",
+      "pwsh *": "ask",
+      "pwsh.exe *": "ask",
+      "Pwsh *": "ask",
+      "Pwsh.exe *": "ask",
+      "bash *": "ask",
+      "sh *": "ask",
+      "dash *": "ask",
+      "zsh *": "ask",
+      "fish *": "ask",
+      "python *": "ask",
+      "python3 *": "ask",
+      "py *": "ask",
+      "node *": "ask",
+      "node.exe *": "ask",
+      "deno *": "ask",
+      "bun *": "ask",
+      "perl *": "ask",
+      "ruby *": "ask",
+      "php *": "ask",
+      "lua *": "ask",
+      "osascript *": "ask",
+      "mshta *": "ask",
+      "wscript *": "ask",
+      "cscript *": "ask",
+      "wsl *": "ask",
+      "npm run *": "ask",
+      "pnpm run *": "ask",
+      "yarn run *": "ask",
+      "bun run *": "ask",
+      "make *": "ask",
+      "gradlew *": "ask",
+      "gradlew.bat *": "ask",
+      "mvn *": "ask",
+      "gradle *": "ask",
+      "dotnet run *": "ask",
+      "go run *": "ask",
+      "cargo run *": "ask",
+      "terraform apply *": "ask",
+      "terraform destroy *": "ask",
+      "kubectl delete *": "ask",
+      "docker rm *": "ask",
+      "docker rmi *": "ask",
+      "docker system prune *": "ask",
+      "*.bat": "ask",
+      "*.cmd": "ask",
+      "*.ps1": "ask",
+      "*.vbs": "ask",
+      "*.sh": "ask",
+      "rm -rf ~*": "deny",
+      "rm -rf /": "deny"
+    },
+    "params": {},
+    "toolParams": {},
+    "agents": {},
+    "argv": [
+      {
+        "match": {
+          "command": [
+            "rm"
+          ],
+          "args": [
+            "-rf",
+            "/"
+          ]
+        },
+        "action": "deny"
+      },
+      {
+        "match": {
+          "pipeline": [
+            "curl*|*sh",
+            "curl*|*bash",
+            "wget*|*sh",
+            "wget*|*bash"
+          ]
+        },
+        "action": "deny"
+      },
+      {
+        "match": {
+          "command": [
+            "python",
+            "python3",
+            "node",
+            "perl",
+            "ruby",
+            "php",
+            "lua",
+            "bun",
+            "deno"
+          ]
+        },
+        "action": "ask"
+      }
+    ],
+    "opaque": "ask",
+    "yolo": false,
+    "network": [],
+    "projectPolicy": true,
+    "enforce": true,
+    "patternMode": "glob",
+    "maxGlobStars": 2,
+    "auditMaxBytes": 5242880,
+    "sessionApprovalTtlMs": 0,
+    "sessionApprovalMaxUses": 0,
+    "approvePersist": true,
+    "snapshots": true,
+    "snapshotMaxFiles": 20,
+    "snapshotMaxBytes": 262144,
+    "snapshotRetain": 100
+  }
+}

package/policy.schema.json

@@ -0,0 +1,317 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/netcatty/dsh-guard/policy.schema.json",
+  "title": "dsh-guard policy",
+  "description": "allow / ask / deny gates for DeepSeek Harness tool calls. The live file is $DSH_HOME/dsh-plugins/dsh-guard/policy.json; this schema gives an editor completion and validation for it.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Editor metadata pointing at this schema. Ignored by the loader."
+    },
+    "permission": {
+      "$ref": "#/$defs/permission"
+    }
+  },
+  "$defs": {
+    "state": {
+      "type": "string",
+      "enum": [
+        "allow",
+        "ask",
+        "deny"
+      ],
+      "description": "deny > ask > allow; the most restrictive result across surfaces wins."
+    },
+    "ruleMap": {
+      "type": "object",
+      "description": "Pattern to state. Within one map the LAST matching rule wins.",
+      "additionalProperties": {
+        "oneOf": [
+          {
+            "$ref": "#/$defs/state"
+          },
+          {
+            "type": "null",
+            "description": "Remove this inherited rule."
+          }
+        ]
+      }
+    },
+    "toolRules": {
+      "type": "object",
+      "description": "Per-tool path rules, e.g. { \"read\": { \"*/secrets/*\": \"deny\" } }.",
+      "additionalProperties": {
+        "oneOf": [
+          {
+            "$ref": "#/$defs/ruleMap"
+          },
+          {
+            "type": "null",
+            "description": "Remove the whole inherited table."
+          }
+        ]
+      }
+    },
+    "paramRules": {
+      "type": "object",
+      "description": "Key pattern to value-pattern map. Keys match a full dotted path (arguments.command) or a leaf name (command).",
+      "additionalProperties": {
+        "oneOf": [
+          {
+            "$ref": "#/$defs/ruleMap"
+          },
+          {
+            "type": "null",
+            "description": "Remove the whole inherited table."
+          }
+        ]
+      }
+    },
+    "permission": {
+      "type": "object",
+      "properties": {
+        "*": {
+          "$ref": "#/$defs/state"
+        },
+        "path": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "pathRead": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "pathWrite": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "externalDirectory": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "bash": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "tools": {
+          "type": "object",
+          "description": "Tool-name glob to path-rule map. Keys match the tool name, so \"mcp__chrome-devtools__*\" governs a whole MCP server.",
+          "additionalProperties": {
+            "$ref": "#/$defs/ruleMap"
+          }
+        },
+        "params": {
+          "$ref": "#/$defs/paramRules"
+        },
+        "agents": {
+          "$ref": "#/$defs/ruleMap"
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "match": {
+                "type": "object",
+                "properties": {
+                  "command": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "args": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "anyArg": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "pipeline": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "action": {
+                "$ref": "#/$defs/state"
+              }
+            },
+            "required": [
+              "match",
+              "action"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "network": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "match": {
+                "type": "object",
+                "properties": {
+                  "domains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "action": {
+                "$ref": "#/$defs/state"
+              }
+            },
+            "required": [
+              "match",
+              "action"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "opaque": {
+          "$ref": "#/$defs/state"
+        },
+        "wrappers": {
+          "$ref": "#/$defs/state"
+        },
+        "sandboxAware": {
+          "type": "boolean"
+        },
+        "yolo": {
+          "type": "boolean"
+        },
+        "enforce": {
+          "type": "boolean"
+        },
+        "audit": {
+          "type": "boolean"
+        },
+        "auditPath": {
+          "type": "string"
+        },
+        "auditMaxBytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "projectPolicy": {
+          "type": "boolean"
+        },
+        "projectPolicyStrict": {
+          "type": "boolean"
+        },
+        "caseInsensitivePaths": {
+          "type": "boolean"
+        },
+        "patternMode": {
+          "type": "string",
+          "enum": [
+            "glob",
+            "regex"
+          ]
+        },
+        "maxGlobStars": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "redact": {
+          "type": "boolean"
+        },
+        "sessionApprovals": {
+          "type": "boolean"
+        },
+        "sessionApprovalTtlMs": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "sessionApprovalMaxUses": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "approvePersist": {
+          "type": "boolean"
+        },
+        "snapshots": {
+          "type": "boolean"
+        },
+        "snapshotMaxFiles": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "snapshotMaxBytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "snapshotRetain": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "approvalMode": {
+          "type": "string",
+          "enum": [
+            "approval",
+            "question",
+            "dialog"
+          ],
+          "description": "approval = DSH native, question = DSH question card with text diff, dialog = self-drawn two-column dialog."
+        },
+        "denyTools": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "projectPolicySearchUp": {
+          "type": "boolean"
+        },
+        "toolParams": {
+          "type": "object",
+          "description": "Tool-name glob to key/value rule map, scoped to that tool only.",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": {
+                "$ref": "#/$defs/state"
+              }
+            }
+          }
+        },
+        "webBase": {
+          "type": "string",
+          "description": "Absolute origin used to build links in approval cards, e.g. http://100.94.19.22:3088. Empty = no link."
+        },
+        "dialogTimeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "description": "How long a self-drawn dialog waits before denying. Default 120000."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "anyOf": [
+    {
+      "required": [
+        "permission"
+      ]
+    },
+    {
+      "required": [
+        "path"
+      ]
+    },
+    {
+      "required": [
+        "bash"
+      ]
+    }
+  ]
+}