dsh-isolation-gate 0.2.3 → 0.3.0

package/lib/index.js

@@ -44,14 +44,16 @@ import {
   setGroupLevel,
   setLevel,
 } from './service.js';
+import { clearAudit } from './audit.js';
 import { collectTargets } from './toolgate.js';
+import { decideWithProfiles, knownDirBindings, loadProfileState } from './profiles-runtime.js';
 import { DEFAULT_LEVEL } from './store.js';
 
 export const name = 'dsh-isolation-gate';
 /** `tools` 是硬依赖：工具执行门没有它就不成立。 */
 export const inject = ['tools'];
 
-const VERSION = '0.2.0';
+const VERSION = '0.3.0';
 const BASE = '/__dsh-isolation-gate';
 const MAX_BODY = 256 * 1024;
 
@@ -103,6 +105,21 @@ export function apply(ctx, config) {
   // 每次工具调用都重新读盘（与 GUI 一样，不缓存）⇒ 面板一改，下一次工具调用即生效。
   const toolGateDecision = (exec) => {
     const collected = collectTargets(exec?.name, exec?.arguments);
+
+    // ① 策略档（会话覆盖 > 目录 .dsh-gate.json > 默认档）。blocklist 档在这里直接放行。
+    const profileDecision = decideWithProfiles(cfg.statePath, {
+      sessionId: exec?.agent?.id,
+      tool: collected.tool,
+      targets: collected.targets,
+      shell: collected.shell,
+      command: typeof exec?.arguments?.command === 'string' ? exec.arguments.command : undefined,
+      known: collected.unknownTool !== true,
+    });
+    if (!profileDecision.allowed) {
+      const where = profileDecision.profile ? `档「${profileDecision.profile}」` : '策略档';
+      return `门禁：${where}拒绝工具「${collected.tool}」${profileDecision.matched ? `（${profileDecision.matched}）` : ''}。${profileDecision.reason}`;
+    }
+
     let firstDeny = null;
     let evaluated = 0;
     for (const target of collected.targets) {
@@ -201,6 +218,7 @@ export function apply(ctx, config) {
         routes: [
           `GET ${BASE}/ping`,
           `GET ${BASE}/state`,
+          `GET ${BASE}/profiles`,
           `POST ${BASE}/level`,
           `POST ${BASE}/roster`,
           `POST ${BASE}/group-level`,
@@ -210,6 +228,7 @@ export function apply(ctx, config) {
           `POST ${BASE}/toolcheck`,
           `POST ${BASE}/check`,
           `GET ${BASE}/log`,
+          `POST ${BASE}/audit/clear`,
         ],
         statePath: cfg.statePath,
         rosterPath: cfg.rosterPath,
@@ -221,6 +240,22 @@ export function apply(ctx, config) {
         ...levelInfo(),
       }),
     },
+    {
+      method: 'GET',
+      path: `${BASE}/profiles`,
+      handler: async () => {
+        const state = loadProfileState(cfg.statePath)
+        const profiles = [...state.profiles.values()].map((profile) => ({
+          name: profile.name,
+          mode: profile.mode,
+          allow: profile.allow,
+          network: profile.network,
+          unknownTool: profile.unknownTool,
+          isDefault: profile.name === state.defaultProfile,
+        }))
+        return { ok: true, defaultProfile: state.defaultProfile, profiles, dirBindings: knownDirBindings() }
+      },
+    },
     {
       method: 'GET',
       path: `${BASE}/state`,
@@ -359,6 +394,16 @@ export function apply(ctx, config) {
         return check(cfg, { name: body.name, path: body.path, op: body.op, channel: 'http' });
       },
     },
+    {
+      method: 'POST',
+      path: `${BASE}/audit/clear`,
+      handler: async () => {
+        const result = clearAudit(cfg.auditPath)
+        if (!result.ok) return result
+        console.log(`[dsh-isolation-gate] 审计已清空 ${result.removed} 条（备份：${result.backup}）`)
+        return { ...result, report: report() }
+      },
+    },
     {
       method: 'GET',
       path: `${BASE}/log`,

package/lib/profiles-runtime.js

@@ -0,0 +1,164 @@
+/**
+ * 门禁 · 策略档运行时（有 I/O，但只在工具门前同步跑）
+ *
+ * 职责：
+ *   ① 从状态文件读档表（带 mtime 缓存；解析失败 ⇒ 只剩 sealed 档，fail-closed）
+ *   ② 从目标路径向上找 `.dsh-gate.json`（带 mtime 缓存；坏文件 ⇒ 按 sealed 处理）
+ *   ③ 合并成"这次调用用哪个档"，再交给纯函数 evaluateCall 判定
+ *
+ * 语义：`.dsh-gate.json` 管的是**它所在的这棵子树**，不是某个会话 —— 谁碰这棵树都按这档。
+ * 会话覆盖（state.sessionOverrides[sessionId]）优先，用于一次性严苛任务。
+ */
+
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { win32 } from 'node:path';
+import { BUILTIN_PROFILES, evaluateCall, narrowProfile, normalizeProfile, readProfiles } from './profiles.js';
+
+const BINDING_FILE = '.dsh-gate.json';
+const MAX_DEPTH = 8;
+
+/** @type {Map<string, {mtimeMs:number, value:any}>} */
+const stateCache = new Map();
+/** @type {Map<string, {mtimeMs:number, value:any}>} */
+const bindingCache = new Map();
+
+function statMtime(filePath) {
+  try {
+    return statSync(filePath).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+/** 读状态文件里的档配置；文件不存在 ⇒ 内置档（normal/strict/sealed）。 */
+export function loadProfileState(statePath) {
+  if (typeof statePath !== 'string' || statePath.trim() === '') {
+    return { profiles: builtinMap(), defaultProfile: 'normal', sessionOverrides: {} };
+  }
+  const mtime = statMtime(statePath);
+  if (mtime === null) {
+    return { profiles: builtinMap(), defaultProfile: 'normal', sessionOverrides: {} };
+  }
+  const hit = stateCache.get(statePath);
+  if (hit && hit.mtimeMs === mtime) return hit.value;
+
+  let value;
+  try {
+    const raw = JSON.parse(readFileSync(statePath, 'utf8'));
+    value = readProfiles(raw);
+    // 状态里没写 profiles ⇒ 补上内置模板档，方便直接引用 strict / sealed
+    for (const [name, def] of Object.entries(BUILTIN_PROFILES)) {
+      if (!value.profiles.has(name)) value.profiles.set(name, normalizeProfile(name, def));
+    }
+  } catch (error) {
+    // 状态文件坏了：只留一个全拒档 —— 宁可停摆，不可放行。
+    const sealed = new Map([['sealed', normalizeProfile('sealed', { mode: 'sealed' })]]);
+    value = { profiles: sealed, defaultProfile: 'sealed', sessionOverrides: {}, error: error?.message };
+  }
+  stateCache.set(statePath, { mtimeMs: mtime, value });
+  return value;
+}
+
+function builtinMap() {
+  const map = new Map();
+  for (const [name, def] of Object.entries(BUILTIN_PROFILES)) map.set(name, normalizeProfile(name, def));
+  return map;
+}
+
+/**
+ * 从目标路径向上找最近的 `.dsh-gate.json`。
+ * @returns {{dir:string, profile?:string, allow?:any[], network?:string, unknownTool?:string, broken?:boolean}|null}
+ */
+export function findDirBinding(targetPath) {
+  if (typeof targetPath !== 'string' || !win32.isAbsolute(targetPath)) return null;
+  let dir = win32.dirname(win32.normalize(targetPath));
+  for (let depth = 0; depth < MAX_DEPTH; depth += 1) {
+    const filePath = win32.join(dir, BINDING_FILE);
+    if (existsSync(filePath)) {
+      const mtime = statMtime(filePath);
+      const hit = bindingCache.get(filePath);
+      if (hit && hit.mtimeMs === mtime) return { ...hit.value, dir };
+      let value;
+      try {
+        const parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+        value =
+          parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? { profile: typeof parsed.profile === 'string' ? parsed.profile : undefined, ...parsed }
+            : { broken: true };
+      } catch {
+        value = { broken: true };
+      }
+      bindingCache.set(filePath, { mtimeMs: mtime, value });
+      return { ...value, dir };
+    }
+    const parent = win32.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+/**
+ * 一次工具调用的完整判定（含档解析）。
+ * @param {string} statePath
+ * @param {{sessionId?:string, tool:string, targets:Array<{op:string,path:string}>, shell?:boolean, command?:string, known?:boolean}} call
+ * @returns {{allowed:boolean, reason:string, profile?:string, source?:string, matched?:string}}
+ */
+export function decideWithProfiles(statePath, call) {
+  const state = loadProfileState(statePath);
+  const sid = typeof call.sessionId === 'string' ? call.sessionId : '';
+  const override = sid && state.sessionOverrides[sid];
+
+  // 会话覆盖：整次调用都按这一档（含联网与未知工具判定）
+  if (override && state.profiles.has(override)) {
+    const profile = state.profiles.get(override);
+    const result = evaluateCall(profile, call);
+    return { ...result, profile: profile.name, source: 'session' };
+  }
+
+  // 目录绑定：逐个目标各自找配置；任一目标被拒即拒。
+  // 没有目标（如 web_search）时只按默认档判 —— 网络工具在 sealed 默认档下会被拦。
+  const targets = Array.isArray(call.targets) ? call.targets : [];
+  let source = 'default';
+  let usedProfile = state.profiles.get(state.defaultProfile);
+
+  for (const target of targets) {
+    const binding = findDirBinding(target.path);
+    if (!binding) continue;
+    if (binding.broken) {
+      return {
+        allowed: false,
+        reason: `${BINDING_FILE} 无法解析，按 sealed 处理`,
+        profile: 'sealed',
+        source: 'dir',
+        matched: target.path,
+      };
+    }
+    const baseName = binding.profile && state.profiles.has(binding.profile) ? binding.profile : state.defaultProfile;
+    const base = state.profiles.get(baseName);
+    const profile = narrowProfile(base, binding);
+    const result = evaluateCall(profile, { ...call, targets: [target] });
+    source = 'dir';
+    usedProfile = profile;
+    if (!result.allowed) return { ...result, profile: profile.name, source };
+  }
+
+  // 没有目录配置的目标：退回默认档
+  const result = evaluateCall(usedProfile, call);
+  return { ...result, profile: usedProfile.name, source };
+}
+
+/** 本进程见过的目录绑定（面板展示用；不是全盘扫描）。 */
+export function knownDirBindings() {
+  return [...bindingCache.entries()].map(([file, hit]) => ({
+    dir: win32.dirname(file),
+    profile: (hit.value && hit.value.profile) || '',
+    file,
+  }))
+}
+
+/** 测试用：清缓存 */
+export function __clearProfileCaches() {
+  stateCache.clear();
+  bindingCache.clear();
+}

package/lib/profiles.js

@@ -0,0 +1,320 @@
+/**
+ * 门禁 · 策略档（profile）
+ *
+ * 一个「档」= 一套判定规则：
+ *   - blocklist：名单里的对象按三级管，其余不管（旧行为）
+ *   - allowlist：只允许 allow 里列出的路径与级别，其余一律拒
+ *   - sealed   ：allowlist + 禁网 + 未知工具一律拒
+ *
+ * 会话与档的关系：会话不定义规则，只**挂**一个档。
+ * 解析优先级：会话覆盖（sessionId）> 会话目录绑定（.dsh-gate.json）> 全局默认档。
+ *
+ * 纯函数、无 I/O —— 自测可直接调。
+ */
+
+import { win32 } from 'node:path';
+
+export const MODES = ['blocklist', 'allowlist', 'sealed'];
+export const LEVEL_RANK = { deny: 0, read: 1, full: 2 };
+
+/** 工具名 → 是否属于"联网类"。按名字判，不看参数。 */
+export const NETWORK_TOOLS = new Set([
+  'web_search',
+  'web_fetch',
+  'web_download',
+  'web_open',
+  'browser',
+  'browser_navigate',
+  'browser_open',
+  'browser_click',
+  'browser_type',
+  'http_request',
+  'fetch_url',
+]);
+
+/** shell 文本里的联网命令（首词匹配，大小写不敏感）。 */
+export const NETWORK_COMMANDS = new Set([
+  'curl',
+  'wget',
+  'invoke-webrequest',
+  'invoke-restmethod',
+  'iwr',
+  'irm',
+  'start-bitstransfer',
+  'npm',
+  'pnpm',
+  'yarn',
+  'pip',
+  'pip3',
+  'git',
+  'ssh',
+  'scp',
+  'sftp',
+  'ftp',
+  'telnet',
+  'nc',
+  'ncat',
+  'aria2c',
+]);
+
+/** git 里只有这几个子命令会碰网络；`git status` 不该被拦。 */
+const GIT_NETWORK_SUBCOMMANDS = new Set(['clone', 'fetch', 'pull', 'push', 'ls-remote', 'submodule']);
+
+/** npm/pnpm/yarn 里会碰网络的子命令；`npm test` 不该被拦。 */
+const PM_NETWORK_SUBCOMMANDS = new Set([
+  'install',
+  'i',
+  'add',
+  'ci',
+  'publish',
+  'update',
+  'up',
+  'upgrade',
+  'audit',
+  'outdated',
+  'view',
+  'info',
+  'search',
+  'exec',
+  'dlx',
+]);
+
+/** pip 里会碰网络的子命令。 */
+const PIP_NETWORK_SUBCOMMANDS = new Set(['install', 'download', 'wheel', 'search', 'index']);
+
+export class ProfileError extends Error {}
+
+/**
+ * 内置档：不需要在状态文件里先定义就能用。
+ * `strict` / `sealed` 的 allow 为空 —— 它们是**模板**，由所在目录的
+ * `.dsh-gate.json` 在**自己的子树内**填允许项（见 narrowProfile）。
+ */
+export const BUILTIN_PROFILES = {
+  normal: { mode: 'blocklist' },
+  strict: { mode: 'allowlist', allow: [] },
+  sealed: { mode: 'sealed', allow: [] },
+};
+
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function normalizeLevel(level) {
+  return Object.prototype.hasOwnProperty.call(LEVEL_RANK, level) ? level : 'deny';
+}
+
+/** 规范化一条 allow 项；非法返回 null（不抛，便于"坏一条丢一条"）。 */
+export function normalizeAllowEntry(entry) {
+  if (!entry || typeof entry !== 'object') return null;
+  const path = typeof entry.path === 'string' ? entry.path.trim() : '';
+  if (!path) return null;
+  const resolved = win32.isAbsolute(path) ? win32.normalize(path) : null;
+  if (!resolved) return null;
+  return { path: resolved.replace(/[\\/]+$/, '') || resolved, level: normalizeLevel(entry.level) };
+}
+
+/**
+ * 规范化一个档。缺字段一律按"最严"补齐 —— 解析坏掉的档不该变成放行。
+ * @returns {{name:string, mode:string, allow:Array<{path:string,level:string}>, network:'allow'|'deny', unknownTool:'allow'|'deny'}}
+ */
+export function normalizeProfile(name, raw) {
+  const def = raw && typeof raw === 'object' ? raw : {};
+  const mode = MODES.includes(def.mode) ? def.mode : 'sealed';
+  const allow = asArray(def.allow).map(normalizeAllowEntry).filter(Boolean);
+  const sealed = mode === 'sealed';
+  const network = sealed ? 'deny' : def.network === 'deny' ? 'deny' : 'allow';
+  const unknownTool = sealed || def.unknownTool === 'deny' ? 'deny' : 'allow';
+  return { name, mode, allow, network, unknownTool };
+}
+
+/**
+ * 从状态文件里取出所有档；兼容 v2（没有 profiles 字段 ⇒ 整体视作一个 blocklist 档）。
+ * @returns {{profiles: Map<string, object>, defaultProfile: string, sessionOverrides: Record<string,string>}}
+ */
+export function readProfiles(state) {
+  const src = state && typeof state === 'object' ? state : {};
+  const profiles = new Map();
+  if (src.profiles && typeof src.profiles === 'object') {
+    for (const [name, def] of Object.entries(src.profiles)) {
+      profiles.set(name, normalizeProfile(name, def));
+    }
+  }
+  if (profiles.size === 0) {
+    // v2 兼容：objects 直接当 blocklist 档；同时带上内置的 strict / sealed 模板档。
+    profiles.set('normal', normalizeProfile('normal', { mode: 'blocklist', objects: src.objects }));
+    for (const [name, def] of Object.entries(BUILTIN_PROFILES)) {
+      if (name !== 'normal') profiles.set(name, normalizeProfile(name, def));
+    }
+  }
+  const defaultProfile =
+    typeof src.defaultProfile === 'string' && profiles.has(src.defaultProfile)
+      ? src.defaultProfile
+      : profiles.keys().next().value;
+  const sessionOverrides =
+    src.sessionOverrides && typeof src.sessionOverrides === 'object' ? { ...src.sessionOverrides } : {};
+  return { profiles, defaultProfile, sessionOverrides };
+}
+
+/**
+ * 选定本次调用用哪个档。
+ * @param {{profiles:Map,defaultProfile:string,sessionOverrides:Record}} state
+ * @param {{sessionId?:string, sessionDir?:string, dirBinding?:{profile?:string, allow?:any[]}}} hint
+ */
+export function pickProfile(state, hint = {}) {
+  const { profiles, defaultProfile, sessionOverrides } = state;
+  const sid = hint.sessionId;
+  if (sid && typeof sessionOverrides[sid] === 'string' && profiles.has(sessionOverrides[sid])) {
+    return { profile: profiles.get(sessionOverrides[sid]), source: 'session' };
+  }
+  const binding = hint.dirBinding;
+  if (binding && typeof binding.profile === 'string' && profiles.has(binding.profile)) {
+    const base = profiles.get(binding.profile);
+    return { profile: narrowProfile(base, binding), source: 'dir' };
+  }
+  return { profile: profiles.get(defaultProfile), source: 'default' };
+}
+
+/**
+ * 目录绑定只能**加严**：引用已定义的档 + 只允许减少 allow 条目、只允许把 network/unknownTool 收紧。
+ * 传入一个想放宽的绑定 ⇒ 保持原档（并记一条 warning）。
+ */
+export function narrowProfile(base, binding) {
+  const warnings = [];
+  const dir =
+    binding && typeof binding.dir === 'string'
+      ? win32.normalize(binding.dir).replace(/[\\/]+$/, '')
+      : null;
+  const insideDir = (p) =>
+    !dir ||
+    p.toLowerCase() === dir.toLowerCase() ||
+    p.toLowerCase().startsWith(dir.toLowerCase() + '\\');
+
+  const rawExtra = asArray(binding && binding.allow).map(normalizeAllowEntry).filter(Boolean);
+  const extra = rawExtra.filter((e) => insideDir(e.path));
+  if (extra.length !== rawExtra.length) {
+    warnings.push('目录绑定里有条目不在该配置文件所在子树内，已忽略（防止用配置解锁别处）');
+  }
+
+  let allow = base.allow;
+  if (base.mode !== 'blocklist' && base.allow.length === 0) {
+    // 模板档（strict / sealed 的 allow 为空）：由本子树内的配置定义允许项
+    allow = extra;
+  } else if (extra.length) {
+    allow = extra
+      .map((e) => {
+        const b = base.allow.find((x) => x.path === e.path);
+        if (!b) return null; // 新增条目 = 放宽，忽略
+        return { path: b.path, level: LEVEL_RANK[e.level] < LEVEL_RANK[b.level] ? e.level : b.level };
+      })
+      .filter(Boolean);
+    if (allow.length !== extra.length) warnings.push('目录绑定试图新增允许项，已忽略');
+  }
+  const mode = base.mode === 'sealed' ? 'sealed' : binding && binding.mode === 'sealed' ? 'sealed' : base.mode;
+  const network = base.network === 'deny' ? 'deny' : binding && binding.network === 'deny' ? 'deny' : 'allow';
+  const unknownTool =
+    base.unknownTool === 'deny' || (binding && binding.unknownTool === 'deny') ? 'deny' : 'allow';
+  return { ...base, mode, allow, network, unknownTool, warnings };
+}
+
+/** 目标路径是否落在 allow 列表内（前缀匹配，按路径段边界，避免 D:\a 命中 D:\ab）。 */
+export function matchAllow(profile, targetPath) {
+  if (!profile || !Array.isArray(profile.allow) || profile.allow.length === 0) return null;
+  if (typeof targetPath !== 'string' || !win32.isAbsolute(targetPath)) return null;
+  const target = win32.normalize(targetPath).replace(/[\\/]+$/, '') || targetPath;
+  let best = null;
+  for (const entry of profile.allow) {
+    const base = entry.path;
+    const same = target.toLowerCase() === base.toLowerCase();
+    const inside = target.toLowerCase().startsWith(base.toLowerCase() + '\\');
+    if (same || inside) {
+      if (!best || base.length > best.path.length) best = entry;
+    }
+  }
+  return best;
+}
+
+/** 联网工具名判定。 */
+export function isNetworkTool(toolName) {
+  return typeof toolName === 'string' && NETWORK_TOOLS.has(toolName.toLowerCase());
+}
+
+/**
+ * shell 文本是否在"联网"。
+ * 只认首词与已知子命令，避免把 `npm test`、`git status` 误判成联网。
+ */
+export function isNetworkCommand(commandText) {
+  if (typeof commandText !== 'string' || !commandText.trim()) return false;
+  // 取第一段（允许 `cd x && curl ...` 这种链式：逐段看）
+  const segments = commandText.split(/&&|\|\||[;|]/);
+  for (const segment of segments) {
+    const words = segment.trim().split(/\s+/).filter(Boolean);
+    if (words.length === 0) continue;
+    let head = words[0].toLowerCase().replace(/^.*[\\/]/, '').replace(/\.exe$/, '');
+    if (head === 'sudo' || head === 'doas') {
+      words.shift();
+      head = (words[0] || '').toLowerCase();
+    }
+    if (!NETWORK_COMMANDS.has(head)) continue;
+    if (head === 'git') {
+      const sub = (words[1] || '').toLowerCase();
+      if (GIT_NETWORK_SUBCOMMANDS.has(sub)) return true;
+      continue;
+    }
+    if (head === 'npm' || head === 'pnpm' || head === 'yarn') {
+      if (words.length === 1) return true; // 裸执行 npm 会打印帮助，不联网；保守起见仍当联网
+      const sub = words[1].toLowerCase();
+      if (PM_NETWORK_SUBCOMMANDS.has(sub)) return true;
+      continue;
+    }
+    if (head === 'pip' || head === 'pip3') {
+      const sub = (words[1] || '').toLowerCase();
+      if (PIP_NETWORK_SUBCOMMANDS.has(sub)) return true;
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+
+/**
+ * 判定一次工具调用。
+ * @param {object} profile 已规范化（可能经 narrowProfile）
+ * @param {{tool:string, targets:Array<{op:string,path:string}>, shell:boolean, command?:string, known:boolean}} call
+ * @returns {{allowed:boolean, reason:string, matched?:string}}
+ */
+export function evaluateCall(profile, call) {
+  const p = profile || normalizeProfile('sealed', { mode: 'sealed' });
+  const tool = typeof call.tool === 'string' ? call.tool : '';
+  const targets = asArray(call.targets).filter((t) => t && typeof t.path === 'string');
+
+  if (p.mode === 'blocklist') return { allowed: true, reason: 'blocklist 档不限制未列出的对象' };
+
+  // allowlist / sealed：有路径就必须落在 allow 内
+  if (targets.length > 0) {
+    for (const t of targets) {
+      const hit = matchAllow(p, t.path);
+      if (!hit) {
+        return { allowed: false, reason: `不在本档允许的目录内（${p.name}）`, matched: t.path };
+      }
+      const need = t.op === 'read' || t.op === 'traverse' ? 'read' : 'full';
+      if (LEVEL_RANK[hit.level] < LEVEL_RANK[need]) {
+        return { allowed: false, reason: `允许级别不足：${hit.path} 只给到 ${hit.level}，本次需要 ${need}`, matched: hit.path };
+      }
+    }
+  }
+
+  if (p.mode === 'sealed') {
+    if (isNetworkTool(tool)) return { allowed: false, reason: '本档禁止联网（工具）', matched: tool };
+    if (call.shell && isNetworkCommand(call.command)) return { allowed: false, reason: '本档禁止联网（命令）', matched: call.command };
+    // shell 里认不出任何路径 ⇒ 无法确认它只碰允许目录，按拒绝处理
+    if (call.shell && targets.length === 0) {
+      return { allowed: false, reason: '无法确认这条命令会动哪些路径，按拒绝处理', matched: tool };
+    }
+  }
+
+  if (p.unknownTool === 'deny' && call.known === false) {
+    return { allowed: false, reason: '本档不认识这个工具，按拒绝处理', matched: tool };
+  }
+
+  return { allowed: true, reason: targets.length ? '落在允许目录内' : '无路径目标，规则未禁止' };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-isolation-gate",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "门禁 · 目录访问管制（隔离区授权台）：一屏管理「哪些目录受管、各自什么级别」，三级=禁/只读/可读写删；判定同时挂在受管辖通道（bin/gate.mjs）与宿主工具执行门（ctx.tools.guard）上，默认禁、名单缺失一律拒绝（fail-closed）、审计可查、agent 可自查；支持分组批量切、目录选择器与状态文件自动迁移。",
   "keywords": [
     "dsh",