dsh-perm-gate 0.2.0 → 0.2.1-beta.2

package/lib/config.d.ts

@@ -1,9 +1,22 @@
-/**
- * Plugin configuration for dsh-perm-gate, defined with Schemastery so the DSH
- * loader validates and fills defaults before `apply`. Invalid values fail loud.
- */
 import z from '@deepseek-ai/schemastery';
 import type { RuleAction } from './rule.js';
+/**
+ * The DSH home directory: an explicit `dshHome`, else `$DSH_HOME`, else
+ * `~/.dsh`. A profile entry that omits `config` must still get a writable data
+ * home — otherwise the event feed, snapshots and learning store silently stay
+ * disabled (no log, no review page).
+ */
+export declare function resolveDshHome(configured?: string): string;
+/** This plugin's data directory (`<dshHome>/perm-gate`), always defined. */
+export declare function resolveDataDir(configured?: string): string;
+/**
+ * The permissions document the gate loads. An explicit `rulesFile` wins; unset
+ * falls back to `<dataDir>/rules.yml`, so a rules file the user drops in the
+ * plugin's own data directory is loaded without also declaring the path in the
+ * composition entry. A missing file still yields an empty ruleset (the gate then
+ * applies `defaultAction`), so the fallback never fails the plugin load.
+ */
+export declare function resolveRulesFile(configured: string | undefined, dataDir: string): string;
 export interface PermGateConfig {
     /** Absolute or `./`-relative path to the YAML permissions document. */
     readonly rulesFile?: string;
@@ -26,6 +39,12 @@ export interface PermGateConfig {
      * toward auto-allowing the exact same operation later. Default false.
      */
     readonly riskLearning?: boolean;
+    /** Learning sedimentation switch: threshold-reached samples become deterministic auto-allows. Default true (while learning is on). */
+    readonly riskSediment?: boolean;
+    /** llmAssist receiver source: an OpenAI-compatible endpoint (`custom`) or the DSH host `llm` service (`host`). Default custom. */
+    readonly classifierSource?: 'custom' | 'host';
+    /** Optional provider override for the host receiver (empty = the session's current model group). */
+    readonly classifierProvider?: string;
     /** Confirmations required before a neutral-risk re-run may auto-allow. Default 3. */
     readonly riskThreshold?: number;
     /** Persistence path for verdict learning; defaults to `<dshHome>/perm-gate/learning.json`. */
@@ -44,11 +63,43 @@ export interface PermGateConfig {
     readonly permissive?: boolean;
     /** Backend approval strategies; combinable. Front-end exposes only `permissive` itself. */
     readonly permissiveStrategies?: Partial<PermissiveStrategies>;
+    /**
+     * Session permission presets in which this gate is active at all.
+     *
+     * The gate owns an independent tier, so it must not overrule a tier the user
+     * selected instead. Outside this scope the gate stands down completely — no
+     * allow, no ask, no deny, no P0 hard-deny, no deny-keyword veto — and the
+     * selected tier's own policy governs the call. That matters because
+     * `danger-full-access` is defined as "full access without approval prompts":
+     * there the DSH approval seam rejects every request before any answerer runs,
+     * so a forwarded ask could only ever fail with `the user rejected tool ...`,
+     * and a hard-deny would silently contradict the tier the user chose.
+     *
+     * Default `['permissive']` (the tier this plugin adds). `['*']` makes the gate
+     * global again, including its hard-deny layer.
+     */
+    readonly gatePresets?: string[];
     /**
      * Editable whitelist (allow-list command patterns), mirrored to the rules
      * file's `allow` section. Optional; edit from the settings card as a list.
      */
     readonly allowlist?: string[];
+    /**
+     * Editable deny-keyword blacklist (preset: dsh-approval-gate's inherited
+     * `DEFAULT_DENY_KEYWORDS`). Unset applies the preset; an explicit array
+     * (possibly empty) replaces it. Editable from the settings card as a list.
+     */
+    readonly denyKeywords?: string[];
+    /**
+     * Extra tool names classified as read-only/internal and therefore auto-allowed.
+     *
+     * The gate already auto-allows DSH's own read-only and session-local tools
+     * (reads, searches, memory/goal/taskboard/job management, UI and todo state);
+     * this list extends that classification for third-party read-only tools.
+     * P0 hard-deny and the deny-keyword layer still run before it, so the list can
+     * never widen authority for a destructive or credential-bearing call.
+     */
+    readonly autoAllowTools?: string[];
 }
 /** Backend combinable approval strategies for the Permissive tier (all opt-in). */
 export interface PermissiveStrategies {
@@ -60,10 +111,18 @@ export interface PermissiveStrategies {
     readonly llmAssist: boolean;
 }
 export declare const DEFAULT_PERMISSIVE_STRATEGIES: Readonly<PermissiveStrategies>;
+/**
+ * Presets in which the gate is active. It owns the `permissive` tier; `'*'`
+ * makes it global (every preset, including the hard-deny layer).
+ */
+export declare const DEFAULT_GATE_PRESETS: readonly string[];
+/** Normalize the gate scope: an unset/empty list means the default. */
+export declare function resolveGatePresets(configured?: readonly string[]): readonly string[];
 /** Normalize a backend strategy bag to fully-specified booleans (backend-part combinable). */
 export declare function resolvePermissiveStrategies(bag?: Partial<PermissiveStrategies>): PermissiveStrategies;
 export declare const Config: z<PermGateConfig>;
 export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
     readonly permissiveStrategies: PermissiveStrategies;
+    readonly gatePresets: readonly string[];
 };
 export declare function resolveConfig(config?: PermGateConfig): ResolvedPermGateConfig;

package/lib/config.js

@@ -2,12 +2,53 @@
  * Plugin configuration for dsh-perm-gate, defined with Schemastery so the DSH
  * loader validates and fills defaults before `apply`. Invalid values fail loud.
  */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
+/**
+ * The DSH home directory: an explicit `dshHome`, else `$DSH_HOME`, else
+ * `~/.dsh`. A profile entry that omits `config` must still get a writable data
+ * home — otherwise the event feed, snapshots and learning store silently stay
+ * disabled (no log, no review page).
+ */
+export function resolveDshHome(configured) {
+    if (typeof configured === 'string' && configured !== '')
+        return configured;
+    const env = process.env.DSH_HOME;
+    if (typeof env === 'string' && env !== '')
+        return env;
+    return join(homedir(), '.dsh');
+}
+/** This plugin's data directory (`<dshHome>/perm-gate`), always defined. */
+export function resolveDataDir(configured) {
+    return join(resolveDshHome(configured), 'perm-gate');
+}
+/**
+ * The permissions document the gate loads. An explicit `rulesFile` wins; unset
+ * falls back to `<dataDir>/rules.yml`, so a rules file the user drops in the
+ * plugin's own data directory is loaded without also declaring the path in the
+ * composition entry. A missing file still yields an empty ruleset (the gate then
+ * applies `defaultAction`), so the fallback never fails the plugin load.
+ */
+export function resolveRulesFile(configured, dataDir) {
+    return typeof configured === 'string' && configured !== '' ? configured : join(dataDir, 'rules.yml');
+}
 export const DEFAULT_PERMISSIVE_STRATEGIES = {
     trustAutoAllow: true,
     alwaysConfirm: false,
     llmAssist: false,
 };
+/**
+ * Presets in which the gate is active. It owns the `permissive` tier; `'*'`
+ * makes it global (every preset, including the hard-deny layer).
+ */
+export const DEFAULT_GATE_PRESETS = ['permissive'];
+/** Normalize the gate scope: an unset/empty list means the default. */
+export function resolveGatePresets(configured) {
+    if (configured === undefined || configured.length === 0)
+        return DEFAULT_GATE_PRESETS;
+    return configured.filter((name) => typeof name === 'string' && name !== '');
+}
 /** Normalize a backend strategy bag to fully-specified booleans (backend-part combinable). */
 export function resolvePermissiveStrategies(bag = {}) {
     return {
@@ -26,19 +67,25 @@ export const Config = z.object({
     classifierModel: z.string().default('deepseek-chat'),
     classifierApiKey: z.string(),
     riskTimeoutMs: z.number().min(1000).default(20_000),
-    riskLearning: z.boolean().default(false),
-    riskThreshold: z.number().min(1).max(10).default(3),
+    riskLearning: z.boolean().default(true),
+    riskSediment: z.boolean().default(true),
+    classifierSource: z.union(['custom', 'host']).default('custom'),
+    classifierProvider: z.string(),
+    riskThreshold: z.number().min(1).max(10).default(1),
     learningFile: z.string(),
     eventsFile: z.string(),
     grantTtlMs: z.number().min(1).default(5 * 60_000),
     grantMaxUses: z.number().min(1).default(1),
     permissive: z.boolean().default(false),
+    gatePresets: z.array(z.string()),
     permissiveStrategies: z.object({
         trustAutoAllow: z.boolean().default(true),
         alwaysConfirm: z.boolean().default(false),
         llmAssist: z.boolean().default(false),
     }),
     allowlist: z.array(z.string()),
+    denyKeywords: z.array(z.string()),
+    autoAllowTools: z.array(z.string()),
 });
 export function resolveConfig(config = {}) {
     const parsed = Config(config);
@@ -59,6 +106,7 @@ export function resolveConfig(config = {}) {
         grantTtlMs: parsed.grantTtlMs ?? 5 * 60_000,
         grantMaxUses: parsed.grantMaxUses ?? 1,
         permissive: parsed.permissive ?? false,
+        gatePresets: resolveGatePresets(parsed.gatePresets),
         permissiveStrategies: resolvePermissiveStrategies(parsed.permissiveStrategies),
     };
 }

package/lib/deny-defaults.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Preset deny keywords inherited from dsh-approval-gate's `DEFAULT_DENY_KEYWORDS`
+ * (the preset blacklist layer of its pipeline). One keyword per entry, matched
+ * case-insensitively on word boundaries against the call's command text and its
+ * scalar arguments — document bodies are skipped — so a keyword can no longer
+ * veto an unrelated identifier or file text that merely contains it.
+ *
+ * Pure data shared by the node half (deny-keyword pre-layer) and the client
+ * bundle (the settings card's preset tags), so it must stay import-free.
+ */
+/** The preset blacklist; the gate applies it whenever the namespace carries no override. */
+export declare const DEFAULT_DENY_KEYWORDS: readonly string[];

package/lib/deny-defaults.js

@@ -0,0 +1,19 @@
+/**
+ * Preset deny keywords inherited from dsh-approval-gate's `DEFAULT_DENY_KEYWORDS`
+ * (the preset blacklist layer of its pipeline). One keyword per entry, matched
+ * case-insensitively on word boundaries against the call's command text and its
+ * scalar arguments — document bodies are skipped — so a keyword can no longer
+ * veto an unrelated identifier or file text that merely contains it.
+ *
+ * Pure data shared by the node half (deny-keyword pre-layer) and the client
+ * bundle (the settings card's preset tags), so it must stay import-free.
+ */
+/** The preset blacklist; the gate applies it whenever the namespace carries no override. */
+export const DEFAULT_DENY_KEYWORDS = [
+    'rm -rf', 'rm -fr', 'rm -r -f', 'rm --recursive --force',
+    'push --force', 'force-push', 'force push', 'drop table', 'drop database',
+    'mkfs', 'mkfs.ext', 'format', 'shutdown', 'reboot', 'dd of=',
+    'delete from', 'truncate table', 'truncate ', 'terraform destroy', 'revoke',
+    '清空数据库', '删除数据库', '格式化', 'sudo rm', 'chmod 777 /',
+    'git reset --hard', 'git clean -fd', 'docker rm', 'docker system prune',
+];

package/lib/engine.d.ts

@@ -1,5 +1,15 @@
 import { type Decision, type ToolCallContext } from './evaluate.js';
 export type EngineStage = 'hard-deny' | 'grant' | 'rule' | 'default' | 'ask' | 'classifier';
+/** The built-in read-only / internal classification, for diagnostics and docs. */
+export declare const AUTO_ALLOW_TOOLS: ReadonlySet<string>;
+/**
+ * Argument keys that carry a document body rather than the operation itself.
+ * A file's text is not the operation: writing a document that *mentions* a
+ * token, a private key, or `credentials.yaml` must not hard-deny the write, and
+ * the deny-keyword layer already skips these keys. The path/command arguments
+ * that actually describe the operation are still scanned.
+ */
+export declare const CONTENT_ARG_KEYS: ReadonlySet<string>;
 /**
  * Deterministic P0 hard-deny reason, or undefined when the call may proceed to
  * later stages.
@@ -14,4 +24,6 @@ export interface FinalDecision extends Decision {
 /** Pure P0–P2 + P4 decision; P3 handled by the caller before falling back to ask. */
 export declare function decide(ctx: ToolCallContext, ruleset: {
     decide: (c: ToolCallContext) => Decision;
-}, grants: GrantResolver): FinalDecision;
+}, grants: GrantResolver, 
+/** Extra tool names the user classified as safe (`autoAllowTools`). */
+autoAllowExtra?: ReadonlySet<string>): FinalDecision;

package/lib/engine.js

@@ -11,18 +11,86 @@
 import { isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
 import { isForceDeletion, isRecursiveDeletion, decomposeShellCommand } from './shell.js';
 const DESTRUCTIVE_TOOL = /(?:^|[_-])(?:delete|remove|rm|destroy|erase|purge|wipe|unlink|rmdir|reset)(?:$|[_-]|recursive)/i;
-const READ_TOOLS = new Set(['read', 'read_image', 'grep', 'glob', 'ls', 'lsp']);
-function serialized(args) {
-    try {
-        return JSON.stringify(args);
-    }
-    catch {
+/**
+ * Read-only tools that can never modify the workspace or execute anything. P0
+ * still protects sensitive path reads outside the workspace root, and the
+ * deny-keyword layer still runs first, so a search whose query contains a
+ * blacklisted phrase is still vetoed.
+ */
+const READ_TOOLS = new Set([
+    'read', 'read_image', 'grep', 'glob', 'ls', 'lsp',
+    // Read-only network / media queries: no write, no exec.
+    'web_search', 'modlens_read_image',
+]);
+/** DSH internal coordination / management tools — not workspace-modifying. */
+const INTERNAL_TOOLS = new Set([
+    // AgentTeams coordination
+    'agent_teams_create', 'agent_teams_add_member', 'agent_teams_remove_member',
+    'agent_teams_delete', 'agent_teams_edit_plan', 'agent_teams_reassign_task',
+    'agent_teams_claim_task', 'agent_teams_create_task', 'agent_teams_send_message',
+    'agent_teams_approve', 'agent_teams_resume',
+    // AgentTeams status reads
+    'agent_teams_status', 'agent_teams_update_task',
+    // DSH session/memory/goal/taskboard management
+    'conversation_search',
+    'memory_add', 'memory_delete', 'memory_read_scene', 'memory_search',
+    'get_goal', 'update_goal', 'create_goal',
+    'taskboard_get', 'taskboard_list', 'taskboard_claim', 'taskboard_block',
+    'taskboard_comment', 'taskboard_release_claim', 'taskboard_submit_review',
+    'taskboard_relate',
+    // Job/agent management
+    'job_list', 'job_output', 'job_kill',
+    'list_agents', 'interrupt_agent', 'send_message',
+    // Session-local UI / plan / todo state (no workspace write, no execution)
+    'todo_write', 'render_ui', 'validate_dsh_ui', 'ask_user_question', 'exit_plan_mode',
+    // Background / planning delegation (the delegated work is gated separately)
+    'subagent', 'subagent_fork', 'ralph', 'workflow', 'skill',
+]);
+/** No user-configured extra auto-allow names. */
+const NO_EXTRA_AUTO_ALLOW = new Set();
+/** The built-in read-only / internal classification, for diagnostics and docs. */
+export const AUTO_ALLOW_TOOLS = new Set([...READ_TOOLS, ...INTERNAL_TOOLS]);
+/**
+ * Argument keys that carry a document body rather than the operation itself.
+ * A file's text is not the operation: writing a document that *mentions* a
+ * token, a private key, or `credentials.yaml` must not hard-deny the write, and
+ * the deny-keyword layer already skips these keys. The path/command arguments
+ * that actually describe the operation are still scanned.
+ */
+export const CONTENT_ARG_KEYS = new Set([
+    'content', 'contents', 'text', 'body', 'message', 'prompt',
+    'new_string', 'old_string', 'newText', 'oldText', 'file_text', 'fileText',
+    'diff', 'patch', 'replacement', 'snippet',
+]);
+/** The call's non-body text: the operation, not any document it carries. */
+function operationText(args, depth = 0) {
+    if (depth > 6)
         return '';
+    const parts = [];
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value === 'string') {
+            if (!CONTENT_ARG_KEYS.has(key))
+                parts.push(value);
+            continue;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (typeof item === 'string')
+                    parts.push(item);
+                else if (item !== null && typeof item === 'object')
+                    parts.push(operationText(item, depth + 1));
+            }
+            continue;
+        }
+        if (value !== null && typeof value === 'object') {
+            parts.push(operationText(value, depth + 1));
+        }
     }
+    return parts.join(' ');
 }
 function containsCredentialMaterial(args) {
     return /(?:BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|Bearer\s+[A-Za-z0-9._~+\/-]{8,}|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i
-        .test(serialized(args));
+        .test(operationText(args));
 }
 function pathArgument(args) {
     for (const key of ['file_path', 'path', 'cwd', 'workdir']) {
@@ -73,10 +141,19 @@ export function hardDenyReason(ctx) {
     return undefined;
 }
 /** Pure P0–P2 + P4 decision; P3 handled by the caller before falling back to ask. */
-export function decide(ctx, ruleset, grants) {
+export function decide(ctx, ruleset, grants, 
+/** Extra tool names the user classified as safe (`autoAllowTools`). */
+autoAllowExtra = NO_EXTRA_AUTO_ALLOW) {
     const hard = hardDenyReason(ctx);
     if (hard !== undefined)
         return { action: 'deny', reason: `[hard-deny] ${hard}`, stage: 'hard-deny', ruleIndex: undefined };
+    // Auto-allow read-only tools and DSH internal coordination/management tools:
+    // they cannot modify the workspace or execute a command, so asking a human
+    // about each one is pure noise. P0 hard-deny already protects sensitive-path
+    // reads and credential material, and the deny-keyword layer runs even earlier.
+    if (READ_TOOLS.has(ctx.tool) || INTERNAL_TOOLS.has(ctx.tool) || autoAllowExtra.has(ctx.tool)) {
+        return { action: 'allow', reason: 'read-only internal tool', stage: 'grant', ruleIndex: undefined };
+    }
     if (grants(ctx.tool, ctx.args) === 'allow') {
         return { action: 'allow', reason: 'covered by session grant', stage: 'grant', ruleIndex: undefined };
     }

package/lib/evaluate.d.ts

@@ -5,6 +5,7 @@ export interface ToolCallContext {
     readonly args: Record<string, unknown>;
     readonly commandText?: string;
     readonly cwd: string;
+    /** Workspace root; used by the write-path override to decide inside vs outside. */
     readonly home?: string;
     readonly dshHome?: string;
     readonly caseInsensitive?: boolean;
@@ -14,6 +15,15 @@ export interface Decision {
     readonly reason: string;
     readonly ruleIndex: number | undefined;
 }
+/**
+ * Tool names that execute a shell command string. `shell` and `terminal` are
+ * DSH's own names (the shipped tool roster uses `shell`; `terminal` is the
+ * interactive variant), and `pwsh` / `bash` / `sh` / `cmd` / `powershell` cover
+ * the platform-specific aliases. Missing `shell` here silently disables the
+ * command-content inspection below for the primary tool — every `git push`,
+ * `chmod`, redirect and `tee` would fall through to `defaultAction`.
+ */
+export declare const SHELL_TOOLS: Set<string>;
 /** Whether one compiled rule matches the given call context. */
 export declare function ruleMatches(rule: CompiledRuleEntry, ctx: ToolCallContext, commands: readonly SimpleCommand[], pathCands: readonly string[], urlCands: readonly string[]): boolean;
 /** Compute the deterministic first-match decision (P2 chain). */

package/lib/evaluate.js

@@ -6,7 +6,15 @@
 import { normalizeWorkspacePath } from './path.js';
 import { extractPathCandidates, extractUrlCandidates, } from './rule.js';
 import { decomposeShellCommand, isForceDeletion, isRecursiveDeletion } from './shell.js';
-const SHELL_TOOLS = new Set(['bash', 'pwsh', 'sh', 'cmd', 'powershell']);
+/**
+ * Tool names that execute a shell command string. `shell` and `terminal` are
+ * DSH's own names (the shipped tool roster uses `shell`; `terminal` is the
+ * interactive variant), and `pwsh` / `bash` / `sh` / `cmd` / `powershell` cover
+ * the platform-specific aliases. Missing `shell` here silently disables the
+ * command-content inspection below for the primary tool — every `git push`,
+ * `chmod`, redirect and `tee` would fall through to `defaultAction`.
+ */
+export const SHELL_TOOLS = new Set(['shell', 'terminal', 'bash', 'pwsh', 'sh', 'cmd', 'powershell']);
 /** Whether one compiled rule matches the given call context. */
 export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     if (!rule.enabled)
@@ -58,11 +66,84 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     }
     return true;
 }
+const WRITE_TOOLS = new Set(['write', 'edit']);
+/**
+ * Shell write/execution patterns. When NONE of these match, the command is
+ * treated as read-only and follows the defaultAction (typically `allow`).
+ *
+ * The deny-keyword layer catches dangerous phrases (rm -rf, dd, mkfs …) before
+ * this function runs, so this list only covers "mildly suspicious" writes that
+ * aren't dangerous enough for the preset blacklist.
+ */
+const SHELL_WRITE_PATTERNS = [
+    /(?:^|\s)(?:mv|cp|install|mkdir|touch|chmod|chown)\b/i,
+    // Redirect into a file: `> f`, `>> f`, `>f`. The leading character class
+    // excludes the stderr idioms a read-only command uses (`2>&1`, `>&2`,
+    // `2>/dev/null`, `1>&2`), and the trailing class requires an actual target.
+    /(?:^|[^0-9&])>>?\s*[^\s&|]/,
+    // `tee` always writes its target; `curl`/`wget` only when they write a file.
+    /(?:^|\s)tee\b/i,
+    /(?:^|\s)(?:curl|wget)\b.*?(?:\s-[oO]\b|>)/i,
+    /(?:^|\s)(?:git|npm|pnpm|yarn|bun)\s+(?:add|commit|push|rebase|reset|rm|stash|checkout|tag)\b/i,
+    /(?:^|\s)(?:docker|podman|kubectl)\s+(?:rm|stop|kill|exec|cp)\b/i,
+    /(?:^|\s)(?:gh)\s+(?:pr\s+create|issue\s+create|repo\s+create)\b/i,
+    /(?:^|\s)(?:terraform|ansible)\s+(?:apply|destroy|provision)\b/i,
+    /(?:^|\s)(?:sed|awk)\s+['"]?-[is]/,
+];
+/** Whether a shell command text contains a write or destructive pattern. */
+function isWriteCommand(commandText) {
+    return SHELL_WRITE_PATTERNS.some((p) => typeof p === 'string' ? commandText.includes(p) : p.test(commandText));
+}
+/**
+ * Default decision for write/edit and shell tools when no rule matches.
+ *
+ * - `write` / `edit`: workspace-internal paths follow `defaultAction`
+ *   (typically `allow`); any target outside the workspace escalates to `ask`
+ *   for content review. This is a hard safety rule that cannot be overridden
+ *   by an explicit allow rule.
+ * - `shell` / `pwsh` / `terminal`: read-only commands (git status, python -c
+ *   fetch, curl without redirect, etc.) follow `defaultAction`; commands that
+ *   contain a write/execution pattern escalate to `ask` for review.
+ */
+function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
+    if (defaultAction !== 'allow')
+        return defaultAction;
+    // write/edit: path-aware (outside workspace → ask)
+    if (WRITE_TOOLS.has(ctx.tool)) {
+        const home = ctx.home;
+        if (home !== undefined && home !== '') {
+            for (const candidate of pathCandidates) {
+                if (normalizeWorkspacePath(home, candidate, ctx.caseInsensitive) === '')
+                    return 'ask';
+            }
+        }
+        return defaultAction;
+    }
+    // shell/pwsh/terminal: command-content-aware (write pattern → ask)
+    if (SHELL_TOOLS.has(ctx.tool)) {
+        const commandText = commandTextOf(ctx);
+        if (commandText !== undefined && isWriteCommand(commandText))
+            return 'ask';
+    }
+    return defaultAction;
+}
+/**
+ * Command text of a shell call: the explicit `commandText` field when set,
+ * otherwise `args.command`. The runtime populates `commandText` in
+ * `PermGateRuntime.ctxFor`, but `decideRules` is exported and also called with
+ * a hand-built context (tests, embedders); deriving here keeps every caller on
+ * the same contract instead of silently treating a write command as read-only.
+ */
+function commandTextOf(ctx) {
+    if (typeof ctx.commandText === 'string')
+        return ctx.commandText;
+    const raw = ctx.args?.['command'];
+    return typeof raw === 'string' ? raw : undefined;
+}
 /** Compute the deterministic first-match decision (P2 chain). */
 export function decideRules(ruleset, ctx) {
-    const commands = ctx.commandText !== undefined && SHELL_TOOLS.has(ctx.tool)
-        ? decomposeSafe(ctx.commandText)
-        : [];
+    const shellText = SHELL_TOOLS.has(ctx.tool) ? commandTextOf(ctx) : undefined;
+    const commands = shellText !== undefined ? decomposeSafe(shellText) : [];
     const pathCands = extractPathCandidates(ctx.args);
     const urlCands = extractUrlCandidates(ctx.args);
     const scan = (list, _action) => {
@@ -76,13 +157,22 @@ export function decideRules(ruleset, ctx) {
     const deny = scan(ruleset.deny, 'deny');
     if (deny !== undefined)
         return deny;
-    const allow = scan(ruleset.allow, 'allow');
-    if (allow !== undefined)
-        return allow;
-    const ask = scan(ruleset.ask, 'ask');
-    if (ask !== undefined)
-        return ask;
-    return { action: ruleset.defaultAction, reason: `no rule matched; default action`, ruleIndex: undefined };
+    // Path/command-aware default: write/edit tools check the target path,
+    // shell/pwsh/terminal tools check the command for write patterns.
+    // Outside safety checks → ask; inside or read-only → defaultAction.
+    let action = ruleset.defaultAction;
+    if (WRITE_TOOLS.has(ctx.tool) || SHELL_TOOLS.has(ctx.tool)) {
+        action = pathAndCommandDefault(ctx, pathCands, action);
+    }
+    if (action === 'allow' || action === 'ask') {
+        const allow = scan(ruleset.allow, 'allow');
+        if (allow !== undefined)
+            return allow;
+        const ask = scan(ruleset.ask, 'ask');
+        if (ask !== undefined)
+            return ask;
+    }
+    return { action, reason: `no rule matched; default action`, ruleIndex: undefined };
 }
 function decomposeSafe(text) {
     try {