dsh-perm-gate 0.2.0

package/lib/runtime.js

@@ -0,0 +1,350 @@
+/**
+ * PermGateRuntime: the host-facing gate. Holds a compiled ruleset, a
+ * session-scoped grant registry, an audit mirror, the verdict-learning store,
+ * and the event feed. `apply` (index.ts) wires it onto the `tools/pre-execute`
+ * waterfall and settles learning on `tools/result`.
+ *
+ * It is constructed either by the cordis `apply` (from config) or directly in
+ * tests with a plain ruleset, so the whole decision path is exercised without a
+ * live harness.
+ */
+import { readFileSync } from 'node:fs';
+import { makeEntry, MemoryAuditMirror } from './audit.js';
+import { resolvePermissiveStrategies } from './config.js';
+import { appendAllowCommand, listAllowCommands, replaceAllowCommands } from './allowlist.js';
+import { decide } from './engine.js';
+import { EventLog } from './events.js';
+import { decideRules } from './evaluate.js';
+import { canonicalizeCall, GrantRegistry } from './grant.js';
+import { learnKey, operationFingerprint, RiskLearning } from './learning.js';
+import { ArtifactRegistry } from './path.js';
+import { classifyRisk } from './risk.js';
+import { compileDocument, documentHash, parsePermissionsDocument } from './rule.js';
+/** Upper bound on in-flight learning candidates awaiting `tools/result`. */
+const PENDING_CAP = 100;
+export class PermGateRuntime {
+    options;
+    ruleset;
+    grants;
+    artifacts = new ArtifactRegistry();
+    audit = new MemoryAuditMirror();
+    cache = new Map(); // hash -> compiled
+    permissiveEnabled;
+    strategies;
+    learning;
+    events;
+    /** Learning candidates awaiting human approval + execution (call fingerprint → candidate). */
+    pending = new Map();
+    constructor(options = {}) {
+        this.options = options;
+        this.grants = new GrantRegistry('__session__', options.now);
+        this.permissiveEnabled = options.permissive ?? false;
+        this.strategies = resolvePermissiveStrategies(options.permissiveStrategies);
+        this.learning = new RiskLearning(options.learningFile, {
+            threshold: () => this.liveRiskLearning().threshold,
+            now: options.now,
+        });
+        this.events = options.eventsFile !== undefined ? new EventLog(options.eventsFile, options.now) : undefined;
+        this.ruleset = this.compileInline(options);
+    }
+    compileInline(options) {
+        const text = options.rulesFile !== undefined ? readFileSafe(options.rulesFile) : '';
+        const empty = {
+            defaultAction: options.defaultAction ?? 'ask',
+            deny: [], allow: [], ask: [],
+            caseInsensitivePaths: options.caseInsensitivePaths ?? true,
+        };
+        if (text === '')
+            return empty;
+        const hash = documentHash(text);
+        const hit = this.cache.get(hash);
+        if (hit !== undefined)
+            return hit;
+        const doc = parsePermissionsDocument(text);
+        const compiled = compileDocument(doc, {
+            maxGlobStars: 2,
+            caseInsensitivePaths: options.caseInsensitivePaths ?? true,
+        });
+        this.cache.set(hash, compiled);
+        return compiled;
+    }
+    /** Reload rules from disk (HMR); on failure keeps the previous rules. */
+    reload() {
+        try {
+            const next = this.compileInline(this.options);
+            this.ruleset = next;
+            this.options.onRulesChanged?.(next);
+            return true;
+        }
+        catch {
+            return false; // keep previous rules; never crash the host
+        }
+    }
+    get auditEntries() {
+        return this.audit.entries;
+    }
+    grantCount() {
+        return this.grants.size;
+    }
+    get defaultAction() {
+        return this.ruleset.defaultAction;
+    }
+    ruleCount() {
+        return this.ruleset.deny.length + this.ruleset.allow.length + this.ruleset.ask.length;
+    }
+    /** Whether the independent Permissive tier is active (single front switch). */
+    get permissive() {
+        return this.permissiveEnabled;
+    }
+    /** Backend approval strategy booleans active when Permissive is on. */
+    get permissiveStrategies() {
+        return this.strategies;
+    }
+    artifactCount() {
+        return this.artifacts.snapshot();
+    }
+    /** The decision-event feed (undefined when event recording is disabled). */
+    get eventLog() {
+        return this.events;
+    }
+    /** Learning candidates currently awaiting settlement (diagnostics/tests). */
+    pendingCount() {
+        return this.pending.size;
+    }
+    /** Deep read-only view of the learning state (diagnostics/tests). */
+    learningSnapshot() {
+        return this.learning.snapshot();
+    }
+    ctxFor(exec) {
+        return {
+            tool: exec.name,
+            args: exec.arguments ?? {},
+            commandText: exec.commandText ?? (typeof exec.arguments.command === 'string' ? exec.arguments.command : undefined),
+            cwd: exec.cwd ?? process.cwd(),
+            caseInsensitive: this.options.caseInsensitivePaths ?? true,
+            dshHome: this.options.dshHome,
+        };
+    }
+    liveRiskLearning() {
+        const read = this.options.readRiskLearning;
+        if (read !== undefined)
+            return read();
+        return { enabled: this.options.riskLearning ?? false, threshold: this.options.riskThreshold ?? 3 };
+    }
+    livePermissive() {
+        return this.options.readPermissive !== undefined
+            ? this.options.readPermissive()
+            : { enabled: this.permissiveEnabled, strategies: this.strategies };
+    }
+    recordEvent(exec, kind, reason, risk) {
+        this.events?.append({ sessionId: exec.sessionId, tool: exec.name, kind, risk, reason });
+    }
+    /**
+     * Decide one tool call. Returns a decision to veto (`deny`/`ask`) or
+     * undefined to delegate via `next()` (allow / passthrough). Always records an
+     * audit entry and a decision event. Grant consumption happens inside
+     * {@link decide}; a call that targets a different fingerprint than any minted
+     * grant no-ops. An `ask` verdict may afterwards be refined by
+     * {@link refineAsk} (LLM risk grading + verdict learning) before it reaches
+     * the human seam.
+     */
+    decideExecution(exec) {
+        const ctx = this.ctxFor(exec);
+        const callId = randomId();
+        const grantResolver = (tool, args) => {
+            if (exec.parentAuthorized === false)
+                return 'no-match';
+            return this.grants.decide(tool, args);
+        };
+        const raw = decide(ctx, { decide: (c) => decideRules(this.ruleset, c) }, grantResolver);
+        const decision = this.applyPermissive(raw);
+        let outcome;
+        let source;
+        switch (decision.stage) {
+            case 'hard-deny':
+                outcome = 'deny';
+                source = 'hard-deny';
+                break;
+            case 'grant':
+                outcome = 'allow';
+                source = 'grant';
+                break;
+            case 'rule':
+                outcome = decision.action === 'ask' ? 'ask' : decision.action;
+                source = 'rule';
+                break;
+            case 'classifier':
+                outcome = decision.action;
+                source = 'classifier';
+                break;
+            case 'default':
+            case 'ask':
+                outcome = decision.action;
+                source = decision.reason.startsWith('permissive') ? 'permissive' : 'default';
+                break;
+        }
+        this.audit.append(makeEntry({ callId, tool: exec.name, outcome, source, reason: decision.reason, at: Date.now() }));
+        this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason);
+        if (decision.action === 'deny')
+            return { kind: 'deny', reason: decision.reason };
+        if (decision.action === 'ask')
+            return { kind: 'ask', reason: decision.reason };
+        return undefined;
+    }
+    /**
+     * Apply the Permissive tier to a raw decision. Hard-deny and minted-grant
+     * outcomes are never touched (fail-closed). `alwaysConfirm` escalates a
+     * rule-allow to `ask` — which the caller may then refine via
+     * {@link refineAsk}. `trustAutoAllow` is the baseline middle-tier auto-allow
+     * and needs no modulation here; llmAssist refinement lives in
+     * {@link refineAsk} because it is asynchronous.
+     */
+    applyPermissive(raw) {
+        const permissive = this.livePermissive();
+        if (!permissive.enabled)
+            return raw;
+        const { strategies: str } = permissive;
+        if (str.alwaysConfirm && raw.action === 'allow' && raw.stage === 'rule') {
+            return { action: 'ask', reason: 'permissive always-confirm escalated rule-allow to ask', stage: 'default', ruleIndex: raw.ruleIndex };
+        }
+        return raw;
+    }
+    /**
+     * Refine an `ask` decision with the configured LLM risk grader
+     * (`llmAssist` strategy). Returns `undefined` to allow (delegate via
+     * `next()`), or the decision to keep vetoing with. Every uncertainty path —
+     * strategy off, no classifier setup, transport failure, off-protocol output —
+     * keeps the original ask (fail-closed). Only a `neutral` risk under an
+     * enabled learning store registers a pending candidate; its confirmation is
+     * settled by {@link settleExecution} when the call actually executes.
+     */
+    async refineAsk(exec, decision) {
+        const permissive = this.livePermissive();
+        if (!permissive.enabled || !permissive.strategies.llmAssist)
+            return decision;
+        if (decision.kind !== 'ask')
+            return decision;
+        // One live read of the classifier setup. Without a fully configured custom
+        // endpoint the ask goes straight to the human seam (fail-closed) — unless a
+        // risk hook is injected (tests / direct embedding replace the HTTP grader).
+        const cfg = this.options.readClassifyConfig?.();
+        if (this.options.riskHook === undefined
+            && (cfg?.endpoint === undefined || cfg?.endpoint === '' || cfg?.model === undefined || cfg?.model === '')) {
+            return decision;
+        }
+        const req = { tool: exec.name, args: exec.arguments ?? {}, reason: decision.reason };
+        const risk = this.options.riskHook !== undefined
+            ? await this.options.riskHook(req)
+            : await classifyRisk(cfg ?? {}, req);
+        if (risk.kind === 'safe') {
+            const reason = `llm-assist risk: safe${risk.reason === undefined ? '' : ` (${risk.reason})`}`;
+            this.audit.append(makeEntry({ callId: randomId(), tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
+            this.recordEvent(exec, 'auto', reason, 'safe');
+            return undefined;
+        }
+        if (risk.kind === 'risky') {
+            if (risk.category !== 'neutral') {
+                // Hard category (or an off-protocol one, graded hard): always the human
+                // seam — never auto-allowed, never learned.
+                const reason = `${decision.reason} [llm-assist risky:${risk.category} → human]`;
+                return { kind: 'ask', reason };
+            }
+            const learning = this.liveRiskLearning();
+            const key = learnKey(exec.name, risk.category);
+            const fp = operationFingerprint(exec.name, exec.arguments ?? {}, exec.commandText);
+            if (learning.enabled && this.learning.shouldAutoAllow(key, fp)) {
+                const reason = `llm-assist learned allow (${key}, ${fp})`;
+                this.audit.append(makeEntry({ callId: randomId(), tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
+                this.recordEvent(exec, 'auto', reason, risk.category);
+                return undefined;
+            }
+            if (learning.enabled) {
+                if (this.pending.size >= PENDING_CAP) {
+                    const oldest = this.pending.keys().next();
+                    if (!oldest.done)
+                        this.pending.delete(oldest.value);
+                }
+                this.pending.set(canonicalizeCall(exec.name, exec.arguments ?? {}), { key, fp, ctx: decision.reason });
+            }
+            return { kind: 'ask', reason: `${decision.reason} [llm-assist risky:neutral]` };
+        }
+        // unresolved: keep the ask, learn nothing.
+        return decision;
+    }
+    /**
+     * Settle a learning candidate after the call finished (`tools/result`).
+     * A result arriving for a registered pending candidate means the human
+     * approved it and it actually executed — record one confirmation.
+     */
+    settleExecution(exec) {
+        const callKey = canonicalizeCall(exec.name, exec.arguments ?? {});
+        const candidate = this.pending.get(callKey);
+        if (candidate === undefined)
+            return;
+        this.pending.delete(callKey);
+        if (!this.liveRiskLearning().enabled)
+            return;
+        this.learning.confirm(candidate.key, candidate.fp, candidate.ctx);
+        this.recordEvent(exec, 'learned', `confirmed ${candidate.key} (${candidate.fp})`, 'neutral');
+    }
+    /** Mint a precise session grant bound to a canonical call fingerprint. */
+    grant(exec, maxUses, ttlMs) {
+        const args = exec.arguments ?? {};
+        this.grants.mint({
+            tool: exec.name,
+            fingerprint: canonicalizeCall(exec.name, args),
+            decidedBy: 'human',
+            parentAuthorized: exec.parentAuthorized !== false,
+            ttlMs,
+            maxUses,
+        });
+    }
+    /**
+     * Grant "repeat this call for the current session" (the always-confirm panel's
+     * first extended allow button): mint a bounded session grant for the exact
+     * call so an identical re-run this session passes without asking again.
+     */
+    approveRepeat(exec, maxUses = this.options.grantMaxUses ?? 3, ttlMs = this.options.grantTtlMs ?? 5 * 60_000) {
+        this.grant(exec, maxUses, ttlMs);
+    }
+    /**
+     * Grant "allow every occurrence of this command" (the always-confirm panel's
+     * second extended allow button): persist the command into the rules file's
+     * `allow` whitelist and reload. Returns the reload result.
+     */
+    approveAllowEverywhere(commandWord, reason = 'permissive allow-everywhere') {
+        if (!this.options.rulesFile)
+            return false;
+        if (!appendAllowCommand(this.options.rulesFile, commandWord, reason))
+            return false;
+        return this.reload();
+    }
+    /** Read-only view of the current allow-list command patterns (whitelist). */
+    allowlist() {
+        if (!this.options.rulesFile)
+            return [];
+        return listAllowCommands(this.options.rulesFile);
+    }
+    /**
+     * Replace the whitelist with exactly the given command patterns and reload.
+     * Returns the reload result (false when no rulesFile or the write failed).
+     */
+    setAllowlist(patterns) {
+        if (!this.options.rulesFile)
+            return false;
+        if (!replaceAllowCommands(this.options.rulesFile, patterns))
+            return false;
+        return this.reload();
+    }
+}
+function readFileSafe(p) {
+    try {
+        return readFileSync(p, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function randomId() {
+    return Math.random().toString(36).slice(2, 10) + Date.now().toString(36);
+}

package/lib/shell.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shell command decomposition for dsh-perm-gate.
+ *
+ * Turns a raw command-string argument into a list of SIMPLE commands: each
+ * simple command is a `command` word plus `args` and `redirect` tokens. It
+ * recognizes pipelines/`&&`/`;` at the top level, strips common prefix wrappers
+ * (`env`, `sudo`, `command`, literal-prefix `\`), and RECURSIVELY descends into
+ * `sh -c "..."` / `bash -c "..."` / `powershell -Command "..."` so that
+ * `sh -c "rm -rf /"` matches the same way as a bare `rm -rf /`.
+ *
+ * Pure: no filesystem/process state.
+ */
+export interface SimpleCommand {
+    /** The command word (env/prefix wrappers stripped, `\,` backtick un-escaped). */
+    readonly command: string;
+    /** Argument tokens (redirect targets are NOT part of `args`). */
+    readonly args: readonly string[];
+    /** Redirect targets (`>`, `>>`, `<`) — treated as argument-token candidates too. */
+    readonly redirects: readonly string[];
+}
+export type CmdFlag = 'recursive' | 'force';
+/**
+ * Tokenize a shell string into tokens, honoring single/double quotes and a few
+ * common escapes. Missing/EOF quotes throw so the caller can route an
+ * undecidable command to `ask` rather than guessing.
+ */
+export declare function tokenizeShell(text: string): string[];
+/**
+ * Recursively decompose a command string into simple commands, descending into
+ * `-c`/`-Command` inline scripts. Throws on undecidable syntax (unclosed quote);
+ * callers route that to `ask`, never `allow`.
+ */
+export declare function decomposeShellCommand(text: string): {
+    commands: SimpleCommand[];
+};
+/** Whether a simple command's args carry a `recursive` deletion modifier. */
+export declare function isRecursiveDeletion(cmd: SimpleCommand): boolean;
+export declare function isForceDeletion(cmd: SimpleCommand): boolean;

package/lib/shell.js

@@ -0,0 +1,176 @@
+const WRAPPER_WORDS = new Set(['env', 'sudo', 'command', 'nohup', 'xargs']);
+const COMMAND_WORDS = new Set(['sh', 'bash', 'zsh', 'dash', 'busybox', 'pwsh', 'powershell', 'cmd']);
+/**
+ * Tokenize a shell string into tokens, honoring single/double quotes and a few
+ * common escapes. Missing/EOF quotes throw so the caller can route an
+ * undecidable command to `ask` rather than guessing.
+ */
+export function tokenizeShell(text) {
+    const tokens = [];
+    let cur = '';
+    let quote = null;
+    let i = 0;
+    const n = text.length;
+    while (i < n) {
+        const ch = text[i];
+        if (quote === "'") {
+            if (ch === "'") {
+                quote = null;
+                i += 1;
+                continue;
+            }
+            cur += ch;
+            i += 1;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === '"') {
+                quote = null;
+                i += 1;
+                continue;
+            }
+            if (ch === '\\' && i + 1 < n) {
+                cur += text[i + 1];
+                i += 2;
+                continue;
+            }
+            cur += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '\\' && i + 1 < n) {
+            cur += text[i + 1];
+            i += 2;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (cur.length > 0) {
+                tokens.push(cur);
+                cur = '';
+            }
+            i += 1;
+            continue;
+        }
+        cur += ch;
+        i += 1;
+    }
+    if (quote !== null) {
+        throw new Error('unterminated quote in command string');
+    }
+    if (cur.length > 0)
+        tokens.push(cur);
+    return tokens;
+}
+/** Split into top-level simple-command token groups on `|`/`&&`/`;`/`||`. */
+function splitPipeline(tokens) {
+    const groups = [];
+    let cur = [];
+    for (const tok of tokens) {
+        if (tok === '|' || tok === '&&' || tok === ';' || tok === '||') {
+            if (cur.length > 0)
+                groups.push(cur);
+            cur = [];
+        }
+        else {
+            cur.push(tok);
+        }
+    }
+    if (cur.length > 0)
+        groups.push(cur);
+    return groups;
+}
+function splitRedirects(tokens) {
+    const args = [];
+    const redirects = [];
+    for (let i = 0; i < tokens.length; i += 1) {
+        const t = tokens[i];
+        if (t === '>' || t === '>>' || t === '<' || t === '1>' || t === '2>' || /^\d+>[>&]?$/.test(t)) {
+            if (i + 1 < tokens.length)
+                redirects.push(tokens[i + 1]);
+            i += 1;
+            continue;
+        }
+        args.push(t);
+    }
+    return { args, redirects };
+}
+/** Strip prefix wrappers (`env A=1`, `sudo`, `command`, leading `\`) from a command token list. */
+function stripWrappers(args) {
+    let list = [...args];
+    let guard = 0;
+    while (list.length > 0 && guard++ < 8) {
+        let head = list[0];
+        if (head.startsWith('\\'))
+            head = head.slice(1);
+        if (WRAPPER_WORDS.has(head)) {
+            // Drop the wrapper and any `K=V` right after it.
+            list = list.slice(1);
+            while (list.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(list[0]))
+                list = list.slice(1);
+            continue;
+        }
+        break;
+    }
+    return list;
+}
+/**
+ * Recursively decompose a command string into simple commands, descending into
+ * `-c`/`-Command` inline scripts. Throws on undecidable syntax (unclosed quote);
+ * callers route that to `ask`, never `allow`.
+ */
+export function decomposeShellCommand(text) {
+    const tokens = tokenizeShell(text);
+    const groups = splitPipeline(tokens);
+    const commands = [];
+    for (const group of groups) {
+        collectSimpleCommand(group, commands);
+    }
+    return { commands };
+}
+function collectSimpleCommand(tokens, out) {
+    const stripped = stripWrappers(tokens);
+    if (stripped.length === 0)
+        return;
+    let command = stripped[0];
+    const rest = stripped.slice(1);
+    if (command.startsWith('\\'))
+        command = command.slice(1);
+    command = command.replace(/`/g, '');
+    // Inline interpreter (-c / -Command): recurse into the script token.
+    const flagIndex = rest.findIndex((t) => t === '-c' || t === '--command' || /^-Command$/i.test(t));
+    if (COMMAND_WORDS.has(command) && flagIndex >= 0) {
+        const script = rest[flagIndex + 1];
+        if (typeof script === 'string') {
+            const nested = new Set();
+            try {
+                for (const sc of decomposeShellCommand(script).commands) {
+                    // Flatten; dedupe exact same command word + token signature.
+                    const key = `${sc.command}:${sc.args.join('\x00')}:${sc.redirects.join('\x00')}`;
+                    if (nested.has(key))
+                        continue;
+                    nested.add(key);
+                    out.push(sc);
+                }
+            }
+            catch {
+                out.push({ command: command.toLowerCase(), args: rest, redirects: [] });
+                return;
+            }
+            return;
+        }
+    }
+    const { args, redirects } = splitRedirects(rest);
+    out.push({ command: command.toLowerCase(), args, redirects });
+}
+/** Whether a simple command's args carry a `recursive` deletion modifier. */
+export function isRecursiveDeletion(cmd) {
+    return cmd.args.some((token) => /^-.*r/i.test(token) || /^-.*rf/i.test(token) || /^--(?:recursive|-?force)$/i.test(token) || token === 'recursive');
+}
+export function isForceDeletion(cmd) {
+    return cmd.args.some((token) => /^-.*f/i.test(token) || /^--force$/i.test(token) || token === 'force');
+}

package/package.json

@@ -0,0 +1,120 @@
+{
+  "name": "dsh-perm-gate",
+  "version": "0.2.0",
+  "description": "DSH permission-gate: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
+  "type": "module",
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "assets",
+    "examples",
+    "README.md",
+    "README.zh.md",
+    "README.ja.md",
+    "README.ko.md",
+    "INSTALL.md",
+    "INSTALL.zh.md",
+    "INSTALL.ja.md",
+    "INSTALL.ko.md",
+    "CHANGELOG.md",
+    "CHANGELOG.ja.md",
+    "CHANGELOG.ko.md",
+    "LICENSE"
+  ],
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./engine": {
+      "types": "./lib/engine.d.ts",
+      "default": "./lib/engine.js"
+    },
+    "./shell": {
+      "types": "./lib/shell.d.ts",
+      "default": "./lib/shell.js"
+    },
+    "./grant": {
+      "types": "./lib/grant.d.ts",
+      "default": "./lib/grant.js"
+    },
+    "./classifier": {
+      "types": "./lib/classifier.d.ts",
+      "default": "./lib/classifier.js"
+    },
+    "./allowlist": {
+      "types": "./lib/allowlist.d.ts",
+      "default": "./lib/allowlist.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "dsh-perm-gate": "./lib/cli.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "yaml": "^2.5.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.7",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "eslint": "^10.9.1",
+    "react": "^18.3.1",
+    "tsdown": "^0.22.14",
+    "typescript": "^5.6.0",
+    "typescript-eslint": "^8.69.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsdown",
+    "prepublishOnly": "npm run build",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "lint": "eslint src test tsdown.config.ts eslint.config.mjs",
+    "test": "vitest run"
+  },
+  "license": "MIT",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "permission",
+    "permission-gate",
+    "allowlist",
+    "denylist",
+    "sandbox",
+    "permissive",
+    "approval",
+    "ai-safety"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  }
+}