dsh-perm-gate 2.1.0 → 3.0.0

package/lib/command-dispatcher.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Command dispatcher - routes commands to appropriate parsers.
+ * Runs parsers in priority order, returns first match.
+ */
+import type { CommandParser, ClassificationResult } from './command-semantics.js';
+/**
+ * Register a parser manually (for testing or custom parsers).
+ */
+export declare function registerParser(parser: CommandParser): void;
+/**
+ * Clear all registered parsers (for testing).
+ */
+export declare function clearParsers(): void;
+/**
+ * Dispatch a command to the appropriate parser.
+ * Returns classification result or null if no parser matches.
+ */
+export declare function dispatchCommand(command: string): ClassificationResult | null;
+/**
+ * Get all registered parsers (for inspection/testing).
+ */
+export declare function getParsers(): readonly CommandParser[];

package/lib/command-dispatcher.js

@@ -0,0 +1,97 @@
+/**
+ * Command dispatcher - routes commands to appropriate parsers.
+ * Runs parsers in priority order, returns first match.
+ */
+import { GitParser } from './parsers/git.js';
+import { ShellDangerousParser } from './parsers/shell-cmds.js';
+/** Registered parsers (loaded lazily) */
+const parsers = [];
+/** Parser registry flag */
+let initialized = false;
+/**
+ * Lazy-load all parsers.
+ * Called once on first dispatch.
+ */
+function initParsers() {
+    if (initialized)
+        return;
+    initialized = true;
+    // P0: Git parser (highest priority)
+    parsers.push(new GitParser());
+    // P1: Shell dangerous commands
+    parsers.push(new ShellDangerousParser());
+    // P2: Package managers (TODO: implement)
+    // parsers.push(new PkgManagerParser())
+    // P3: Docker (TODO: implement)
+    // parsers.push(new DockerParser())
+    // P4: SQL (TODO: implement)
+    // parsers.push(new SqlParser())
+}
+/**
+ * Register a parser manually (for testing or custom parsers).
+ */
+export function registerParser(parser) {
+    // Insert in priority order (lower priority number = higher priority)
+    const idx = parsers.findIndex(p => p.priority > parser.priority);
+    if (idx === -1) {
+        parsers.push(parser);
+    }
+    else {
+        parsers.splice(idx, 0, parser);
+    }
+}
+/**
+ * Clear all registered parsers (for testing).
+ */
+export function clearParsers() {
+    parsers.length = 0;
+    initialized = false;
+}
+/**
+ * Dispatch a command to the appropriate parser.
+ * Returns classification result or null if no parser matches.
+ */
+export function dispatchCommand(command) {
+    initParsers();
+    const startTime = performance.now();
+    for (const parser of parsers) {
+        if (parser.canParse(command)) {
+            const semantics = parser.parse(command);
+            if (semantics) {
+                const parseTimeMs = performance.now() - startTime;
+                return {
+                    semantics,
+                    confidence: 1.0, // Static parsers have high confidence
+                    parser: parser.name,
+                    parseTimeMs,
+                };
+            }
+        }
+    }
+    // No parser matched - return unknown semantics
+    const parseTimeMs = performance.now() - startTime;
+    return {
+        semantics: {
+            family: 'unknown',
+            destructiveness: 0,
+            destructiveFlags: false,
+            targets: [],
+            flags: [],
+            requiresConfirmation: false,
+            compound: false,
+            gitOperation: false,
+            targetsSharedBranch: false,
+            rawCommand: command,
+        },
+        confidence: 0,
+        parser: 'none',
+        parseTimeMs,
+    };
+}
+/**
+ * Get all registered parsers (for inspection/testing).
+ */
+export function getParsers() {
+    initParsers();
+    return parsers;
+}

package/lib/command-semantics.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Unified command semantics output from all classifiers.
+ * Every parser (git, shell-dangerous, docker, sql, pkg-manager)
+ * returns this interface — the evaluator does one matching pass.
+ */
+/** Command families supported by static parsers */
+export type CommandFamily = 'git' | 'shell-dangerous' | 'docker' | 'sql' | 'pkg-manager' | 'unknown';
+/** Destructiveness rating (0=safe, 5=extremely destructive) */
+export type DestructivenessLevel = 0 | 1 | 2 | 3 | 4 | 5;
+/** Unified semantics output */
+export interface CommandSemantics {
+    /** Command family (git, shell-dangerous, docker, sql, pkg-manager, unknown) */
+    family: CommandFamily;
+    /** Subcommand (e.g. 'push', 'rm', 'run') */
+    subcommand?: string;
+    /** Specific operation (e.g. 'force-push', 'recursive-delete') */
+    operation?: string;
+    /** Destructiveness level 0-5 */
+    destructiveness: DestructivenessLevel;
+    /** Whether destructive flags are present (--force, --recursive, etc.) */
+    destructiveFlags: boolean;
+    /** Target identifiers (branch names, file paths, container IDs, table names, package names) */
+    targets: string[];
+    /** All parsed flags (normalized) */
+    flags: string[];
+    /** Whether the command requires explicit confirmation */
+    requiresConfirmation: boolean;
+    /** Whether the command is compound (contains &&, ||, |) */
+    compound: boolean;
+    /** Whether the command involves git operations */
+    gitOperation: boolean;
+    /** Branch name (extracted from git commands) */
+    branch?: string;
+    /** Remote name (for git push/fetch) */
+    remote?: string;
+    /** Whether the command targets shared/protected branches */
+    targetsSharedBranch: boolean;
+    /** Raw command string */
+    rawCommand?: string;
+}
+/** Classification result with confidence */
+export interface ClassificationResult {
+    /** The semantics object */
+    semantics: CommandSemantics;
+    /** Parser confidence (0-1) */
+    confidence: number;
+    /** Parser used */
+    parser: string;
+    /** Parse time in milliseconds */
+    parseTimeMs: number;
+}
+/** Parser interface - all parsers implement this */
+export interface CommandParser {
+    /** Parser name */
+    readonly name: string;
+    /** Priority (lower = runs first) */
+    readonly priority: number;
+    /** Try to parse the command. Return null if not applicable. */
+    parse(command: string): CommandSemantics | null;
+    /** Check if this parser can handle the command */
+    canParse(command: string): boolean;
+}

package/lib/command-semantics.js

@@ -0,0 +1,6 @@
+/**
+ * Unified command semantics output from all classifiers.
+ * Every parser (git, shell-dangerous, docker, sql, pkg-manager)
+ * returns this interface — the evaluator does one matching pass.
+ */
+export {};

package/lib/compiler.d.ts

@@ -28,3 +28,53 @@ export declare function compileGlob(pattern: string, options?: {
 export declare function compileLiteral(pattern: string): CompiledPattern;
 /** Stable SHA-256 content hash (used for rule-file compile caching). */
 export declare function hashText(text: string): string;
+/**
+ * Compile a CIDR notation string (e.g. `10.0.0.0/8`) into a matcher that
+ * tests whether an IPv4 address falls within the range.
+ *
+ * Returns a pure function `(ip: string) => boolean`. Non-IPv4 inputs always
+ * return false. Invalid CIDR throws at compile time (fail-loud).
+ */
+export declare function compileCidr(cidr: string): (ip: string) => boolean;
+/**
+ * Compile a port specification into a matcher function.
+ *
+ * Accepts:
+ *   - A single port: `"443"` → matches exactly 443
+ *   - A port range: `"8000-9000"` → matches 8000–9000 inclusive
+ *
+ * Returns `(port: number) => boolean`. Invalid specs throw at compile time.
+ */
+export declare function compilePortSpec(spec: string): (port: number) => boolean;
+/**
+ * Compile a domain pattern into a matcher that supports subdomain inclusion.
+ *
+ * - `"github.com"` matches `github.com` AND any subdomain (`api.github.com`)
+ * - `"*.example.com"` matches only subdomains, not `example.com` itself
+ * - Glob characters (`*`, `?`, `[...]`) are handled by {@link compileGlob}.
+ *
+ * Returns a {@link CompiledPattern} whose `.re` is the anchored RegExp.
+ */
+export declare function compileDomainPattern(pattern: string): CompiledPattern;
+/**
+ * Compile a git branch-name pattern into a matcher.
+ *
+ * Branch names are path-like (`release/1.0`) but a rule author thinks in
+ * segments-with-globs terms (`release*`), so this is a **non-segment** glob:
+ * `*` crosses `/` on purpose, matching how `args` patterns behave.
+ *
+ * Rejects a pattern that is nothing but a separator so a typo can not degrade
+ * into "matches everything".
+ */
+export declare function compileBranchPattern(pattern: string): CompiledPattern;
+/**
+ * Compile a list of patterns (possibly `!`-prefixed) into param matchers.
+ * Returns `{ pattern, negated, compiled }` entries for the params dimension.
+ */
+export declare function compileParamPatterns(patterns: readonly string[], opts?: {
+    maxStars?: number;
+}): Array<{
+    readonly pattern: string;
+    readonly negated: boolean;
+    readonly compiled: CompiledPattern;
+}>;

package/lib/compiler.js

@@ -124,3 +124,125 @@ function escapeRegexChar(ch) {
 export function hashText(text) {
     return createHash('sha256').update(text, 'utf8').digest('hex');
 }
+// ─── Extended matchers for new dimensions ──────────────────────────────────
+/**
+ * Compile a CIDR notation string (e.g. `10.0.0.0/8`) into a matcher that
+ * tests whether an IPv4 address falls within the range.
+ *
+ * Returns a pure function `(ip: string) => boolean`. Non-IPv4 inputs always
+ * return false. Invalid CIDR throws at compile time (fail-loud).
+ */
+export function compileCidr(cidr) {
+    const slash = cidr.indexOf('/');
+    if (slash <= 0 || slash >= cidr.length - 1) {
+        throw new PatternError(`CIDR "${cidr}" must be in address/prefix format`);
+    }
+    const addrStr = cidr.slice(0, slash);
+    const prefixStr = cidr.slice(slash + 1);
+    const prefix = Number.parseInt(prefixStr, 10);
+    if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) {
+        throw new PatternError(`CIDR "${cidr}" prefix must be 0–32`);
+    }
+    const addr = ipv4ToNumber(addrStr);
+    if (addr === undefined) {
+        throw new PatternError(`CIDR "${cidr}" has invalid IPv4 address`);
+    }
+    const mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
+    const network = (addr & mask) >>> 0;
+    return (ip) => {
+        const n = ipv4ToNumber(ip);
+        if (n === undefined)
+            return false;
+        return ((n & mask) >>> 0) === network;
+    };
+}
+/** Parse an IPv4 dotted-decimal string to a 32-bit unsigned integer, or undefined. */
+function ipv4ToNumber(addr) {
+    const parts = addr.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    let result = 0;
+    for (const part of parts) {
+        const n = Number.parseInt(part, 10);
+        if (!Number.isFinite(n) || n < 0 || n > 255)
+            return undefined;
+        if (part.length > 1 && part.startsWith('0'))
+            return undefined; // no leading zeros
+        result = (result * 256 + n) >>> 0;
+    }
+    return result;
+}
+/**
+ * Compile a port specification into a matcher function.
+ *
+ * Accepts:
+ *   - A single port: `"443"` → matches exactly 443
+ *   - A port range: `"8000-9000"` → matches 8000–9000 inclusive
+ *
+ * Returns `(port: number) => boolean`. Invalid specs throw at compile time.
+ */
+export function compilePortSpec(spec) {
+    const dash = spec.indexOf('-');
+    if (dash === -1) {
+        const n = Number.parseInt(spec, 10);
+        if (!Number.isFinite(n) || n < 0 || n > 65535) {
+            throw new PatternError(`port "${spec}" must be 0–65535`);
+        }
+        return (port) => port === n;
+    }
+    const lo = Number.parseInt(spec.slice(0, dash), 10);
+    const hi = Number.parseInt(spec.slice(dash + 1), 10);
+    if (!Number.isFinite(lo) || !Number.isFinite(hi) || lo < 0 || hi > 65535 || lo > hi) {
+        throw new PatternError(`port range "${spec}" must be low–high within 0–65535`);
+    }
+    return (port) => port >= lo && port <= hi;
+}
+/**
+ * Compile a domain pattern into a matcher that supports subdomain inclusion.
+ *
+ * - `"github.com"` matches `github.com` AND any subdomain (`api.github.com`)
+ * - `"*.example.com"` matches only subdomains, not `example.com` itself
+ * - Glob characters (`*`, `?`, `[...]`) are handled by {@link compileGlob}.
+ *
+ * Returns a {@link CompiledPattern} whose `.re` is the anchored RegExp.
+ */
+export function compileDomainPattern(pattern) {
+    // If the pattern already contains glob chars, use glob compilation.
+    if (/[*?[\]]/.test(pattern)) {
+        return compileGlob(pattern, { segments: false, maxStars: DEFAULT_MAX_STARS });
+    }
+    // Literal domain: match exactly OR as a parent of a subdomain.
+    // e.g. "github.com" matches "github.com" and "api.github.com"
+    const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`^(?:.*\\.)?${escaped}$`, 'u');
+    return { source: pattern, re };
+}
+/**
+ * Compile a git branch-name pattern into a matcher.
+ *
+ * Branch names are path-like (`release/1.0`) but a rule author thinks in
+ * segments-with-globs terms (`release*`), so this is a **non-segment** glob:
+ * `*` crosses `/` on purpose, matching how `args` patterns behave.
+ *
+ * Rejects a pattern that is nothing but a separator so a typo can not degrade
+ * into "matches everything".
+ */
+export function compileBranchPattern(pattern) {
+    if (!/[A-Za-z0-9_*?[\]]/.test(pattern)) {
+        throw new PatternError(`branch pattern ${JSON.stringify(pattern)} has no matchable character`);
+    }
+    return compileGlob(pattern, { segments: false, maxStars: DEFAULT_MAX_STARS });
+}
+/**
+ * Compile a list of patterns (possibly `!`-prefixed) into param matchers.
+ * Returns `{ pattern, negated, compiled }` entries for the params dimension.
+ */
+export function compileParamPatterns(patterns, opts = {}) {
+    const maxStars = opts.maxStars ?? DEFAULT_MAX_STARS;
+    return patterns.map((p) => {
+        if (p.startsWith('!') && p.length > 1) {
+            return { pattern: p, negated: true, compiled: compileGlob(p.slice(1), { segments: false, maxStars }) };
+        }
+        return { pattern: p, negated: false, compiled: compileGlob(p, { segments: false, maxStars }) };
+    });
+}

package/lib/config.d.ts

@@ -1,5 +1,6 @@
 import z from '@deepseek-ai/schemastery';
 import type { RuleAction } from './rule.js';
+import { DEFAULT_GATE_PRESETS, resolveGatePresets } from './preset.js';
 /**
  * The DSH home directory: an explicit `dshHome`, else `$DSH_HOME`, else
  * `~/.dsh`. A profile entry that omits `config` must still get a writable data
@@ -100,6 +101,96 @@ export interface PermGateConfig {
      * never widen authority for a destructive or credential-bearing call.
      */
     readonly autoAllowTools?: string[];
+    /**
+     * Session-lifecycle sweep: on startup and hourly, drop the authorization
+     * chain's decision events and pre-change snapshots of sessions DSH has
+     * archived or no longer tracks. Fail-open, best-effort. Default true.
+     */
+    readonly sessionSweep?: boolean;
+    /** Path to DSH's workspace store; defaults to `<dshHome>/storages/workspace.json`. Read-only to the gate. */
+    readonly workspaceStoreFile?: string;
+    /**
+     * Whether to enable multi-file rule chain resolution. When true, the gate
+     * searches up directory ancestors for the rules file. Default false.
+     */
+    readonly searchUp?: boolean;
+    /** Fallback rules file path when no file is found in the chain search. */
+    readonly fallbackPath?: string;
+    /** Error policy for malformed files in the chain: `fail` (throw) or `warn` (skip). Default fail. */
+    readonly badFilePolicy?: 'fail' | 'warn';
+    /** Maximum number of files in the rule chain. Default 10. */
+    readonly maxChainLength?: number;
+    /**
+     * Master network switch. **Default false** — the network proxy is an
+     * opt-in capability, not part of the baseline gate.
+     *
+     * When false: no proxy is started, no environment variables are injected,
+     * and no network interception occurs — zero behavior change from the
+     * pre-network baseline.
+     *
+     * Enable it from the settings card only after verifying it in your
+     * environment. The proxy binds a loopback port and rewrites proxy env
+     * vars for subprocesses, so it must never be enabled implicitly.
+     */
+    readonly networkEnabled?: boolean;
+    /** Network policy mode when auto-mapping from sandbox is not used. Default 'whitelist'. */
+    readonly networkMode?: import('./network.js').NetworkMode;
+    /** How unlisted targets are handled in whitelist mode.
+     *
+     * - `'deny'` — block outright, never prompt.
+     * - `'ask'`  — raise an interactive approval for the attributed shell command;
+     *              approve to let THIS target through for this session.
+     *
+     * A `deny` rule always wins: approval can widen reach for a target no rule
+     * allows, but it can never override a rule that says no.
+     */
+    readonly networkUnlisted?: import('./network.js').UnlistedAction;
+    /**
+     * How traffic with **no shell attribution** is handled. Default `'allow'`.
+     *
+     * A connection that cannot be tied to an in-flight shell execution did not
+     * come from a subprocess this gate manages — it is DSH's own client (a
+     * built-in network tool, the LLM transport). The proxy is a *subprocess*
+     * policy surface, so reviewing the host's own traffic risks the host
+     * blocking itself, which is far worse than a missed block. `'deny'` reviews
+     * it anyway, and would break DSH if a built-in client ever honors the proxy
+     * environment (e.g. Node 24+ with `NODE_USE_ENV_PROXY=1`).
+     */
+    readonly networkUnattributed?: import('./network.js').UnattributedAction;
+    /** Loopback handling: 'allow' short-circuits before rules; 'policy' evaluates normally. Default 'allow'. */
+    readonly networkLoopback?: 'allow' | 'policy';
+    /** Proxy bind address. Default '127.0.0.1'. */
+    readonly networkBind?: string;
+    /** Proxy bind port. Default 0 (ephemeral). */
+    readonly networkPort?: number;
+    /** NO_PROXY handling: 'clear' empties it so policy cannot be bypassed; 'preserve' keeps ambient values. Default 'clear'. */
+    readonly networkNoProxy?: 'clear' | 'preserve';
+    /**
+     * Rewrite `HTTP(S)_PROXY` / `ALL_PROXY` for subprocesses so their traffic
+     * reaches the proxy. Default true.
+     *
+     * Turn it off to run the proxy WITHOUT touching `process.env` — the
+     * listener still adjudicates whatever is explicitly pointed at it, but no
+     * ambient state is rewritten. Useful when the environment is managed
+     * elsewhere or when verifying the proxy in isolation.
+     */
+    readonly networkInjectEnv?: boolean;
+    /**
+     * How long an unlisted-target approval waits for a human before failing
+     * closed to a block (ms). Default 120000 (2 min).
+     */
+    readonly networkAskTimeoutMs?: number;
+    /**
+     * How long one approved network target stays approved for the session (ms).
+     * One shell command routinely opens many connections to the same host, so
+     * without this the human would be prompted once per connection.
+     * Default 1800000 (30 min).
+     */
+    readonly networkGrantTtlMs?: number;
+    /** @deprecated Rules now live in the `dsh-perm-gate-rules` settings namespace; file watching was removed. Accepted (ignored) for composition compatibility. */
+    readonly watch?: boolean;
+    /** @deprecated See {@link watch}. */
+    readonly watchDebounceMs?: number;
 }
 /** Backend combinable approval strategies for the Permissive tier (all opt-in). */
 export interface PermissiveStrategies {
@@ -127,15 +218,78 @@ export interface PermissiveStrategies {
     readonly trustEscalation: boolean;
 }
 export declare const DEFAULT_PERMISSIVE_STRATEGIES: Readonly<PermissiveStrategies>;
-/**
- * Presets in which the gate is active. It owns the `permissive` tier; `'*'`
- * makes it global (every preset, including the hard-deny layer).
- */
-export declare const DEFAULT_GATE_PRESETS: readonly string[];
-/** Normalize the gate scope: an unset/empty list means the default. */
-export declare function resolveGatePresets(configured?: readonly string[]): readonly string[];
+export { DEFAULT_GATE_PRESETS, resolveGatePresets };
 /** Normalize a backend strategy bag to fully-specified booleans (backend-part combinable). */
 export declare function resolvePermissiveStrategies(bag?: Partial<PermissiveStrategies>): PermissiveStrategies;
+/**
+ * One rule entry as stored in settings. Deliberately permissive (`z.any()`
+ * fields): strict validation happens in `parseRuleEntry` at compile time (fail
+ * loud), and the stored form must round-trip BOTH the raw YAML shape (string
+ * scalars, `params` as a key→patterns mapping) and the parsed document shape
+ * (parsed dimensions), so a file migration can be seeded without lossy
+ * normalization. Schemastery preserves unknown keys in non-strict object mode.
+ */
+export declare const RuleEntrySchema: z<unknown>;
+/**
+ * The rules structure stored in the DSH settings namespace — the JSON form of
+ * rules.yml. Unknown extra keys on the document itself are preserved too.
+ */
+export declare const RulesSchema: z<RulesConfig>;
+/** One rule entry in the settings-stored rules document (JSON form; all optional). */
+export interface RulesEntryConfig {
+    readonly tools?: readonly string[];
+    readonly command?: readonly string[];
+    readonly args?: readonly string[];
+    readonly paths?: readonly string[];
+    readonly params?: unknown;
+    readonly absent?: readonly string[];
+    readonly agents?: readonly string[];
+    readonly when?: unknown;
+    readonly argv?: unknown;
+    readonly network?: {
+        readonly domains?: readonly string[];
+        readonly ips?: readonly string[];
+        readonly ports?: readonly string[];
+        readonly schemes?: readonly string[];
+    };
+    readonly branch?: {
+        readonly target?: readonly string[];
+        readonly remote?: readonly string[];
+        readonly shared?: boolean;
+    };
+    readonly reason?: string;
+    readonly enabled?: boolean;
+}
+/**
+ * The rules document stored in the settings namespace. The action lists are
+ * `unknown[]` on purpose: entries may be the raw YAML shape or the parsed
+ * document shape, and strict validation belongs to `parseRuleEntry` at compile
+ * time — see {@link RulesEntryConfig} for the documented JSON form. (Mutable
+ * arrays: the type doubles as the Schemastery input face of {@link RulesSchema},
+ * which validates in place.)
+ */
+export interface RulesConfig {
+    readonly defaultAction?: RuleAction;
+    readonly deny?: unknown[];
+    readonly allow?: unknown[];
+    readonly ask?: unknown[];
+}
+/** Settings namespace for rules (separate from the main perm-gate namespace). */
+export declare const RULES_NAMESPACE = "dsh-perm-gate-rules";
+/**
+ * Whether a settings-sourced rules document carries a REAL configuration —
+ * entries or a non-default `defaultAction`. A namespace still holding bare
+ * schema defaults is "not configured" and must not shadow the rules file
+ * (the dual-source contract: settings first, file fallback).
+ */
+export declare function isRulesConfigured(value: unknown): boolean;
+/**
+ * Read the rules from a settings scope: the document when the namespace is
+ * configured, otherwise `undefined` so the caller falls back to the rules file.
+ */
+export declare function readRulesFromSettings(scope: {
+    get(): unknown;
+} | undefined): RulesConfig | undefined;
 export declare const Config: z<PermGateConfig>;
 export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
     readonly permissiveStrategies: PermissiveStrategies;

package/lib/config.js

@@ -5,6 +5,7 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
+import { DEFAULT_GATE_PRESETS, resolveGatePresets } from './preset.js';
 /**
  * The DSH home directory: an explicit `dshHome`, else `$DSH_HOME`, else
  * `~/.dsh`. A profile entry that omits `config` must still get a writable data
@@ -42,17 +43,10 @@ export const DEFAULT_PERMISSIVE_STRATEGIES = {
     // bulk) — the escalation-worthy ones — auto-deny rather than allow.
     trustEscalation: true,
 };
-/**
- * Presets in which the gate is active. It owns the `permissive` tier; `'*'`
- * makes it global (every preset, including the hard-deny layer).
- */
-export const DEFAULT_GATE_PRESETS = ['permissive'];
-/** Normalize the gate scope: an unset/empty list means the default. */
-export function resolveGatePresets(configured) {
-    if (configured === undefined || configured.length === 0)
-        return DEFAULT_GATE_PRESETS;
-    return configured.filter((name) => typeof name === 'string' && name !== '');
-}
+// The scope constants live in the dependency-free `preset` module (the browser
+// half renders them); bound locally AND re-exported so every existing
+// `./config.js` import keeps resolving.
+export { DEFAULT_GATE_PRESETS, resolveGatePresets };
 /** Normalize a backend strategy bag to fully-specified booleans (backend-part combinable). */
 export function resolvePermissiveStrategies(bag = {}) {
     return {
@@ -62,6 +56,57 @@ export function resolvePermissiveStrategies(bag = {}) {
         trustEscalation: bag.trustEscalation ?? DEFAULT_PERMISSIVE_STRATEGIES.trustEscalation,
     };
 }
+// ─── Rules Schema (for settings namespace) ──────────────────────────────────
+// The JSON twin of the rules.yml permissions document, stored in its own DSH
+// settings namespace so the gate loads without any file on disk.
+/**
+ * One rule entry as stored in settings. Deliberately permissive (`z.any()`
+ * fields): strict validation happens in `parseRuleEntry` at compile time (fail
+ * loud), and the stored form must round-trip BOTH the raw YAML shape (string
+ * scalars, `params` as a key→patterns mapping) and the parsed document shape
+ * (parsed dimensions), so a file migration can be seeded without lossy
+ * normalization. Schemastery preserves unknown keys in non-strict object mode.
+ */
+export const RuleEntrySchema = z.any();
+/**
+ * The rules structure stored in the DSH settings namespace — the JSON form of
+ * rules.yml. Unknown extra keys on the document itself are preserved too.
+ */
+export const RulesSchema = z.object({
+    defaultAction: z.union(['allow', 'ask', 'deny']).default('ask'),
+    deny: z.array(RuleEntrySchema).default([]),
+    allow: z.array(RuleEntrySchema).default([]),
+    ask: z.array(RuleEntrySchema).default([]),
+});
+/** Settings namespace for rules (separate from the main perm-gate namespace). */
+export const RULES_NAMESPACE = 'dsh-perm-gate-rules';
+/**
+ * Whether a settings-sourced rules document carries a REAL configuration —
+ * entries or a non-default `defaultAction`. A namespace still holding bare
+ * schema defaults is "not configured" and must not shadow the rules file
+ * (the dual-source contract: settings first, file fallback).
+ */
+export function isRulesConfigured(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const doc = value;
+    if (doc.defaultAction !== undefined && doc.defaultAction !== 'ask')
+        return true;
+    for (const key of ['deny', 'allow', 'ask']) {
+        const list = doc[key];
+        if (Array.isArray(list) && list.length > 0)
+            return true;
+    }
+    return false;
+}
+/**
+ * Read the rules from a settings scope: the document when the namespace is
+ * configured, otherwise `undefined` so the caller falls back to the rules file.
+ */
+export function readRulesFromSettings(scope) {
+    const value = scope?.get();
+    return isRulesConfigured(value) ? value : undefined;
+}
 export const Config = z.object({
     rulesFile: z.string(),
     dshHome: z.string(),
@@ -92,6 +137,28 @@ export const Config = z.object({
     allowlist: z.array(z.string()),
     denyKeywords: z.array(z.string()),
     autoAllowTools: z.array(z.string()),
+    sessionSweep: z.boolean().default(true),
+    workspaceStoreFile: z.string(),
+    // Rule chain (T1.9)
+    searchUp: z.boolean().default(false),
+    fallbackPath: z.string(),
+    badFilePolicy: z.union(['fail', 'warn']).default('fail'),
+    maxChainLength: z.number().min(1).max(50).default(10),
+    // Network (Phase 2)
+    networkEnabled: z.boolean().default(false),
+    networkMode: z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist'),
+    networkUnlisted: z.union(['ask', 'deny']).default('ask'),
+    networkUnattributed: z.union(['allow', 'deny']).default('allow'),
+    networkLoopback: z.union(['allow', 'policy']).default('allow'),
+    networkBind: z.string().default('127.0.0.1'),
+    networkPort: z.number().min(0).max(65535).default(0),
+    networkNoProxy: z.union(['clear', 'preserve']).default('clear'),
+    networkInjectEnv: z.boolean().default(true),
+    networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000),
+    networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000),
+    // Hot reload (Phase 3)
+    watch: z.boolean().default(true),
+    watchDebounceMs: z.number().min(50).max(5000).default(300),
 });
 export function resolveConfig(config = {}) {
     const parsed = Config(config);