dsh-perm-gate 2.1.2 → 3.0.0

package/lib/engine.js

@@ -9,7 +9,14 @@
  * Strictly fail-closed: P0 wins over every later stage.
  */
 import { isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
+// SHELL_TOOLS 是**值的导入**：这份名单必须与 evaluate.ts / runtime.ts 共用同一个
+// 事实源。此处曾经自带一份 `/(?:bash|pwsh|sh|cmd)$/` 正则，漏掉了 `shell` /
+// `terminal` / `powershell`——于是 P0 的 shell 检查对 DSH 的**主 shell 工具**
+// 完全失效（实测：同一句 `echo x > /etc/passwd`，bash 被拦截，shell 放行）。
+// 同名事实的第二份副本必然腐烂，这里不再保留副本。
+import { SHELL_TOOLS } from './evaluate.js';
 import { isForceDeletion, isRecursiveDeletion, decomposeShellCommand } from './shell.js';
+import { dispatchCommand } from './command-dispatcher.js';
 const DESTRUCTIVE_TOOL = /(?:^|[_-])(?:delete|remove|rm|destroy|erase|purge|wipe|unlink|rmdir|reset)(?:$|[_-]|recursive)/i;
 /**
  * Read-only tools that can never modify the workspace or execute anything. P0
@@ -107,6 +114,42 @@ function pathArgument(args) {
     }
     return undefined;
 }
+/** 廉价前缀过滤：绝大多数 shell 调用不是 push，先过一遍正则再动用解析器。 */
+const GIT_PUSH_TEXT = /\bgit\s+push\b/;
+/**
+ * 远端历史改写：`git push` 强制覆盖或删除**保护分支**。
+ *
+ * **「只升不降」是形状约束，不是口头约定**：返回值只有 `string | undefined`，
+ * 调用方把 `string` 读作 deny、`undefined` 读作「继续走后面的阶段」。本函数
+ * 结构上**无法**产生 allow，所以挂在 P0 上永远不会放宽门的判定。
+ *
+ * 刻意**不**覆盖（仍交给关键词层 / 规则层 / LLM 层）：
+ * - 非保护分支上的 force push（如 `origin feat/x`）——P0 不可撤销，得给工作流留口子；
+ * - 没写分支名的 `git push --force`——解析不出目标就不做断言；
+ * - 普通 push。
+ *
+ * 这正是本插件补不上的那一段：`DEFAULT_DENY_KEYWORDS` 里的 `'push --force'` 是
+ * **扁平的、可被命名空间覆盖掉**的，且完全不看分支；P0 这一层则是不可协商的底。
+ */
+function gitRemoteRewriteReason(segments) {
+    for (const seg of segments) {
+        const text = [seg.command, ...seg.args].join(' ');
+        if (!GIT_PUSH_TEXT.test(text))
+            continue;
+        const result = dispatchCommand(text);
+        if (result === null)
+            continue;
+        const s = result.semantics;
+        if (s.operation !== 'force-push' && s.operation !== 'push-delete')
+            continue;
+        if (!s.targetsSharedBranch)
+            continue;
+        const what = s.operation === 'push-delete' ? 'delete' : 'force-overwrite';
+        const remote = s.remote === undefined ? '' : ` (remote ${s.remote})`;
+        return `git push would ${what} protected branch: ${s.branch}${remote}`;
+    }
+    return undefined;
+}
 /**
  * Deterministic P0 hard-deny reason, or undefined when the call may proceed to
  * later stages.
@@ -115,8 +158,7 @@ export function hardDenyReason(ctx) {
     const args = ctx.args;
     if (containsCredentialMaterial(args))
         return 'call contains credential or private-key material';
-    const shell = /^(?:bash|pwsh|sh|cmd)$/.test(ctx.tool);
-    if (shell && typeof args.command === 'string') {
+    if (SHELL_TOOLS.has(ctx.tool) && typeof args.command === 'string') {
         let commands = [];
         try {
             commands = decomposeShellCommand(args.command).commands;
@@ -133,8 +175,16 @@ export function hardDenyReason(ctx) {
             if (redir !== undefined)
                 return `shell redirect targets protected path: ${redir}`;
         }
+        const rewrite = gitRemoteRewriteReason(commands);
+        if (rewrite !== undefined)
+            return rewrite;
     }
     const path = pathArgument(args);
+    // 注意：这里**刻意不**用 SHELL_TOOLS。本判据读的是 `pathArgument`（file_path /
+    // path / cwd / **workdir**），它是"被改写的路径"而不是"要执行的命令"。shell 工具的
+    // 真目标在 command 里，由上面的命令级检查负责；若把 shell 工具也塞进来，
+    // `shell({ command: 'ls', workdir: '/etc' })` 这种纯读操作会因为 workdir 落在受保护
+    // 前缀而被 P0 永久挡住——那是过度拦截，而且 P0 撤销不了。
     if (path !== undefined && (DESTRUCTIVE_TOOL.test(ctx.tool) || ctx.tool === 'bash' || ctx.tool === 'pwsh' || ctx.tool === 'write' || ctx.tool === 'edit')) {
         if (isProtectedDestructiveTarget(path, ctx.dshHome))
             return `mutation targets protected path: ${path}`;

package/lib/evaluate.js

@@ -5,8 +5,9 @@
  */
 import { normalizeWorkspacePath } from './path.js';
 import { extractPathCandidates, extractUrlCandidates, } from './rule.js';
-import { decomposeShellCommand, isForceDeletion, isRecursiveDeletion } from './shell.js';
+import { commandArgv, decomposeShellCommand, isForceDeletion, isRecursiveDeletion } from './shell.js';
 import { compileCidr, compilePortSpec, compileDomainPattern } from './compiler.js';
+import { dispatchCommand } from './command-dispatcher.js';
 /**
  * Tool names that execute a shell command string. `shell` and `terminal` are
  * DSH's own names (the shipped tool roster uses `shell`; `terminal` is the
@@ -95,7 +96,10 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     if (rule.argv?.pipeline !== undefined && rule.argv.pipeline.length > 0) {
         if (commands.length === 0)
             return false;
-        const pipelineText = commands.map((c) => c.command).join('|');
+        // Join the FULL argv of each simple command: `c.command` alone is just the
+        // command word, so `curl https://x | sh` would read as `curl|sh` and the
+        // documented `curl|sh` pattern could never see its own subject.
+        const pipelineText = commands.map((c) => commandArgv(c)).join('|');
         const compiled = rule.argv.pipeline.map((p) => compileGlobForMatch(p));
         if (!compiled.some((g) => g.test(pipelineText)))
             return false;
@@ -105,6 +109,13 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
         if (!matchNetwork(rule.network, ctx.network))
             return false;
     }
+    // branch dimension: git semantics only; non-git commands satisfy no branch
+    // dimension (per sub-dimension above). Never throws — a parser is pure, and
+    // the dispatcher falls back to `family: 'unknown'` rather than raising.
+    if (rule.branch !== undefined) {
+        if (!matchBranch(rule.branch, commands))
+            return false;
+    }
     return true;
 }
 const WRITE_TOOLS = new Set(['write', 'edit']);
@@ -371,3 +382,66 @@ function matchNetwork(network, ctx) {
     }
     return true;
 }
+/**
+ * Per-call memo for command classification.
+ *
+ * `ruleMatches` runs once per rule, so a rule chain with several `branch`
+ * rules would otherwise re-parse the same command each time. `dispatchCommand`
+ * is pure, so caching its result per `SimpleCommand` object is safe; the
+ * WeakMap keeps no references once the command array is dropped.
+ */
+const commandSemanticsCache = new WeakMap();
+function semanticsOf(cmd) {
+    const cached = commandSemanticsCache.get(cmd);
+    if (cached !== undefined)
+        return cached;
+    // The parser needs the WHOLE argv: `cmd.command` carries only the command
+    // word, so `git push --force origin main` would arrive as `git` and classify
+    // as `family: unknown` (no branch, no remote, no flags).
+    const result = dispatchCommand(commandArgv(cmd));
+    commandSemanticsCache.set(cmd, result);
+    return result;
+}
+/**
+ * Branch dimension matching (git semantics only).
+ *
+ * Candidates come from the shared command dispatcher, so `refspec` forms
+ * (`HEAD:main`) are already split and a remote name is never mistaken for a
+ * branch name. Sub-dimensions are AND (each present one must match); within a
+ * sub-dimension the entries are OR.
+ *
+ * **Non-git commands satisfy no branch dimension**: `dispatchCommand` reports
+ * `family: 'unknown'` for them rather than throwing, so a rule that names a
+ * branch simply does not match `rm -rf`, `npm install` and friends. That is
+ * deliberate — the write-path/blacklist layers cover non-git commands.
+ *
+ * `shared` is the parser's STATIC protected-branch rule (main / master /
+ * production / release / stable, see `src/parsers/git.ts`). No git subprocess
+ * ever runs on the decision path.
+ */
+function matchBranch(branch, commands) {
+    if (commands.length === 0)
+        return false;
+    const branches = [];
+    const remotes = [];
+    let anyShared = false;
+    for (const cmd of commands) {
+        const result = semanticsOf(cmd);
+        if (result === null || result.semantics.family !== 'git')
+            continue;
+        const { branch: name, remote, targetsSharedBranch } = result.semantics;
+        if (targetsSharedBranch)
+            anyShared = true;
+        if (typeof name === 'string' && name.length > 0)
+            branches.push(name);
+        if (typeof remote === 'string' && remote.length > 0)
+            remotes.push(remote);
+    }
+    if (branch.shared && !anyShared)
+        return false;
+    if (branch.target.length > 0 && !branches.some((b) => branch.target.some((g) => g.re.test(b))))
+        return false;
+    if (branch.remote.length > 0 && !remotes.some((r) => branch.remote.some((g) => g.re.test(r))))
+        return false;
+    return true;
+}

package/lib/events.d.ts

@@ -1,3 +1,4 @@
+import type { RulesView } from './rules-view.js';
 /** One gate decision event. `kind` drives the client notice strip styling. */
 export interface GateEvent {
     /** Monotonic id (resumed from the file across restarts). */
@@ -8,9 +9,11 @@ export interface GateEvent {
     /**
      * auto = allowed (rule/grant/llm), ask = routed to the human, deny = vetoed,
      * learned = confirmation settled, manual-* = the human's terminal answer to an
-     * ask (approved / rejected / cancelled).
+     * ask (approved / rejected / cancelled), stand-down = the gate itself is
+     * inactive in this session's permission preset and therefore decided nothing
+     * (see {@link GateEvent.verdict} `stand-down`).
      */
-    readonly kind: 'auto' | 'ask' | 'deny' | 'learned' | 'manual-approved' | 'manual-rejected' | 'manual-cancelled';
+    readonly kind: 'auto' | 'ask' | 'deny' | 'learned' | 'manual-approved' | 'manual-rejected' | 'manual-cancelled' | 'stand-down';
     /** Risk category when an LLM verdict contributed to the decision. */
     readonly risk?: string;
     /** Truncated decision reason. */
@@ -133,6 +136,8 @@ export declare const DIFF_ROUTE = "/api/dsh-perm-gate/diff";
 export declare const REVERT_ROUTE = "/api/dsh-perm-gate/revert";
 export declare const SNAPSHOTS_STATS_ROUTE = "/api/dsh-perm-gate/snapshots-stats";
 export declare const SNAPSHOTS_CLEAR_ROUTE = "/api/dsh-perm-gate/snapshots-clear";
+export declare const DRY_RUN_ROUTE = "/api/dsh-perm-gate/dry-run";
+export declare const RULES_ROUTE = "/api/dsh-perm-gate/rules";
 /**
  * Register `GET /api/dsh-perm-gate/events?sessionId=&since=` on the webServer
  * service. Returns whether the route was registered (false when the service is
@@ -196,6 +201,55 @@ export interface LearningRouteProvider {
     threshold(): number;
     reset(key: string, fp?: string): void;
 }
+/** One rule-test request: the call to evaluate, nothing else. */
+export interface DryRunRequest {
+    readonly tool: string;
+    readonly args: Record<string, unknown>;
+    readonly permissive?: boolean;
+}
+/**
+ * The rule-test face the settings card calls. `run` evaluates one call against
+ * the ruleset the gate currently has loaded and returns the report from
+ * `dryRunResult`. It must not change any state — see {@link registerDryRunRoute}.
+ */
+export interface DryRunRouteProvider {
+    run(request: DryRunRequest): unknown;
+}
+/**
+ * Register `POST /api/dsh-perm-gate/dry-run` — the rule-test panel's endpoint.
+ * Body `{ tool, args?, permissive? }`; the response carries the effective
+ * verdict plus the rule layer's own answer.
+ *
+ * **Read-only by construction.** Unlike `/learning` (GET reads, POST resets), this
+ * route has no write form: it never edits rules, grants, learning state or the
+ * settings namespace, and the provider it delegates to evaluates against a
+ * throwaway or live read path only. Testing a rule must not be able to change
+ * the ruleset — otherwise "test it first" would itself be the risky action.
+ *
+ * Returns whether the route was registered.
+ */
+export declare function registerDryRunRoute(server: unknown, provider: DryRunRouteProvider): (() => void) | undefined;
+/**
+ * The permissions-file face the settings card calls. `view` reads the rules file
+ * the gate is loading; it must never write it.
+ */
+export interface RulesRouteProvider {
+    view(): RulesView;
+}
+/**
+ * Register `GET /api/dsh-perm-gate/rules` — the panel's view of the permissions
+ * YAML the gate actually loads.
+ *
+ * **Read-only by construction**, like {@link registerDryRunRoute}: there is no
+ * write form. The card could already *edit* this file — the allowlist section
+ * appends and replaces patterns — but had no way to display it, so an operator
+ * changing rules through the panel could not see the document being changed.
+ * Reading must not be the risky act, and a viewer that could write would make
+ * "let me just look at the rules" a mutation.
+ *
+ * Returns whether the route was registered.
+ */
+export declare function registerRulesRoute(server: unknown, provider: RulesRouteProvider): (() => void) | undefined;
 /**
  * Register the learning-store routes on the webServer service:
  * `GET  /api/dsh-perm-gate/learning` → the store snapshot + live threshold,

package/lib/events.js

@@ -357,6 +357,8 @@ export const DIFF_ROUTE = '/api/dsh-perm-gate/diff';
 export const REVERT_ROUTE = '/api/dsh-perm-gate/revert';
 export const SNAPSHOTS_STATS_ROUTE = '/api/dsh-perm-gate/snapshots-stats';
 export const SNAPSHOTS_CLEAR_ROUTE = '/api/dsh-perm-gate/snapshots-clear';
+export const DRY_RUN_ROUTE = '/api/dsh-perm-gate/dry-run';
+export const RULES_ROUTE = '/api/dsh-perm-gate/rules';
 /**
  * Register `GET /api/dsh-perm-gate/events?sessionId=&since=` on the webServer
  * service. Returns whether the route was registered (false when the service is
@@ -682,6 +684,96 @@ export function registerNetworkRoute(server, provider) {
         },
     });
 }
+/**
+ * Register `POST /api/dsh-perm-gate/dry-run` — the rule-test panel's endpoint.
+ * Body `{ tool, args?, permissive? }`; the response carries the effective
+ * verdict plus the rule layer's own answer.
+ *
+ * **Read-only by construction.** Unlike `/learning` (GET reads, POST resets), this
+ * route has no write form: it never edits rules, grants, learning state or the
+ * settings namespace, and the provider it delegates to evaluates against a
+ * throwaway or live read path only. Testing a rule must not be able to change
+ * the ruleset — otherwise "test it first" would itself be the risky action.
+ *
+ * Returns whether the route was registered.
+ */
+export function registerDryRunRoute(server, provider) {
+    const ws = routeServer(server);
+    if (ws === undefined)
+        return undefined;
+    return ws.register({
+        kind: 'exact',
+        path: DRY_RUN_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'POST') {
+                json(res, 405, { ok: false, error: 'method not allowed' });
+                return;
+            }
+            void (async () => {
+                try {
+                    const parsed = await readBody(req);
+                    const tool = parsed.tool;
+                    if (typeof tool !== 'string' || tool === '') {
+                        json(res, 400, { ok: false, error: 'missing tool' });
+                        return;
+                    }
+                    const args = parsed.args;
+                    if (args !== undefined && (typeof args !== 'object' || args === null || Array.isArray(args))) {
+                        json(res, 400, { ok: false, error: 'args must be an object' });
+                        return;
+                    }
+                    const result = provider.run({
+                        tool,
+                        args: (args ?? {}),
+                        ...(typeof parsed.permissive === 'boolean' ? { permissive: parsed.permissive } : {}),
+                    });
+                    json(res, 200, { ok: true, result });
+                }
+                catch (e) {
+                    json(res, 500, { ok: false, error: String(e?.message ?? e) });
+                }
+            })();
+        },
+    });
+}
+/**
+ * Register `GET /api/dsh-perm-gate/rules` — the panel's view of the permissions
+ * YAML the gate actually loads.
+ *
+ * **Read-only by construction**, like {@link registerDryRunRoute}: there is no
+ * write form. The card could already *edit* this file — the allowlist section
+ * appends and replaces patterns — but had no way to display it, so an operator
+ * changing rules through the panel could not see the document being changed.
+ * Reading must not be the risky act, and a viewer that could write would make
+ * "let me just look at the rules" a mutation.
+ *
+ * Returns whether the route was registered.
+ */
+export function registerRulesRoute(server, provider) {
+    const ws = routeServer(server);
+    if (ws === undefined)
+        return undefined;
+    return ws.register({
+        kind: 'exact',
+        path: RULES_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'GET') {
+                json(res, 405, { ok: false, error: 'method not allowed' });
+                return;
+            }
+            try {
+                json(res, 200, { ok: true, result: provider.view() });
+            }
+            catch (e) {
+                json(res, 500, { ok: false, error: String(e?.message ?? e) });
+            }
+        },
+    });
+}
 /**
  * Register the learning-store routes on the webServer service:
  * `GET  /api/dsh-perm-gate/learning` → the store snapshot + live threshold,

package/lib/index.js

@@ -1,13 +1,16 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { Config, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
-import { registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes } from './events.js';
+import { parse } from 'yaml';
+import { Config, RULES_NAMESPACE, RulesSchema, isRulesConfigured, readRulesFromSettings, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
+import { appendAllowToSettings, replaceAllowInSettings } from './allowlist.js';
+import { runDryRun } from './dry-run.js';
+import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
 import { buildReceiverInfo } from './receiver-info.js';
+import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
 import { classifySessions, sweepSessionData } from './session-sweep.js';
 import { decideNetworkTarget } from './network.js';
 import { NetworkLifecycle } from './network-lifecycle.js';
-import { RuleWatcher } from './watch.js';
 export const name = 'dsh-perm-gate';
 /**
  * The `tools` service drives `tools/pre-execute`/`tools/result` (dsh-tools).
@@ -182,6 +185,37 @@ export function apply(ctx, config = {}) {
     // read-only). The default resolves to `$DSH_HOME` / `~/.dsh`, so a profile
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
+    // ─── Rules sources (dual-source: settings first, rulesFile fallback) ──
+    // The `dsh-perm-gate-rules` settings namespace is the primary rules store —
+    // the framework owns it, so the gate loads with no rules file on disk. A
+    // namespace still at bare defaults never shadows the file, and the first
+    // settings write seeds the file document along (implicit migration). Both
+    // references are filled in by the settings registration below; until then
+    // the file paths run exactly as before.
+    const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    let rulesFromSettings = () => ({});
+    const rulesScopeRef = { scope: undefined };
+    /** The raw file document, for seeding the namespace on its first write. */
+    const fileSeedDoc = () => {
+        try {
+            const text = readFileSync(rulesFilePath, 'utf8');
+            if (text.trim() === '')
+                return undefined;
+            return parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const settingsWrite = (write, fallback) => {
+        const scope = rulesScopeRef.scope;
+        if (scope === undefined)
+            return fallback();
+        void write(scope, fileSeedDoc()).catch((e) => {
+            console.warn('[dsh-perm-gate] settings rules write failed:', e);
+        });
+        return true;
+    };
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel
@@ -322,8 +356,19 @@ export function apply(ctx, config = {}) {
             : join(dataDir, 'learning.json'),
         // The rules document lives in the plugin's data dir by default, so a
         // `$DSH_HOME/perm-gate/rules.yml` the user writes is actually loaded without
-        // also having to declare `rulesFile` in the composition entry.
-        rulesFile: resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir),
+        // also having to declare `rulesFile` in the composition entry. It is the
+        // FALLBACK source: a configured `dsh-perm-gate-rules` namespace wins.
+        rulesFile: rulesFilePath,
+        // Settings-first rules: the live `dsh-perm-gate-rules` document when the
+        // namespace carries a real configuration, else undefined (file fallback).
+        readRulesDocument: () => readRulesFromSettings({ get: () => rulesFromSettings() }),
+        // Settings-backed allowlist writes; a falsy verdict (settings service
+        // absent) makes the runtime fall back to its own rules-file paths, and the
+        // namespace's watch triggers the reload once a write lands.
+        allowlistWriter: {
+            append: (pattern, reason) => settingsWrite((scope, seed) => appendAllowToSettings(scope, pattern, reason, seed), () => false),
+            replace: (patterns, reason) => settingsWrite((scope, seed) => replaceAllowInSettings(scope, patterns, reason, seed), () => false),
+        },
         // The whole gate is scoped to the presets that opt into it (default: the
         // `permissive` tier this plugin adds); elsewhere it stands down entirely.
         gatePresets: resolveGatePresets(Array.isArray(config.gatePresets) ? config.gatePresets : undefined),
@@ -414,15 +459,17 @@ export function apply(ctx, config = {}) {
         },
         onChange: () => { },
         onScope: (scope) => {
-            // Seed the editable whitelist from the rules file only when the namespace
-            // carries no override yet, so the card shows the current allow patterns.
+            // Seed the editable whitelist from the rules source only when the
+            // namespace carries no override yet, so the card shows the current allow
+            // patterns.
             const surface = asSurface(scope.get());
             if (surface !== undefined && !Array.isArray(surface.allowlist)) {
                 const patterns = runtime.allowlist();
                 if (patterns.length > 0)
                     void scope.update({ allowlist: patterns.slice() });
             }
-            // Card edits -> namespace -> rulesFile (mirror + reload).
+            // Card edits -> namespace -> rules source (settings via the runtime's
+            // writer, else the rules file mirror) + reload.
             scope.watch(() => {
                 const next = asSurface(scope.get());
                 if (next !== undefined && Array.isArray(next.allowlist)) {
@@ -442,6 +489,22 @@ export function apply(ctx, config = {}) {
             });
         },
     });
+    // The rules namespace: the primary rules store (JSON twin of rules.yml).
+    // Every change recompiles the gate — the settings half of the hot reload
+    // that used to be a chokidar file watcher. `onScope` hands the live scope to
+    // the allowlist writers above; the seed entry is `{}`, so an untouched
+    // namespace reads as "not configured" and the file paths stay in force.
+    installSettingsSection(ctx, RULES_NAMESPACE, RulesSchema, {}, {
+        setSource: (source) => {
+            rulesFromSettings = source;
+        },
+        onChange: () => {
+            runtime.reload();
+        },
+        onScope: (scope) => {
+            rulesScopeRef.scope = scope;
+        },
+    });
     // Event feed HTTP API (best effort): the dsh webServer service exposes the
     // JSONL decision events to the browser half; without it events stay on disk.
     try {
@@ -488,6 +551,36 @@ export function apply(ctx, config = {}) {
             });
             if (offNetwork !== undefined)
                 ctx.effect(() => () => { offNetwork(); }, 'dsh-perm-gate: network route');
+            // Rule test (dry-run): evaluate one would-be call against the ruleset the
+            // gate currently has loaded, and report both the effective verdict and the
+            // rule layer's own answer. Read-only — the route has no write form, so
+            // testing a rule can never change it. It runs against the LIVE runtime
+            // rather than a fresh one so the panel tests the rules in force, not a
+            // re-derivation of them (a fresh runtime would also re-resolve the chain
+            // from a different root and could silently answer about a different file).
+            const offDryRun = registerDryRunRoute(webServer, {
+                run: (request) => runDryRun({
+                    tool: request.tool,
+                    args: request.args,
+                    ...(request.permissive !== undefined ? { permissive: request.permissive } : {}),
+                }, runtime),
+            });
+            if (offDryRun !== undefined)
+                ctx.effect(() => () => { offDryRun(); }, 'dsh-perm-gate: dry-run route');
+            // Permissions view: the document the gate is actually loading, shown so
+            // the panel is never editing rules it cannot display. Read-only, and
+            // resolved exactly as the gate resolves it — settings first, the file the
+            // fallback resolves to otherwise.
+            const offRules = registerRulesRoute(webServer, {
+                view: () => {
+                    const doc = rulesFromSettings();
+                    if (isRulesConfigured(doc))
+                        return readRulesViewFromSettings(doc);
+                    return readRulesView(rulesFilePath);
+                },
+            });
+            if (offRules !== undefined)
+                ctx.effect(() => () => { offRules(); }, 'dsh-perm-gate: rules route');
             // Receiver projection for the settings card (provider/model catalog is
             // potentially slow to enumerate — cached briefly).
             let receiverCache = null;
@@ -633,23 +726,10 @@ export function apply(ctx, config = {}) {
     networkRefs.snapshot = () => networkLifecycle.snapshot();
     if (networkRefs.appliedKey === undefined)
         networkRefs.appliedKey = networkKeyOf(current());
-    // ─── Hot reload watcher (Phase 3, T3.6) ────────────────────────────
-    const watchEnabled = typeof config.watch === 'boolean' ? config.watch : true;
-    if (watchEnabled) {
-        const watchDebounceMs = typeof config.watchDebounceMs === 'number' ? config.watchDebounceMs : 300;
-        const ruleWatcher = new RuleWatcher({
-            debounceMs: watchDebounceMs,
-            logger: { warn: (msg) => console.warn(msg) },
-        });
-        // Watch the effective rules file for the current workspace.
-        const rulesFile = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
-        const cwd = typeof config.cwd === 'string' ? config.cwd : process.cwd();
-        ruleWatcher.watch(cwd, [rulesFile], () => {
-            runtime.reload();
-        });
-        ctx.effect(() => () => {
-            ruleWatcher.closeAll();
-        }, 'dsh-perm-gate: rule watcher');
-    }
+    // ─── Rule hot reload ────────────────────────────────────────────────
+    // The file watcher (chokidar) is gone: the settings namespace is the primary
+    // rules store and its `scope.watch` recompiles the gate on every change
+    // (see the RULES_NAMESPACE registration above). A rules FILE edit is no
+    // longer picked up mid-session — the settings document is the source to edit.
     return runtime;
 }

package/lib/parsers/git.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Git command parser - extracts subcommand, branch, remote, flags, destructiveness.
+ * P0 priority - most critical for branch permissions.
+ *
+ * Handles:
+ * - git push/force push detection
+ * - git branch operations (delete, rename)
+ * - git checkout/switch with branch names
+ * - git merge/rebase
+ * - git reset (soft/hard/mixed)
+ * - git clean (destructive file deletion)
+ * - git stash operations
+ * - git refspec parsing (HEAD:main)
+ * - Remote vs branch name disambiguation
+ */
+import type { CommandParser, CommandSemantics } from '../command-semantics.js';
+export declare class GitParser implements CommandParser {
+    readonly name = "git";
+    readonly priority = 10;
+    canParse(command: string): boolean;
+    parse(command: string): CommandSemantics | null;
+    private analyzeSubcommand;
+    private parseGitArgs;
+    private extractFlags;
+    private extractRemote;
+    private extractBranch;
+    private extractBranchName;
+    private extractRefs;
+    /**
+     * 目标是否落在保护分支上。
+     *
+     * **只剥已知的 ref 前缀，不对任意 `/` 取末段。** 早先的写法是
+     * `branch.split('/').pop()`，于是：
+     *   - `refs/heads/main` → `main`  ✅ 期望如此
+     *   - `backup/main`     → `main`  ❌ **误判**（它是含斜杠的普通分支名）
+     *   - `feat/release`    → `release` ❌ **误判**
+     *
+     * 误判方向不是"更安全"。这条判据喂给 P0 硬拒——而 P0 是**不可配置撤销**的
+     * （见 engine.ts 顶部："deterministic, monotonic, never negotiated"）。
+     * 漏判还有关键词层与 LLM 层兜底，误判则是"合法工作流被永久挡住且无出口"。
+     */
+    private isProtectedBranch;
+}