dsh-perm-gate 2.1.2 → 4.0.0

package/lib/index.js

@@ -1,13 +1,16 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { Config, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
-import { registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes } from './events.js';
+import { parse } from 'yaml';
+import { Config, RULES_NAMESPACE, RulesSchema, isRulesConfigured, readRulesFromSettings, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
+import { appendAllowToSettings, replaceAllowInSettings } from './allowlist.js';
+import { runDryRun } from './dry-run.js';
+import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute, registerStreamRoute } from './events.js';
 import { buildReceiverInfo } from './receiver-info.js';
+import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
 import { classifySessions, sweepSessionData } from './session-sweep.js';
 import { decideNetworkTarget } from './network.js';
 import { NetworkLifecycle } from './network-lifecycle.js';
-import { RuleWatcher } from './watch.js';
 export const name = 'dsh-perm-gate';
 /**
  * The `tools` service drives `tools/pre-execute`/`tools/result` (dsh-tools).
@@ -182,6 +185,37 @@ export function apply(ctx, config = {}) {
     // read-only). The default resolves to `$DSH_HOME` / `~/.dsh`, so a profile
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
+    // ─── Rules sources (dual-source: settings first, rulesFile fallback) ──
+    // The `dsh-perm-gate-rules` settings namespace is the primary rules store —
+    // the framework owns it, so the gate loads with no rules file on disk. A
+    // namespace still at bare defaults never shadows the file, and the first
+    // settings write seeds the file document along (implicit migration). Both
+    // references are filled in by the settings registration below; until then
+    // the file paths run exactly as before.
+    const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    let rulesFromSettings = () => ({});
+    const rulesScopeRef = { scope: undefined };
+    /** The raw file document, for seeding the namespace on its first write. */
+    const fileSeedDoc = () => {
+        try {
+            const text = readFileSync(rulesFilePath, 'utf8');
+            if (text.trim() === '')
+                return undefined;
+            return parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const settingsWrite = (write, fallback) => {
+        const scope = rulesScopeRef.scope;
+        if (scope === undefined)
+            return fallback();
+        void write(scope, fileSeedDoc()).catch((e) => {
+            console.warn('[dsh-perm-gate] settings rules write failed:', e);
+        });
+        return true;
+    };
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel
@@ -322,8 +356,19 @@ export function apply(ctx, config = {}) {
             : join(dataDir, 'learning.json'),
         // The rules document lives in the plugin's data dir by default, so a
         // `$DSH_HOME/perm-gate/rules.yml` the user writes is actually loaded without
-        // also having to declare `rulesFile` in the composition entry.
-        rulesFile: resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir),
+        // also having to declare `rulesFile` in the composition entry. It is the
+        // FALLBACK source: a configured `dsh-perm-gate-rules` namespace wins.
+        rulesFile: rulesFilePath,
+        // Settings-first rules: the live `dsh-perm-gate-rules` document when the
+        // namespace carries a real configuration, else undefined (file fallback).
+        readRulesDocument: () => readRulesFromSettings({ get: () => rulesFromSettings() }),
+        // Settings-backed allowlist writes; a falsy verdict (settings service
+        // absent) makes the runtime fall back to its own rules-file paths, and the
+        // namespace's watch triggers the reload once a write lands.
+        allowlistWriter: {
+            append: (pattern, reason) => settingsWrite((scope, seed) => appendAllowToSettings(scope, pattern, reason, seed), () => false),
+            replace: (patterns, reason) => settingsWrite((scope, seed) => replaceAllowInSettings(scope, patterns, reason, seed), () => false),
+        },
         // The whole gate is scoped to the presets that opt into it (default: the
         // `permissive` tier this plugin adds); elsewhere it stands down entirely.
         gatePresets: resolveGatePresets(Array.isArray(config.gatePresets) ? config.gatePresets : undefined),
@@ -414,15 +459,17 @@ export function apply(ctx, config = {}) {
         },
         onChange: () => { },
         onScope: (scope) => {
-            // Seed the editable whitelist from the rules file only when the namespace
-            // carries no override yet, so the card shows the current allow patterns.
+            // Seed the editable whitelist from the rules source only when the
+            // namespace carries no override yet, so the card shows the current allow
+            // patterns.
             const surface = asSurface(scope.get());
             if (surface !== undefined && !Array.isArray(surface.allowlist)) {
                 const patterns = runtime.allowlist();
                 if (patterns.length > 0)
                     void scope.update({ allowlist: patterns.slice() });
             }
-            // Card edits -> namespace -> rulesFile (mirror + reload).
+            // Card edits -> namespace -> rules source (settings via the runtime's
+            // writer, else the rules file mirror) + reload.
             scope.watch(() => {
                 const next = asSurface(scope.get());
                 if (next !== undefined && Array.isArray(next.allowlist)) {
@@ -442,6 +489,22 @@ export function apply(ctx, config = {}) {
             });
         },
     });
+    // The rules namespace: the primary rules store (JSON twin of rules.yml).
+    // Every change recompiles the gate — the settings half of the hot reload
+    // that used to be a chokidar file watcher. `onScope` hands the live scope to
+    // the allowlist writers above; the seed entry is `{}`, so an untouched
+    // namespace reads as "not configured" and the file paths stay in force.
+    installSettingsSection(ctx, RULES_NAMESPACE, RulesSchema, {}, {
+        setSource: (source) => {
+            rulesFromSettings = source;
+        },
+        onChange: () => {
+            runtime.reload();
+        },
+        onScope: (scope) => {
+            rulesScopeRef.scope = scope;
+        },
+    });
     // Event feed HTTP API (best effort): the dsh webServer service exposes the
     // JSONL decision events to the browser half; without it events stay on disk.
     try {
@@ -457,6 +520,11 @@ export function apply(ctx, config = {}) {
             const offEvents = registerEventsRoute(webServer, runtime.eventLog);
             if (offEvents !== undefined)
                 ctx.effect(() => () => { offEvents(); }, 'dsh-perm-gate: events route');
+            // Push plane: the browser half follows decisions over one SSE connection
+            // instead of re-reading the event log on a timer.
+            const offStream = registerStreamRoute(webServer, runtime.eventLog);
+            if (offStream !== undefined)
+                ctx.effect(() => () => { offStream(); }, 'dsh-perm-gate: stream route');
         }
         // Review-page plane (diff / revert / snapshot stats / snapshot clear): the
         // approval-history view's file chips and snapshot bar drive these.
@@ -488,6 +556,36 @@ export function apply(ctx, config = {}) {
             });
             if (offNetwork !== undefined)
                 ctx.effect(() => () => { offNetwork(); }, 'dsh-perm-gate: network route');
+            // Rule test (dry-run): evaluate one would-be call against the ruleset the
+            // gate currently has loaded, and report both the effective verdict and the
+            // rule layer's own answer. Read-only — the route has no write form, so
+            // testing a rule can never change it. It runs against the LIVE runtime
+            // rather than a fresh one so the panel tests the rules in force, not a
+            // re-derivation of them (a fresh runtime would also re-resolve the chain
+            // from a different root and could silently answer about a different file).
+            const offDryRun = registerDryRunRoute(webServer, {
+                run: (request) => runDryRun({
+                    tool: request.tool,
+                    args: request.args,
+                    ...(request.permissive !== undefined ? { permissive: request.permissive } : {}),
+                }, runtime),
+            });
+            if (offDryRun !== undefined)
+                ctx.effect(() => () => { offDryRun(); }, 'dsh-perm-gate: dry-run route');
+            // Permissions view: the document the gate is actually loading, shown so
+            // the panel is never editing rules it cannot display. Read-only, and
+            // resolved exactly as the gate resolves it — settings first, the file the
+            // fallback resolves to otherwise.
+            const offRules = registerRulesRoute(webServer, {
+                view: () => {
+                    const doc = rulesFromSettings();
+                    if (isRulesConfigured(doc))
+                        return readRulesViewFromSettings(doc);
+                    return readRulesView(rulesFilePath);
+                },
+            });
+            if (offRules !== undefined)
+                ctx.effect(() => () => { offRules(); }, 'dsh-perm-gate: rules route');
             // Receiver projection for the settings card (provider/model catalog is
             // potentially slow to enumerate — cached briefly).
             let receiverCache = null;
@@ -633,23 +731,10 @@ export function apply(ctx, config = {}) {
     networkRefs.snapshot = () => networkLifecycle.snapshot();
     if (networkRefs.appliedKey === undefined)
         networkRefs.appliedKey = networkKeyOf(current());
-    // ─── Hot reload watcher (Phase 3, T3.6) ────────────────────────────
-    const watchEnabled = typeof config.watch === 'boolean' ? config.watch : true;
-    if (watchEnabled) {
-        const watchDebounceMs = typeof config.watchDebounceMs === 'number' ? config.watchDebounceMs : 300;
-        const ruleWatcher = new RuleWatcher({
-            debounceMs: watchDebounceMs,
-            logger: { warn: (msg) => console.warn(msg) },
-        });
-        // Watch the effective rules file for the current workspace.
-        const rulesFile = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
-        const cwd = typeof config.cwd === 'string' ? config.cwd : process.cwd();
-        ruleWatcher.watch(cwd, [rulesFile], () => {
-            runtime.reload();
-        });
-        ctx.effect(() => () => {
-            ruleWatcher.closeAll();
-        }, 'dsh-perm-gate: rule watcher');
-    }
+    // ─── Rule hot reload ────────────────────────────────────────────────
+    // The file watcher (chokidar) is gone: the settings namespace is the primary
+    // rules store and its `scope.watch` recompiles the gate on every change
+    // (see the RULES_NAMESPACE registration above). A rules FILE edit is no
+    // longer picked up mid-session — the settings document is the source to edit.
     return runtime;
 }

package/lib/parsers/git.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Git command parser - extracts subcommand, branch, remote, flags, destructiveness.
+ * P0 priority - most critical for branch permissions.
+ *
+ * Handles:
+ * - git push/force push detection
+ * - git branch operations (delete, rename)
+ * - git checkout/switch with branch names
+ * - git merge/rebase
+ * - git reset (soft/hard/mixed)
+ * - git clean (destructive file deletion)
+ * - git stash operations
+ * - git refspec parsing (HEAD:main)
+ * - Remote vs branch name disambiguation
+ */
+import type { CommandParser, CommandSemantics } from '../command-semantics.js';
+export declare class GitParser implements CommandParser {
+    readonly name = "git";
+    readonly priority = 10;
+    canParse(command: string): boolean;
+    parse(command: string): CommandSemantics | null;
+    private analyzeSubcommand;
+    private parseGitArgs;
+    private extractFlags;
+    private extractRemote;
+    private extractBranch;
+    private extractBranchName;
+    private extractRefs;
+    /**
+     * 目标是否落在保护分支上。
+     *
+     * **只剥已知的 ref 前缀，不对任意 `/` 取末段。** 早先的写法是
+     * `branch.split('/').pop()`，于是：
+     *   - `refs/heads/main` → `main`  ✅ 期望如此
+     *   - `backup/main`     → `main`  ❌ **误判**（它是含斜杠的普通分支名）
+     *   - `feat/release`    → `release` ❌ **误判**
+     *
+     * 误判方向不是"更安全"。这条判据喂给 P0 硬拒——而 P0 是**不可配置撤销**的
+     * （见 engine.ts 顶部："deterministic, monotonic, never negotiated"）。
+     * 漏判还有关键词层与 LLM 层兜底，误判则是"合法工作流被永久挡住且无出口"。
+     */
+    private isProtectedBranch;
+}

package/lib/parsers/git.js

@@ -0,0 +1,404 @@
+/**
+ * Git command parser - extracts subcommand, branch, remote, flags, destructiveness.
+ * P0 priority - most critical for branch permissions.
+ *
+ * Handles:
+ * - git push/force push detection
+ * - git branch operations (delete, rename)
+ * - git checkout/switch with branch names
+ * - git merge/rebase
+ * - git reset (soft/hard/mixed)
+ * - git clean (destructive file deletion)
+ * - git stash operations
+ * - git refspec parsing (HEAD:main)
+ * - Remote vs branch name disambiguation
+ */
+/** Known protected branch patterns */
+const PROTECTED_BRANCHES = /^(main|master|production|release|stable)$/i;
+/** Known remote names (common defaults) */
+const KNOWN_REMOTES = /^(origin|upstream|fork|origin-\w+)$/i;
+/** Flags that increase destructiveness */
+const DESTRUCTIVE_FLAGS = new Set([
+    '--force', '-f',
+    '--hard',
+    '--delete', '-d', '-D',
+    '--amend',
+    '--no-backup',
+    '-rf',
+    '--clean',
+    '--reset',
+]);
+export class GitParser {
+    name = 'git';
+    priority = 10;
+    canParse(command) {
+        const trimmed = command.trim();
+        // Direct git command
+        if (/^git\s+/.test(trimmed))
+            return true;
+        // Shell-wrapped: sh -c "git ...", bash -c git ..., etc.
+        if (/(?:sh|bash|pwsh|powershell)(?:\s+-c\s+['"]?)?.*?\bgit\s+/.test(trimmed))
+            return true;
+        return false;
+    }
+    parse(command) {
+        const trimmed = command.trim();
+        // Extract the git command portion (strip shell wrappers)
+        const gitMatch = trimmed.match(/(?:sh|bash|pwsh|powershell)(?:\s+-c\s+['"]?)?(\s+git\s+.+)/);
+        const gitPart = gitMatch ? gitMatch[1].trim() : trimmed;
+        // Parse git arguments
+        const parts = this.parseGitArgs(gitPart);
+        if (parts.length < 2)
+            return null;
+        // Skip 'git' keyword if present
+        const startIndex = parts[0] === 'git' ? 1 : 0;
+        if (parts.length - startIndex < 1)
+            return null;
+        const subcommand = parts[startIndex]?.toLowerCase();
+        // Get rest of arguments
+        const args = parts.slice(startIndex + 1);
+        return this.analyzeSubcommand(subcommand, args, trimmed);
+    }
+    analyzeSubcommand(subcommand, args, rawCommand) {
+        const flags = this.extractFlags(args);
+        const hasForce = flags.includes('--force') || flags.includes('-f') || flags.includes('--force-with-lease');
+        const hasDelete = flags.includes('--delete') || flags.includes('-d') || flags.includes('-D');
+        const hasHard = flags.includes('--hard');
+        let operation;
+        let destructiveness = 1;
+        let targets = [];
+        let branch;
+        let remote;
+        let gitOperation = true;
+        let targetsSharedBranch = false;
+        switch (subcommand) {
+            case 'push': {
+                remote = this.extractRemote(args);
+                branch = this.extractBranch(args);
+                targets = [branch, remote].filter(Boolean);
+                targetsSharedBranch = this.isProtectedBranch(branch);
+                if (hasForce || flags.includes('--force-with-lease')) {
+                    operation = 'force-push';
+                    destructiveness = targetsSharedBranch ? 5 : 4;
+                }
+                else if (hasDelete) {
+                    // 删除远端分支。`hasDelete` 此前只在 `branch` 分支被读取，push 侧从未
+                    // 使用——于是 `git push --delete origin main` 落进上面的 else，被判成
+                    // 普通 push(dest=4)、`DESTRUCTIVENESS_MAP` 里的 `'push-delete': 5`
+                    // 是**死条目**。删远端分支与 force push 同级：都不可逆地改动共享历史。
+                    operation = 'push-delete';
+                    destructiveness = targetsSharedBranch ? 5 : 4;
+                }
+                else {
+                    operation = 'push';
+                    destructiveness = targetsSharedBranch ? 4 : 3;
+                }
+                break;
+            }
+            case 'reset': {
+                if (hasHard) {
+                    operation = 'reset-hard';
+                    destructiveness = 5;
+                }
+                else if (flags.includes('--soft')) {
+                    operation = 'reset-soft';
+                    destructiveness = 2;
+                }
+                else {
+                    operation = 'reset-mixed';
+                    destructiveness = 4;
+                }
+                targets = this.extractRefs(args);
+                break;
+            }
+            case 'branch': {
+                if (hasDelete) {
+                    const forceDelete = flags.includes('-D');
+                    branch = this.extractBranchName(args);
+                    targets = [branch].filter(Boolean);
+                    targetsSharedBranch = this.isProtectedBranch(branch);
+                    operation = forceDelete ? 'branch-delete-force' : 'branch-delete';
+                    destructiveness = targetsSharedBranch ? 5 : (forceDelete ? 3 : 2);
+                }
+                else if (flags.includes('-m') || flags.includes('--move')) {
+                    operation = 'branch-rename';
+                    destructiveness = 2;
+                    targets = this.extractRefs(args);
+                }
+                else {
+                    operation = 'branch-create';
+                    destructiveness = 3;
+                    branch = this.extractBranchName(args);
+                    targets = [branch].filter(Boolean);
+                }
+                break;
+            }
+            case 'checkout':
+            case 'switch': {
+                const isNewBranch = flags.includes('-b') || flags.includes('--create');
+                branch = this.extractBranchName(args);
+                targets = [branch].filter(Boolean);
+                operation = isNewBranch ? 'checkout-new-branch' : 'checkout';
+                destructiveness = isNewBranch ? 3 : 2;
+                break;
+            }
+            case 'merge': {
+                targets = this.extractRefs(args);
+                if (flags.includes('--ff-only')) {
+                    operation = 'merge-ff-only';
+                    destructiveness = 3;
+                }
+                else {
+                    operation = 'merge';
+                    destructiveness = 3;
+                }
+                break;
+            }
+            case 'rebase': {
+                targets = this.extractRefs(args);
+                if (flags.includes('-i') || flags.includes('--interactive')) {
+                    operation = 'rebase-interactive';
+                    destructiveness = 4;
+                }
+                else {
+                    operation = 'rebase';
+                    destructiveness = 3;
+                }
+                break;
+            }
+            case 'clean': {
+                if (hasForce || flags.includes('-f')) {
+                    operation = 'clean-force';
+                    destructiveness = 5;
+                }
+                else {
+                    operation = 'clean';
+                    destructiveness = 3;
+                }
+                targets = this.extractRefs(args);
+                break;
+            }
+            case 'cherry-pick': {
+                operation = 'cherry-pick';
+                destructiveness = 3;
+                targets = this.extractRefs(args);
+                break;
+            }
+            case 'revert': {
+                operation = 'revert';
+                destructiveness = 3;
+                targets = this.extractRefs(args);
+                break;
+            }
+            case 'tag': {
+                if (hasDelete) {
+                    operation = 'tag-delete';
+                    destructiveness = 2;
+                    targets = this.extractRefs(args);
+                }
+                else {
+                    operation = 'tag-create';
+                    destructiveness = 1;
+                    targets = this.extractRefs(args);
+                }
+                break;
+            }
+            case 'stash': {
+                const stashOp = args[0]?.toLowerCase();
+                if (stashOp === 'pop' || stashOp === 'apply') {
+                    operation = 'stash-pop';
+                    destructiveness = 2;
+                }
+                else if (stashOp === 'drop') {
+                    operation = 'stash-drop';
+                    destructiveness = 2;
+                }
+                else {
+                    operation = 'stash-create';
+                    destructiveness = 1;
+                }
+                break;
+            }
+            case 'fetch': {
+                remote = this.extractRemote(args);
+                targets = [remote].filter(Boolean);
+                operation = 'fetch';
+                destructiveness = 1;
+                break;
+            }
+            case 'pull': {
+                remote = this.extractRemote(args);
+                branch = this.extractBranch(args);
+                targets = [remote, branch].filter(Boolean);
+                operation = 'pull';
+                destructiveness = 2;
+                break;
+            }
+            case 'clone': {
+                operation = 'clone';
+                destructiveness = 1;
+                targets = this.extractRefs(args);
+                break;
+            }
+            case 'status':
+            case 'log':
+            case 'diff':
+            case 'show':
+            case 'blame':
+            case 'ls-files':
+            case 'rev-parse':
+            case 'describe': {
+                operation = subcommand;
+                destructiveness = 1;
+                break;
+            }
+            default: {
+                // Unknown git subcommand
+                operation = subcommand;
+                destructiveness = 1;
+                gitOperation = true;
+                break;
+            }
+        }
+        // Detect destructive flags
+        const destructiveFlags = hasForce || hasDelete || hasHard ||
+            flags.some(f => DESTRUCTIVE_FLAGS.has(f));
+        return {
+            family: 'git',
+            subcommand,
+            operation,
+            destructiveness: destructiveness,
+            destructiveFlags,
+            targets,
+            flags,
+            requiresConfirmation: destructiveness >= 4,
+            compound: false,
+            gitOperation,
+            branch,
+            remote,
+            targetsSharedBranch,
+            rawCommand: rawCommand,
+        };
+    }
+    parseGitArgs(command) {
+        const args = [];
+        let current = '';
+        let inQuote = false;
+        let quoteChar = '';
+        let escape = false;
+        for (const char of command) {
+            if (escape) {
+                current += char;
+                escape = false;
+                continue;
+            }
+            if (char === '\\') {
+                escape = true;
+                continue;
+            }
+            if (inQuote) {
+                if (char === quoteChar) {
+                    inQuote = false;
+                    continue;
+                }
+                current += char;
+                continue;
+            }
+            if (char === '"' || char === "'") {
+                inQuote = true;
+                quoteChar = char;
+                continue;
+            }
+            if (/\s/.test(char)) {
+                if (current) {
+                    args.push(current);
+                    current = '';
+                }
+                continue;
+            }
+            current += char;
+        }
+        if (current)
+            args.push(current);
+        return args;
+    }
+    extractFlags(args) {
+        const flags = [];
+        for (const arg of args) {
+            if (arg.startsWith('-')) {
+                // Normalize long flags to lowercase, but preserve case for short flags
+                // to distinguish between -d (delete) and -D (force delete)
+                if (arg.startsWith('--')) {
+                    flags.push(arg.toLowerCase());
+                }
+                else {
+                    // Short flags: -f, -d, -D, etc. - preserve case
+                    flags.push(arg);
+                }
+            }
+        }
+        return flags;
+    }
+    extractRemote(args) {
+        // First positional arg is usually remote
+        for (const arg of args) {
+            if (!arg.startsWith('-')) {
+                if (KNOWN_REMOTES.test(arg)) {
+                    return arg;
+                }
+                // Could be a URL or path
+                if (arg.includes('/') || arg.includes('.')) {
+                    return arg;
+                }
+            }
+        }
+        return undefined;
+    }
+    extractBranch(args) {
+        // Branch is usually the last positional arg or after remote
+        const positionalArgs = args.filter(a => !a.startsWith('-'));
+        if (positionalArgs.length > 1) {
+            // Could be "origin main" or "origin:main"
+            const last = positionalArgs[positionalArgs.length - 1];
+            // Handle refspec (e.g., HEAD:main)
+            if (last.includes(':')) {
+                return last.split(':')[1];
+            }
+            return last;
+        }
+        return positionalArgs[0];
+    }
+    extractBranchName(args) {
+        // For branch create/checkout, find the branch name
+        const positionalArgs = args.filter(a => !a.startsWith('-'));
+        // Skip -b flag value if present
+        for (let i = 0; i < args.length; i++) {
+            if (args[i] === '-b' || args[i] === '--create') {
+                return args[i + 1];
+            }
+        }
+        return positionalArgs[positionalArgs.length - 1];
+    }
+    extractRefs(args) {
+        return args.filter(a => !a.startsWith('-') && !KNOWN_REMOTES.test(a));
+    }
+    /**
+     * 目标是否落在保护分支上。
+     *
+     * **只剥已知的 ref 前缀，不对任意 `/` 取末段。** 早先的写法是
+     * `branch.split('/').pop()`，于是：
+     *   - `refs/heads/main` → `main`  ✅ 期望如此
+     *   - `backup/main`     → `main`  ❌ **误判**（它是含斜杠的普通分支名）
+     *   - `feat/release`    → `release` ❌ **误判**
+     *
+     * 误判方向不是"更安全"。这条判据喂给 P0 硬拒——而 P0 是**不可配置撤销**的
+     * （见 engine.ts 顶部："deterministic, monotonic, never negotiated"）。
+     * 漏判还有关键词层与 LLM 层兜底，误判则是"合法工作流被永久挡住且无出口"。
+     */
+    isProtectedBranch(branch) {
+        if (!branch)
+            return false;
+        const cleanBranch = branch.replace(/^refs\/(?:heads|tags|remotes\/[^/]+)\//, '');
+        return PROTECTED_BRANCHES.test(cleanBranch);
+    }
+}

package/lib/parsers/shell-cmds.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Shell dangerous commands parser - rm, mv, cp, chmod, dd, diskpart, etc.
+ * P1 priority - detects destructive filesystem operations.
+ *
+ * Handles:
+ * - rm -rf / recursive deletion
+ * - mv overwriting existing files
+ * - cp -r with destructive patterns
+ * - chmod/chown with system directories
+ * - dd writing to disk
+ * - diskpart on Windows
+ * - format disk operations
+ * - PowerShell Remove-Item with dangerous patterns
+ */
+import type { CommandParser, CommandSemantics } from '../command-semantics.js';
+export declare class ShellDangerousParser implements CommandParser {
+    readonly name = "shell-dangerous";
+    readonly priority = 20;
+    canParse(command: string): boolean;
+    parse(command: string): CommandSemantics | null;
+    private extractBaseName;
+    private parseRm;
+    private parseMv;
+    private parseCp;
+    private parseChmod;
+    private parseDd;
+    private parseDiskpart;
+    private parsePowerShellRemove;
+    private parseArchive;
+    private extractArgs;
+    private extractFlags;
+}