dsh-perm-gate 4.1.3 → 4.1.5

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "4.1.3",
+  "version": "4.1.5",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/allowlist.d.ts

@@ -44,3 +44,11 @@ export declare function listAllowCommands(rulesFile: string): string[];
  * @param reason - reason recorded on each generated allow entry.
  */
 export declare function replaceAllowCommands(rulesFile: string, patterns: readonly string[], reason?: string): boolean;
+/**
+ * Parse the rules file into a plain document — the seed for the first
+ * settings-backed allowlist write, so migrating a file-defined document into
+ * the rules namespace cannot drop its deny/ask sections. The file's optional
+ * `permissions:` wrapper is unwrapped (the settings document stores the bare
+ * form). Returns `{}` when the file is absent or unreadable.
+ */
+export declare function readRulesFileDoc(rulesFile: string): unknown;

package/lib/allowlist.js

@@ -197,3 +197,26 @@ function readFileSafe(p) {
         return '';
     }
 }
+/**
+ * Parse the rules file into a plain document — the seed for the first
+ * settings-backed allowlist write, so migrating a file-defined document into
+ * the rules namespace cannot drop its deny/ask sections. The file's optional
+ * `permissions:` wrapper is unwrapped (the settings document stores the bare
+ * form). Returns `{}` when the file is absent or unreadable.
+ */
+export function readRulesFileDoc(rulesFile) {
+    const text = readFileSafe(rulesFile);
+    if (text === '')
+        return {};
+    try {
+        const root = parse(text);
+        if (root !== null && typeof root === 'object' && !Array.isArray(root)
+            && root['permissions'] !== null && typeof root['permissions'] === 'object') {
+            return root['permissions'];
+        }
+        return root ?? {};
+    }
+    catch {
+        return {};
+    }
+}

package/lib/config.d.ts

@@ -276,14 +276,17 @@ export interface RulesConfig {
     readonly deny?: unknown[];
     readonly allow?: unknown[];
     readonly ask?: unknown[];
+    /** Activation-time seed marker (see RulesSchema). */
+    readonly initialized?: boolean;
 }
 /** Settings namespace for rules (separate from the main perm-gate namespace). */
 export declare const RULES_NAMESPACE = "dsh-perm-gate-rules";
 /**
  * Whether a settings-sourced rules document carries a REAL configuration —
- * entries or a non-default `defaultAction`. A namespace still holding bare
- * schema defaults is "not configured" and must not shadow the rules file
- * (the dual-source contract: settings first, file fallback).
+ * entries, a non-default `defaultAction`, or the `initialized` marker the
+ * activation-time seed writes after populating an empty document. A namespace
+ * still holding bare schema defaults is "not configured" and must not shadow
+ * the rules file (the dual-source contract: settings first, file fallback).
  */
 export declare function isRulesConfigured(value: unknown): boolean;
 /**

package/lib/config.js

@@ -113,19 +113,26 @@ export const RulesSchema = z.object({
     deny: z.array(RuleEntrySchema).default([]),
     allow: z.array(RuleEntrySchema).default([]),
     ask: z.array(RuleEntrySchema).default([]),
+    // Activation-time seed marker: the gate writes `true` the first time it
+    // populates an empty document (file migration or bare starter), so the
+    // seeded namespace becomes the rules source instead of shadowing nothing.
+    initialized: z.boolean().default(false),
 });
 /** Settings namespace for rules (separate from the main perm-gate namespace). */
 export const RULES_NAMESPACE = 'dsh-perm-gate-rules';
 /**
  * Whether a settings-sourced rules document carries a REAL configuration —
- * entries or a non-default `defaultAction`. A namespace still holding bare
- * schema defaults is "not configured" and must not shadow the rules file
- * (the dual-source contract: settings first, file fallback).
+ * entries, a non-default `defaultAction`, or the `initialized` marker the
+ * activation-time seed writes after populating an empty document. A namespace
+ * still holding bare schema defaults is "not configured" and must not shadow
+ * the rules file (the dual-source contract: settings first, file fallback).
  */
 export function isRulesConfigured(value) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         return false;
     const doc = value;
+    if (doc.initialized === true)
+        return true;
     if (doc.defaultAction !== undefined && doc.defaultAction !== 'ask')
         return true;
     for (const key of ['deny', 'allow', 'ask']) {

package/lib/index.js

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { Config, RULES_NAMESPACE, RulesSchema, readRulesFromSettings, resolveDshHome, resolveDataDir, ensureDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
+import { Config, RULES_NAMESPACE, RulesSchema, readRulesFromSettings, resolveDshHome, resolveDataDir, ensureDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile, isRulesConfigured } from './config.js';
+import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
 import { buildReceiverInfo } from './receiver-info.js';
@@ -194,13 +195,29 @@ export function apply(ctx, config = {}) {
     let current = () => config;
     // ─── Rules settings scope (dsh-perm-gate-rules namespace) ────────────────
     // Holds the live settings-sourced rules document. When non-undefined, the
-    // runtime prefers it over the rules file on disk.
+    // runtime prefers it over the rules file on disk. The write-capable view is
+    // captured separately so allowlist writes can go through the namespace.
     let rulesScope;
+    let rulesWriteScope;
     const readRulesDocument = () => readRulesFromSettings(rulesScope);
     // Plugin-owned data files live under $DSH_HOME (node_modules may be
     // read-only). The default resolves to `$DSH_HOME` / `~/.dsh`, so a profile
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
+    const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    // Allowlist write-back through the rules namespace: "allow always" and the
+    // panel's allowlist editor land in the live settings document (seeded from
+    // the rules file on first write) instead of the file the document shadows.
+    // A falsy verdict (namespace not wired yet) falls back to the rules file.
+    const settingsWrite = (write) => {
+        const scope = rulesWriteScope;
+        if (scope === undefined)
+            return false;
+        void write(scope, readRulesFileDoc(rulesFilePath)).catch((e) => {
+            console.warn('[dsh-perm-gate] settings rules write failed:', e);
+        });
+        return true;
+    };
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel
@@ -342,9 +359,15 @@ export function apply(ctx, config = {}) {
         // The rules document lives in the plugin's data dir by default, so a
         // `$DSH_HOME/perm-gate/rules.yml` the user writes is actually loaded without
         // also having to declare `rulesFile` in the composition entry.
-        rulesFile: resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir),
+        rulesFile: rulesFilePath,
         // Settings-sourced rules take precedence over the file when present.
         readRulesDocument,
+        // Allowlist write-back (see settingsWrite above); falsy verdict falls back
+        // to the rules file paths.
+        allowlistWriter: {
+            append: (pattern, reason) => settingsWrite((scope, seed) => appendAllowToSettings(scope, pattern, reason, seed)),
+            replace: (patterns, reason) => settingsWrite((scope, seed) => replaceAllowInSettings(scope, patterns, reason, seed)),
+        },
         // The whole gate is scoped to the presets that opt into it (default: the
         // `permissive` tier this plugin adds); elsewhere it stands down entirely.
         gatePresets: resolveGatePresets(Array.isArray(config.gatePresets) ? config.gatePresets : undefined),
@@ -473,9 +496,21 @@ export function apply(ctx, config = {}) {
         onChange: () => { },
         onScope: (scope) => {
             rulesScope = scope;
+            rulesWriteScope = scope;
             // When rules change in settings, reload the runtime so the new ruleset
             // takes effect on the next tool call.
             scope.watch(() => { runtime.reload(); });
+            // Activation-time seed: an empty (never-configured) namespace is
+            // populated once — from the rules file when one exists (implicit
+            // migration), otherwise a bare starter document — and marked
+            // `initialized`, so the panel shows a live rules document from the
+            // first boot instead of a missing-file fallback.
+            if (!isRulesConfigured(scope.get())) {
+                const seed = { ...readRulesFileDoc(rulesFilePath), initialized: true };
+                void Promise.resolve(scope.update(seed)).catch((e) => {
+                    console.warn('[dsh-perm-gate] rules seed write failed:', e);
+                });
+            }
         },
     });
     // Event feed HTTP API (best effort): the dsh webServer service exposes the

package/lib/rule.js

@@ -71,7 +71,8 @@ export function parsePermissionsObject(raw) {
     if (!isRecord(raw))
         throw new RuleError('permissions document must be a mapping');
     const root = isRecord(raw.permissions) ? raw.permissions : raw;
-    const unknown = Object.keys(root).filter((k) => !VALID_ACTIONS.includes(k) && k !== 'defaultAction');
+    // `initialized` is the activation-time seed marker (RulesSchema), not a rule.
+    const unknown = Object.keys(root).filter((k) => !VALID_ACTIONS.includes(k) && k !== 'defaultAction' && k !== 'initialized');
     if (unknown.length > 0) {
         throw new RuleError(`unknown permissions field${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => JSON.stringify(k)).join(', ')}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "4.1.3",
+  "version": "4.1.5",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public",