dsh-perm-gate 4.2.0-beta.4 → 4.2.0-beta.6

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "4.2.0-beta.4",
+  "version": "4.2.0-beta.6",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/allowlist.d.ts

@@ -44,3 +44,12 @@ export declare function listAllowCommands(rulesFile: string): string[];
  * @param reason - reason recorded on each generated allow entry.
  */
 export declare function replaceAllowCommands(rulesFile: string, patterns: readonly string[], reason?: string): boolean;
+/**
+ * Parse the rules file into a plain document — the seed for the first
+ * settings-backed allowlist write and the activation-time rules seed, so
+ * migrating a file-defined document into the entry's `rules` config field
+ * cannot drop its deny/ask sections. The file's optional `permissions:`
+ * wrapper is unwrapped (the config field stores the bare form). Returns `{}`
+ * when the file is absent or unreadable.
+ */
+export declare function readRulesFileDoc(rulesFile: string): unknown;

package/lib/allowlist.js

@@ -197,3 +197,27 @@ function readFileSafe(p) {
         return '';
     }
 }
+/**
+ * Parse the rules file into a plain document — the seed for the first
+ * settings-backed allowlist write and the activation-time rules seed, so
+ * migrating a file-defined document into the entry's `rules` config field
+ * cannot drop its deny/ask sections. The file's optional `permissions:`
+ * wrapper is unwrapped (the config field stores the bare form). Returns `{}`
+ * when the file is absent or unreadable.
+ */
+export function readRulesFileDoc(rulesFile) {
+    const text = readFileSafe(rulesFile);
+    if (text === '')
+        return {};
+    try {
+        const root = parse(text);
+        if (root !== null && typeof root === 'object' && !Array.isArray(root)
+            && root['permissions'] !== null && typeof root['permissions'] === 'object') {
+            return root['permissions'];
+        }
+        return root ?? {};
+    }
+    catch {
+        return {};
+    }
+}

package/lib/client.js

@@ -149,7 +149,7 @@ window.__ModuleLoader__.load({
 			"card.dryRunFail": "测试失败：",
 			"card.dryRunStale": "路由不存在（插件未重启？）",
 			"card.rules": "Settings 内置规则",
-			"card.rulesHint": "门禁此刻实际加载的规则（来自 settings 命名空间 dsh-perm-gate-rules）。只读——这里改不了任何东西。要改规则，用下面的白名单，或在设置页中编辑。",
+			"card.rulesHint": "门禁此刻实际加载的规则（来自本插件入口的 rules 配置字段；未配置时回退到规则文件）。只读——这里改不了任何东西。要改规则，用下面的白名单，或在设置页中编辑。",
 			"card.rulesRefresh": "刷新",
 			"card.rulesLoading": "读取中…",
 			"card.rulesPath": "来源",
@@ -161,7 +161,7 @@ window.__ModuleLoader__.load({
 			"card.rulesTruncated": "规则过大，仅显示前 512 KB。",
 			"card.rulesError": "加载失败：",
 			"card.rulesStale": "路由不存在（插件未重启？）",
-			"card.rulesNote": "此处只读：面板无法修改规则，白名单段是唯一会写入 settings 的地方。"
+			"card.rulesNote": "此处只读：面板无法修改规则；白名单段与“始终允许”会写回本插件的入口配置。"
 		};
 		/** English dictionary (keys mirror zh). */
 		const en = {
@@ -302,7 +302,7 @@ window.__ModuleLoader__.load({
 			"card.dryRunFail": "Test failed: ",
 			"card.dryRunStale": "route missing (plugin not restarted?)",
 			"card.rules": "Settings Built-in Rules",
-			"card.rulesHint": "The rules the gate is loading right now (from the dsh-perm-gate-rules settings namespace). Read-only — nothing here can change them. To change rules, use the allowlist below or edit them on the settings page.",
+			"card.rulesHint": "The rules the gate is loading right now (from this plugin entry's `rules` config field; falls back to the rules file when unset). Read-only — nothing here can change them. To change rules, use the allowlist below or edit them on the settings page.",
 			"card.rulesRefresh": "Refresh",
 			"card.rulesLoading": "Reading…",
 			"card.rulesPath": "Source",
@@ -314,7 +314,7 @@ window.__ModuleLoader__.load({
 			"card.rulesTruncated": "Rules are large; showing the first 512 KB only.",
 			"card.rulesError": "Load failed: ",
 			"card.rulesStale": "route missing (plugin not restarted?)",
-			"card.rulesNote": "Read-only: this panel cannot modify the rules. The allowlist section is the only place that writes to settings."
+			"card.rulesNote": "Read-only: this panel cannot modify the rules. The allowlist section and \"allow always\" write back to this plugin's entry config."
 		};
 		//#endregion
 		//#region src/deny-defaults.ts