dsh-perm-gate 5.0.4 → 5.1.0

package/lib/config.d.ts

@@ -191,6 +191,38 @@ export interface PermGateConfig {
      * Default 1800000 (30 min).
      */
     readonly networkGrantTtlMs?: number;
+    /**
+     * Run gate-allowed shell commands inside a Windows AppContainer. The
+     * container token carries NO network capability, so non-loopback egress is
+     * denied by Windows Firewall (WFP) itself; the container SID is derived
+     * deterministically so the loopback exemption is a one-time step. Default
+     * false — enabling changes how allowed commands execute.
+     */
+    readonly sandboxEnabled?: boolean;
+    /**
+     * Filesystem posture inside the container: 'workspace-write' grants the
+     * workspace Modify + temp FullControl; 'read-only' grants RX only.
+     * System directories stay readable through the stock ALL APPLICATION
+     * PACKAGES ACEs. Default 'workspace-write'.
+     */
+    readonly sandboxMode?: 'read-only' | 'workspace-write';
+    /**
+     * THE proxy parameter: the URL injected as HTTP(S)_PROXY / ALL_PROXY into
+     * sandboxed processes. Empty (default) follows the builtin filtered proxy
+     * (its actual bound 127.0.0.1 port) when networkEnabled; an explicit value
+     * must be loopback-bound (the container cannot reach anything else) and the
+     * destination filtering is that proxy's job. Neither set → no proxy env;
+     * direct egress stays WFP-blocked either way.
+     */
+    readonly sandboxProxy?: string;
+    /**
+     * Attempt the one-time `CheckNetIsolation LoopbackExempt -a -p=<sid>` for
+     * the container SID so sandboxed processes can reach 127.0.0.1 (the proxy
+     * and the host webServer). Denied without elevation → warning with the
+     * exact command; the sandbox still runs, only loopback stays closed.
+     * Default 'exempt'.
+     */
+    readonly sandboxLoopback?: 'exempt' | 'off';
     /** @deprecated Rules now live in the `dsh-perm-gate-rules` settings namespace; file watching was removed. Accepted (ignored) for composition compatibility. */
     readonly watch?: boolean;
     /** @deprecated See {@link watch}. */
@@ -349,6 +381,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     networkInjectEnv: z<boolean, boolean, "volatile-defined">;
     networkAskTimeoutMs: z<number, number, "volatile-defined">;
     networkGrantTtlMs: z<number, number, "volatile-defined">;
+    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
+    sandboxProxy: z<string, string, "volatile-defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
     rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -404,6 +440,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     networkInjectEnv: z<boolean, boolean, "volatile-defined">;
     networkAskTimeoutMs: z<number, number, "volatile-defined">;
     networkGrantTtlMs: z<number, number, "volatile-defined">;
+    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
+    sandboxProxy: z<string, string, "volatile-defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
     rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -411,7 +451,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -199,6 +199,11 @@ export const Config = z.object({
     networkInjectEnv: z.boolean().default(true).volatile(),
     networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000).volatile(),
     networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000).volatile(),
+    // AppContainer sandbox (Windows; goal 2)
+    sandboxEnabled: z.boolean().default(false).volatile(),
+    sandboxMode: z.union(['read-only', 'workspace-write']).default('workspace-write').volatile(),
+    sandboxProxy: z.string().default('').volatile(),
+    sandboxLoopback: z.union(['exempt', 'off']).default('exempt').volatile(),
     // 0.1.7: the rules document lives on this entry as a volatile whole-object
     // field (a second settings namespace is no longer projectable). Unconfigured
     // (bare defaults) -> the rules file remains the source.
@@ -217,6 +222,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',
     'networkGrantTtlMs', 'rules',
+    'sandboxEnabled', 'sandboxMode', 'sandboxProxy', 'sandboxLoopback',
 ];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export function readVolatileValue(value) {

package/lib/index.d.ts

@@ -53,5 +53,5 @@ export declare function makeApprovalAnswerer(runtime: Pick<PermGateRuntime, 'set
  * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
  * (fail-closed).
  */
-export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
+export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'> & Partial<Pick<PermGateRuntime, 'sandboxRewrite'>>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
 export declare function apply(ctx: Context, config?: Record<string, unknown>): PermGateRuntime;

package/lib/index.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { SandboxController } from './appcontainer/index.js';
 import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
 import { runDryRun } from './dry-run.js';
@@ -142,6 +143,22 @@ export function makePreExecuteListener(runtime) {
             // The call proceeds: register it so a network connection made by its
             // child process can be attributed back to this session.
             runtime.beginShellExecution(exec);
+            // AppContainer sandbox (goal 2): rewrite the allowed shell call into
+            // the launcher invocation, or fail closed. The host executes THIS exec
+            // object after the waterfall resolves, so the in-place arguments swap
+            // is the sanctioned seam; the base64 wrapper keeps every pipe/&&
+            // inside the container (outer shell sees a plain exe call).
+            if (typeof runtime.sandboxRewrite === 'function') {
+                const rewrite = await runtime.sandboxRewrite(exec);
+                if (rewrite !== undefined) {
+                    if (rewrite.kind === 'deny')
+                        return { kind: 'deny', reason: rewrite.reason };
+                    exec.arguments = {
+                        ...exec.arguments,
+                        command: rewrite.command,
+                    };
+                }
+            }
             return next();
         }
         if (decision.kind !== 'ask')
@@ -709,6 +726,42 @@ export function apply(ctx, config = {}) {
     networkRefs.snapshot = () => networkLifecycle.snapshot();
     if (networkRefs.appliedKey === undefined)
         networkRefs.appliedKey = networkKeyOf(current());
+    // ─── AppContainer sandbox (goal 2, Windows) ─────────────────────────
+    // The gate-aware rewrite hook: an ALLOWED shell call is rewritten into the
+    // launcher invocation (or denied, fail-closed). Settings are read per call
+    // so the card's switches apply without a reload; the controller memoizes
+    // the launcher compile + loopback exemption.
+    const readSandboxSettings = () => {
+        const live = current();
+        const str = (key, fallback) => typeof live[key] === 'string' && live[key] !== '' ? live[key] : fallback;
+        const bool = (key, fallback) => typeof live[key] === 'boolean' ? live[key] : fallback;
+        return {
+            enabled: bool('sandboxEnabled', false),
+            mode: str('sandboxMode', 'workspace-write'),
+            proxy: str('sandboxProxy', ''),
+            loopback: str('sandboxLoopback', 'exempt'),
+        };
+    };
+    const sandboxController = new SandboxController({
+        cwdRoot: () => process.cwd(),
+        builtinProxyPort: () => {
+            try {
+                const snap = networkLifecycle.snapshot();
+                return snap.proxyActive === true && typeof snap.port === 'number' ? snap.port : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        log: (message) => loggerWarn(message),
+    });
+    runtime.setSandboxHook((exec) => sandboxController.wrap(readSandboxSettings(), exec));
+    // The sandbox is Windows-only: on any other platform an enabled switch is a
+    // misconfiguration — warn once and treat it as off (wrap() also guards).
+    if (readSandboxSettings().enabled && process.platform !== 'win32') {
+        loggerWarn('[dsh-perm-gate] sandbox: sandboxEnabled is set but this host is not Windows — the AppContainer sandbox stays OFF');
+    }
+    ctx.effect(() => () => { void sandboxController.dispose(); }, 'dsh-perm-gate: sandbox scratch cleanup');
     // ─── Hot reload watcher (Phase 3, T3.6) ────────────────────────────
     const watchEnabled = typeof config.watch === 'boolean' ? config.watch : true;
     if (watchEnabled) {

package/lib/runtime.d.ts

@@ -12,6 +12,14 @@ export interface PreToolDecisionLike {
     kind: 'deny' | 'ask';
     reason: string;
 }
+/** The sandbox hook's verdict for one allowed shell call (appcontainer seam). */
+export type SandboxRewriteOutcome = {
+    readonly kind: 'wrap';
+    readonly command: string;
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+};
 /**
  * The P2 rule chain's own verdict for one call, as reported by
  * {@link PermGateRuntime.explainRules}. Distinct from the gate's effective
@@ -349,6 +357,20 @@ export declare class PermGateRuntime {
     private auditNetworkAsk;
     /** The compiled ruleset (read-only view for network module). */
     get compiledRuleset(): CompiledRuleset;
+    /**
+     * The sandbox hook installed by the plugin: gate-aware, fail-closed rewrite
+     * of an allowed shell call. Undefined → the feature is off entirely.
+     */
+    private sandboxHook;
+    /** Install/clear the sandbox rewrite hook (plugin wiring). */
+    setSandboxHook(hook: ((exec: ToolExecutionLike) => Promise<SandboxRewriteOutcome | undefined>) | undefined): void;
+    /**
+     * Gate-aware sandbox rewrite for the pre-execute waterfall's allow path.
+     * Mirrors {@link decideExecution}'s stand-down: outside the gate's presets
+     * the sandbox must not silently confine either — same scope, same fence.
+     * Returns undefined when not applicable.
+     */
+    sandboxRewrite(exec: ToolExecutionLike): Promise<SandboxRewriteOutcome | undefined>;
     private liveRiskLearning;
     private liveRiskSediment;
     private liveClassifySource;

package/lib/runtime.js

@@ -581,6 +581,30 @@ export class PermGateRuntime {
     get compiledRuleset() {
         return this.ruleset;
     }
+    // ─── AppContainer sandbox seam (goal 2) ─────────────────────────────
+    /**
+     * The sandbox hook installed by the plugin: gate-aware, fail-closed rewrite
+     * of an allowed shell call. Undefined → the feature is off entirely.
+     */
+    sandboxHook;
+    /** Install/clear the sandbox rewrite hook (plugin wiring). */
+    setSandboxHook(hook) {
+        this.sandboxHook = hook;
+    }
+    /**
+     * Gate-aware sandbox rewrite for the pre-execute waterfall's allow path.
+     * Mirrors {@link decideExecution}'s stand-down: outside the gate's presets
+     * the sandbox must not silently confine either — same scope, same fence.
+     * Returns undefined when not applicable.
+     */
+    async sandboxRewrite(exec) {
+        const hook = this.sandboxHook;
+        if (hook === undefined)
+            return undefined;
+        if (!this.gateActive(this.presetOf(exec)))
+            return undefined;
+        return hook(exec);
+    }
     liveRiskLearning() {
         const read = this.options.readRiskLearning;
         if (read !== undefined)

package/locale/de.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Berechtigungsschleuse", "description": "Deterministisch-zuerst, fehlgeschlossene Berechtigungsschleuse für DeepSeek Harness: P0 harte Ablehnung → P1 Sitzungsfreigabe → P2 statische Regelkette → P3 optionaler LLM-Semantik-Klassifikator → P4 manuelle Bestätigung, mit Befehls-Whitelist und -Blacklist." } }

package/locale/en.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Permission Gate", "description": "Deterministic-first, fail-closed permission gate for DeepSeek Harness: P0 hard-deny → P1 session grant → P2 static rules → P3 LLM classifier → P4 ask, with command whitelist and blacklist." } }

package/locale/es.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Puerta de permisos", "description": "Puerta de permisos determinista y de cierre seguro para DeepSeek Harness: P0 denegación estricta → P1 concesión de sesión → P2 cadena de reglas estáticas → P3 clasificador semántico LLM opcional → P4 confirmación manual, con lista blanca y lista negra de comandos." } }

package/locale/fr.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Passerelle de permissions", "description": "Passerelle de permissions déterministe et à échec fermé pour DeepSeek Harness : P0 refus strict → P1 autorisation de session → P2 chaîne de règles statiques → P3 classifieur sémantique LLM optionnel → P4 confirmation manuelle, avec liste blanche et liste noire de commandes." } }

package/locale/it.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Gateway dei permessi", "description": "Gateway dei permessi deterministico e fail-closed per DeepSeek Harness: P0 rifiuto rigido → P1 concessione di sessione → P2 catena di regole statiche → P3 classificatore semantico LLM opzionale → P4 conferma manuale, con whitelist e blacklist dei comandi." } }

package/locale/ja.json

@@ -0,0 +1 @@
+{ "meta": { "title": "権限ゲート", "description": "DeepSeek Harness 用の決定論優先・フェイルクローズド権限ゲート：P0 ハード拒否 → P1 セッション許可 → P2 静的ルールチェーン → P3 オプション LLM セマンティック分類器 → P4 人手確認、コマンドホワイトリスト/ブラックリスト付き。" } }

package/locale/ko.json

@@ -0,0 +1 @@
+{ "meta": { "title": "권한 게이트", "description": "DeepSeek Harness용 결정론 우선·실패 시 차단 권한 게이트: P0 하드 거부 → P1 세션 승인 → P2 정적 규칙 체인 → P3 선택적 LLM 시맨틱 분류기 → P4 수동 확인, 명령 화이트리스트/블랙리스트 포함." } }

package/locale/ru.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Шлюз разрешений", "description": "Детерминированный шлюз разрешений с закрытием при сбое для DeepSeek Harness: P0 жёсткий запрет → P1 сессионное разрешение → P2 цепочка статических правил → P3 необязательный LLM-семантический классификатор → P4 ручной запрос, с белым и чёрным списком команд." } }

package/locale/zh.json

@@ -0,0 +1 @@
+{ "meta": { "title": "权限门禁", "description": "面向 DeepSeek Harness 的确定性优先、fail-closed 权限门禁：P0 硬拒绝 → P1 会话授权 → P2 静态规则链 → P3 可选 LLM 语义分类器 → P4 人工确认，含命令白名单与黑名单。" } }

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "publishConfig": {
-    "tag": "dsh-0.2.0"
+    "tag": "latest"
   },
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
   "files": [
     "lib",
+    "locale",
     "scripts/patch-permission-glyph.mjs",
     "cordis.patch.yml",
     "dsh.plugin.json",
@@ -57,6 +58,7 @@
     "./client": {
       "default": "./lib/client.js"
     },
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "bin": {
@@ -65,13 +67,13 @@
   },
   "engines": {
     "node": ">=24",
-    "dsh": ">=0.2.0-rc.1 <0.2.1-0"
+    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": ">=0.2.0-rc.1 <0.2.1-0",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.0-rc.1 <0.2.1-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.0-rc.1 <0.2.1-0"
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4",
@@ -80,10 +82,10 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
@@ -94,23 +96,6 @@
     "typescript-eslint": "^8.69.0",
     "vitest": "^3.0.0"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsdown",
-    "prepublishOnly": "npm run build",
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
-    "test": "vitest run",
-    "patch:glyph": "node scripts/patch-permission-glyph.mjs",
-    "patch:glyph:check": "node scripts/patch-permission-glyph.mjs --check",
-    "verify:line": "node scripts/verify-line.mjs next",
-    "verify:lines": "node scripts/verify-line.mjs both",
-    "check:line": "node scripts/sync-0.1.5-line.mjs check",
-    "release:latest": "npm publish --tag latest",
-    "release:2x": "npm publish --tag 2.x",
-    "release:legacy": "npm publish --tag legacy",
-    "release:3x": "npm publish --tag dsh-0.1.5",
-    "release:5x": "npm publish --tag dsh-0.2.0"
-  },
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -154,5 +139,20 @@
     "@deepseek-ai/dsh-client-ui-settings": {
       "optional": true
     }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsdown",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
+    "test": "vitest run",
+    "patch:glyph": "node scripts/patch-permission-glyph.mjs",
+    "patch:glyph:check": "node scripts/patch-permission-glyph.mjs --check",
+    "verify:line": "node scripts/verify-line.mjs new",
+    "verify:lines": "node scripts/verify-line.mjs both",
+    "check:line": "node scripts/sync-0.1.5-line.mjs check",
+    "release:latest": "npm publish --tag latest",
+    "release:2x": "npm publish --tag 2.x",
+    "release:legacy": "npm publish --tag legacy",
+    "release:3x": "npm publish --tag dsh-0.1.5"
   }
-}
+}