dsh-perm-gate 5.0.4 → 5.1.2-compat.7

package/lib/config.d.ts

@@ -191,6 +191,38 @@ export interface PermGateConfig {
      * Default 1800000 (30 min).
      */
     readonly networkGrantTtlMs?: number;
+    /**
+     * Run gate-allowed shell commands inside a Windows AppContainer. The
+     * container token carries NO network capability, so non-loopback egress is
+     * denied by Windows Firewall (WFP) itself; the container SID is derived
+     * deterministically so the loopback exemption is a one-time step. Default
+     * false — enabling changes how allowed commands execute.
+     */
+    readonly sandboxEnabled?: boolean;
+    /**
+     * Filesystem posture inside the container: 'workspace-write' grants the
+     * workspace Modify + temp FullControl; 'read-only' grants RX only.
+     * System directories stay readable through the stock ALL APPLICATION
+     * PACKAGES ACEs. Default 'workspace-write'.
+     */
+    readonly sandboxMode?: 'read-only' | 'workspace-write';
+    /**
+     * THE proxy parameter: the URL injected as HTTP(S)_PROXY / ALL_PROXY into
+     * sandboxed processes. Empty (default) follows the builtin filtered proxy
+     * (its actual bound 127.0.0.1 port) when networkEnabled; an explicit value
+     * must be loopback-bound (the container cannot reach anything else) and the
+     * destination filtering is that proxy's job. Neither set → no proxy env;
+     * direct egress stays WFP-blocked either way.
+     */
+    readonly sandboxProxy?: string;
+    /**
+     * Attempt the one-time `CheckNetIsolation LoopbackExempt -a -p=<sid>` for
+     * the container SID so sandboxed processes can reach 127.0.0.1 (the proxy
+     * and the host webServer). Denied without elevation → warning with the
+     * exact command; the sandbox still runs, only loopback stays closed.
+     * Default 'exempt'.
+     */
+    readonly sandboxLoopback?: 'exempt' | 'off';
     /** @deprecated Rules now live in the `dsh-perm-gate-rules` settings namespace; file watching was removed. Accepted (ignored) for composition compatibility. */
     readonly watch?: boolean;
     /** @deprecated See {@link watch}. */
@@ -349,6 +381,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     networkInjectEnv: z<boolean, boolean, "volatile-defined">;
     networkAskTimeoutMs: z<number, number, "volatile-defined">;
     networkGrantTtlMs: z<number, number, "volatile-defined">;
+    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
+    sandboxProxy: z<string, string, "volatile-defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
     rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -404,6 +440,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     networkInjectEnv: z<boolean, boolean, "volatile-defined">;
     networkAskTimeoutMs: z<number, number, "volatile-defined">;
     networkGrantTtlMs: z<number, number, "volatile-defined">;
+    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
+    sandboxProxy: z<string, string, "volatile-defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
     rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -411,7 +451,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -199,6 +199,11 @@ export const Config = z.object({
     networkInjectEnv: z.boolean().default(true).volatile(),
     networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000).volatile(),
     networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000).volatile(),
+    // AppContainer sandbox (Windows; goal 2)
+    sandboxEnabled: z.boolean().default(false).volatile(),
+    sandboxMode: z.union(['read-only', 'workspace-write']).default('workspace-write').volatile(),
+    sandboxProxy: z.string().default('').volatile(),
+    sandboxLoopback: z.union(['exempt', 'off']).default('exempt').volatile(),
     // 0.1.7: the rules document lives on this entry as a volatile whole-object
     // field (a second settings namespace is no longer projectable). Unconfigured
     // (bare defaults) -> the rules file remains the source.
@@ -217,6 +222,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',
     'networkGrantTtlMs', 'rules',
+    'sandboxEnabled', 'sandboxMode', 'sandboxProxy', 'sandboxLoopback',
 ];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export function readVolatileValue(value) {

package/lib/debug-generation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * debug-generation — T10b served 集合诊断端点（临时，上线前删，spec served 七步第 2 步）。
+ *
+ * GET /api/dsh-perm-gate/debug-generation
+ * 返回插件持有的 settings 服务实例自检：全量 describe 的 ns 列表 + 方法面。
+ * 判读：ns 列表若同时含 dsh-perm-gate / dsh-session-guard / dsh-free-search-settings
+ * 等其他插件命名空间 → 持有的是宿主共享单例（identitySame=TRUE，H3 孤儿假设死）；
+ * 若只有自家 ns → 孤儿实例坐实（H3 成立）。
+ */
+export interface SettingsServiceLike {
+    update(ns: string, patch: object): Promise<void>;
+    register?(ns: string, schema: unknown, options?: {
+        base?: unknown;
+    }): unknown;
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: unknown): unknown;
+    describe?(): Array<{
+        ns: unknown;
+    }>;
+}
+export declare const DEBUG_GENERATION_ROUTE = "/api/dsh-perm-gate/debug-generation";
+export declare function registerDebugGenerationRoute(server: unknown, getSettingsSvc: () => SettingsServiceLike | undefined): (() => void) | undefined;

package/lib/debug-generation.js

@@ -0,0 +1,44 @@
+export const DEBUG_GENERATION_ROUTE = '/api/dsh-perm-gate/debug-generation';
+export function registerDebugGenerationRoute(server, getSettingsSvc) {
+    if (typeof server !== 'object' || server === null)
+        return undefined;
+    const ws = typeof server.register === 'function' ? server : undefined;
+    if (ws === undefined || typeof ws.register !== 'function')
+        return undefined;
+    return ws.register({
+        kind: 'exact',
+        path: DEBUG_GENERATION_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'GET' && req.method !== 'HEAD') {
+                res.writeHead(405);
+                res.end();
+                return;
+            }
+            const svc = getSettingsSvc();
+            let namespaces = [];
+            let describeError;
+            if (svc !== undefined && typeof svc.describe === 'function') {
+                try {
+                    const descriptors = svc.describe();
+                    namespaces = descriptors.map((d) => String(d.ns));
+                }
+                catch (e) {
+                    describeError = e instanceof Error ? e.message : String(e);
+                }
+            }
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({
+                hasSvc: svc !== undefined,
+                describeError,
+                namespaces,
+                methods: svc === undefined ? null : {
+                    register: typeof svc.register === 'function',
+                    installSection: typeof svc.installSection === 'function',
+                    update: typeof svc.update === 'function',
+                },
+            }, null, 2));
+        },
+    });
+}

package/lib/index.d.ts

@@ -53,5 +53,5 @@ export declare function makeApprovalAnswerer(runtime: Pick<PermGateRuntime, 'set
  * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
  * (fail-closed).
  */
-export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
+export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'> & Partial<Pick<PermGateRuntime, 'sandboxRewrite'>>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
 export declare function apply(ctx: Context, config?: Record<string, unknown>): PermGateRuntime;

package/lib/index.js

@@ -1,9 +1,12 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
+import { SandboxController } from './appcontainer/index.js';
+import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
+// T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
+import { registerSettingsBridgeRoutes } from './bridge.js';
 import { buildReceiverInfo } from './receiver-info.js';
 import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
@@ -142,6 +145,22 @@ export function makePreExecuteListener(runtime) {
             // The call proceeds: register it so a network connection made by its
             // child process can be attributed back to this session.
             runtime.beginShellExecution(exec);
+            // AppContainer sandbox (goal 2): rewrite the allowed shell call into
+            // the launcher invocation, or fail closed. The host executes THIS exec
+            // object after the waterfall resolves, so the in-place arguments swap
+            // is the sanctioned seam; the base64 wrapper keeps every pipe/&&
+            // inside the container (outer shell sees a plain exe call).
+            if (typeof runtime.sandboxRewrite === 'function') {
+                const rewrite = await runtime.sandboxRewrite(exec);
+                if (rewrite !== undefined) {
+                    if (rewrite.kind === 'deny')
+                        return { kind: 'deny', reason: rewrite.reason };
+                    exec.arguments = {
+                        ...exec.arguments,
+                        command: rewrite.command,
+                    };
+                }
+            }
             return next();
         }
         if (decision.kind !== 'ask')
@@ -171,7 +190,7 @@ export function makePreExecuteListener(runtime) {
 export function apply(ctx, config = {}) {
     // Runtime-adjustable config: 0.1.7 hands `.volatile()` fields to apply() as
     // live refs; `current()` shallow-resolves one snapshot per read.
-    const current = () => resolveVolatileConfig(config);
+    let current = () => resolveVolatileConfig(config);
     // ─── Rules (volatile `rules` field on this entry) ─────────────────────────
     // The rules document is a `.volatile()` whole-object field of the plugin's
     // own entry (0.1.7 has no second projectable namespace). Unconfigured
@@ -190,17 +209,104 @@ export function apply(ctx, config = {}) {
     ctx.inject(['settings'], (child) => {
         const svc = child.settings;
         settingsRef.svc = svc;
+        if (svc === undefined)
+            return;
+        // setSource 换绑运行时读取源:source 可能是 () => values(≤0.1.5 scope.get)
+        // 或普通对象;base 与运行时读分用两个 resolve(手册 §P1-3)。
+        const rebindFrom = (source) => {
+            current = () => resolveVolatileConfig((typeof source === 'function' ? source() : (source ?? config)));
+        };
+        const seedDoc = () => ({ ...readRulesFileDoc(rulesFilePath), initialized: true });
+        const seedUpdate = () => svc.update(ENTRY_ID, { rules: seedDoc() });
+        // F4 加固（spec served 段判「无论如何无条件做」）：宿主 installSection 在
+        // register 之后同步调 setSource（dsh-settings 0.1.5 lib/index.js:332），换绑
+        // 或 onChange 抛错会从 installSection 一路抛穿插件加载、连带注册失败——
+        // 这里兜住异常保住注册（卡派发依赖 ns∈served，注册比换绑成败更金贵）。
+        const guardedSetSource = (source) => {
+            try {
+                rebindFrom(source);
+                hooks.onChange();
+            }
+            catch (e) {
+                console.warn('[dsh-perm-gate] setSource rebind failed (registration kept):', e);
+            }
+        };
+        const hooks = {
+            setSource: guardedSetSource,
+            onChange: () => { applyVolatileUpdate(); },
+        };
         // Activation-time seed: a never-configured `rules` field is populated once
         // — from the rules file when one exists (implicit migration), otherwise a
         // bare starter document — and marked `initialized`, so the panel shows a
         // live rules document from the first boot instead of a missing-file
         // fallback. The field watcher below picks the seed up via reload.
-        if (svc !== undefined && readRulesDocument() === undefined) {
-            const seed = { ...readRulesFileDoc(rulesFilePath), initialized: true };
-            void svc.update(ENTRY_ID, { rules: seed }).catch((e) => {
-                console.warn('[dsh-perm-gate] rules seed write failed:', e);
+        // ── 三代 waist:三分支执行体互斥(P1-1/P1-2),register-retry 仅存活于
+        // 兜底分支且在 rc.1+ 永不命中;rc.1+ 不引入 configure(P1-5)。
+        if (typeof svc.installSection === 'function') {
+            console.warn('[dsh-perm-gate] settings generation = service.installSection (0.1.2/0.1.5 line)');
+            svc.installSection(ctx, ENTRY_ID, Config, resolveConfig(config), {
+                setSource: guardedSetSource,
+                onChange: () => { applyVolatileUpdate(); },
             });
+            if (readRulesDocument() === undefined) {
+                void seedUpdate().catch((e) => {
+                    console.warn('[dsh-perm-gate] legacy seed update failed:', e);
+                });
+            }
+            return;
         }
+        void (async () => {
+            try {
+                // 变量说明符:dsh-settings 现为 optional peer(T35,2026-10-07——dependencies
+                // 硬钉 0.1.1-rc.2 已删:六线运行时它本来就无效——0.1.5 分支互斥不加载、老线
+                // nested 链接悬空后动态 import 经 node 向上解析落宿主自身副本,见
+                // cross-version-adaptation-all/findings.md T10b 附录)。变量形式让 TS 按 any
+                // 解析不做模块查证;另注意 ctx.get 不跨插件隔离上下文(index.ts:44),
+                // legacy 分支只能动态 import,不能 ctx.get 直取宿主单例。
+                const legacySpecifier = '@deepseek-ai/dsh-settings';
+                const legacy = (await import(legacySpecifier));
+                if (typeof legacy.installSettingsSection === 'function' && typeof legacy.settingsNamespace === 'function') {
+                    console.warn('[dsh-perm-gate] settings generation = module.installSettingsSection (0.1.0/0.1.1 line)');
+                    legacy.installSettingsSection(ctx, legacy.settingsNamespace(ENTRY_ID), Config, resolveConfig(config), {
+                        setSource: (source) => {
+                            rebindFrom(source);
+                            hooks.onChange();
+                        },
+                        onChange: () => { applyVolatileUpdate(); },
+                    });
+                    if (readRulesDocument() === undefined) {
+                        await seedUpdate().catch((e) => {
+                            console.warn('[dsh-perm-gate] legacy seed update failed:', e);
+                        });
+                    }
+                    return;
+                }
+            }
+            catch {
+                // 模块级 legacy API 缺失/导入失败 → 落到 rc.1 兜底
+            }
+            console.warn('[dsh-perm-gate] settings generation = rc1.loader (rc.1+: loader 自动注册 ns,update 直接成功;register-retry 兜底永不命中)');
+            if (readRulesDocument() === undefined) {
+                void (async () => {
+                    try {
+                        await seedUpdate();
+                    }
+                    catch (e) {
+                        const message = e instanceof Error ? e.message : String(e);
+                        // register-retry 兜底:rc.1+ 上 ns 已被 loader 占用,永不命中
+                        if (!/not registered/i.test(message) || typeof svc.register !== 'function') {
+                            throw e;
+                        }
+                        console.warn(`[dsh-perm-gate] legacy fallback: registering settings namespace ${ENTRY_ID}`);
+                        svc.register(ENTRY_ID, Config, { base: { rules: seedDoc() } });
+                        await seedUpdate();
+                        console.warn('[dsh-perm-gate] legacy fallback registered + seeded');
+                    }
+                })().catch((e) => {
+                    console.warn('[dsh-perm-gate] rules seed write failed:', e);
+                });
+            }
+        })();
     });
     const settingsWrite = (write) => {
         const svc = settingsRef.svc;
@@ -461,7 +567,7 @@ export function apply(ctx, config = {}) {
     // The host no longer seeds settings (there is no write path): an empty
     // `allowlist` keeps the rules-file default via `runtime.allowlist()`.
     let lastRulesDocKey;
-    ctx.on('loader/volatile-update', () => {
+    function applyVolatileUpdate() {
         const next = asSurface(current());
         if (next !== undefined) {
             if (Array.isArray(next.allowlist)) {
@@ -489,6 +595,10 @@ export function apply(ctx, config = {}) {
             if (changed)
                 runtime.reload();
         }
+    }
+    ;
+    ctx.on('loader/volatile-update', () => {
+        applyVolatileUpdate();
     });
     // Event feed HTTP API (best effort): the dsh webServer service exposes the
     // JSONL decision events to the browser half; without it events stay on disk.
@@ -529,6 +639,10 @@ export function apply(ctx, config = {}) {
             const offHealth = registerHealthRoute(webServer, { check: () => runtime.healthCheck() });
             if (offHealth !== undefined)
                 ctx.effect(() => () => { offHealth(); }, 'dsh-perm-gate: health route');
+            // T12: 设置数据桥（client 卡在 settingsScope 不解析的线上由此取数/写回）
+            for (const offBridge of registerSettingsBridgeRoutes(webServer, () => settingsRef.svc, ENTRY_ID)) {
+                ctx.effect(() => () => { offBridge(); }, 'dsh-perm-gate: settings bridge route');
+            }
             // Network diagnostics: mode, bind, port, proxy liveness, env injection,
             // block counters and recent blocks. Read-only.
             const offNetwork = registerNetworkRoute(webServer, {
@@ -709,6 +823,42 @@ export function apply(ctx, config = {}) {
     networkRefs.snapshot = () => networkLifecycle.snapshot();
     if (networkRefs.appliedKey === undefined)
         networkRefs.appliedKey = networkKeyOf(current());
+    // ─── AppContainer sandbox (goal 2, Windows) ─────────────────────────
+    // The gate-aware rewrite hook: an ALLOWED shell call is rewritten into the
+    // launcher invocation (or denied, fail-closed). Settings are read per call
+    // so the card's switches apply without a reload; the controller memoizes
+    // the launcher compile + loopback exemption.
+    const readSandboxSettings = () => {
+        const live = current();
+        const str = (key, fallback) => typeof live[key] === 'string' && live[key] !== '' ? live[key] : fallback;
+        const bool = (key, fallback) => typeof live[key] === 'boolean' ? live[key] : fallback;
+        return {
+            enabled: bool('sandboxEnabled', false),
+            mode: str('sandboxMode', 'workspace-write'),
+            proxy: str('sandboxProxy', ''),
+            loopback: str('sandboxLoopback', 'exempt'),
+        };
+    };
+    const sandboxController = new SandboxController({
+        cwdRoot: () => process.cwd(),
+        builtinProxyPort: () => {
+            try {
+                const snap = networkLifecycle.snapshot();
+                return snap.proxyActive === true && typeof snap.port === 'number' ? snap.port : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        log: (message) => loggerWarn(message),
+    });
+    runtime.setSandboxHook((exec) => sandboxController.wrap(readSandboxSettings(), exec));
+    // The sandbox is Windows-only: on any other platform an enabled switch is a
+    // misconfiguration — warn once and treat it as off (wrap() also guards).
+    if (readSandboxSettings().enabled && process.platform !== 'win32') {
+        loggerWarn('[dsh-perm-gate] sandbox: sandboxEnabled is set but this host is not Windows — the AppContainer sandbox stays OFF');
+    }
+    ctx.effect(() => () => { void sandboxController.dispose(); }, 'dsh-perm-gate: sandbox scratch cleanup');
     // ─── Hot reload watcher (Phase 3, T3.6) ────────────────────────────
     const watchEnabled = typeof config.watch === 'boolean' ? config.watch : true;
     if (watchEnabled) {

package/lib/runtime.d.ts

@@ -12,6 +12,14 @@ export interface PreToolDecisionLike {
     kind: 'deny' | 'ask';
     reason: string;
 }
+/** The sandbox hook's verdict for one allowed shell call (appcontainer seam). */
+export type SandboxRewriteOutcome = {
+    readonly kind: 'wrap';
+    readonly command: string;
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+};
 /**
  * The P2 rule chain's own verdict for one call, as reported by
  * {@link PermGateRuntime.explainRules}. Distinct from the gate's effective
@@ -349,6 +357,20 @@ export declare class PermGateRuntime {
     private auditNetworkAsk;
     /** The compiled ruleset (read-only view for network module). */
     get compiledRuleset(): CompiledRuleset;
+    /**
+     * The sandbox hook installed by the plugin: gate-aware, fail-closed rewrite
+     * of an allowed shell call. Undefined → the feature is off entirely.
+     */
+    private sandboxHook;
+    /** Install/clear the sandbox rewrite hook (plugin wiring). */
+    setSandboxHook(hook: ((exec: ToolExecutionLike) => Promise<SandboxRewriteOutcome | undefined>) | undefined): void;
+    /**
+     * Gate-aware sandbox rewrite for the pre-execute waterfall's allow path.
+     * Mirrors {@link decideExecution}'s stand-down: outside the gate's presets
+     * the sandbox must not silently confine either — same scope, same fence.
+     * Returns undefined when not applicable.
+     */
+    sandboxRewrite(exec: ToolExecutionLike): Promise<SandboxRewriteOutcome | undefined>;
     private liveRiskLearning;
     private liveRiskSediment;
     private liveClassifySource;

package/lib/runtime.js

@@ -581,6 +581,30 @@ export class PermGateRuntime {
     get compiledRuleset() {
         return this.ruleset;
     }
+    // ─── AppContainer sandbox seam (goal 2) ─────────────────────────────
+    /**
+     * The sandbox hook installed by the plugin: gate-aware, fail-closed rewrite
+     * of an allowed shell call. Undefined → the feature is off entirely.
+     */
+    sandboxHook;
+    /** Install/clear the sandbox rewrite hook (plugin wiring). */
+    setSandboxHook(hook) {
+        this.sandboxHook = hook;
+    }
+    /**
+     * Gate-aware sandbox rewrite for the pre-execute waterfall's allow path.
+     * Mirrors {@link decideExecution}'s stand-down: outside the gate's presets
+     * the sandbox must not silently confine either — same scope, same fence.
+     * Returns undefined when not applicable.
+     */
+    async sandboxRewrite(exec) {
+        const hook = this.sandboxHook;
+        if (hook === undefined)
+            return undefined;
+        if (!this.gateActive(this.presetOf(exec)))
+            return undefined;
+        return hook(exec);
+    }
     liveRiskLearning() {
         const read = this.options.readRiskLearning;
         if (read !== undefined)

package/locale/de.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Berechtigungsschleuse", "description": "Deterministisch-zuerst, fehlgeschlossene Berechtigungsschleuse für DeepSeek Harness: P0 harte Ablehnung → P1 Sitzungsfreigabe → P2 statische Regelkette → P3 optionaler LLM-Semantik-Klassifikator → P4 manuelle Bestätigung, mit Befehls-Whitelist und -Blacklist." } }

package/locale/en.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Permission Gate", "description": "Deterministic-first, fail-closed permission gate for DeepSeek Harness: P0 hard-deny → P1 session grant → P2 static rules → P3 LLM classifier → P4 ask, with command whitelist and blacklist." } }

package/locale/es.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Puerta de permisos", "description": "Puerta de permisos determinista y de cierre seguro para DeepSeek Harness: P0 denegación estricta → P1 concesión de sesión → P2 cadena de reglas estáticas → P3 clasificador semántico LLM opcional → P4 confirmación manual, con lista blanca y lista negra de comandos." } }

package/locale/fr.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Passerelle de permissions", "description": "Passerelle de permissions déterministe et à échec fermé pour DeepSeek Harness : P0 refus strict → P1 autorisation de session → P2 chaîne de règles statiques → P3 classifieur sémantique LLM optionnel → P4 confirmation manuelle, avec liste blanche et liste noire de commandes." } }

package/locale/it.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Gateway dei permessi", "description": "Gateway dei permessi deterministico e fail-closed per DeepSeek Harness: P0 rifiuto rigido → P1 concessione di sessione → P2 catena di regole statiche → P3 classificatore semantico LLM opzionale → P4 conferma manuale, con whitelist e blacklist dei comandi." } }

package/locale/ja.json

@@ -0,0 +1 @@
+{ "meta": { "title": "権限ゲート", "description": "DeepSeek Harness 用の決定論優先・フェイルクローズド権限ゲート：P0 ハード拒否 → P1 セッション許可 → P2 静的ルールチェーン → P3 オプション LLM セマンティック分類器 → P4 人手確認、コマンドホワイトリスト/ブラックリスト付き。" } }

package/locale/ko.json

@@ -0,0 +1 @@
+{ "meta": { "title": "권한 게이트", "description": "DeepSeek Harness용 결정론 우선·실패 시 차단 권한 게이트: P0 하드 거부 → P1 세션 승인 → P2 정적 규칙 체인 → P3 선택적 LLM 시맨틱 분류기 → P4 수동 확인, 명령 화이트리스트/블랙리스트 포함." } }

package/locale/ru.json

@@ -0,0 +1 @@
+{ "meta": { "title": "Шлюз разрешений", "description": "Детерминированный шлюз разрешений с закрытием при сбое для DeepSeek Harness: P0 жёсткий запрет → P1 сессионное разрешение → P2 цепочка статических правил → P3 необязательный LLM-семантический классификатор → P4 ручной запрос, с белым и чёрным списком команд." } }

package/locale/zh.json

@@ -0,0 +1 @@
+{ "meta": { "title": "权限门禁", "description": "面向 DeepSeek Harness 的确定性优先、fail-closed 权限门禁：P0 硬拒绝 → P1 会话授权 → P2 静态规则链 → P3 可选 LLM 语义分类器 → P4 人工确认，含命令白名单与黑名单。" } }

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.0.4",
+  "version": "5.1.2-compat.7",
   "publishConfig": {
-    "tag": "dsh-0.2.0"
+    "tag": "compat"
   },
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
   "files": [
     "lib",
+    "locale",
     "scripts/patch-permission-glyph.mjs",
     "cordis.patch.yml",
     "dsh.plugin.json",
@@ -57,6 +58,7 @@
     "./client": {
       "default": "./lib/client.js"
     },
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "bin": {
@@ -65,13 +67,15 @@
   },
   "engines": {
     "node": ">=24",
-    "dsh": ">=0.2.0-rc.1 <0.2.1-0"
+    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": ">=0.2.0-rc.1 <0.2.1-0",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.0-rc.1 <0.2.1-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.0-rc.1 <0.2.1-0"
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4",
@@ -80,10 +84,10 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
@@ -92,24 +96,25 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.69.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.2"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && tsdown",
+    "prepack": "npm run build",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
     "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
     "test": "vitest run",
     "patch:glyph": "node scripts/patch-permission-glyph.mjs",
     "patch:glyph:check": "node scripts/patch-permission-glyph.mjs --check",
-    "verify:line": "node scripts/verify-line.mjs next",
+    "verify:line": "node scripts/verify-line.mjs new",
     "verify:lines": "node scripts/verify-line.mjs both",
     "check:line": "node scripts/sync-0.1.5-line.mjs check",
     "release:latest": "npm publish --tag latest",
     "release:2x": "npm publish --tag 2.x",
     "release:legacy": "npm publish --tag legacy",
-    "release:3x": "npm publish --tag dsh-0.1.5",
-    "release:5x": "npm publish --tag dsh-0.2.0"
+    "release:3x": "npm publish --tag dsh-0.1.5"
   },
   "license": "MIT",
   "repository": {
@@ -153,6 +158,12 @@
     },
     "@deepseek-ai/dsh-client-ui-settings": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-conversation": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-settings": {
+      "optional": true
     }
   }
 }