dsh-perm-gate 5.1.2-compat.7 → 5.2.0

package/lib/config.js

@@ -150,64 +150,88 @@ export function readRulesFromSettings(scope) {
     const value = scope?.get();
     return isRulesConfigured(value) ? value : undefined;
 }
+/**
+ * Feature guard for `Schema…volatile()`.
+ *
+ * `.volatile()` is not guaranteed to exist on the schemastery copy this plugin
+ * resolves at runtime. Every node below used to chain it unguarded **inside the
+ * module body**, so a missing method throws while `Config` is being built: the
+ * plugin fails to load at all (`engines.dsh` declares support for all 15 host
+ * lines, so that is a hard load-failure, not a degradation).
+ *
+ * Probing per node keeps the plain schema node instead. The read side already
+ * tolerates that — `readVolatileValue` / `resolveVolatileConfig` treat a value
+ * without `get()` as the frozen snapshot — so every switch still works, and only
+ * hot reload of a changed value is lost (it then needs a restart).
+ *
+ * Do **not** “fix” this by adding `volatile` to schemastery's prototype: the
+ * profile uses a hoisted flat layout, so that single copy is shared by every
+ * plugin in the profile (14 of them declare schemastery themselves) — a
+ * prototype write here would silently change their behaviour too.
+ */
+function vol(node) {
+    const maybe = node;
+    return typeof maybe.volatile === 'function' ? maybe.volatile() : node;
+}
 export const Config = z.object({
     rulesFile: z.string(),
     dshHome: z.string(),
-    defaultAction: z.union(['allow', 'ask', 'deny']).default('ask').volatile(),
-    caseInsensitivePaths: z.boolean().default(true).volatile(),
-    classifierEnabled: z.boolean().default(false).volatile(),
-    classifierEndpoint: z.string().volatile(),
-    classifierModel: z.string().default('deepseek-chat').volatile(),
-    classifierApiKey: z.string().volatile(),
-    riskTimeoutMs: z.number().min(1000).default(20_000).volatile(),
-    riskLearning: z.boolean().default(true).volatile(),
-    riskSediment: z.boolean().default(true).volatile(),
-    classifierSource: z.union(['custom', 'host']).default('custom').volatile(),
-    classifierProvider: z.string().volatile(),
-    riskThreshold: z.number().min(1).max(10).default(1).volatile(),
+    defaultAction: vol(z.union(['allow', 'ask', 'deny']).default('ask')),
+    caseInsensitivePaths: vol(z.boolean().default(true)),
+    classifierEnabled: vol(z.boolean().default(false)),
+    classifierEndpoint: vol(z.string()),
+    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierApiKey: vol(z.string()),
+    riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
+    riskLearning: vol(z.boolean().default(true)),
+    riskSediment: vol(z.boolean().default(true)),
+    classifierSource: vol(z.union(['custom', 'host']).default('custom')),
+    classifierProvider: vol(z.string()),
+    riskThreshold: vol(z.number().min(1).max(10).default(1)),
     learningFile: z.string(),
     eventsFile: z.string(),
-    grantTtlMs: z.number().min(1).default(5 * 60_000).volatile(),
-    grantMaxUses: z.number().min(1).default(1).volatile(),
-    permissive: z.boolean().default(false).volatile(),
+    grantTtlMs: vol(z.number().min(1).default(5 * 60_000)),
+    grantMaxUses: vol(z.number().min(1).default(1)),
+    permissive: vol(z.boolean().default(false)),
     gatePresets: z.array(z.string()),
-    permissiveStrategies: z.object({
+    permissiveStrategies: vol(z.object({
         trustAutoAllow: z.boolean().default(true),
         alwaysConfirm: z.boolean().default(false),
         llmAssist: z.boolean().default(false),
         trustEscalation: z.boolean().default(true),
-    }).volatile(),
-    allowlist: z.array(z.string()).volatile(),
-    denyKeywords: z.array(z.string()).volatile(),
-    autoAllowTools: z.array(z.string()).volatile(),
-    sessionSweep: z.boolean().default(true).volatile(),
+    })),
+    allowlist: vol(z.array(z.string())),
+    denyKeywords: vol(z.array(z.string())),
+    presetRulesSeeded: vol(z.boolean().default(false)),
+    autoAllowTools: vol(z.array(z.string())),
+    sessionSweep: vol(z.boolean().default(true)),
     workspaceStoreFile: z.string(),
     // Rule chain (T1.9)
-    searchUp: z.boolean().default(false).volatile(),
+    searchUp: vol(z.boolean().default(false)),
     fallbackPath: z.string(),
-    badFilePolicy: z.union(['fail', 'warn']).default('fail').volatile(),
-    maxChainLength: z.number().min(1).max(50).default(10).volatile(),
+    badFilePolicy: vol(z.union(['fail', 'warn']).default('fail')),
+    maxChainLength: vol(z.number().min(1).max(50).default(10)),
     // Network (Phase 2)
-    networkEnabled: z.boolean().default(false).volatile(),
-    networkMode: z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist').volatile(),
-    networkUnlisted: z.union(['ask', 'deny']).default('ask').volatile(),
-    networkUnattributed: z.union(['allow', 'deny']).default('allow').volatile(),
-    networkLoopback: z.union(['allow', 'policy']).default('allow').volatile(),
-    networkBind: z.string().default('127.0.0.1').volatile(),
-    networkPort: z.number().min(0).max(65535).default(0).volatile(),
-    networkNoProxy: z.union(['clear', 'preserve']).default('clear').volatile(),
-    networkInjectEnv: z.boolean().default(true).volatile(),
-    networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000).volatile(),
-    networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000).volatile(),
+    networkEnabled: vol(z.boolean().default(false)),
+    networkMode: vol(z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist')),
+    networkUnlisted: vol(z.union(['ask', 'deny']).default('ask')),
+    networkUnattributed: vol(z.union(['allow', 'deny']).default('allow')),
+    networkLoopback: vol(z.union(['allow', 'policy']).default('allow')),
+    networkBind: vol(z.string().default('127.0.0.1')),
+    networkPort: vol(z.number().min(0).max(65535).default(0)),
+    networkNoProxy: vol(z.union(['clear', 'preserve']).default('clear')),
+    networkInjectEnv: vol(z.boolean().default(true)),
+    networkAskTimeoutMs: vol(z.number().min(1000).max(600_000).default(120_000)),
+    networkGrantTtlMs: vol(z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000)),
     // AppContainer sandbox (Windows; goal 2)
-    sandboxEnabled: z.boolean().default(false).volatile(),
-    sandboxMode: z.union(['read-only', 'workspace-write']).default('workspace-write').volatile(),
-    sandboxProxy: z.string().default('').volatile(),
-    sandboxLoopback: z.union(['exempt', 'off']).default('exempt').volatile(),
+    sandboxEnabled: vol(z.boolean().default(false)),
+    sandboxMode: vol(z.union(['read-only', 'workspace-write']).default('workspace-write')),
+    sandboxProxy: vol(z.string().default('')),
+    sandboxLoopback: vol(z.union(['exempt', 'off']).default('exempt')),
     // 0.1.7: the rules document lives on this entry as a volatile whole-object
     // field (a second settings namespace is no longer projectable). Unconfigured
     // (bare defaults) -> the rules file remains the source.
-    rules: RulesSchema.volatile(),
+    rules: vol(RulesSchema),
     // Hot reload (Phase 3)
     watch: z.boolean().default(false),
     watchDebounceMs: z.number().min(50).max(5000).default(300),
@@ -217,7 +241,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'autoAllowTools',
+    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/engine.js

@@ -9,57 +9,15 @@
  * Strictly fail-closed: P0 wins over every later stage.
  */
 import { isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
-// SHELL_TOOLS 是**值的导入**：这份名单必须与 evaluate.ts / runtime.ts 共用同一个
-// 事实源。此处曾经自带一份 `/(?:bash|pwsh|sh|cmd)$/` 正则，漏掉了 `shell` /
-// `terminal` / `powershell`——于是 P0 的 shell 检查对 DSH 的**主 shell 工具**
-// 完全失效（实测：同一句 `echo x > /etc/passwd`，bash 被拦截，shell 放行）。
-// 同名事实的第二份副本必然腐烂，这里不再保留副本。
-import { SHELL_TOOLS } from './evaluate.js';
-import { isForceDeletion, isRecursiveDeletion, decomposeShellCommand } from './shell.js';
+import { commandIrreversibleReason, irreversibleReason } from './irreversible.js';
+import { executableVariants, normalizeCommandText } from './command-normalize.js';
+// 工具名名单归 `tool-names.ts` 所有（不得在此处再抄一份）。P0 **不看工具名白名单**：
+// 它看 `executableCommandOf`——已知非执行器（read/write/内部工具）的 `command` 参数是数据，
+// 其余任何带命令串的调用都按命令对待，所以工具叫什么（包括模型打错的 `pash`）都不是绕过面。
+import { INTERNAL_TOOLS, READ_TOOLS, executableCommandOf } from './tool-names.js';
+import { decomposeShellCommand } from './shell.js';
 import { dispatchCommand } from './command-dispatcher.js';
 const DESTRUCTIVE_TOOL = /(?:^|[_-])(?:delete|remove|rm|destroy|erase|purge|wipe|unlink|rmdir|reset)(?:$|[_-]|recursive)/i;
-/**
- * Read-only tools that can never modify the workspace or execute anything. P0
- * still protects sensitive path reads outside the workspace root, and the
- * deny-keyword layer still runs first, so a search whose query contains a
- * blacklisted phrase is still vetoed.
- */
-const READ_TOOLS = new Set([
-    'read', 'read_image', 'grep', 'glob', 'ls', 'lsp',
-    // Search / lookup: every one of these only READS. `web_search` and
-    // `modlens_read_image` also reach the network, but through DSH's own client
-    // rather than a subprocess — see the network note below.
-    'web_search', 'modlens_read_image',
-    'advanced_search', 'platform_search', 'free_search_test',
-    // Session-scoped reads: they disclose already-recorded state, never mutate.
-    'context_compression_retrieve', 'memory_search_graph', 'memory_expand_graph_node',
-]);
-/** DSH internal coordination / management tools — not workspace-modifying. */
-const INTERNAL_TOOLS = new Set([
-    // AgentTeams coordination
-    'agent_teams_create', 'agent_teams_add_member', 'agent_teams_remove_member',
-    'agent_teams_delete', 'agent_teams_edit_plan', 'agent_teams_reassign_task',
-    'agent_teams_claim_task', 'agent_teams_create_task', 'agent_teams_send_message',
-    'agent_teams_approve', 'agent_teams_resume',
-    // AgentTeams status reads
-    'agent_teams_status', 'agent_teams_update_task',
-    // DSH session/memory/goal/taskboard management. The memory store is the
-    // agent's own state, not the workspace: writing it is not a workspace write.
-    'conversation_search',
-    'memory_add', 'memory_delete', 'memory_read_scene', 'memory_search',
-    'memory_import', 'memory_ruminate', 'memory_ruminate_cancel', 'memory_ruminate_status',
-    'get_goal', 'update_goal', 'create_goal',
-    'taskboard_get', 'taskboard_list', 'taskboard_claim', 'taskboard_block',
-    'taskboard_comment', 'taskboard_release_claim', 'taskboard_submit_review',
-    'taskboard_relate',
-    // Job/agent management
-    'job_list', 'job_output', 'job_kill',
-    'list_agents', 'interrupt_agent', 'send_message',
-    // Session-local UI / plan / todo state (no workspace write, no execution)
-    'todo_write', 'render_ui', 'validate_dsh_ui', 'ask_user_question', 'exit_plan_mode',
-    // Background / planning delegation (the delegated work is gated separately)
-    'subagent', 'subagent_fork', 'ralph', 'workflow', 'skill',
-]);
 /** No user-configured extra auto-allow names. */
 const NO_EXTRA_AUTO_ALLOW = new Set();
 /** The built-in read-only / internal classification, for diagnostics and docs. */
@@ -102,9 +60,41 @@ function operationText(args, depth = 0) {
     }
     return parts.join(' ');
 }
+/**
+ * Credential or private-key material a call carries.
+ *
+ * Two clauses were removed on purpose, both because this predicate reads one flat
+ * string and therefore cannot tell *using* a secret from *moving* one — and P0 is
+ * the layer nobody can appeal:
+ *
+ * - `Bearer <token>`: putting a token in its own `Authorization` header is how every
+ *   API is called. The benign-encoding corpus measured it as a false hard-deny
+ *   (`curl -H "Authorization: Bearer …" https://api.internal/v1/me`); a command that
+ *   cannot be shown to anyone is also a command that never reaches the popup.
+ * - a read-only look at a key file: `Test-Path ~/.ssh/id_rsa` moves nothing. The
+ *   plan's own grading rule says so ("reading a local credential is not itself the
+ *   act"), and the deny layer must not contradict the prompt it hands the model.
+ *
+ * What is left is the theft shape: a secret *artifact* plus a channel out, or any
+ * non-readonly verb touching one. That pairing lives in `irreversible.ts`, so both
+ * layers agree.
+ */
+const CREDENTIAL_MATERIAL = /(?:BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i;
+/** Verbs that only look. A call made of nothing else cannot have leaked anything. */
+const READ_ONLY_HEAD = /^(?:test-path|test|ls|dir|get-childitem|get-content|get-item|cat|type|more|head|tail|stat|file|select-string|where|which|exists)$/i;
+/** Whether every segment of this command text is a read-only look. */
+function readonlyProbe(text) {
+    const segments = text.split(/[;&|\n]+/).map((s) => s.trim()).filter((s) => s !== '');
+    if (segments.length === 0)
+        return false;
+    return segments.every((seg) => {
+        const head = (seg.replace(/^["'`]+/, '').split(/[\s/]+/)[0] ?? '').toLowerCase();
+        return READ_ONLY_HEAD.test(head);
+    });
+}
 function containsCredentialMaterial(args) {
-    return /(?:BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|Bearer\s+[A-Za-z0-9._~+\/-]{8,}|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i
-        .test(operationText(args));
+    const text = operationText(args);
+    return CREDENTIAL_MATERIAL.test(text) && !readonlyProbe(text);
 }
 function pathArgument(args) {
     for (const key of ['file_path', 'path', 'cwd', 'workdir']) {
@@ -116,6 +106,14 @@ function pathArgument(args) {
 }
 /** 廉价前缀过滤：绝大多数 shell 调用不是 push，先过一遍正则再动用解析器。 */
 const GIT_PUSH_TEXT = /\bgit\s+push\b/;
+/**
+ * Irreversibility itself is **not** defined here: it lives in `irreversible.ts`,
+ * shared with the tier grading in `ask-context.ts`. Two copies of that fact drift,
+ * and the drift was observed — `Optimize-VHD` was known to no rule while no graded
+ * model hard-denied it either. P0 consumes the shared judgement, and only ever
+ * turns it into a deny for the command as received plus the decoded variants the
+ * original will actually execute.
+ */
 /**
  * 远端历史改写：`git push` 强制覆盖或删除**保护分支**。
  *
@@ -158,23 +156,45 @@ export function hardDenyReason(ctx) {
     const args = ctx.args;
     if (containsCredentialMaterial(args))
         return 'call contains credential or private-key material';
-    if (SHELL_TOOLS.has(ctx.tool) && typeof args.command === 'string') {
+    // **Shape, not a name whitelist** (see tool-names.ts): a call that carries a
+    // command string and is not a known non-executor is a command call whatever the
+    // tool is called, or an unfamiliar name would skip P0 with `diskpart /s x.txt`
+    // sitting right there in `args`.
+    const commandText = executableCommandOf(ctx.tool, args);
+    if (commandText !== undefined) {
+        // Encoded layers are resolved **first**: `-EncodedCommand` hides the act from
+        // every word-boundary rule below, and the visible shell form can itself be
+        // undecodable to the parser (unbalanced quotes), whose early exit must not
+        // also skip this check. Only variants the original hands to an execution
+        // primitive are trusted, and they can only ever add a deny — nothing here
+        // widens, and no decoded text is written back to the call or the log.
+        let decodedReason;
+        for (const variant of executableVariants(normalizeCommandText(commandText))) {
+            const hidden = irreversibleReason(variant);
+            if (hidden !== undefined) {
+                decodedReason = `${hidden} (decoded from an encoded layer)`;
+                break;
+            }
+        }
         let commands = [];
         try {
-            commands = decomposeShellCommand(args.command).commands;
+            commands = decomposeShellCommand(commandText).commands;
         }
         catch {
-            return undefined; // undecidable syntax -> route to ask (P4), never allow
+            // Undecidable syntax routes to ask (P4), never allow — unless a decode
+            // already proved an irreversible act.
+            return decodedReason;
         }
         for (const cmd of commands) {
-            if (cmd.command === 'rm' && (isRecursiveDeletion(cmd) || isForceDeletion(cmd))) {
-                // Guarded further by path rules; root-level deletion denied below only
-                // when the explicit target is a protected root.
-            }
             const redir = cmd.redirects.find((r) => isProtectedDestructiveTarget(r, ctx.dshHome));
             if (redir !== undefined)
                 return `shell redirect targets protected path: ${redir}`;
+            const wipe = commandIrreversibleReason(cmd);
+            if (wipe !== undefined)
+                return wipe;
         }
+        if (decodedReason !== undefined)
+            return decodedReason;
         const rewrite = gitRemoteRewriteReason(commands);
         if (rewrite !== undefined)
             return rewrite;

package/lib/evaluate.d.ts

@@ -32,6 +32,11 @@ export interface Decision {
  * command-content inspection below for the primary tool — every `git push`,
  * `chmod`, redirect and `tee` would fall through to `defaultAction`.
  */
+/**
+ * Executor names, re-exported for the rule layer's `tools` dimension and for
+ * learning/appcontainer consumers. The list itself lives in `tool-names.ts` so the
+ * "is this an executed command?" question has one answer in the codebase.
+ */
 export declare const SHELL_TOOLS: Set<string>;
 /** Whether one compiled rule matches the given call context. */
 export declare function ruleMatches(rule: CompiledRuleEntry, ctx: ToolCallContext, commands: readonly SimpleCommand[], pathCands: readonly string[], urlCands: readonly string[]): boolean;

package/lib/evaluate.js

@@ -8,6 +8,7 @@ import { extractPathCandidates, extractUrlCandidates, } from './rule.js';
 import { commandArgv, decomposeShellCommand, isForceDeletion, isRecursiveDeletion } from './shell.js';
 import { compileCidr, compilePortSpec, compileDomainPattern } from './compiler.js';
 import { dispatchCommand } from './command-dispatcher.js';
+import { SHELL_TOOLS as IMPORTED_SHELL_TOOLS, WRITE_TOOLS as IMPORTED_WRITE_TOOLS, executableCommandOf, } from './tool-names.js';
 /**
  * Tool names that execute a shell command string. `shell` and `terminal` are
  * DSH's own names (the shipped tool roster uses `shell`; `terminal` is the
@@ -16,7 +17,12 @@ import { dispatchCommand } from './command-dispatcher.js';
  * command-content inspection below for the primary tool — every `git push`,
  * `chmod`, redirect and `tee` would fall through to `defaultAction`.
  */
-export const SHELL_TOOLS = new Set(['shell', 'terminal', 'bash', 'pwsh', 'sh', 'cmd', 'powershell']);
+/**
+ * Executor names, re-exported for the rule layer's `tools` dimension and for
+ * learning/appcontainer consumers. The list itself lives in `tool-names.ts` so the
+ * "is this an executed command?" question has one answer in the codebase.
+ */
+export const SHELL_TOOLS = IMPORTED_SHELL_TOOLS;
 /** Whether one compiled rule matches the given call context. */
 export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     if (!rule.enabled)
@@ -99,9 +105,14 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
         // Join the FULL argv of each simple command: `c.command` alone is just the
         // command word, so `curl https://x | sh` would read as `curl|sh` and the
         // documented `curl|sh` pattern could never see its own subject.
-        const pipelineText = commands.map((c) => commandArgv(c)).join('|');
+        const argvs = commands.map((c) => commandArgv(c));
+        const pipelineText = argvs.join('|');
         const compiled = rule.argv.pipeline.map((p) => compileGlobForMatch(p));
-        if (!compiled.some((g) => g.test(pipelineText)))
+        // Match per simple command as well as over the joined pipeline: anchored
+        // prefix patterns (`git reset --hard*`) must see each segment on its own —
+        // `cd x && git reset --hard` hides the guarded segment behind the join —
+        // while cross-segment patterns (`curl|sh`) still read the joined string.
+        if (!compiled.some((g) => g.test(pipelineText) || argvs.some((s) => g.test(s))))
             return false;
     }
     // network dimension: all present sub-dimensions must match.
@@ -118,7 +129,7 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     }
     return true;
 }
-const WRITE_TOOLS = new Set(['write', 'edit']);
+const WRITE_TOOLS = IMPORTED_WRITE_TOOLS;
 /**
  * Shell write/execution patterns. When NONE of these match, the command is
  * treated as read-only and follows the defaultAction (typically `allow`).
@@ -172,11 +183,9 @@ function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
         return defaultAction;
     }
     // shell/pwsh/terminal: command-content-aware (write pattern → ask)
-    if (SHELL_TOOLS.has(ctx.tool)) {
-        const commandText = commandTextOf(ctx);
-        if (commandText !== undefined && isWriteCommand(commandText))
-            return 'ask';
-    }
+    const commandText = commandTextOf(ctx);
+    if (commandText !== undefined && isWriteCommand(commandText))
+        return 'ask';
     return defaultAction;
 }
 /**
@@ -189,12 +198,14 @@ function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
 function commandTextOf(ctx) {
     if (typeof ctx.commandText === 'string')
         return ctx.commandText;
-    const raw = ctx.args?.['command'];
-    return typeof raw === 'string' ? raw : undefined;
+    return executableCommandOf(ctx.tool, ctx.args);
 }
 /** Compute the deterministic first-match decision (P2 chain). */
 export function decideRules(ruleset, ctx) {
-    const shellText = SHELL_TOOLS.has(ctx.tool) ? commandTextOf(ctx) : undefined;
+    // Command-bearing calls are decomposed by **shape**, not by whether the tool's
+    // name is in SHELL_TOOLS: an unfamiliar executor name must not make the command
+    // dimensions of every rule silently stop matching.
+    const shellText = commandTextOf(ctx);
     const commands = shellText !== undefined ? decomposeSafe(shellText) : [];
     const pathCands = extractPathCandidates(ctx.args);
     const urlCands = extractUrlCandidates(ctx.args);
@@ -213,7 +224,7 @@ export function decideRules(ruleset, ctx) {
     // shell/pwsh/terminal tools check the command for write patterns.
     // Outside safety checks → ask; inside or read-only → defaultAction.
     let action = ruleset.defaultAction;
-    if (WRITE_TOOLS.has(ctx.tool) || SHELL_TOOLS.has(ctx.tool)) {
+    if (WRITE_TOOLS.has(ctx.tool) || shellText !== undefined) {
         action = pathAndCommandDefault(ctx, pathCands, action);
     }
     if (action === 'allow' || action === 'ask') {

package/lib/events.d.ts

@@ -32,6 +32,27 @@ export interface GateEvent {
     readonly learningCount?: number;
     /** Confirmations required before that key auto-allows (manual-approve events). */
     readonly threshold?: number;
+    /**
+     * Salted digest of the redacted input behind this decision.
+     *
+     * Lives as its own field rather than riding in `reason`, because `reason` is
+     * truncated to REASON_MAX on write — attribution data must not be the part
+     * that gets cut. Raw arguments are never stored.
+     */
+    readonly inputDigest?: string;
+    /** Which grading prompt produced this verdict, so wording changes are traceable. */
+    readonly promptVersion?: string;
+    /** Machine keys of "why this asked", so the panel can localize them later. */
+    readonly doubtKinds?: readonly string[];
+    /**
+     * The card the human actually decided from (why it asks / what it touches / what
+     * each button costs). Stored because a review list that shows only the audit
+     * `reason` cannot be read back: the person sees `no rule matched` where they
+     * once read a full explanation.
+     */
+    readonly humanBrief?: string;
+    /** The redacted command, stored apart from the prose so a list can render it as code. */
+    readonly humanCommand?: string;
 }
 export interface GateEventInput {
     readonly sessionId?: string;
@@ -46,6 +67,11 @@ export interface GateEventInput {
     readonly files?: readonly string[];
     readonly learningCount?: number;
     readonly threshold?: number;
+    readonly inputDigest?: string;
+    readonly promptVersion?: string;
+    readonly doubtKinds?: readonly string[];
+    readonly humanBrief?: string;
+    readonly humanCommand?: string;
     /** Session working directory, used to resolve relative snapshot paths. */
     readonly baseDir?: string;
 }

package/lib/events.js

@@ -264,6 +264,13 @@ export class EventLog {
                 ...(files === undefined ? {} : { files }),
                 ...(input.learningCount === undefined ? {} : { learningCount: input.learningCount }),
                 ...(input.threshold === undefined ? {} : { threshold: input.threshold }),
+                ...(input.inputDigest === undefined ? {} : { inputDigest: input.inputDigest }),
+                ...(input.promptVersion === undefined ? {} : { promptVersion: input.promptVersion }),
+                ...(input.doubtKinds === undefined || input.doubtKinds.length === 0 ? {} : { doubtKinds: input.doubtKinds.slice(0, 4) }),
+                // Bounded: this is a card, not a transcript, and the event file is read back
+                // into a UI list where a long entry pushes the rest off screen.
+                ...(input.humanBrief === undefined ? {} : { humanBrief: String(input.humanBrief).slice(0, 600) }),
+                ...(input.humanCommand === undefined || input.humanCommand === '' ? {} : { humanCommand: String(input.humanCommand).slice(0, 400) }),
             };
             mkdirSync(dirname(this.filePath), { recursive: true });
             appendFileSync(this.filePath, JSON.stringify(ev) + '\n', 'utf8');

package/lib/grader-rules.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The grading rules shared by every grader in this plugin.
+ *
+ * `classifier.ts` and `risk.ts` are two protocols over the same transport, and
+ * their rule text was duplicated between them with different wording — one said
+ * "clearly safe" and "exfiltration-adjacent", the other carried the reversible
+ * exclusion list. A call could therefore be graded against two different
+ * standards depending on which path asked, which is how a local read
+ * (`cat .env`) ends up denied by one grader and allowed by the other.
+ *
+ * This module holds the rules once. Both protocols prepend their own output
+ * shape (three-way verdict vs safe/risky + category) and append these.
+ *
+ * It stays dependency-free so it can be imported from either half.
+ */
+/**
+ * The substantive grading rules, in the order both graders should present them.
+ *
+ * Kept deliberately terse and measured: grading latency is prefill-dominated, and
+ * the first draft of these rules cost +42ms of p50 (gate: <= +20ms). What the
+ * runtime now enforces deterministically is not repeated here — the opaque-payload
+ * veto in `runtime.ts` refuses `safe` even when the grader grants it, so prose
+ * begging the model not to guess safe would only cost tokens. Rules below stay
+ * only where they change a judgement the code cannot make.
+ *
+ * Redundant restatements were merged once the whole prompt was re-measured at
+ * +36ms: the deletion list is one line instead of four, the read-only remote rule
+ * is one line instead of three. Same judgements, fewer tokens to read.
+ */
+export declare const GRADER_RULES: readonly string[];
+/** Join the shared rules into prompt text. */
+export declare function graderRulesText(): string;

package/lib/grader-rules.js

@@ -0,0 +1,48 @@
+/**
+ * The grading rules shared by every grader in this plugin.
+ *
+ * `classifier.ts` and `risk.ts` are two protocols over the same transport, and
+ * their rule text was duplicated between them with different wording — one said
+ * "clearly safe" and "exfiltration-adjacent", the other carried the reversible
+ * exclusion list. A call could therefore be graded against two different
+ * standards depending on which path asked, which is how a local read
+ * (`cat .env`) ends up denied by one grader and allowed by the other.
+ *
+ * This module holds the rules once. Both protocols prepend their own output
+ * shape (three-way verdict vs safe/risky + category) and append these.
+ *
+ * It stays dependency-free so it can be imported from either half.
+ */
+/**
+ * The substantive grading rules, in the order both graders should present them.
+ *
+ * Kept deliberately terse and measured: grading latency is prefill-dominated, and
+ * the first draft of these rules cost +42ms of p50 (gate: <= +20ms). What the
+ * runtime now enforces deterministically is not repeated here — the opaque-payload
+ * veto in `runtime.ts` refuses `safe` even when the grader grants it, so prose
+ * begging the model not to guess safe would only cost tokens. Rules below stay
+ * only where they change a judgement the code cannot make.
+ *
+ * Redundant restatements were merged once the whole prompt was re-measured at
+ * +36ms: the deletion list is one line instead of four, the read-only remote rule
+ * is one line instead of three. Same judgements, fewer tokens to read.
+ */
+export const GRADER_RULES = [
+    'Rules:',
+    '- safe is only for reversible, in-scope operations that touch no sensitive resource.',
+    '- When unsure between safe and neutral, answer neutral; never guess safe.',
+    '- Judge the operation content, not merely its location.',
+    '- "inside the workspace" is judged against workspace_root; if it is absent, treat the scope as unknown, not as inside.',
+    '- An encoded or unreadable payload is unknown, not proven safe.',
+    '',
+    'DELETION exclusion rules (these override the deletion category):',
+    '- Cleanup of temporary files, build outputs, session-local artifacts, or failed clone directories is SAFE even via rm/rmdir/Remove-Item — temp paths ("temp", "tmp", "test-clone"), and node_modules, .next, __pycache__, .pytest_cache, .cache, .git, dist, build are always regenerable.',
+    '- Only flag as deletion when the target is: (a) user data with no backup, (b) configuration files, (c) database records, (d) files outside the workspace that were not created by this session, or (e) a destructive rm -rf on a directory containing unique, irreplaceable content.',
+    '',
+    'READ-ONLY remote operations are safe: git fetch, git pull, git clone, git log, git diff, git status, git show, npm install (read-only), pip install (read-only), apt-get update, curl/wget (read, no write flag). Only flag as remote when the operation WRITES, DEPLOYS, PUSHES, or DELETES on the remote side.',
+    '- Reading a local credential is not itself the act; flag it only when its content leaves this machine.',
+];
+/** Join the shared rules into prompt text. */
+export function graderRulesText() {
+    return GRADER_RULES.join('\n');
+}

package/lib/index.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { SandboxController } from './appcontainer/index.js';
 import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
+import { mergePresetIntoRaw } from './preset-rules.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
 // T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
@@ -206,6 +207,25 @@ export function apply(ctx, config = {}) {
     // the ref unset and the runtime falls back to its rules-file write paths.
     const ENTRY_ID = 'dsh-perm-gate';
     const settingsRef = {};
+    // 预设拒绝表播种：一次性、只走宿主设置面（写回落进 profile patch 的本插件
+    // config 条目）。刻意不再写插件自有的 `perm-gate/rules.yml` —— 那是用户手维护的
+    // 规则源，混进 51 条预设会让「我的规则」与「插件注入的规则」不可区分。
+    // 两条经实测定下的约束：① 必须在各分支「注册完成之后」调（0.1.5 上 ns 要等
+    // installSection 才注册，提前写报 `settings namespace ... is not registered`）；
+    // ② 规则与幂等位必须合成一次 update（拆两次时 0.1.7 第二次报 `Plugin entry ... is
+    // no longer configurable`，幂等位永远落不下去 ⇒ 用户全删后会被重新塞回）。
+    // 写失败不阻断启动也不置幂等位 ⇒ 下次激活重试。
+    const seedPresetDenyTable = (svc) => {
+        void (async () => {
+            if (current().presetRulesSeeded === true)
+                return;
+            const merged = mergePresetIntoRaw(readVolatileValue(config.rules));
+            await svc.update(ENTRY_ID, { rules: merged.doc, presetRulesSeeded: true });
+            console.log(`[dsh-perm-gate] preset deny table seeded via settings (+${merged.added} rules)`);
+        })().catch((e) => {
+            console.warn('[dsh-perm-gate] preset deny table 播种失败（不阻断启动，下次激活重试）:', e);
+        });
+    };
     ctx.inject(['settings'], (child) => {
         const svc = child.settings;
         settingsRef.svc = svc;
@@ -253,6 +273,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
             return;
         }
         void (async () => {
@@ -279,6 +300,7 @@ export function apply(ctx, config = {}) {
                             console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                         });
                     }
+                    seedPresetDenyTable(svc);
                     return;
                 }
             }
@@ -306,6 +328,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] rules seed write failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
         })();
     });
     const settingsWrite = (write) => {
@@ -326,6 +349,7 @@ export function apply(ctx, config = {}) {
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
     const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    // 预设拒绝表的播种在上面的 settings inject 回调里（那里才有 svc）。
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel
@@ -396,6 +420,11 @@ export function apply(ctx, config = {}) {
                     toolName: req.toolName,
                     ...(req.callId !== undefined ? { callId: req.callId } : {}),
                     reason: req.reason,
+                    // Host-sanctioned presentation field (`ApprovalRequestEvent.displayReason`):
+                    // read by the answerer UI, deliberately not written to the audit pair. The
+                    // service persists only id/toolName/callId/reason, so forwarding it costs
+                    // nothing on hosts that ignore it.
+                    ...(req.displayReason !== undefined ? { displayReason: req.displayReason } : {}),
                     ...(req.signal !== undefined ? { signal: req.signal } : {}),
                 });
                 return APPROVAL_OUTCOMES.has(String(outcome))