dsh-perm-gate 5.1.2-compat.7 → 5.2.0

package/lib/irreversible.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The single definition of "this act cannot be undone".
+ *
+ * Irreversibility was previously encoded twice — once as P0's wipe-utility list
+ * in `engine.ts`, once as the `I` tier grading in `ask-context.ts`. Two copies of
+ * one fact drift: the tier could call something irreversible while the deny layer
+ * had never heard of it (exactly the state `Optimize-VHD` was in: no rule knew it,
+ * no graded model hard-denied it). This module owns the knowledge; P0 uses it to
+ * deny and the context uses it to label, so they cannot disagree.
+ *
+ * Shape constraint that keeps the sharing safe: every function here returns
+ * `string | undefined` — a reason or "not mine to decide". It is structurally
+ * incapable of producing an allow, so importing it cannot widen the gate.
+ *
+ * Callers that deny must pass only deterministic input: the command as received
+ * plus **executed** decoded variants (`command-normalize.ts`), never a blob that
+ * merely happens to decode to something alarming.
+ */
+import type { SimpleCommand } from './shell.js';
+/** Storage-wipe utilities with no benign reading worth preserving. */
+export declare const WIPE_UTILITIES: ReadonlySet<string>;
+/**
+ * Why one piece of text is irreversible, or undefined when it is not.
+ *
+ * `executed` gates the credential rule: a path quoted inside a commit message is
+ * not a secret leaving the machine, while the same text run through `curl` is.
+ *
+ * `program` says the caller already knows the executable (it came from the shell
+ * parser). When it is given, that name — not a position guess over text whose
+ * quotes were stripped — decides which program is running, and `inline` carries
+ * the script bodies of an interpreter (`bash -c "…"`), which really are nested
+ * command lines and are still scanned by position.
+ */
+export declare function irreversibleReason(text: string, opts?: {
+    readonly executed?: boolean;
+    readonly program?: string;
+    readonly inline?: readonly string[];
+    readonly extraPrograms?: readonly string[];
+}): string | undefined;
+export declare function commandIrreversibleReason(cmd: SimpleCommand): string | undefined;
+/**
+ * Unrecoverable acts that are **not** P0 material: the call must be asked and
+ * must never be cleared automatically or learned away, but the human keeps the
+ * decision. Returns a reason or "not mine to decide" — the same shape constraint
+ * as {@link irreversibleReason}, so no caller can turn it into an allow.
+ *
+ * Two families qualify. `docker volume rm` destroys data for good yet is routine
+ * maintenance, so an unappealable deny is the wrong layer. The two exfil shapes
+ * below are only *invisible to the per-segment deny layer* (a pipeline splits the
+ * secret from the upload), which the whole-call view can see — and because the
+ * same words in a commit message are ordinary text, they earn a permanent ask
+ * rather than a permanent refusal.
+ */
+export declare function neverClearReason(text: string): string | undefined;

package/lib/irreversible.js

@@ -0,0 +1,376 @@
+/** Storage-wipe utilities with no benign reading worth preserving. */
+export const WIPE_UTILITIES = new Set([
+    'diskpart', 'optimize-vhd', 'clear-disk', 'initialize-disk', 'set-disk',
+    'remove-vhd', 'mount-disk', 'mkfs', 'fdisk', 'sdelete',
+]);
+const RECURSE_FLAG = /-(?:Recurse|rf|fr|r)\b/i;
+const FORCE_FLAG = /-(?:Force|rf|fr|f)\b/i;
+/** Command-initial position: string start, a separator, or just after a quote/paren. `{1,}` so two-letter programs (`rm`, `dd`) qualify. */
+const PROGRAM_POSITION = /(?:^|[;&|\n]|&&|\|\||["'(])\s*["']?\s*([A-Za-z][A-Za-z0-9_-]{1,})/g;
+/** Bare drive root `C:\`, `d:/`, and the JSON-escaped doubles. */
+const DRIVE_ROOT = /^[a-z]:[\\/]{0,2}$/i;
+const FS_ROOT = /^\/+$/;
+const WIN_SYSTEM = /^([a-z]:[\\/]{1,2})?(Windows|WinSxS|System32|Program Files(?: \(x86\))?)([\\/].*)?$/i;
+const WIN_USERS = /^([a-z]:[\\/]{1,2}|[\\/])?Users([\\/][^\\/]+([\\/](Documents|Desktop|Downloads))?)?[\\/]*$/i;
+const NIX_SYSTEM = /^\/{1,2}(?:etc|usr|var|opt|home|root|bin|sbin|boot|srv)(?:\/{1,2}.*)?$/i;
+/**
+ * The same Windows roots with separators removed.
+ *
+ * `decomposeShellCommand` strips `\` from unquoted arguments before any rule
+ * runs, so `Remove-Item -Recurse -Force C:\Windows\System32` reaches this module
+ * as the token `C:WindowsSystem32`. A rule that demands a separator therefore
+ * misses the most common Windows wipe in real traffic (measured, not assumed).
+ * The flattened form is only accepted when it starts with a drive letter: that
+ * keeps `Remove-Item -Recurse -Force users` (a directory in the repo) out while
+ * `C:\Users` still qualifies. The tail class excludes `.` and `_` so a file name
+ * like `windows_setup.iso` / `windows11.iso` cannot read as a root.
+ */
+const FLAT_DRIVE_ROOT = /^[a-z]:(?:windows|winsxs|system32|syswow64|programfiles(?:\(x86\))?|users|perflogs|recovery|boot)(?:[a-z0-9 ()+-]*)$/i;
+/**
+ * Destructive argument shapes, only meaningful next to their program.
+ *
+ * Nothing here is a free-text pattern. An earlier version matched a word
+ * alternation over the whole command, which hard-denied
+ * `git commit -m "fix diskpart handling"` — P0 is not appealable, so a name that
+ * merely *appears* in someone's message must never trigger it. Every rule below
+ * requires the program to sit at a command position first, and treats the rest as
+ * that program's arguments.
+ */
+const SHADOW_DELETE = /\bdelete\s+shadows\b/i;
+const CIPHER_WIPE = /[\s/"'-]w[:\s"]/i;
+const DRIVE_FORMAT = /\s[a-z]:\b/i;
+const RAW_DEVICE_WRITE = /\bof=\/dev\//i;
+/**
+ * Destructive SQL, but only as an argument of a database client.
+ *
+ * The phrase alone is not enough: it also appears in commit messages, docs and
+ * migration filenames, and P0 cannot be appealed. Requiring `psql`/`mysql`/… at a
+ * command position keeps `git commit -m "document the drop database incident"`
+ * allowed while `psql -c "DROP DATABASE orders_prod"` is denied.
+ *
+ * The motor shapes (`db.dropDatabase()`, `_delete_by_query`, `dropdb --force`) are
+ * measured misses: the mongo/elastic/dropdb spellings are the same act as
+ * `DROP DATABASE` and none of them was recognised, so an always-cooperative grader
+ * cleared them.
+ */
+const DB_CLIENTS = new Set([
+    'psql', 'mysql', 'mariadb', 'sqlcmd', 'sqlite3', 'mongosh', 'mongo', 'redis-cli',
+    'dropdb', 'clickhouse-client', 'obclient', 'sqsh', 'gsql', 'mongodump', 'mongorestore',
+]);
+const DESTRUCTIVE_SQL = /\b(drop\s+(?:database|table|schema)|truncate\s+table|flushall|delete\s+from\s+\w+\s*;?\s*$|db\.dropdatabase|_delete_by_query|dropdb\b)\b/i;
+/**
+ * Data-purging API calls driven through an HTTP client.
+ *
+ * `curl -X POST "http://es.prod:9200/orders/_delete_by_query"` is a table wipe
+ * with no `psql` in sight, so the client gate above cannot see it. Requiring an
+ * HTTP verb next to the endpoint name keeps it specific: a commit message or a doc
+ * that merely mentions `_delete_by_query` has no `-X POST` and stays allowed.
+ */
+const HTTP_CLIENT = new Set(['curl', 'wget', 'http', 'https', 'invoke-webrequest', 'invoke-restmethod']);
+const DESTRUCTIVE_API = /(?:_delete_by_query|_delete_by_reindex|db\.dropdatabase|\bflushall\b)/i;
+/**
+ * Registry destruction and the gate's own state, reached through a manager command.
+ *
+ * These need an argument-shape match rather than a program name alone: `docker`
+ * and `reg` are perfectly ordinary otherwise, and the gate's own state directory
+ * is the one path whose deletion cannot be undone by re-running anything — it
+ * silently un-does every decision the gate has learned.
+ */
+/** `HKLM\SYSTEM` / `HKEY_LOCAL_MACHINE\SYSTEM` (and user hives) under `reg delete`. */
+// No separator in the pattern and no trailing word boundary: the shell parser
+// strips `\` before this runs, so `HKLM\SYSTEM\CurrentControlSet\…` arrives as
+// `HKLMSYSTEMCurrentControlSet…`. A `\b` after `system` used to miss every real
+// subkey delete — which is the whole shape of the attack (`reg delete
+// HKLM\SYSTEM\…\Lsa\FipsAlgorithmPolicy /f`), while the bare `HKLM\SYSTEM` it did
+// match is not a thing anyone runs.
+const REGISTRY_DESTROY = /\breg\s+delete\b[^\n]*\b(?:hklm|hkey_local_machine|hku|hkey_users)[\\/]?system/i;
+/** Any delete verb aimed at the gate's own durable state (approvals, grants, audit). */
+const OWN_STATE_PATH = /(?:~|\$env:USERPROFILE|\\Users\\[^\\]+)\\?\/\.dsh|\.dsh[\\/]taskboard/i;
+/**
+ * Volume destruction a legitimate operator also runs on purpose.
+ *
+ * `docker volume rm` / `system prune --volumes` throw away anonymous volumes with
+ * no recovery path, yet they are routine maintenance and the eval set grades them
+ * `ask`, not `deny`. So they get the **deterministic ask that never learns**
+ * instead of P0: no model can clear them and no run of confirmations can sediment
+ * them, but a human always gets to decide. P0 would be unappealable, which for a
+ * command people run weekly is the wrong layer (`engine.ts` deny = no appeal).
+ */
+const VOLUME_DESTROY = /\bdocker\s+volume\s+rm\b|\bdocker\s+system\s+prune\b[^\n]*--volumes|\bdocker\s+compose\s+down\b[^\n]*(?:^|\s)-v(?=\s|$)|\bdocker\s+rm\b[^\n]*(?:^|\s)-v(?=\s|$)/i;
+/** Programs that start a command here: string start, after a separator, or after an opening quote. */
+function programsIn(text) {
+    const names = [];
+    for (const seg of segments(text)) {
+        PROGRAM_POSITION.lastIndex = 0;
+        let m = PROGRAM_POSITION.exec(seg);
+        while (m !== null) {
+            const name = (m[1] ?? '').toLowerCase().replace(/\.exe$/, '');
+            if (name !== '')
+                names.push(name);
+            m = PROGRAM_POSITION.exec(seg);
+        }
+    }
+    return names;
+}
+/**
+ * Concrete credential material, paired with an outbound channel = the secret is
+ * gone.
+ *
+ * Deliberately specific. This predicate now feeds P0, which cannot be appealed,
+ * so a loose term like a bare `credential` would hard-deny ordinary work (a
+ * commit message about a credential helper, a doc with a URL in it) — the exact
+ * over-block this plugin has already recorded twice. Only artifacts that are
+ * secrets in themselves qualify.
+ */
+const SECRET_SOURCE = /(?:\bid_(?:rsa|ed25519|ecdsa|dsa)\b|\.ssh[\\/]|\.npmrc\b|\.netrc\b|\.git-credentials\b|[\\/"]\.env\b|cookies?\.db\b|User Data[^\s"]*Cookies|aws_secret_access_key|BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|credential\.(?:helper|store)\b)/i;
+const OUTBOUND = /(?:\bcurl\b|\bwget\b|Invoke-WebRequest|Invoke-RestMethod|\bscp\b|\brsync\b|\bnc\b\b|ncat|pastebin\.com|webhook\.site|requestbin|\bterraform\s+destroy\b|\bnpm\s+publish\b|https?:\/\/[^\s"']+)/i;
+/**
+ * A dot-env file named bare, and a verb that puts file contents on stdout.
+ *
+ * `adv_047` (`Get-Content .env -Raw | … | curl -d @- https://pastebin…`) reads the
+ * secret as a bare ` .env` token, which the path-shaped deny list above cannot
+ * see, and the pipeline splits it into segments so no segment carries both halves.
+ * That is handled at the *ask* level, never as P0: `git commit -m "fix .env
+ * loading, see https://docs.example"` mentions a file and a URL in one message and
+ * must stay allowed, since P0 cannot be appealed.
+ */
+const BARE_ENV_FILE = /(?:^|[\s"'`(/])\.env(?![.\w])/i;
+const SECRET_READER = /\b(?:get-content|cat|type|more|head|tail|base64|openssl|tar|zip|dd)\b/i;
+/**
+ * Secret material the deny list does not carry, and the channels that push it out.
+ *
+ * Measured misses, all of them real eval cases: `gh auth token | curl -d @- …`,
+ * `scp -r ~/.dsh host:/tmp/exfil`, `tar czf - ~/.dsh | nc …`, and the Chrome
+ * cookie DB. The gate's own state directory counts as a secret because it holds
+ * the audit trail and every learned approval — uploading it leaks the whole
+ * decision history in one shot.
+ *
+ * Deliberately **ask-level, not P0**: the same words in a commit message are
+ * ordinary text, and a bare `https://` is in most benign commands, so the channel
+ * has to be an actual upload verb rather than any URL.
+ */
+const OTHER_SECRET_SOURCE = /(?:\bgh\s+auth\s+token\b|\bprintenv\b|\.dsh\b|user data[^\n]{0,40}cookies?\b|\baws\s+configure\s+get\b)/i;
+const UPLOAD_CHANNEL = /\bscp\b|\brsync\b|\bnc\b|\bncat\b|webhook\.site|pastebin\.com|requestbin|curl\s+[^\n]*(?:-t\b|--data|-d\s+@|--upload|-x\s+post)|invoke-webrequest[^\n]*-method\s+post/i;
+/**
+ * Secret material copied into a staging location. No network involved, and the
+ * consequence is the same: `Copy-Item "…\Chrome\User Data\Default\Cookies" C:\temp\c.db`
+ * puts a browser session store somewhere any local process (or any later upload)
+ * can read. Ask-level: the same verb over ordinary files is everyday work.
+ */
+const COPY_VERB = /\b(?:copy-item|xcopy|copy|cp)\b/i;
+const STAGING_DIR = /(?:temp|tmp|public|inetpub|wwwroot|downloads|shares?)/i;
+/** Sweep the machine for keys, write the hits out, upload them (`adv_049`). */
+const SECRET_HARVEST = /\b(?:grep|rg|findstr|select-string)\b[^\n]*sk-[^\n]*\b(?:curl|wget|scp|rsync|nc|ncat|Invoke-WebRequest|Invoke-RestMethod)\b/i;
+/**
+ * A function body that wipes, invoked with an argument (`adv_014`).
+ *
+ * `function scrub($p){ Remove-Item -Recurse -Force $p }; scrub "C:\Windows"` is a
+ * real wipe whose target only materialises at runtime. Nothing static can name
+ * the consequence, so the shape is marked never-clear — the honest outcome for an
+ * unreadable indirection is a permanent ask, not a guessed `safe`.
+ */
+const WIPE_IN_BODY = /\b(?:function|filter)\s+[\w-]+\s*\([^)]*\)\s*\{[^}]*(?:remove-item|\brm\b|\bdel\b|rmdir)[^}]*-(?:recurse|force|rf|fr|s)\b/i;
+/** A target whose wipe cannot be undone. */
+function isRootish(token) {
+    const t = token.trim();
+    if (t === '')
+        return false;
+    if (t === '--no-preserve-root' || t.endsWith('--no-preserve-root'))
+        return true;
+    return DRIVE_ROOT.test(t) || FS_ROOT.test(t) || WIN_SYSTEM.test(t) || WIN_USERS.test(t) || NIX_SYSTEM.test(t)
+        || FLAT_DRIVE_ROOT.test(t.replace(/[\\/]+/g, ''));
+}
+/**
+ * Forced recursive deletion aimed at a root or system tree.
+ *
+ * Verb, flags and target are checked independently, and the verb must sit at a
+ * command position: `Remove-Item -Path C:\ -Recurse -Force` and
+ * `Remove-Item -Recurse -Force C:\` are the same act and both appear in real
+ * traffic, while `git commit -m "rm -rf /"` is a message about a command, not the
+ * command — and P0 cannot be appealed after the fact.
+ */
+function forcedDeleteOfRoot(text, programs) {
+    const deletes = programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p));
+    if (!deletes || !RECURSE_FLAG.test(text) || !FORCE_FLAG.test(text))
+        return false;
+    return text.split(/[\s"',;`]+/).some(isRootish);
+}
+/**
+ * Segments of a command line, so `git status; … ; Clear-Disk …` is judged per command.
+ *
+ * Splitting respects quotes. `Select-String -Pattern "vssadmin|cipher|diskpart"` is
+ * a *value*: cutting it at the `|` characters put `diskpart` at a segment start, the
+ * position test read it as a program, and an unappealable P0 deny came out of a
+ * search pattern (measured, and quoted arguments arrive here with their quotes
+ * already stripped, which is why the structured form below is used instead).
+ */
+function segments(text) {
+    const out = [];
+    let current = '';
+    let quote = '';
+    for (const ch of text) {
+        if (quote !== '') {
+            current += ch;
+            if (ch === quote)
+                quote = '';
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === ';' || ch === '|' || ch === '&' || ch === '\n') {
+            if (current.trim() !== '')
+                out.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    if (current.trim() !== '')
+        out.push(current.trim());
+    return out;
+}
+/**
+ * Why one piece of text is irreversible, or undefined when it is not.
+ *
+ * `executed` gates the credential rule: a path quoted inside a commit message is
+ * not a secret leaving the machine, while the same text run through `curl` is.
+ *
+ * `program` says the caller already knows the executable (it came from the shell
+ * parser). When it is given, that name — not a position guess over text whose
+ * quotes were stripped — decides which program is running, and `inline` carries
+ * the script bodies of an interpreter (`bash -c "…"`), which really are nested
+ * command lines and are still scanned by position.
+ */
+export function irreversibleReason(text, opts = {}) {
+    if (typeof text !== 'string' || text.trim() === '')
+        return undefined;
+    const executed = opts.executed ?? true;
+    const programs = opts.program !== undefined
+        ? [
+            opts.program.toLowerCase().replace(/\.exe$/, ''),
+            ...(opts.extraPrograms ?? []),
+            ...((opts.inline ?? []).flatMap((body) => programsIn(body))),
+        ]
+        : programsIn(text);
+    const isWipeProgram = (name) => programs.some((p) => p === name || p.split('.')[0] === name);
+    for (const name of programs) {
+        // `mkfs.ext4` / `mkfs.xfs` carry the filesystem suffix.
+        if (WIPE_UTILITIES.has(name) || WIPE_UTILITIES.has(name.split('.')[0] ?? '')) {
+            return `${name} performs an unrecoverable storage/volume operation`;
+        }
+    }
+    if (isWipeProgram('format') && DRIVE_FORMAT.test(text))
+        return 'format wipes a volume';
+    if (isWipeProgram('dd') && RAW_DEVICE_WRITE.test(text))
+        return 'dd overwrites a raw device';
+    if (isWipeProgram('vssadmin') && SHADOW_DELETE.test(text)) {
+        return 'vssadmin deletes all shadow copies (the last local backup, and a ransomware precursor)';
+    }
+    if (isWipeProgram('cipher') && CIPHER_WIPE.test(text)) {
+        return 'cipher /w overwrites free space, destroying any recoverable deletion';
+    }
+    if (forcedDeleteOfRoot(text, programs))
+        return 'forced recursive deletion targets a system root';
+    // Deleting the gate's own state directory is unrecoverable and disarms the gate:
+    // no recurse flag required, because the WAL/journal files are the point.
+    if (programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p)) && OWN_STATE_PATH.test(text)) {
+        return 'deletes the permission gate\u2019s own durable state (~/.dsh)';
+    }
+    if (programs.includes('reg') && REGISTRY_DESTROY.test(text))
+        return 'deletes a machine-wide registry hive';
+    if (programs.some((p) => DB_CLIENTS.has(p)) && DESTRUCTIVE_SQL.test(text)) {
+        return 'destructive SQL is sent to a database server';
+    }
+    if (programs.some((p) => HTTP_CLIENT.has(p)) && DESTRUCTIVE_API.test(text) && /(?:-x\s+post|--data|-d\s+@|-method\s+post|\bpost\b)/i.test(text)) {
+        return 'a data-purging API call is sent to a server';
+    }
+    if (executed && SECRET_SOURCE.test(text) && OUTBOUND.test(text))
+        return 'credential material is sent outside this machine';
+    return undefined;
+}
+/**
+ * Same question, asked of one decomposed command.
+ *
+ * The parser hands us the executable, so use it: everything after it is an
+ * argument *value*, and a wipe utility merely appearing inside a search pattern or
+ * a message is data, not an act. Interpreter bodies are the exception — they are
+ * nested command lines, so those (and only those) get the position scan.
+ */
+const INTERPRETERS = new Set([
+    'bash', 'sh', 'zsh', 'dash', 'cmd', 'pwsh', 'powershell', 'node', 'npx', 'deno', 'python', 'python3', 'ruby', 'perl',
+]);
+/**
+ * Programs introduced by a chain operator that survives the parser.
+ *
+ * `decomposeShellCommand` does not split `git status; … ; Clear-Disk …` — it hands
+ * back one command whose argument list contains the separators *between* elements
+ * (`status;`, then `Write-Output`, then `cleaning;`, then `Clear-Disk`). The
+ * boundary is therefore visible only between args, never inside one, which is
+ * exactly the distinction that matters: `Select-String -Pattern "vssadmin|cipher|diskpart"`
+ * keeps its `|` characters *inside a single argument* — that is a value, and
+ * reading it as a pipeline is what produced an unappealable deny for a search
+ * pattern.
+ */
+function chainedPrograms(args) {
+    const names = [];
+    for (let i = 0; i + 1 < args.length; i += 1) {
+        const tail = (args[i] ?? '').trimEnd();
+        const boundary = tail.slice(-1);
+        if (boundary !== ';' && boundary !== '|' && boundary !== '&')
+            continue;
+        const head = (args[i + 1] ?? '').trim().replace(/^["'`]+/, '').split(/\s/)[0] ?? '';
+        const name = head.toLowerCase().replace(/\.exe$/, '');
+        if (name !== '')
+            names.push(name);
+    }
+    return names;
+}
+export function commandIrreversibleReason(cmd) {
+    const name = cmd.command.toLowerCase().replace(/\.exe$/, '');
+    const inline = INTERPRETERS.has(name)
+        ? cmd.args.filter((a) => /\s/.test(a) || /[;&|]/.test(a))
+        : [];
+    return irreversibleReason([cmd.command, ...cmd.args].join(' '), {
+        program: name,
+        inline,
+        extraPrograms: chainedPrograms(cmd.args),
+    });
+}
+/**
+ * Unrecoverable acts that are **not** P0 material: the call must be asked and
+ * must never be cleared automatically or learned away, but the human keeps the
+ * decision. Returns a reason or "not mine to decide" — the same shape constraint
+ * as {@link irreversibleReason}, so no caller can turn it into an allow.
+ *
+ * Two families qualify. `docker volume rm` destroys data for good yet is routine
+ * maintenance, so an unappealable deny is the wrong layer. The two exfil shapes
+ * below are only *invisible to the per-segment deny layer* (a pipeline splits the
+ * secret from the upload), which the whole-call view can see — and because the
+ * same words in a commit message are ordinary text, they earn a permanent ask
+ * rather than a permanent refusal.
+ */
+export function neverClearReason(text) {
+    if (typeof text !== 'string' || text.trim() === '')
+        return undefined;
+    const programs = programsIn(text);
+    if (programs.includes('docker') && VOLUME_DESTROY.test(text)) {
+        return 'docker destroys container volumes that cannot be recovered';
+    }
+    if (OUTBOUND.test(text) && BARE_ENV_FILE.test(text) && SECRET_READER.test(text)) {
+        return 'a dot-env file is read and sent off this machine';
+    }
+    if (UPLOAD_CHANNEL.test(text) && OTHER_SECRET_SOURCE.test(text)) {
+        return 'credential material is pushed off this machine';
+    }
+    if (COPY_VERB.test(text) && OTHER_SECRET_SOURCE.test(text) && STAGING_DIR.test(text)) {
+        return 'credential material is copied into a staging location';
+    }
+    if (SECRET_HARVEST.test(text))
+        return 'keys are swept off this machine and uploaded';
+    if (WIPE_IN_BODY.test(text))
+        return 'a wipe is hidden behind a function body expanded at runtime';
+    return undefined;
+}

package/lib/parsers/shell-cmds.d.ts

@@ -16,6 +16,15 @@ import type { CommandParser, CommandSemantics } from '../command-semantics.js';
 export declare class ShellDangerousParser implements CommandParser {
     readonly name = "shell-dangerous";
     readonly priority = 20;
+    /**
+     * Level for a base name, tolerating the tool-suffix spelling real calls use.
+     *
+     * The table stores `mkfs`, the command on the wire is `mkfs.ext4` — so a plain
+     * lookup gave a format-the-disk Level 1 while the pattern route still flagged the
+     * command, leaving the two halves of this parser disagreeing about the same call
+     * (`irreversible.ts` already matches on the dotted prefix; now the parser does too).
+     */
+    private levelOf;
     canParse(command: string): boolean;
     parse(command: string): CommandSemantics | null;
     private extractBaseName;

package/lib/parsers/shell-cmds.js

@@ -12,7 +12,19 @@
  * - format disk operations
  * - PowerShell Remove-Item with dangerous patterns
  */
-/** Commands that are inherently destructive (only dangerous ones trigger canParse) */
+/**
+ * Commands that are inherently destructive (only dangerous ones trigger canParse).
+ *
+ * The Windows storage/volume cmdlets are here because the ones listed are Level 5
+ * *by name* — `Clear-Disk`, `Optimize-VHD`, `Set-Disk` have no benign reading worth
+ * preserving, so no argument shape is required. Arg-dependent tools are deliberately
+ * **not** in this table (`vssadmin`, `cipher`): they live in `DESTRUCTIVE_PATTERNS`
+ * below, so `vssadmin` alone does not classify as a wipe. The decision path itself
+ * does not read this table — irreversibility is decided once, in `irreversible.ts`,
+ * which both P0 and the reversibility tier consume. Keeping the parser in agreement
+ * is what stops it from reporting `unknown` to any future consumer (rule dimension,
+ * explanation view) of `destructiveness`.
+ */
 const DESTRUCTIVE_COMMANDS = {
     // Level 5: Extreme (system-wide, data loss)
     'dd': 5,
@@ -21,6 +33,13 @@ const DESTRUCTIVE_COMMANDS = {
     'fdisk': 5,
     'mkfs': 5,
     'rm-sudo': 5,
+    'optimize-vhd': 5,
+    'clear-disk': 5,
+    'initialize-disk': 5,
+    'set-disk': 5,
+    'remove-vhd': 5,
+    'mount-disk': 5,
+    'sdelete': 5,
     // Level 4: High (significant file deletion/modification)
     'rm': 4,
     'rmdir': 4,
@@ -53,15 +72,30 @@ const DESTRUCTIVE_PATTERNS = [
     /mkfs\./i, // format filesystem
     />\s*\//i, // redirect to /
     />>\s*\//i, // append to /
+    // Arg-shaped destruction: the program alone is ordinary administration, so it
+    // is matched with its argument rather than added to the name table above.
+    /vssadmin\s+delete\s+shadows/i, // deletes every shadow copy (last local backup)
+    /cipher\s+\/w/i, // cipher /w overwrites free space
 ];
 export class ShellDangerousParser {
     name = 'shell-dangerous';
     priority = 20;
+    /**
+     * Level for a base name, tolerating the tool-suffix spelling real calls use.
+     *
+     * The table stores `mkfs`, the command on the wire is `mkfs.ext4` — so a plain
+     * lookup gave a format-the-disk Level 1 while the pattern route still flagged the
+     * command, leaving the two halves of this parser disagreeing about the same call
+     * (`irreversible.ts` already matches on the dotted prefix; now the parser does too).
+     */
+    levelOf(baseName) {
+        return DESTRUCTIVE_COMMANDS[baseName] ?? DESTRUCTIVE_COMMANDS[baseName.split('.')[0] ?? ''];
+    }
     canParse(command) {
         const cmd = command.trim().toLowerCase();
         const baseName = this.extractBaseName(cmd);
         // Check if it's a known destructive command
-        if (DESTRUCTIVE_COMMANDS[baseName] !== undefined) {
+        if (this.levelOf(baseName) !== undefined) {
             return true;
         }
         // Check for PowerShell equivalents
@@ -75,7 +109,7 @@ export class ShellDangerousParser {
         const trimmed = command.trim();
         const cmd = trimmed.toLowerCase();
         const baseName = this.extractBaseName(cmd);
-        let destructiveness = DESTRUCTIVE_COMMANDS[baseName] || 1;
+        let destructiveness = this.levelOf(baseName) || 1;
         let operation = baseName;
         let targets = [];
         let destructiveFlags = false;

package/lib/preset-rules.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Preset deny rule table for dsh-perm-gate.
+ *
+ * Ported from cc-safety-net (MIT, https://github.com/kenryu42/cc-safety-net)
+ * `src/core/rules/destructive.ts` + `secret.ts`, translated into this plugin's
+ * own `permissions` YAML vocabulary (see rule.ts / rule-dims.ts). The catalog
+ * is ONE SHOT-SEEDED preset: on first activation the entries are appended to
+ * the tail of the live rules document's deny/ask lists — the settings `rules`
+ * field when it is configured, otherwise the rules file. Revocation is
+ * user-owned: every entry carries a `[deny-rule:<id>]` tag and can be flipped
+ * to `enabled: false` or deleted in the settings card or the file; the
+ * `presetRulesSeeded` config flag keeps the seed from ever re-adding them.
+ *
+ * Policy decisions baked into this table (auditable history in
+ * .agents/plans/compat-cc-safety-net-deny-table/):
+ * - `git push --force` → ask, not deny (user decision 2026-10-13; also sidesteps
+ *   the glob negation gap for --force-with-lease).
+ * - Dynamic/unverifiable targets (cc's strict-mode fail-closed family) → ask,
+ *   aligning with this gate's existing "undecidable → ask" philosophy.
+ * - Secret protection keeps this gate's ruling: read = ask, write/delete = deny,
+ *   read+egress combos stay in the prompt layer (layered-defense decision).
+ * - Root/home wipes and full-drive Remove-Item are NOT duplicated here — the P0
+ *   irreversible layer runs first and owns them.
+ * - The legacy deny-keyword blacklist (deny-defaults.ts) stays as a parallel
+ *   layer; nothing here replaces it.
+ *
+ * Pure + import-light (yaml + rule.ts only): the client bundle may render the
+ * table from `presetEntriesForView()` without pulling in the node filesystem.
+ */
+import { type PermissionsDoc } from './rule.js';
+/** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
+export declare const PRESET_RULE_MARKER = "[deny-rule:";
+/** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
+export declare function presetRuleId(reason: unknown): string | undefined;
+/**
+ * The preset document in the file's bare YAML form. `defaultAction: ask`
+ * matches the empty-ruleset default, so seeding cannot widen anything.
+ * Patterns obey the compile limits: ≤2 glob stars, ordered subcommand+flag
+ * forms through argv.pipeline (evaluated per simple command as well as over
+ * the joined pipeline — see evaluate.ts), token co-occurrence NEVER through
+ * args (args is any-token OR).
+ */
+export declare const PRESET_RULES_YAML = "defaultAction: ask\n\ndeny:\n  # \u2500\u2500 Git \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [git]\n    argv: { pipeline: [\"git reset --hard*\", \"git reset *--hard*\"] }\n    reason: \"[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git reset --merge*\", \"git reset --abort*\"] }\n    reason: \"[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed.\"\n  - command: [git]\n    argv: { pipeline: [\"git clean *-f*\", \"git clean *--force*\"] }\n    reason: \"[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd.\"\n  - command: [git]\n    argv: { pipeline: [\"git push origin *--delete*\", \"git push * --delete *\", \"git push --delete*\"] }\n    reason: \"[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent.\"\n  - command: [git]\n    argv: { pipeline: [\"git push --mirror*\", \"git push * --mirror\"] }\n    reason: \"[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale.\"\n  - command: [git]\n    argv: { pipeline: [\"git branch -D*\", \"git branch * -D\", \"git branch *--force-delete*\"] }\n    reason: \"[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash drop*\"] }\n    reason: \"[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash clear*\"] }\n    reason: \"[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state.\"\n  - command: [git]\n    argv: { pipeline: [\"git tag -d*\", \"git tag --delete*\"] }\n    reason: \"[deny-rule:git.tag-delete] Tag deletion removes release anchors.\"\n  - command: [git]\n    argv: { pipeline: [\"git reflog delete*\", \"git reflog expire*\"] }\n    reason: \"[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits.\"\n  - command: [git]\n    argv: { pipeline: [\"git rebase --abort*\"] }\n    reason: \"[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip.\"\n  - command: [git]\n    argv: { pipeline: [\"git merge --abort*\"] }\n    reason: \"[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution.\"\n  - command: [git]\n    argv: { pipeline: [\"git rm -rf *\", \"git rm *-rf *\", \"git rm * -rf\", \"git rm -fr *\", \"git rm --force *\", \"git rm * --force\", \"git rm -f *\", \"git rm * -f\"] }\n    reason: \"[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout --force *\", \"git checkout * --force\", \"git checkout -f *\", \"git checkout * -f\", \"git checkout -f\", \"git checkout * --force *\"] }\n    reason: \"[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout -- *\"] }\n    reason: \"[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout * -- *\"] }\n    reason: \"[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout *--pathspec-from-file*\"] }\n    reason: \"[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch *--discard-changes*\"] }\n    reason: \"[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch --force *\", \"git switch * --force\", \"git switch -f *\", \"git switch * -f\"] }\n    reason: \"[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first.\"\n  - command: [git]\n    # git restore <bare path> (the plain unstaged discard) is NOT ported here:\n    # any glob broad enough to catch it also catches the harmless\n    # git restore --staged <path> (G6) \u2014 only the explicit discard forms are\n    # denied, the bare-path case stays in the prompt layer.\n    argv: { pipeline: [\"git restore --worktree *\", \"git restore * --worktree *\", \"git restore * --worktree\", \"git restore -W *\"] }\n    reason: \"[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first.\"\n  - command: [git]\n    argv: { pipeline: [\"git worktree remove --force *\", \"git worktree remove * --force\", \"git worktree remove -f *\", \"git worktree remove * -f\"] }\n    reason: \"[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree.\"\n  - command: [git]\n    args: [\"alias.*\"]\n    reason: \"[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed.\"\n  # params matches the RAW command string: the env-assignment word lands as the\n  # simple command's lowercased word, so a command:[git] dimension would never\n  # see this form \u2014 match on params alone.\n  - params: { command: [\"*GIT_SSH_COMMAND=*\", \"*git_ssh_command=*\", \"*GIT_SSH=*\", \"*git_ssh=*\"] }\n    reason: \"[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code.\"\n\n  # \u2500\u2500 Filesystem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [\"rm#recursive\", \"rm#force\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors.\"\n  - command: [find]\n    argv: { pipeline: [\"find .git*\"] }\n    reason: \"[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state.\"\n  - command: [find]\n    argv: { pipeline: [\"find * -delete\"] }\n    reason: \"[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first.\"\n  - command: [find]\n    argv: { pipeline: [\"find *-exec rm*\", \"find *-delete*\"] }\n    reason: \"[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths.\"\n  - command: [dd]\n    argv: { pipeline: [\"dd * of=/dev/sd*\", \"dd * of=/dev/nvme*\", \"dd * of=/dev/mmcblk*\"] }\n    reason: \"[deny-rule:dd.device-write] dd writing to a block device destroys the disk.\"\n  - command: [mkfs, mke2fs, newfs, \"mkfs.*\"]\n    reason: \"[deny-rule:mkfs.device] Formatting a device erases it.\"\n  - command: [diskutil, wipefs, sgdisk, parted]\n    reason: \"[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data.\"\n  - command: [shred]\n    reason: \"[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it).\"\n  - command: [cat, head, tail, dd]\n    args: [\"*/dev/sd*\", \"*/dev/nvme*\", \"*/dev/disk*\", \"*/dev/mmcblk*\"]\n    reason: \"[deny-rule:redirect.block-device] Redirect target resolving to a disk device path.\"\n\n  # \u2500\u2500 PowerShell \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # Command words are lowercased by the decomposer \u2014 command dimensions must\n  # carry the lowercased verb (Remove-Item \u2192 remove-item).\n  - command: [\"remove-item#recursive\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:powershell.remove-item-git-metadata] Never target .git.\"\n  - command: [powershell, pwsh]\n    argv: { pipeline: [\"pwsh *Remove-Item*\", \"powershell *Remove-Item*\", \"pwsh *remove-item*\", \"powershell *remove-item*\"] }\n    reason: \"[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope.\"\n\n  # \u2500\u2500 Command Prompt \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with\n  # these globs \u2014 every cmd /c recursion is nested behind a second parser,\n  # so its true target is undecidable: it moves to the ask section instead.)\n  - command: [cmd, rmdir, del]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:cmd.recursive-delete-git-metadata] Never target .git.\"\n  - command: [rmdir, del]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project.\"\n  - command: [rmdir, del]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope.\"\n\n  # \u2500\u2500 Secret targets (write/delete deny; reads are the ask section below) \u2500\u2500\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.ssh\", \"*/.aws\", \"*/.gnupg\", \".ssh\", \".aws\"]\n    reason: \"[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate.\"\n  - command: [echo, \"set-content\", \"out-file\"]\n    args: [\".env\", \".env.*\"]\n    reason: \"[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines.\"\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.git-credentials\", \".git-credentials\"]\n    reason: \"[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth.\"\n\nask:\n  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).\n  - command: [git]\n    argv: { pipeline: [\"git push *--force*\", \"git push *-f*\"] }\n    reason: \"[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease.\"\n\n  # cmd /c recursion hides the real target behind a second parser (and quoting):\n  # undecidable \u2192 ask, where cc denied only the drive-root-collapse variant.\n  - command: [cmd]\n    argv: { pipeline: [\"cmd /c *rmdir /s*\", \"cmd /c *del /s*\"] }\n    reason: \"[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target.\"\n\n  # Dynamic targets: this gate's ruling is \"undecidable \u2192 ask\", not fail-closed deny.\n  - command: [\"rm#recursive\", \"remove-item#recursive\"]\n    args: [\"$*\"]\n    reason: \"[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target \u2014 verify the variable yourself.\"\n  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns\n  # never see it \u2014 match the raw command string through the params dimension.\n  - params: { command: [\"*xargs rm*\", \"*xargs del*\"] }\n    reason: \"[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets.\"\n  - command: [parallel]\n    argv: { pipeline: [\"parallel *rm*\", \"*| parallel*\"] }\n    reason: \"[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets.\"\n  - command: [awk]\n    args: [\"*system(*\"]\n    reason: \"[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed.\"\n  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported \u2014 a glob\n  # cannot tell ref candidates from paths, and a broad pattern would prompt on\n  # every git checkout -b new-branch. Documented residual gap.\n\n  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\", \"select-string\"]\n    args: [\".env\", \".env.*\", \"*.env\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"id_rsa\", \"id_ed25519\", \"id_ecdsa\"]\n    reason: \"[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command.\"\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\"]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*/.aws\", \"*/.aws/*\", \"*/.gnupg\", \"*/.gnupg/*\", \"*/.config/gcloud/*\", \"*/.claude/*\", \"*/.codex/*\"]\n    reason: \"[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation.\"\n\n  # Self-protection: editing the gate's own rule sources needs confirmation \u2014\n  # revocation must be a human act, not something an agent can slide through.\n  # (Settings-namespace edits go through the host UI, not a tool call, and are\n  # out of reach of this entry; documented gap.)\n  - args: [\"*rules.yml\", \"*rules.yaml\", \"*deny-defaults*\"]\n    reason: \"[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces.\"\n";
+export declare function parsePresetDoc(): PermissionsDoc;
+/** Every preset id, in table order. Client view + tests use this as the row key. */
+export declare function presetRuleIds(): string[];
+/**
+ * Append missing preset entries to a RAW rules document object (bare or
+ * `permissions:`-wrapped form). Idempotent and revocation-preserving: an id
+ * already present — enabled or not — is never re-added. Mutates nothing;
+ * returns the merged copy and the added count.
+ */
+export declare function mergePresetIntoRaw(rawDoc: unknown): {
+    doc: Record<string, unknown>;
+    added: number;
+};
+/**
+ * One-shot file seed: create the rules file from the preset when absent, or
+ * append missing preset entries when present (comments in a hand-written file
+ * are lost on rewrite — the file is the plugin's data dir, not user-authored
+ * by default). A sibling marker file records that the seed ran: after a full
+ * revocation (user deletes every preset entry) the seed must never re-add
+ * them, and the marker works on hosts without the settings service where the
+ * `presetRulesSeeded` config flag cannot be persisted. Returns what happened
+ * for the log line.
+ */
+export declare function ensurePresetRulesFile(rulesFile: string, markerFile?: string): {
+    action: 'created' | 'merged' | 'skipped' | 'already-seeded';
+    added: number;
+};