dsh-perm-gate 5.1.2 → 5.2.0

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,44 @@
+# Third-Party Notices
+
+## cc-safety-net — source of the default deny/ask rule table
+
+The preset rule catalog in `src/preset-rules.ts` (`PRESET_RULES_YAML`, the
+`[deny-rule:*]` entries seeded into the live rules document on first
+activation) is a port of the rule catalog from **cc-safety-net**:
+
+- Project: <https://github.com/kenryu42/cc-safety-net>
+- Files ported: `src/core/rules/destructive.ts` and `src/core/rules/secret.ts`
+- Form of the port: the rules were **re-expressed** in this plugin's own
+  `permissions` YAML vocabulary (`command` / `argv` / `tools` dimensions, see
+  `src/rule.ts`); pattern shapes, tiering and verdicts were re-decided for this
+  gate's fail-toward-`ask` philosophy rather than copied verbatim.
+- Deviations and coverage gaps are recorded in
+  `.agents/plans/compat-cc-safety-net-deny-table/rewrite-target.md`.
+
+cc-safety-net is distributed under the MIT License, reproduced in full below;
+its copyright notice is retained here and in the header of
+`src/preset-rules.ts`.
+
+```
+MIT License
+
+Copyright (c) 2026 J Liew
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/config.d.ts

@@ -95,6 +95,13 @@ export interface PermGateConfig {
      * (possibly empty) replaces it. Editable from the settings card as a list.
      */
     readonly denyKeywords?: string[];
+    /**
+     * One-shot marker for the preset deny-table seed (`preset-rules.ts`, ported
+     * from cc-safety-net): set once the `[deny-rule:*]` entries have been merged
+     * into the live rules source. A full revocation (deleting every preset entry)
+     * persists — the seed never re-adds them.
+     */
+    readonly presetRulesSeeded?: boolean;
     /**
      * Extra tool names classified as read-only/internal and therefore auto-allowed.
      *
@@ -332,126 +339,128 @@ export declare function readRulesFromSettings(scope: {
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     rulesFile: z<string, string, "plain">;
     dshHome: z<string, string, "plain">;
-    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "volatile-defined">;
-    caseInsensitivePaths: z<boolean, boolean, "volatile-defined">;
-    classifierEnabled: z<boolean, boolean, "volatile-defined">;
-    classifierEndpoint: z<string, string, "volatile">;
-    classifierModel: z<string, string, "volatile-defined">;
-    classifierApiKey: z<string, string, "volatile">;
-    riskTimeoutMs: z<number, number, "volatile-defined">;
-    riskLearning: z<boolean, boolean, "volatile-defined">;
-    riskSediment: z<boolean, boolean, "volatile-defined">;
-    classifierSource: z<"host" | "custom", "host" | "custom", "volatile-defined">;
-    classifierProvider: z<string, string, "volatile">;
-    riskThreshold: z<number, number, "volatile-defined">;
+    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "defined">;
+    caseInsensitivePaths: z<boolean, boolean, "defined">;
+    classifierEnabled: z<boolean, boolean, "defined">;
+    classifierEndpoint: z<string, string, "plain">;
+    classifierModel: z<string, string, "defined">;
+    classifierApiKey: z<string, string, "plain">;
+    riskTimeoutMs: z<number, number, "defined">;
+    riskLearning: z<boolean, boolean, "defined">;
+    riskSediment: z<boolean, boolean, "defined">;
+    classifierSource: z<"host" | "custom", "host" | "custom", "defined">;
+    classifierProvider: z<string, string, "plain">;
+    riskThreshold: z<number, number, "defined">;
     learningFile: z<string, string, "plain">;
     eventsFile: z<string, string, "plain">;
-    grantTtlMs: z<number, number, "volatile-defined">;
-    grantMaxUses: z<number, number, "volatile-defined">;
-    permissive: z<boolean, boolean, "volatile-defined">;
+    grantTtlMs: z<number, number, "defined">;
+    grantMaxUses: z<number, number, "defined">;
+    permissive: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
-    permissiveStrategies: z<NoInfer<Schemastery.ObjectS<NoInfer<{
+    permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, NoInfer<Schemastery.ObjectT<NoInfer<{
+    }>>, Schemastery.ObjectT<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, "volatile">;
-    allowlist: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    denyKeywords: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    autoAllowTools: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    sessionSweep: z<boolean, boolean, "volatile-defined">;
+    }>>, "plain">;
+    allowlist: z<string[], string[], "plain">;
+    denyKeywords: z<string[], string[], "plain">;
+    presetRulesSeeded: z<boolean, boolean, "defined">;
+    autoAllowTools: z<string[], string[], "plain">;
+    sessionSweep: z<boolean, boolean, "defined">;
     workspaceStoreFile: z<string, string, "plain">;
-    searchUp: z<boolean, boolean, "volatile-defined">;
+    searchUp: z<boolean, boolean, "defined">;
     fallbackPath: z<string, string, "plain">;
-    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "volatile-defined">;
-    maxChainLength: z<number, number, "volatile-defined">;
-    networkEnabled: z<boolean, boolean, "volatile-defined">;
-    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "volatile-defined">;
-    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "volatile-defined">;
-    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "volatile-defined">;
-    networkLoopback: z<"allow" | "policy", "allow" | "policy", "volatile-defined">;
-    networkBind: z<string, string, "volatile-defined">;
-    networkPort: z<number, number, "volatile-defined">;
-    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "volatile-defined">;
-    networkInjectEnv: z<boolean, boolean, "volatile-defined">;
-    networkAskTimeoutMs: z<number, number, "volatile-defined">;
-    networkGrantTtlMs: z<number, number, "volatile-defined">;
-    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
-    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
-    sandboxProxy: z<string, string, "volatile-defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
-    rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
+    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "defined">;
+    maxChainLength: z<number, number, "defined">;
+    networkEnabled: z<boolean, boolean, "defined">;
+    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "defined">;
+    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "defined">;
+    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "defined">;
+    networkLoopback: z<"allow" | "policy", "allow" | "policy", "defined">;
+    networkBind: z<string, string, "defined">;
+    networkPort: z<number, number, "defined">;
+    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "defined">;
+    networkInjectEnv: z<boolean, boolean, "defined">;
+    networkAskTimeoutMs: z<number, number, "defined">;
+    networkGrantTtlMs: z<number, number, "defined">;
+    sandboxEnabled: z<boolean, boolean, "defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
+    sandboxProxy: z<string, string, "defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     rulesFile: z<string, string, "plain">;
     dshHome: z<string, string, "plain">;
-    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "volatile-defined">;
-    caseInsensitivePaths: z<boolean, boolean, "volatile-defined">;
-    classifierEnabled: z<boolean, boolean, "volatile-defined">;
-    classifierEndpoint: z<string, string, "volatile">;
-    classifierModel: z<string, string, "volatile-defined">;
-    classifierApiKey: z<string, string, "volatile">;
-    riskTimeoutMs: z<number, number, "volatile-defined">;
-    riskLearning: z<boolean, boolean, "volatile-defined">;
-    riskSediment: z<boolean, boolean, "volatile-defined">;
-    classifierSource: z<"host" | "custom", "host" | "custom", "volatile-defined">;
-    classifierProvider: z<string, string, "volatile">;
-    riskThreshold: z<number, number, "volatile-defined">;
+    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "defined">;
+    caseInsensitivePaths: z<boolean, boolean, "defined">;
+    classifierEnabled: z<boolean, boolean, "defined">;
+    classifierEndpoint: z<string, string, "plain">;
+    classifierModel: z<string, string, "defined">;
+    classifierApiKey: z<string, string, "plain">;
+    riskTimeoutMs: z<number, number, "defined">;
+    riskLearning: z<boolean, boolean, "defined">;
+    riskSediment: z<boolean, boolean, "defined">;
+    classifierSource: z<"host" | "custom", "host" | "custom", "defined">;
+    classifierProvider: z<string, string, "plain">;
+    riskThreshold: z<number, number, "defined">;
     learningFile: z<string, string, "plain">;
     eventsFile: z<string, string, "plain">;
-    grantTtlMs: z<number, number, "volatile-defined">;
-    grantMaxUses: z<number, number, "volatile-defined">;
-    permissive: z<boolean, boolean, "volatile-defined">;
+    grantTtlMs: z<number, number, "defined">;
+    grantMaxUses: z<number, number, "defined">;
+    permissive: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
-    permissiveStrategies: z<NoInfer<Schemastery.ObjectS<NoInfer<{
+    permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, NoInfer<Schemastery.ObjectT<NoInfer<{
+    }>>, Schemastery.ObjectT<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, "volatile">;
-    allowlist: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    denyKeywords: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    autoAllowTools: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    sessionSweep: z<boolean, boolean, "volatile-defined">;
+    }>>, "plain">;
+    allowlist: z<string[], string[], "plain">;
+    denyKeywords: z<string[], string[], "plain">;
+    presetRulesSeeded: z<boolean, boolean, "defined">;
+    autoAllowTools: z<string[], string[], "plain">;
+    sessionSweep: z<boolean, boolean, "defined">;
     workspaceStoreFile: z<string, string, "plain">;
-    searchUp: z<boolean, boolean, "volatile-defined">;
+    searchUp: z<boolean, boolean, "defined">;
     fallbackPath: z<string, string, "plain">;
-    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "volatile-defined">;
-    maxChainLength: z<number, number, "volatile-defined">;
-    networkEnabled: z<boolean, boolean, "volatile-defined">;
-    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "volatile-defined">;
-    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "volatile-defined">;
-    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "volatile-defined">;
-    networkLoopback: z<"allow" | "policy", "allow" | "policy", "volatile-defined">;
-    networkBind: z<string, string, "volatile-defined">;
-    networkPort: z<number, number, "volatile-defined">;
-    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "volatile-defined">;
-    networkInjectEnv: z<boolean, boolean, "volatile-defined">;
-    networkAskTimeoutMs: z<number, number, "volatile-defined">;
-    networkGrantTtlMs: z<number, number, "volatile-defined">;
-    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
-    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
-    sandboxProxy: z<string, string, "volatile-defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
-    rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
+    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "defined">;
+    maxChainLength: z<number, number, "defined">;
+    networkEnabled: z<boolean, boolean, "defined">;
+    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "defined">;
+    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "defined">;
+    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "defined">;
+    networkLoopback: z<"allow" | "policy", "allow" | "policy", "defined">;
+    networkBind: z<string, string, "defined">;
+    networkPort: z<number, number, "defined">;
+    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "defined">;
+    networkInjectEnv: z<boolean, boolean, "defined">;
+    networkAskTimeoutMs: z<number, number, "defined">;
+    networkGrantTtlMs: z<number, number, "defined">;
+    sandboxEnabled: z<boolean, boolean, "defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
+    sandboxProxy: z<string, string, "defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
 }>>, "plain">;
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -150,64 +150,88 @@ export function readRulesFromSettings(scope) {
     const value = scope?.get();
     return isRulesConfigured(value) ? value : undefined;
 }
+/**
+ * Feature guard for `Schema…volatile()`.
+ *
+ * `.volatile()` is not guaranteed to exist on the schemastery copy this plugin
+ * resolves at runtime. Every node below used to chain it unguarded **inside the
+ * module body**, so a missing method throws while `Config` is being built: the
+ * plugin fails to load at all (`engines.dsh` declares support for all 15 host
+ * lines, so that is a hard load-failure, not a degradation).
+ *
+ * Probing per node keeps the plain schema node instead. The read side already
+ * tolerates that — `readVolatileValue` / `resolveVolatileConfig` treat a value
+ * without `get()` as the frozen snapshot — so every switch still works, and only
+ * hot reload of a changed value is lost (it then needs a restart).
+ *
+ * Do **not** “fix” this by adding `volatile` to schemastery's prototype: the
+ * profile uses a hoisted flat layout, so that single copy is shared by every
+ * plugin in the profile (14 of them declare schemastery themselves) — a
+ * prototype write here would silently change their behaviour too.
+ */
+function vol(node) {
+    const maybe = node;
+    return typeof maybe.volatile === 'function' ? maybe.volatile() : node;
+}
 export const Config = z.object({
     rulesFile: z.string(),
     dshHome: z.string(),
-    defaultAction: z.union(['allow', 'ask', 'deny']).default('ask').volatile(),
-    caseInsensitivePaths: z.boolean().default(true).volatile(),
-    classifierEnabled: z.boolean().default(false).volatile(),
-    classifierEndpoint: z.string().volatile(),
-    classifierModel: z.string().default('deepseek-chat').volatile(),
-    classifierApiKey: z.string().volatile(),
-    riskTimeoutMs: z.number().min(1000).default(20_000).volatile(),
-    riskLearning: z.boolean().default(true).volatile(),
-    riskSediment: z.boolean().default(true).volatile(),
-    classifierSource: z.union(['custom', 'host']).default('custom').volatile(),
-    classifierProvider: z.string().volatile(),
-    riskThreshold: z.number().min(1).max(10).default(1).volatile(),
+    defaultAction: vol(z.union(['allow', 'ask', 'deny']).default('ask')),
+    caseInsensitivePaths: vol(z.boolean().default(true)),
+    classifierEnabled: vol(z.boolean().default(false)),
+    classifierEndpoint: vol(z.string()),
+    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierApiKey: vol(z.string()),
+    riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
+    riskLearning: vol(z.boolean().default(true)),
+    riskSediment: vol(z.boolean().default(true)),
+    classifierSource: vol(z.union(['custom', 'host']).default('custom')),
+    classifierProvider: vol(z.string()),
+    riskThreshold: vol(z.number().min(1).max(10).default(1)),
     learningFile: z.string(),
     eventsFile: z.string(),
-    grantTtlMs: z.number().min(1).default(5 * 60_000).volatile(),
-    grantMaxUses: z.number().min(1).default(1).volatile(),
-    permissive: z.boolean().default(false).volatile(),
+    grantTtlMs: vol(z.number().min(1).default(5 * 60_000)),
+    grantMaxUses: vol(z.number().min(1).default(1)),
+    permissive: vol(z.boolean().default(false)),
     gatePresets: z.array(z.string()),
-    permissiveStrategies: z.object({
+    permissiveStrategies: vol(z.object({
         trustAutoAllow: z.boolean().default(true),
         alwaysConfirm: z.boolean().default(false),
         llmAssist: z.boolean().default(false),
         trustEscalation: z.boolean().default(true),
-    }).volatile(),
-    allowlist: z.array(z.string()).volatile(),
-    denyKeywords: z.array(z.string()).volatile(),
-    autoAllowTools: z.array(z.string()).volatile(),
-    sessionSweep: z.boolean().default(true).volatile(),
+    })),
+    allowlist: vol(z.array(z.string())),
+    denyKeywords: vol(z.array(z.string())),
+    presetRulesSeeded: vol(z.boolean().default(false)),
+    autoAllowTools: vol(z.array(z.string())),
+    sessionSweep: vol(z.boolean().default(true)),
     workspaceStoreFile: z.string(),
     // Rule chain (T1.9)
-    searchUp: z.boolean().default(false).volatile(),
+    searchUp: vol(z.boolean().default(false)),
     fallbackPath: z.string(),
-    badFilePolicy: z.union(['fail', 'warn']).default('fail').volatile(),
-    maxChainLength: z.number().min(1).max(50).default(10).volatile(),
+    badFilePolicy: vol(z.union(['fail', 'warn']).default('fail')),
+    maxChainLength: vol(z.number().min(1).max(50).default(10)),
     // Network (Phase 2)
-    networkEnabled: z.boolean().default(false).volatile(),
-    networkMode: z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist').volatile(),
-    networkUnlisted: z.union(['ask', 'deny']).default('ask').volatile(),
-    networkUnattributed: z.union(['allow', 'deny']).default('allow').volatile(),
-    networkLoopback: z.union(['allow', 'policy']).default('allow').volatile(),
-    networkBind: z.string().default('127.0.0.1').volatile(),
-    networkPort: z.number().min(0).max(65535).default(0).volatile(),
-    networkNoProxy: z.union(['clear', 'preserve']).default('clear').volatile(),
-    networkInjectEnv: z.boolean().default(true).volatile(),
-    networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000).volatile(),
-    networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000).volatile(),
+    networkEnabled: vol(z.boolean().default(false)),
+    networkMode: vol(z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist')),
+    networkUnlisted: vol(z.union(['ask', 'deny']).default('ask')),
+    networkUnattributed: vol(z.union(['allow', 'deny']).default('allow')),
+    networkLoopback: vol(z.union(['allow', 'policy']).default('allow')),
+    networkBind: vol(z.string().default('127.0.0.1')),
+    networkPort: vol(z.number().min(0).max(65535).default(0)),
+    networkNoProxy: vol(z.union(['clear', 'preserve']).default('clear')),
+    networkInjectEnv: vol(z.boolean().default(true)),
+    networkAskTimeoutMs: vol(z.number().min(1000).max(600_000).default(120_000)),
+    networkGrantTtlMs: vol(z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000)),
     // AppContainer sandbox (Windows; goal 2)
-    sandboxEnabled: z.boolean().default(false).volatile(),
-    sandboxMode: z.union(['read-only', 'workspace-write']).default('workspace-write').volatile(),
-    sandboxProxy: z.string().default('').volatile(),
-    sandboxLoopback: z.union(['exempt', 'off']).default('exempt').volatile(),
+    sandboxEnabled: vol(z.boolean().default(false)),
+    sandboxMode: vol(z.union(['read-only', 'workspace-write']).default('workspace-write')),
+    sandboxProxy: vol(z.string().default('')),
+    sandboxLoopback: vol(z.union(['exempt', 'off']).default('exempt')),
     // 0.1.7: the rules document lives on this entry as a volatile whole-object
     // field (a second settings namespace is no longer projectable). Unconfigured
     // (bare defaults) -> the rules file remains the source.
-    rules: RulesSchema.volatile(),
+    rules: vol(RulesSchema),
     // Hot reload (Phase 3)
     watch: z.boolean().default(false),
     watchDebounceMs: z.number().min(50).max(5000).default(300),
@@ -217,7 +241,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'autoAllowTools',
+    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/evaluate.js

@@ -105,9 +105,14 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
         // Join the FULL argv of each simple command: `c.command` alone is just the
         // command word, so `curl https://x | sh` would read as `curl|sh` and the
         // documented `curl|sh` pattern could never see its own subject.
-        const pipelineText = commands.map((c) => commandArgv(c)).join('|');
+        const argvs = commands.map((c) => commandArgv(c));
+        const pipelineText = argvs.join('|');
         const compiled = rule.argv.pipeline.map((p) => compileGlobForMatch(p));
-        if (!compiled.some((g) => g.test(pipelineText)))
+        // Match per simple command as well as over the joined pipeline: anchored
+        // prefix patterns (`git reset --hard*`) must see each segment on its own —
+        // `cd x && git reset --hard` hides the guarded segment behind the join —
+        // while cross-segment patterns (`curl|sh`) still read the joined string.
+        if (!compiled.some((g) => g.test(pipelineText) || argvs.some((s) => g.test(s))))
             return false;
     }
     // network dimension: all present sub-dimensions must match.

package/lib/index.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { SandboxController } from './appcontainer/index.js';
 import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
+import { mergePresetIntoRaw } from './preset-rules.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
 // T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
@@ -206,6 +207,25 @@ export function apply(ctx, config = {}) {
     // the ref unset and the runtime falls back to its rules-file write paths.
     const ENTRY_ID = 'dsh-perm-gate';
     const settingsRef = {};
+    // 预设拒绝表播种：一次性、只走宿主设置面（写回落进 profile patch 的本插件
+    // config 条目）。刻意不再写插件自有的 `perm-gate/rules.yml` —— 那是用户手维护的
+    // 规则源，混进 51 条预设会让「我的规则」与「插件注入的规则」不可区分。
+    // 两条经实测定下的约束：① 必须在各分支「注册完成之后」调（0.1.5 上 ns 要等
+    // installSection 才注册，提前写报 `settings namespace ... is not registered`）；
+    // ② 规则与幂等位必须合成一次 update（拆两次时 0.1.7 第二次报 `Plugin entry ... is
+    // no longer configurable`，幂等位永远落不下去 ⇒ 用户全删后会被重新塞回）。
+    // 写失败不阻断启动也不置幂等位 ⇒ 下次激活重试。
+    const seedPresetDenyTable = (svc) => {
+        void (async () => {
+            if (current().presetRulesSeeded === true)
+                return;
+            const merged = mergePresetIntoRaw(readVolatileValue(config.rules));
+            await svc.update(ENTRY_ID, { rules: merged.doc, presetRulesSeeded: true });
+            console.log(`[dsh-perm-gate] preset deny table seeded via settings (+${merged.added} rules)`);
+        })().catch((e) => {
+            console.warn('[dsh-perm-gate] preset deny table 播种失败（不阻断启动，下次激活重试）:', e);
+        });
+    };
     ctx.inject(['settings'], (child) => {
         const svc = child.settings;
         settingsRef.svc = svc;
@@ -253,6 +273,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
             return;
         }
         void (async () => {
@@ -279,6 +300,7 @@ export function apply(ctx, config = {}) {
                             console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                         });
                     }
+                    seedPresetDenyTable(svc);
                     return;
                 }
             }
@@ -306,6 +328,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] rules seed write failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
         })();
     });
     const settingsWrite = (write) => {
@@ -326,6 +349,7 @@ export function apply(ctx, config = {}) {
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
     const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    // 预设拒绝表的播种在上面的 settings inject 回调里（那里才有 svc）。
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel

package/lib/preset-rules.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Preset deny rule table for dsh-perm-gate.
+ *
+ * Ported from cc-safety-net (MIT, https://github.com/kenryu42/cc-safety-net)
+ * `src/core/rules/destructive.ts` + `secret.ts`, translated into this plugin's
+ * own `permissions` YAML vocabulary (see rule.ts / rule-dims.ts). The catalog
+ * is ONE SHOT-SEEDED preset: on first activation the entries are appended to
+ * the tail of the live rules document's deny/ask lists — the settings `rules`
+ * field when it is configured, otherwise the rules file. Revocation is
+ * user-owned: every entry carries a `[deny-rule:<id>]` tag and can be flipped
+ * to `enabled: false` or deleted in the settings card or the file; the
+ * `presetRulesSeeded` config flag keeps the seed from ever re-adding them.
+ *
+ * Policy decisions baked into this table (auditable history in
+ * .agents/plans/compat-cc-safety-net-deny-table/):
+ * - `git push --force` → ask, not deny (user decision 2026-10-13; also sidesteps
+ *   the glob negation gap for --force-with-lease).
+ * - Dynamic/unverifiable targets (cc's strict-mode fail-closed family) → ask,
+ *   aligning with this gate's existing "undecidable → ask" philosophy.
+ * - Secret protection keeps this gate's ruling: read = ask, write/delete = deny,
+ *   read+egress combos stay in the prompt layer (layered-defense decision).
+ * - Root/home wipes and full-drive Remove-Item are NOT duplicated here — the P0
+ *   irreversible layer runs first and owns them.
+ * - The legacy deny-keyword blacklist (deny-defaults.ts) stays as a parallel
+ *   layer; nothing here replaces it.
+ *
+ * Pure + import-light (yaml + rule.ts only): the client bundle may render the
+ * table from `presetEntriesForView()` without pulling in the node filesystem.
+ */
+import { type PermissionsDoc } from './rule.js';
+/** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
+export declare const PRESET_RULE_MARKER = "[deny-rule:";
+/** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
+export declare function presetRuleId(reason: unknown): string | undefined;
+/**
+ * The preset document in the file's bare YAML form. `defaultAction: ask`
+ * matches the empty-ruleset default, so seeding cannot widen anything.
+ * Patterns obey the compile limits: ≤2 glob stars, ordered subcommand+flag
+ * forms through argv.pipeline (evaluated per simple command as well as over
+ * the joined pipeline — see evaluate.ts), token co-occurrence NEVER through
+ * args (args is any-token OR).
+ */
+export declare const PRESET_RULES_YAML = "defaultAction: ask\n\ndeny:\n  # \u2500\u2500 Git \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [git]\n    argv: { pipeline: [\"git reset --hard*\", \"git reset *--hard*\"] }\n    reason: \"[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git reset --merge*\", \"git reset --abort*\"] }\n    reason: \"[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed.\"\n  - command: [git]\n    argv: { pipeline: [\"git clean *-f*\", \"git clean *--force*\"] }\n    reason: \"[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd.\"\n  - command: [git]\n    argv: { pipeline: [\"git push origin *--delete*\", \"git push * --delete *\", \"git push --delete*\"] }\n    reason: \"[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent.\"\n  - command: [git]\n    argv: { pipeline: [\"git push --mirror*\", \"git push * --mirror\"] }\n    reason: \"[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale.\"\n  - command: [git]\n    argv: { pipeline: [\"git branch -D*\", \"git branch * -D\", \"git branch *--force-delete*\"] }\n    reason: \"[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash drop*\"] }\n    reason: \"[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash clear*\"] }\n    reason: \"[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state.\"\n  - command: [git]\n    argv: { pipeline: [\"git tag -d*\", \"git tag --delete*\"] }\n    reason: \"[deny-rule:git.tag-delete] Tag deletion removes release anchors.\"\n  - command: [git]\n    argv: { pipeline: [\"git reflog delete*\", \"git reflog expire*\"] }\n    reason: \"[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits.\"\n  - command: [git]\n    argv: { pipeline: [\"git rebase --abort*\"] }\n    reason: \"[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip.\"\n  - command: [git]\n    argv: { pipeline: [\"git merge --abort*\"] }\n    reason: \"[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution.\"\n  - command: [git]\n    argv: { pipeline: [\"git rm -rf *\", \"git rm *-rf *\", \"git rm * -rf\", \"git rm -fr *\", \"git rm --force *\", \"git rm * --force\", \"git rm -f *\", \"git rm * -f\"] }\n    reason: \"[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout --force *\", \"git checkout * --force\", \"git checkout -f *\", \"git checkout * -f\", \"git checkout -f\", \"git checkout * --force *\"] }\n    reason: \"[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout -- *\"] }\n    reason: \"[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout * -- *\"] }\n    reason: \"[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout *--pathspec-from-file*\"] }\n    reason: \"[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch *--discard-changes*\"] }\n    reason: \"[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch --force *\", \"git switch * --force\", \"git switch -f *\", \"git switch * -f\"] }\n    reason: \"[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first.\"\n  - command: [git]\n    # git restore <bare path> (the plain unstaged discard) is NOT ported here:\n    # any glob broad enough to catch it also catches the harmless\n    # git restore --staged <path> (G6) \u2014 only the explicit discard forms are\n    # denied, the bare-path case stays in the prompt layer.\n    argv: { pipeline: [\"git restore --worktree *\", \"git restore * --worktree *\", \"git restore * --worktree\", \"git restore -W *\"] }\n    reason: \"[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first.\"\n  - command: [git]\n    argv: { pipeline: [\"git worktree remove --force *\", \"git worktree remove * --force\", \"git worktree remove -f *\", \"git worktree remove * -f\"] }\n    reason: \"[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree.\"\n  - command: [git]\n    args: [\"alias.*\"]\n    reason: \"[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed.\"\n  # params matches the RAW command string: the env-assignment word lands as the\n  # simple command's lowercased word, so a command:[git] dimension would never\n  # see this form \u2014 match on params alone.\n  - params: { command: [\"*GIT_SSH_COMMAND=*\", \"*git_ssh_command=*\", \"*GIT_SSH=*\", \"*git_ssh=*\"] }\n    reason: \"[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code.\"\n\n  # \u2500\u2500 Filesystem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [\"rm#recursive\", \"rm#force\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors.\"\n  - command: [find]\n    argv: { pipeline: [\"find .git*\"] }\n    reason: \"[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state.\"\n  - command: [find]\n    argv: { pipeline: [\"find * -delete\"] }\n    reason: \"[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first.\"\n  - command: [find]\n    argv: { pipeline: [\"find *-exec rm*\", \"find *-delete*\"] }\n    reason: \"[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths.\"\n  - command: [dd]\n    argv: { pipeline: [\"dd * of=/dev/sd*\", \"dd * of=/dev/nvme*\", \"dd * of=/dev/mmcblk*\"] }\n    reason: \"[deny-rule:dd.device-write] dd writing to a block device destroys the disk.\"\n  - command: [mkfs, mke2fs, newfs, \"mkfs.*\"]\n    reason: \"[deny-rule:mkfs.device] Formatting a device erases it.\"\n  - command: [diskutil, wipefs, sgdisk, parted]\n    reason: \"[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data.\"\n  - command: [shred]\n    reason: \"[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it).\"\n  - command: [cat, head, tail, dd]\n    args: [\"*/dev/sd*\", \"*/dev/nvme*\", \"*/dev/disk*\", \"*/dev/mmcblk*\"]\n    reason: \"[deny-rule:redirect.block-device] Redirect target resolving to a disk device path.\"\n\n  # \u2500\u2500 PowerShell \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # Command words are lowercased by the decomposer \u2014 command dimensions must\n  # carry the lowercased verb (Remove-Item \u2192 remove-item).\n  - command: [\"remove-item#recursive\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:powershell.remove-item-git-metadata] Never target .git.\"\n  - command: [powershell, pwsh]\n    argv: { pipeline: [\"pwsh *Remove-Item*\", \"powershell *Remove-Item*\", \"pwsh *remove-item*\", \"powershell *remove-item*\"] }\n    reason: \"[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope.\"\n\n  # \u2500\u2500 Command Prompt \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with\n  # these globs \u2014 every cmd /c recursion is nested behind a second parser,\n  # so its true target is undecidable: it moves to the ask section instead.)\n  - command: [cmd, rmdir, del]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:cmd.recursive-delete-git-metadata] Never target .git.\"\n  - command: [rmdir, del]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project.\"\n  - command: [rmdir, del]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope.\"\n\n  # \u2500\u2500 Secret targets (write/delete deny; reads are the ask section below) \u2500\u2500\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.ssh\", \"*/.aws\", \"*/.gnupg\", \".ssh\", \".aws\"]\n    reason: \"[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate.\"\n  - command: [echo, \"set-content\", \"out-file\"]\n    args: [\".env\", \".env.*\"]\n    reason: \"[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines.\"\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.git-credentials\", \".git-credentials\"]\n    reason: \"[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth.\"\n\nask:\n  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).\n  - command: [git]\n    argv: { pipeline: [\"git push *--force*\", \"git push *-f*\"] }\n    reason: \"[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease.\"\n\n  # cmd /c recursion hides the real target behind a second parser (and quoting):\n  # undecidable \u2192 ask, where cc denied only the drive-root-collapse variant.\n  - command: [cmd]\n    argv: { pipeline: [\"cmd /c *rmdir /s*\", \"cmd /c *del /s*\"] }\n    reason: \"[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target.\"\n\n  # Dynamic targets: this gate's ruling is \"undecidable \u2192 ask\", not fail-closed deny.\n  - command: [\"rm#recursive\", \"remove-item#recursive\"]\n    args: [\"$*\"]\n    reason: \"[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target \u2014 verify the variable yourself.\"\n  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns\n  # never see it \u2014 match the raw command string through the params dimension.\n  - params: { command: [\"*xargs rm*\", \"*xargs del*\"] }\n    reason: \"[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets.\"\n  - command: [parallel]\n    argv: { pipeline: [\"parallel *rm*\", \"*| parallel*\"] }\n    reason: \"[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets.\"\n  - command: [awk]\n    args: [\"*system(*\"]\n    reason: \"[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed.\"\n  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported \u2014 a glob\n  # cannot tell ref candidates from paths, and a broad pattern would prompt on\n  # every git checkout -b new-branch. Documented residual gap.\n\n  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\", \"select-string\"]\n    args: [\".env\", \".env.*\", \"*.env\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"id_rsa\", \"id_ed25519\", \"id_ecdsa\"]\n    reason: \"[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command.\"\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\"]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*/.aws\", \"*/.aws/*\", \"*/.gnupg\", \"*/.gnupg/*\", \"*/.config/gcloud/*\", \"*/.claude/*\", \"*/.codex/*\"]\n    reason: \"[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation.\"\n\n  # Self-protection: editing the gate's own rule sources needs confirmation \u2014\n  # revocation must be a human act, not something an agent can slide through.\n  # (Settings-namespace edits go through the host UI, not a tool call, and are\n  # out of reach of this entry; documented gap.)\n  - args: [\"*rules.yml\", \"*rules.yaml\", \"*deny-defaults*\"]\n    reason: \"[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces.\"\n";
+export declare function parsePresetDoc(): PermissionsDoc;
+/** Every preset id, in table order. Client view + tests use this as the row key. */
+export declare function presetRuleIds(): string[];
+/**
+ * Append missing preset entries to a RAW rules document object (bare or
+ * `permissions:`-wrapped form). Idempotent and revocation-preserving: an id
+ * already present — enabled or not — is never re-added. Mutates nothing;
+ * returns the merged copy and the added count.
+ */
+export declare function mergePresetIntoRaw(rawDoc: unknown): {
+    doc: Record<string, unknown>;
+    added: number;
+};
+/**
+ * One-shot file seed: create the rules file from the preset when absent, or
+ * append missing preset entries when present (comments in a hand-written file
+ * are lost on rewrite — the file is the plugin's data dir, not user-authored
+ * by default). A sibling marker file records that the seed ran: after a full
+ * revocation (user deletes every preset entry) the seed must never re-add
+ * them, and the marker works on hosts without the settings service where the
+ * `presetRulesSeeded` config flag cannot be persisted. Returns what happened
+ * for the log line.
+ */
+export declare function ensurePresetRulesFile(rulesFile: string, markerFile?: string): {
+    action: 'created' | 'merged' | 'skipped' | 'already-seeded';
+    added: number;
+};

package/lib/preset-rules.js

@@ -0,0 +1,388 @@
+/**
+ * Preset deny rule table for dsh-perm-gate.
+ *
+ * Ported from cc-safety-net (MIT, https://github.com/kenryu42/cc-safety-net)
+ * `src/core/rules/destructive.ts` + `secret.ts`, translated into this plugin's
+ * own `permissions` YAML vocabulary (see rule.ts / rule-dims.ts). The catalog
+ * is ONE SHOT-SEEDED preset: on first activation the entries are appended to
+ * the tail of the live rules document's deny/ask lists — the settings `rules`
+ * field when it is configured, otherwise the rules file. Revocation is
+ * user-owned: every entry carries a `[deny-rule:<id>]` tag and can be flipped
+ * to `enabled: false` or deleted in the settings card or the file; the
+ * `presetRulesSeeded` config flag keeps the seed from ever re-adding them.
+ *
+ * Policy decisions baked into this table (auditable history in
+ * .agents/plans/compat-cc-safety-net-deny-table/):
+ * - `git push --force` → ask, not deny (user decision 2026-10-13; also sidesteps
+ *   the glob negation gap for --force-with-lease).
+ * - Dynamic/unverifiable targets (cc's strict-mode fail-closed family) → ask,
+ *   aligning with this gate's existing "undecidable → ask" philosophy.
+ * - Secret protection keeps this gate's ruling: read = ask, write/delete = deny,
+ *   read+egress combos stay in the prompt layer (layered-defense decision).
+ * - Root/home wipes and full-drive Remove-Item are NOT duplicated here — the P0
+ *   irreversible layer runs first and owns them.
+ * - The legacy deny-keyword blacklist (deny-defaults.ts) stays as a parallel
+ *   layer; nothing here replaces it.
+ *
+ * Pure + import-light (yaml + rule.ts only): the client bundle may render the
+ * table from `presetEntriesForView()` without pulling in the node filesystem.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { parse, stringify } from 'yaml';
+import { parsePermissionsDocument } from './rule.js';
+/** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
+export const PRESET_RULE_MARKER = '[deny-rule:';
+/** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
+export function presetRuleId(reason) {
+    if (typeof reason !== 'string')
+        return undefined;
+    const m = /\[deny-rule:([a-z0-9._-]+)\]/.exec(reason);
+    return m?.[1];
+}
+/**
+ * The preset document in the file's bare YAML form. `defaultAction: ask`
+ * matches the empty-ruleset default, so seeding cannot widen anything.
+ * Patterns obey the compile limits: ≤2 glob stars, ordered subcommand+flag
+ * forms through argv.pipeline (evaluated per simple command as well as over
+ * the joined pipeline — see evaluate.ts), token co-occurrence NEVER through
+ * args (args is any-token OR).
+ */
+export const PRESET_RULES_YAML = `defaultAction: ask
+
+deny:
+  # ── Git ──────────────────────────────────────────────────────────────────
+  - command: [git]
+    argv: { pipeline: ["git reset --hard*", "git reset *--hard*"] }
+    reason: "[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first."
+  - command: [git]
+    argv: { pipeline: ["git reset --merge*", "git reset --abort*"] }
+    reason: "[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed."
+  - command: [git]
+    argv: { pipeline: ["git clean *-f*", "git clean *--force*"] }
+    reason: "[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd."
+  - command: [git]
+    argv: { pipeline: ["git push origin *--delete*", "git push * --delete *", "git push --delete*"] }
+    reason: "[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent."
+  - command: [git]
+    argv: { pipeline: ["git push --mirror*", "git push * --mirror"] }
+    reason: "[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale."
+  - command: [git]
+    argv: { pipeline: ["git branch -D*", "git branch * -D", "git branch *--force-delete*"] }
+    reason: "[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d."
+  - command: [git]
+    argv: { pipeline: ["git stash drop*"] }
+    reason: "[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list."
+  - command: [git]
+    argv: { pipeline: ["git stash clear*"] }
+    reason: "[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state."
+  - command: [git]
+    argv: { pipeline: ["git tag -d*", "git tag --delete*"] }
+    reason: "[deny-rule:git.tag-delete] Tag deletion removes release anchors."
+  - command: [git]
+    argv: { pipeline: ["git reflog delete*", "git reflog expire*"] }
+    reason: "[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits."
+  - command: [git]
+    argv: { pipeline: ["git rebase --abort*"] }
+    reason: "[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip."
+  - command: [git]
+    argv: { pipeline: ["git merge --abort*"] }
+    reason: "[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution."
+  - command: [git]
+    argv: { pipeline: ["git rm -rf *", "git rm *-rf *", "git rm * -rf", "git rm -fr *", "git rm --force *", "git rm * --force", "git rm -f *", "git rm * -f"] }
+    reason: "[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first."
+  - command: [git]
+    argv: { pipeline: ["git checkout --force *", "git checkout * --force", "git checkout -f *", "git checkout * -f", "git checkout -f", "git checkout * --force *"] }
+    reason: "[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout."
+  - command: [git]
+    argv: { pipeline: ["git checkout -- *"] }
+    reason: "[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>."
+  - command: [git]
+    argv: { pipeline: ["git checkout * -- *"] }
+    reason: "[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first."
+  - command: [git]
+    argv: { pipeline: ["git checkout *--pathspec-from-file*"] }
+    reason: "[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore."
+  - command: [git]
+    argv: { pipeline: ["git switch *--discard-changes*"] }
+    reason: "[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first."
+  - command: [git]
+    argv: { pipeline: ["git switch --force *", "git switch * --force", "git switch -f *", "git switch * -f"] }
+    reason: "[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first."
+  - command: [git]
+    # git restore <bare path> (the plain unstaged discard) is NOT ported here:
+    # any glob broad enough to catch it also catches the harmless
+    # git restore --staged <path> (G6) — only the explicit discard forms are
+    # denied, the bare-path case stays in the prompt layer.
+    argv: { pipeline: ["git restore --worktree *", "git restore * --worktree *", "git restore * --worktree", "git restore -W *"] }
+    reason: "[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first."
+  - command: [git]
+    argv: { pipeline: ["git worktree remove --force *", "git worktree remove * --force", "git worktree remove -f *", "git worktree remove * -f"] }
+    reason: "[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree."
+  - command: [git]
+    args: ["alias.*"]
+    reason: "[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed."
+  # params matches the RAW command string: the env-assignment word lands as the
+  # simple command's lowercased word, so a command:[git] dimension would never
+  # see this form — match on params alone.
+  - params: { command: ["*GIT_SSH_COMMAND=*", "*git_ssh_command=*", "*GIT_SSH=*", "*git_ssh=*"] }
+    reason: "[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code."
+
+  # ── Filesystem ───────────────────────────────────────────────────────────
+  - command: ["rm#recursive", "rm#force"]
+    args: [".git", ".git/*", "*/.git"]
+    reason: "[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors."
+  - command: [find]
+    argv: { pipeline: ["find .git*"] }
+    reason: "[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state."
+  - command: [find]
+    argv: { pipeline: ["find * -delete"] }
+    reason: "[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first."
+  - command: [find]
+    argv: { pipeline: ["find *-exec rm*", "find *-delete*"] }
+    reason: "[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths."
+  - command: [dd]
+    argv: { pipeline: ["dd * of=/dev/sd*", "dd * of=/dev/nvme*", "dd * of=/dev/mmcblk*"] }
+    reason: "[deny-rule:dd.device-write] dd writing to a block device destroys the disk."
+  - command: [mkfs, mke2fs, newfs, "mkfs.*"]
+    reason: "[deny-rule:mkfs.device] Formatting a device erases it."
+  - command: [diskutil, wipefs, sgdisk, parted]
+    reason: "[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data."
+  - command: [shred]
+    reason: "[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it)."
+  - command: [cat, head, tail, dd]
+    args: ["*/dev/sd*", "*/dev/nvme*", "*/dev/disk*", "*/dev/mmcblk*"]
+    reason: "[deny-rule:redirect.block-device] Redirect target resolving to a disk device path."
+
+  # ── PowerShell ───────────────────────────────────────────────────────────
+  # Command words are lowercased by the decomposer — command dimensions must
+  # carry the lowercased verb (Remove-Item → remove-item).
+  - command: ["remove-item#recursive"]
+    args: [".git", ".git/*", "*/.git"]
+    reason: "[deny-rule:powershell.remove-item-git-metadata] Never target .git."
+  - command: [powershell, pwsh]
+    argv: { pipeline: ["pwsh *Remove-Item*", "powershell *Remove-Item*", "pwsh *remove-item*", "powershell *remove-item*"] }
+    reason: "[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs."
+  - command: ["remove-item#recursive"]
+    args: [".", "./"]
+    reason: "[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project."
+  - command: ["remove-item#recursive"]
+    args: ["../*", "..\\\\*"]
+    reason: "[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope."
+
+  # ── Command Prompt ───────────────────────────────────────────────────────
+  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with
+  # these globs — every cmd /c recursion is nested behind a second parser,
+  # so its true target is undecidable: it moves to the ask section instead.)
+  - command: [cmd, rmdir, del]
+    args: [".git", ".git/*", "*/.git"]
+    reason: "[deny-rule:cmd.recursive-delete-git-metadata] Never target .git."
+  - command: [rmdir, del]
+    args: [".", "./"]
+    reason: "[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project."
+  - command: [rmdir, del]
+    args: ["../*", "..\\\\*"]
+    reason: "[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope."
+
+  # ── Secret targets (write/delete deny; reads are the ask section below) ──
+  - command: ["rm#recursive", "remove-item#recursive", rmdir, del]
+    args: ["*/.ssh", "*/.aws", "*/.gnupg", ".ssh", ".aws"]
+    reason: "[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate."
+  - command: [echo, "set-content", "out-file"]
+    args: [".env", ".env.*"]
+    reason: "[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines."
+  - command: ["rm#recursive", "remove-item#recursive", rmdir, del]
+    args: ["*/.git-credentials", ".git-credentials"]
+    reason: "[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth."
+
+ask:
+  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).
+  - command: [git]
+    argv: { pipeline: ["git push *--force*", "git push *-f*"] }
+    reason: "[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease."
+
+  # cmd /c recursion hides the real target behind a second parser (and quoting):
+  # undecidable → ask, where cc denied only the drive-root-collapse variant.
+  - command: [cmd]
+    argv: { pipeline: ["cmd /c *rmdir /s*", "cmd /c *del /s*"] }
+    reason: "[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target."
+
+  # Dynamic targets: this gate's ruling is "undecidable → ask", not fail-closed deny.
+  - command: ["rm#recursive", "remove-item#recursive"]
+    args: ["$*"]
+    reason: "[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target — verify the variable yourself."
+  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns
+  # never see it — match the raw command string through the params dimension.
+  - params: { command: ["*xargs rm*", "*xargs del*"] }
+    reason: "[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets."
+  - command: [parallel]
+    argv: { pipeline: ["parallel *rm*", "*| parallel*"] }
+    reason: "[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets."
+  - command: [awk]
+    args: ["*system(*"]
+    reason: "[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed."
+  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported — a glob
+  # cannot tell ref candidates from paths, and a broad pattern would prompt on
+  # every git checkout -b new-branch. Documented residual gap.
+
+  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).
+  - command: [cat, head, tail, type, "get-content", ls, dir, "get-childitem", "select-string"]
+    args: [".env", ".env.*", "*.env", ".npmrc", ".pypirc", ".netrc", ".git-credentials", "id_rsa", "id_ed25519", "id_ecdsa"]
+    reason: "[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command."
+  - command: [cat, head, tail, type, "get-content", ls, dir, "get-childitem"]
+    args: ["*/.ssh", "*/.ssh/*", "*/.aws", "*/.aws/*", "*/.gnupg", "*/.gnupg/*", "*/.config/gcloud/*", "*/.claude/*", "*/.codex/*"]
+    reason: "[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation."
+
+  # Self-protection: editing the gate's own rule sources needs confirmation —
+  # revocation must be a human act, not something an agent can slide through.
+  # (Settings-namespace edits go through the host UI, not a tool call, and are
+  # out of reach of this entry; documented gap.)
+  - args: ["*rules.yml", "*rules.yaml", "*deny-defaults*"]
+    reason: "[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces."
+`;
+/** Parsed preset document (module-level cache; throws on a malformed table — never silent). */
+let presetDoc;
+export function parsePresetDoc() {
+    if (presetDoc === undefined)
+        presetDoc = parsePermissionsDocument(PRESET_RULES_YAML);
+    return presetDoc;
+}
+/** Every preset id, in table order. Client view + tests use this as the row key. */
+export function presetRuleIds() {
+    const doc = parsePresetDoc();
+    return [...doc.deny, ...doc.ask].map((e) => presetRuleId(e.reason) ?? '');
+}
+/**
+ * A rule entry as it is stored in a raw document (settings JSON / file YAML):
+ * only the fields the author wrote — parse fills every dimension with empty
+ * arrays, and an empty dimension means "no constraint", so round-tripping the
+ * parsed shape verbatim would be noise (still valid, just bloated).
+ */
+function rawEntry(e) {
+    const out = {};
+    if (e.tools.length > 0)
+        out.tools = e.tools;
+    if (e.command.length > 0)
+        out.command = e.command;
+    if (e.args.length > 0)
+        out.args = e.args;
+    if (e.paths.length > 0)
+        out.paths = e.paths;
+    // `params` 是唯一「源形态 = 映射、编译形态 = ParamCondition[]」的维度（其余维度
+    // 两者一致），所以不能直写 e.params：那会产出 `params: [{key,patterns,negated}]`，
+    // 下次启动被 parseParamsDimension 拒（`params must be a mapping`）⇒ 插件不激活。
+    // 反向映射时把 negation 还原成源头的 `!glob` 前缀写法（parse 就是这么判的）。
+    if (e.params.length > 0) {
+        const map = {};
+        for (const cond of e.params) {
+            map[cond.key] = cond.patterns.map((p) => (cond.negated && !p.startsWith('!') ? `!${p}` : p));
+        }
+        out.params = map;
+    }
+    if (e.absent.length > 0)
+        out.absent = e.absent;
+    if (e.agents.length > 0)
+        out.agents = e.agents;
+    if (e.when !== undefined)
+        out.when = e.when;
+    if (e.argv !== undefined)
+        out.argv = e.argv;
+    if (e.network !== undefined)
+        out.network = e.network;
+    if (e.branch !== undefined)
+        out.branch = e.branch;
+    out.reason = e.reason;
+    out.enabled = e.enabled;
+    return out;
+}
+function idsPresentIn(section) {
+    const out = new Set();
+    if (Array.isArray(section)) {
+        for (const item of section) {
+            if (item !== null && typeof item === 'object' && !Array.isArray(item)) {
+                const id = presetRuleId(item.reason);
+                if (id !== undefined)
+                    out.add(id);
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Append missing preset entries to a RAW rules document object (bare or
+ * `permissions:`-wrapped form). Idempotent and revocation-preserving: an id
+ * already present — enabled or not — is never re-added. Mutates nothing;
+ * returns the merged copy and the added count.
+ */
+export function mergePresetIntoRaw(rawDoc) {
+    const root = rawDoc !== null && typeof rawDoc === 'object' && !Array.isArray(rawDoc)
+        ? { ...rawDoc }
+        : {};
+    const wrapper = root['permissions'] !== null && typeof root['permissions'] === 'object' && !Array.isArray(root['permissions'])
+        ? root['permissions']
+        : root;
+    const doc = root['permissions'] !== undefined ? root : { ...wrapper };
+    const target = root['permissions'] !== undefined ? root['permissions'] : doc;
+    let added = 0;
+    const preset = parsePresetDoc();
+    for (const [key, list] of [['deny', preset.deny], ['ask', preset.ask]]) {
+        const existing = Array.isArray(target[key]) ? [...target[key]] : [];
+        const have = idsPresentIn(existing);
+        for (const entry of list) {
+            const id = presetRuleId(entry.reason);
+            if (id !== undefined && have.has(id))
+                continue;
+            existing.push(rawEntry(entry));
+            added += 1;
+        }
+        target[key] = existing;
+    }
+    if (typeof doc.defaultAction !== 'string' && typeof target.defaultAction !== 'string') {
+        target.defaultAction = 'ask';
+    }
+    return { doc, added };
+}
+/**
+ * One-shot file seed: create the rules file from the preset when absent, or
+ * append missing preset entries when present (comments in a hand-written file
+ * are lost on rewrite — the file is the plugin's data dir, not user-authored
+ * by default). A sibling marker file records that the seed ran: after a full
+ * revocation (user deletes every preset entry) the seed must never re-add
+ * them, and the marker works on hosts without the settings service where the
+ * `presetRulesSeeded` config flag cannot be persisted. Returns what happened
+ * for the log line.
+ */
+export function ensurePresetRulesFile(rulesFile, markerFile) {
+    try {
+        if (markerFile !== undefined && existsSync(markerFile))
+            return { action: 'already-seeded', added: 0 };
+        let result;
+        if (!existsSync(rulesFile)) {
+            writeFileSync(rulesFile, PRESET_RULES_YAML, 'utf8');
+            result = { action: 'created', added: presetRuleIds().length };
+        }
+        else {
+            const text = readFileSync(rulesFile, 'utf8');
+            const root = text.trim() === '' ? {} : parse(text);
+            const { doc, added } = mergePresetIntoRaw(root);
+            if (added === 0) {
+                result = { action: 'skipped', added: 0 };
+            }
+            else {
+                writeFileSync(rulesFile, stringify(doc, { lineWidth: 0 }), 'utf8');
+                result = { action: 'merged', added };
+            }
+        }
+        if (markerFile !== undefined && result.action !== 'skipped') {
+            try {
+                writeFileSync(markerFile, new Date().toISOString(), 'utf8');
+            }
+            catch { /* marker is best-effort */ }
+        }
+        return result;
+    }
+    catch {
+        // A broken user file must NOT be rewritten by the seed (fail-open on the
+        // seed path only: the loader's own badFilePolicy still governs decisions).
+        return { action: 'skipped', added: 0 };
+    }
+}

package/lib/runtime.js

@@ -1068,7 +1068,12 @@ export class PermGateRuntime {
         // user's terminal answer comes back through tools/result anyway.
         if (outcome !== 'ask') {
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome, source, reason: decision.reason, at: Date.now() }));
-            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: source });
+            // Preset deny-table entries tag their reason with `[deny-rule:<id>]`
+            // (see preset-rules.ts): surface the tag as the verdict so the audit,
+            // the feed and per-rule revocation attribute the exact entry instead of
+            // the whole `rule` partition.
+            const ruleTag = decision.stage === 'rule' ? /\[deny-rule:[a-z0-9._-]+\]/.exec(decision.reason)?.[0] : undefined;
+            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: ruleTag ?? source });
         }
         if (decision.action === 'deny')
             return { kind: 'deny', reason: decision.reason };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "publishConfig": {
     "tag": "latest"
   },
@@ -26,6 +26,7 @@
     "CHANGELOG.md",
     "CHANGELOG.ja.md",
     "CHANGELOG.ko.md",
+    "THIRD_PARTY_NOTICES.md",
     "LICENSE"
   ],
   "main": "lib/index.js",
@@ -62,8 +63,8 @@
     "./package.json": "./package.json"
   },
   "bin": {
-    "dsh-perm-gate": "./lib/cli.js",
-    "dsh-perm-gate-patch-glyph": "./scripts/patch-permission-glyph.mjs"
+    "dsh-perm-gate": "lib/cli.js",
+    "dsh-perm-gate-patch-glyph": "scripts/patch-permission-glyph.mjs"
   },
   "engines": {
     "node": ">=24",