dsh-perm-gate 5.1.2 → 5.3.0

package/lib/config.d.ts

@@ -66,6 +66,75 @@ export interface PermGateConfig {
      * widens decision before the human/LLM seam.
      */
     readonly permissive?: boolean;
+    /**
+     * YOLO — the switch behind the `permissive-yolo` tier, the model-backed human-free
+     * implementation. It never raises a human confirmation: what the mechanical screen names
+     * (irreversible, unlearnable, unreadable payload) is blocked and fed back to the main LLM
+     * as a `工具审核意见` user message, and the residual goes to the review model, which
+     * answers in the person's place — risky blocks, anything else runs.
+     *
+     * This is a per-tier switch, not a session-wide flow: it governs the `permissive-yolo`
+     * preset and nothing else, so turning it off changes no other tier's behaviour. The tier
+     * is the model-backed one by definition; with no reviewer in seat it still refuses to ask
+     * a person (that is the promise), settles on the mechanical screen alone, and records that
+     * the model never answered instead of letting the tier quietly become a different one.
+     */
+    readonly yolo?: boolean;
+    /**
+     * `safenet-pass` — the switch behind the `permissive-mech` tier: the deterministic
+     * mechanical screen plus the preset opinions take over the ask. Named danger is blocked
+     * and fed back to the main LLM, everything the nets cannot condemn runs. No human prompt
+     * and **no model call at all** — the reviewed form of `approval: never`, and the tier for
+     * a run with no reviewer LLM or where the tokens are not worth spending.
+     */
+    readonly safenetPass?: boolean;
+    /**
+     * `safenet-ask` — the switch behind the `permissive-snet` tier: the mechanical screen
+     * still filters and lists its doubts, but the ask stays with a **person** and no grader is
+     * consulted. The shape the gate takes when no reviewer LLM is connected and you would
+     * rather answer than auto-run. Uncommon by design.
+     */
+    readonly safenetAsk?: boolean;
+    /**
+     * Degraded review — fall back to a **rule-only gate when there is no reviewer**.
+     *
+     * With `permissiveStrategies.llmAssist` on, an `ask` is normally graded by the
+     * configured model, and every path that cannot grade it (no endpoint/model set up,
+     * host `llm` absent, transport failure → `unresolved`) is fail-closed to a *human*
+     * confirmation. In a headless or unattended run that is a stall: nobody answers.
+     * This switch degrades those two no-reviewer paths to the deterministic nets only —
+     * a cc-safety-net-class gate: danger the rules can name (irreversible / unlearnable /
+     * opaque payload) is **blocked** and the reason is fed back to the main LLM, anything
+     * else runs. It changes nothing while a reviewer *is* answering, and never softens a
+     * deterministic deny. It applies to the ordinary 自动审查 tiers (`permissive`,
+     * `permissive-full`); the three tiers that own an implementation (`yolo`, `safenetPass`,
+     * `safenetAsk`) already say who answers and are not degraded by this switch.
+     */
+    readonly rulesFallback?: boolean;
+    /**
+     * **Retired** (2026-10-17) — the per-preset mode table (`<preset id>=<mode>`) that briefly
+     * decided who answers an ask. Each human-free implementation now owns exactly one preset
+     * and exactly one switch (`yolo` → `permissive-yolo`, `safenetPass` → `permissive-mech`,
+     * `safenetAsk` → `permissive-snet`), which is what the table could not guarantee: entries
+     * could name a preset outside the gate's scope, and a stored list could claim to steer
+     * presets it never actually reached. The key stays in the schema **only** so a
+     * profile written by those builds still parses; nothing reads it, and the settings card no
+     * longer writes it. The replacement semantics live in `src/unattended.ts`.
+     */
+    readonly unattendedTiers?: string[];
+    /**
+     * Script review (default **on**) — when a call runs a script file (`bash x.sh`,
+     * `pwsh -File x.ps1`, `python x.py`, `./deploy.sh`), read the file and attach its
+     * body to the review: the risk grader and the human both judge the code that will
+     * execute instead of a filename, and the deterministic nets grade the body too (a
+     * script that wipes `$HOME` is irreversible whatever the command line says).
+     *
+     * Bounded (a few files, a fixed per-file budget) and redacted on the way out like
+     * every other egress text. Turn it off to keep file contents off the configured
+     * endpoint: the cost is that out-of-workspace and unreadable script runs go back to
+     * being graded as unknowable (the `U` tier).
+     */
+    readonly scriptReview?: boolean;
     /** Backend approval strategies; combinable. Front-end exposes only `permissive` itself. */
     readonly permissiveStrategies?: Partial<PermissiveStrategies>;
     /**
@@ -95,6 +164,57 @@ export interface PermGateConfig {
      * (possibly empty) replaces it. Editable from the settings card as a list.
      */
     readonly denyKeywords?: string[];
+    /**
+     * Keywords **appended** to whichever blacklist is live (`denyKeywords` when set, the
+     * preset otherwise) instead of replacing it. This is what to use to protect a
+     * long-tail secret of your own — a company token prefix, a vault CLI subcommand —
+     * without having to copy fifty preset entries into your profile and keep them current.
+     */
+    readonly denyKeywordsExtra?: string[];
+    /**
+     * Credential paths beyond the built-in store list (`.ssh`, `.aws`, `.npmrc`,
+     * `credentials.yaml`, …), which P0 refuses to read from outside the workspace and
+     * refuses to mutate through a file tool.
+     *
+     * Entries are path globs matched on the normalized path: `**` crosses directories, `*`
+     * and `?` stay inside one; a plain entry is a path fragment (`vault/prod.env`,
+     * `.myco_token`), and a `~/` prefix expands to the real home. Relative patterns also
+     * match at any depth, so `secrets/*.env` covers `a/b/secrets/prod.env`.
+     *
+     * Why a setting and not a rule in `rules.yml`: a `read`/`grep` call is auto-allowed a
+     * stage before the rule chain runs (the only layer that sees it first is P0), and the
+     * tier of an entry must not be the author's choice — a declared secret gets what
+     * `.ssh` gets, never a confirmation a model can talk its way out of.
+     */
+    readonly credentialPaths?: string[];
+    /**
+     * Argument keys to treat as **document bodies** in addition to the built-in list
+     * (`content`, `text`, `plan`…): their values never enter the flattened text the
+     * deny-keyword blacklist and the P0 credential pre-screen read.
+     *
+     * The point is the long tail of host tools whose prose keys nobody shipped a rule for
+     * (`steps`, `notes`, `rationale`) — the shape of GitHub issue #2, where an unlisted
+     * document key made a plan get refused for describing `rm -rf`. Additive only: the
+     * built-in list cannot be replaced, because an omission would re-create that bug.
+     */
+    readonly extraContentArgKeys?: string[];
+    /**
+     * Argument keys to treat as **operations** even when the tool class says otherwise: the
+     * field's text is read by the blacklist and the credential pre-screen, and this list
+     * wins over `extraContentArgKeys` when both name the same key.
+     *
+     * For a workflow/skill-style tool whose body *is* executed code. Cost, stated: naming a
+     * genuine document key here re-exposes the issue #2 failure — a plan or note that merely
+     * mentions a destructive command will be refused for mentioning it.
+     */
+    readonly extraOperationArgKeys?: string[];
+    /**
+     * One-shot marker for the preset deny-table seed (`preset-rules.ts`, ported
+     * from cc-safety-net): set once the `[deny-rule:*]` entries have been merged
+     * into the live rules source. A full revocation (deleting every preset entry)
+     * persists — the seed never re-adds them.
+     */
+    readonly presetRulesSeeded?: boolean;
     /**
      * Extra tool names classified as read-only/internal and therefore auto-allowed.
      *
@@ -332,126 +452,166 @@ export declare function readRulesFromSettings(scope: {
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     rulesFile: z<string, string, "plain">;
     dshHome: z<string, string, "plain">;
-    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "volatile-defined">;
-    caseInsensitivePaths: z<boolean, boolean, "volatile-defined">;
-    classifierEnabled: z<boolean, boolean, "volatile-defined">;
-    classifierEndpoint: z<string, string, "volatile">;
-    classifierModel: z<string, string, "volatile-defined">;
-    classifierApiKey: z<string, string, "volatile">;
-    riskTimeoutMs: z<number, number, "volatile-defined">;
-    riskLearning: z<boolean, boolean, "volatile-defined">;
-    riskSediment: z<boolean, boolean, "volatile-defined">;
-    classifierSource: z<"host" | "custom", "host" | "custom", "volatile-defined">;
-    classifierProvider: z<string, string, "volatile">;
-    riskThreshold: z<number, number, "volatile-defined">;
+    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "defined">;
+    caseInsensitivePaths: z<boolean, boolean, "defined">;
+    classifierEnabled: z<boolean, boolean, "defined">;
+    classifierEndpoint: z<string, string, "plain">;
+    classifierModel: z<string, string, "defined">;
+    classifierApiKey: z<string, string, "plain">;
+    riskTimeoutMs: z<number, number, "defined">;
+    riskLearning: z<boolean, boolean, "defined">;
+    riskSediment: z<boolean, boolean, "defined">;
+    classifierSource: z<"host" | "custom", "host" | "custom", "defined">;
+    classifierProvider: z<string, string, "plain">;
+    riskThreshold: z<number, number, "defined">;
     learningFile: z<string, string, "plain">;
     eventsFile: z<string, string, "plain">;
-    grantTtlMs: z<number, number, "volatile-defined">;
-    grantMaxUses: z<number, number, "volatile-defined">;
-    permissive: z<boolean, boolean, "volatile-defined">;
+    grantTtlMs: z<number, number, "defined">;
+    grantMaxUses: z<number, number, "defined">;
+    permissive: z<boolean, boolean, "defined">;
+    yolo: z<boolean, boolean, "defined">;
+    rulesFallback: z<boolean, boolean, "defined">;
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: z<string[], string[], "defined">;
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: z<boolean, boolean, "defined">;
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: z<boolean, boolean, "defined">;
+    scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
-    permissiveStrategies: z<NoInfer<Schemastery.ObjectS<NoInfer<{
+    permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, NoInfer<Schemastery.ObjectT<NoInfer<{
+    }>>, Schemastery.ObjectT<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, "volatile">;
-    allowlist: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    denyKeywords: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    autoAllowTools: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    sessionSweep: z<boolean, boolean, "volatile-defined">;
+    }>>, "plain">;
+    allowlist: z<string[], string[], "plain">;
+    denyKeywords: z<string[], string[], "plain">;
+    denyKeywordsExtra: z<string[], string[], "defined">;
+    credentialPaths: z<string[], string[], "defined">;
+    extraContentArgKeys: z<string[], string[], "defined">;
+    extraOperationArgKeys: z<string[], string[], "defined">;
+    presetRulesSeeded: z<boolean, boolean, "defined">;
+    autoAllowTools: z<string[], string[], "plain">;
+    sessionSweep: z<boolean, boolean, "defined">;
     workspaceStoreFile: z<string, string, "plain">;
-    searchUp: z<boolean, boolean, "volatile-defined">;
+    searchUp: z<boolean, boolean, "defined">;
     fallbackPath: z<string, string, "plain">;
-    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "volatile-defined">;
-    maxChainLength: z<number, number, "volatile-defined">;
-    networkEnabled: z<boolean, boolean, "volatile-defined">;
-    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "volatile-defined">;
-    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "volatile-defined">;
-    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "volatile-defined">;
-    networkLoopback: z<"allow" | "policy", "allow" | "policy", "volatile-defined">;
-    networkBind: z<string, string, "volatile-defined">;
-    networkPort: z<number, number, "volatile-defined">;
-    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "volatile-defined">;
-    networkInjectEnv: z<boolean, boolean, "volatile-defined">;
-    networkAskTimeoutMs: z<number, number, "volatile-defined">;
-    networkGrantTtlMs: z<number, number, "volatile-defined">;
-    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
-    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
-    sandboxProxy: z<string, string, "volatile-defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
-    rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
+    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "defined">;
+    maxChainLength: z<number, number, "defined">;
+    networkEnabled: z<boolean, boolean, "defined">;
+    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "defined">;
+    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "defined">;
+    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "defined">;
+    networkLoopback: z<"allow" | "policy", "allow" | "policy", "defined">;
+    networkBind: z<string, string, "defined">;
+    networkPort: z<number, number, "defined">;
+    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "defined">;
+    networkInjectEnv: z<boolean, boolean, "defined">;
+    networkAskTimeoutMs: z<number, number, "defined">;
+    networkGrantTtlMs: z<number, number, "defined">;
+    sandboxEnabled: z<boolean, boolean, "defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
+    sandboxProxy: z<string, string, "defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     rulesFile: z<string, string, "plain">;
     dshHome: z<string, string, "plain">;
-    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "volatile-defined">;
-    caseInsensitivePaths: z<boolean, boolean, "volatile-defined">;
-    classifierEnabled: z<boolean, boolean, "volatile-defined">;
-    classifierEndpoint: z<string, string, "volatile">;
-    classifierModel: z<string, string, "volatile-defined">;
-    classifierApiKey: z<string, string, "volatile">;
-    riskTimeoutMs: z<number, number, "volatile-defined">;
-    riskLearning: z<boolean, boolean, "volatile-defined">;
-    riskSediment: z<boolean, boolean, "volatile-defined">;
-    classifierSource: z<"host" | "custom", "host" | "custom", "volatile-defined">;
-    classifierProvider: z<string, string, "volatile">;
-    riskThreshold: z<number, number, "volatile-defined">;
+    defaultAction: z<"allow" | "ask" | "deny", "allow" | "ask" | "deny", "defined">;
+    caseInsensitivePaths: z<boolean, boolean, "defined">;
+    classifierEnabled: z<boolean, boolean, "defined">;
+    classifierEndpoint: z<string, string, "plain">;
+    classifierModel: z<string, string, "defined">;
+    classifierApiKey: z<string, string, "plain">;
+    riskTimeoutMs: z<number, number, "defined">;
+    riskLearning: z<boolean, boolean, "defined">;
+    riskSediment: z<boolean, boolean, "defined">;
+    classifierSource: z<"host" | "custom", "host" | "custom", "defined">;
+    classifierProvider: z<string, string, "plain">;
+    riskThreshold: z<number, number, "defined">;
     learningFile: z<string, string, "plain">;
     eventsFile: z<string, string, "plain">;
-    grantTtlMs: z<number, number, "volatile-defined">;
-    grantMaxUses: z<number, number, "volatile-defined">;
-    permissive: z<boolean, boolean, "volatile-defined">;
+    grantTtlMs: z<number, number, "defined">;
+    grantMaxUses: z<number, number, "defined">;
+    permissive: z<boolean, boolean, "defined">;
+    yolo: z<boolean, boolean, "defined">;
+    rulesFallback: z<boolean, boolean, "defined">;
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: z<string[], string[], "defined">;
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: z<boolean, boolean, "defined">;
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: z<boolean, boolean, "defined">;
+    scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
-    permissiveStrategies: z<NoInfer<Schemastery.ObjectS<NoInfer<{
+    permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, NoInfer<Schemastery.ObjectT<NoInfer<{
+    }>>, Schemastery.ObjectT<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
         alwaysConfirm: z<boolean, boolean, "defined">;
         llmAssist: z<boolean, boolean, "defined">;
         trustEscalation: z<boolean, boolean, "defined">;
-    }>>>, "volatile">;
-    allowlist: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    denyKeywords: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    autoAllowTools: z<NoInfer<string[]>, NoInfer<string[]>, "volatile">;
-    sessionSweep: z<boolean, boolean, "volatile-defined">;
+    }>>, "plain">;
+    allowlist: z<string[], string[], "plain">;
+    denyKeywords: z<string[], string[], "plain">;
+    denyKeywordsExtra: z<string[], string[], "defined">;
+    credentialPaths: z<string[], string[], "defined">;
+    extraContentArgKeys: z<string[], string[], "defined">;
+    extraOperationArgKeys: z<string[], string[], "defined">;
+    presetRulesSeeded: z<boolean, boolean, "defined">;
+    autoAllowTools: z<string[], string[], "plain">;
+    sessionSweep: z<boolean, boolean, "defined">;
     workspaceStoreFile: z<string, string, "plain">;
-    searchUp: z<boolean, boolean, "volatile-defined">;
+    searchUp: z<boolean, boolean, "defined">;
     fallbackPath: z<string, string, "plain">;
-    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "volatile-defined">;
-    maxChainLength: z<number, number, "volatile-defined">;
-    networkEnabled: z<boolean, boolean, "volatile-defined">;
-    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "volatile-defined">;
-    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "volatile-defined">;
-    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "volatile-defined">;
-    networkLoopback: z<"allow" | "policy", "allow" | "policy", "volatile-defined">;
-    networkBind: z<string, string, "volatile-defined">;
-    networkPort: z<number, number, "volatile-defined">;
-    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "volatile-defined">;
-    networkInjectEnv: z<boolean, boolean, "volatile-defined">;
-    networkAskTimeoutMs: z<number, number, "volatile-defined">;
-    networkGrantTtlMs: z<number, number, "volatile-defined">;
-    sandboxEnabled: z<boolean, boolean, "volatile-defined">;
-    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "volatile-defined">;
-    sandboxProxy: z<string, string, "volatile-defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "volatile-defined">;
-    rules: z<NoInfer<RulesConfig>, NoInfer<RulesConfig>, "volatile">;
+    badFilePolicy: z<"fail" | "warn", "fail" | "warn", "defined">;
+    maxChainLength: z<number, number, "defined">;
+    networkEnabled: z<boolean, boolean, "defined">;
+    networkMode: z<"deny-all" | "whitelist" | "allow-all", "deny-all" | "whitelist" | "allow-all", "defined">;
+    networkUnlisted: z<"ask" | "deny", "ask" | "deny", "defined">;
+    networkUnattributed: z<"allow" | "deny", "allow" | "deny", "defined">;
+    networkLoopback: z<"allow" | "policy", "allow" | "policy", "defined">;
+    networkBind: z<string, string, "defined">;
+    networkPort: z<number, number, "defined">;
+    networkNoProxy: z<"clear" | "preserve", "clear" | "preserve", "defined">;
+    networkInjectEnv: z<boolean, boolean, "defined">;
+    networkAskTimeoutMs: z<number, number, "defined">;
+    networkGrantTtlMs: z<number, number, "defined">;
+    sandboxEnabled: z<boolean, boolean, "defined">;
+    sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
+    sandboxProxy: z<string, string, "defined">;
+    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
 }>>, "plain">;
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -150,64 +150,107 @@ export function readRulesFromSettings(scope) {
     const value = scope?.get();
     return isRulesConfigured(value) ? value : undefined;
 }
+/**
+ * Feature guard for `Schema…volatile()`.
+ *
+ * `.volatile()` is not guaranteed to exist on the schemastery copy this plugin
+ * resolves at runtime. Every node below used to chain it unguarded **inside the
+ * module body**, so a missing method throws while `Config` is being built: the
+ * plugin fails to load at all (`engines.dsh` declares support for all 15 host
+ * lines, so that is a hard load-failure, not a degradation).
+ *
+ * Probing per node keeps the plain schema node instead. The read side already
+ * tolerates that — `readVolatileValue` / `resolveVolatileConfig` treat a value
+ * without `get()` as the frozen snapshot — so every switch still works, and only
+ * hot reload of a changed value is lost (it then needs a restart).
+ *
+ * Do **not** “fix” this by adding `volatile` to schemastery's prototype: the
+ * profile uses a hoisted flat layout, so that single copy is shared by every
+ * plugin in the profile (14 of them declare schemastery themselves) — a
+ * prototype write here would silently change their behaviour too.
+ */
+function vol(node) {
+    const maybe = node;
+    return typeof maybe.volatile === 'function' ? maybe.volatile() : node;
+}
 export const Config = z.object({
     rulesFile: z.string(),
     dshHome: z.string(),
-    defaultAction: z.union(['allow', 'ask', 'deny']).default('ask').volatile(),
-    caseInsensitivePaths: z.boolean().default(true).volatile(),
-    classifierEnabled: z.boolean().default(false).volatile(),
-    classifierEndpoint: z.string().volatile(),
-    classifierModel: z.string().default('deepseek-chat').volatile(),
-    classifierApiKey: z.string().volatile(),
-    riskTimeoutMs: z.number().min(1000).default(20_000).volatile(),
-    riskLearning: z.boolean().default(true).volatile(),
-    riskSediment: z.boolean().default(true).volatile(),
-    classifierSource: z.union(['custom', 'host']).default('custom').volatile(),
-    classifierProvider: z.string().volatile(),
-    riskThreshold: z.number().min(1).max(10).default(1).volatile(),
+    defaultAction: vol(z.union(['allow', 'ask', 'deny']).default('ask')),
+    caseInsensitivePaths: vol(z.boolean().default(true)),
+    classifierEnabled: vol(z.boolean().default(false)),
+    classifierEndpoint: vol(z.string()),
+    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierApiKey: vol(z.string()),
+    riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
+    riskLearning: vol(z.boolean().default(true)),
+    riskSediment: vol(z.boolean().default(true)),
+    classifierSource: vol(z.union(['custom', 'host']).default('custom')),
+    classifierProvider: vol(z.string()),
+    riskThreshold: vol(z.number().min(1).max(10).default(1)),
     learningFile: z.string(),
     eventsFile: z.string(),
-    grantTtlMs: z.number().min(1).default(5 * 60_000).volatile(),
-    grantMaxUses: z.number().min(1).default(1).volatile(),
-    permissive: z.boolean().default(false).volatile(),
+    grantTtlMs: vol(z.number().min(1).default(5 * 60_000)),
+    grantMaxUses: vol(z.number().min(1).default(1)),
+    permissive: vol(z.boolean().default(false)),
+    yolo: vol(z.boolean().default(false)),
+    rulesFallback: vol(z.boolean().default(false)),
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: vol(z.array(z.string()).default([])),
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: vol(z.boolean().default(true)),
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: vol(z.boolean().default(false)),
+    scriptReview: vol(z.boolean().default(true)),
     gatePresets: z.array(z.string()),
-    permissiveStrategies: z.object({
+    permissiveStrategies: vol(z.object({
         trustAutoAllow: z.boolean().default(true),
         alwaysConfirm: z.boolean().default(false),
         llmAssist: z.boolean().default(false),
         trustEscalation: z.boolean().default(true),
-    }).volatile(),
-    allowlist: z.array(z.string()).volatile(),
-    denyKeywords: z.array(z.string()).volatile(),
-    autoAllowTools: z.array(z.string()).volatile(),
-    sessionSweep: z.boolean().default(true).volatile(),
+    })),
+    allowlist: vol(z.array(z.string())),
+    denyKeywords: vol(z.array(z.string())),
+    denyKeywordsExtra: vol(z.array(z.string()).default([])),
+    credentialPaths: vol(z.array(z.string()).default([])),
+    extraContentArgKeys: vol(z.array(z.string()).default([])),
+    extraOperationArgKeys: vol(z.array(z.string()).default([])),
+    presetRulesSeeded: vol(z.boolean().default(false)),
+    autoAllowTools: vol(z.array(z.string())),
+    sessionSweep: vol(z.boolean().default(true)),
     workspaceStoreFile: z.string(),
     // Rule chain (T1.9)
-    searchUp: z.boolean().default(false).volatile(),
+    searchUp: vol(z.boolean().default(false)),
     fallbackPath: z.string(),
-    badFilePolicy: z.union(['fail', 'warn']).default('fail').volatile(),
-    maxChainLength: z.number().min(1).max(50).default(10).volatile(),
+    badFilePolicy: vol(z.union(['fail', 'warn']).default('fail')),
+    maxChainLength: vol(z.number().min(1).max(50).default(10)),
     // Network (Phase 2)
-    networkEnabled: z.boolean().default(false).volatile(),
-    networkMode: z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist').volatile(),
-    networkUnlisted: z.union(['ask', 'deny']).default('ask').volatile(),
-    networkUnattributed: z.union(['allow', 'deny']).default('allow').volatile(),
-    networkLoopback: z.union(['allow', 'policy']).default('allow').volatile(),
-    networkBind: z.string().default('127.0.0.1').volatile(),
-    networkPort: z.number().min(0).max(65535).default(0).volatile(),
-    networkNoProxy: z.union(['clear', 'preserve']).default('clear').volatile(),
-    networkInjectEnv: z.boolean().default(true).volatile(),
-    networkAskTimeoutMs: z.number().min(1000).max(600_000).default(120_000).volatile(),
-    networkGrantTtlMs: z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000).volatile(),
+    networkEnabled: vol(z.boolean().default(false)),
+    networkMode: vol(z.union(['deny-all', 'whitelist', 'allow-all']).default('whitelist')),
+    networkUnlisted: vol(z.union(['ask', 'deny']).default('ask')),
+    networkUnattributed: vol(z.union(['allow', 'deny']).default('allow')),
+    networkLoopback: vol(z.union(['allow', 'policy']).default('allow')),
+    networkBind: vol(z.string().default('127.0.0.1')),
+    networkPort: vol(z.number().min(0).max(65535).default(0)),
+    networkNoProxy: vol(z.union(['clear', 'preserve']).default('clear')),
+    networkInjectEnv: vol(z.boolean().default(true)),
+    networkAskTimeoutMs: vol(z.number().min(1000).max(600_000).default(120_000)),
+    networkGrantTtlMs: vol(z.number().min(0).max(24 * 60 * 60_000).default(30 * 60_000)),
     // AppContainer sandbox (Windows; goal 2)
-    sandboxEnabled: z.boolean().default(false).volatile(),
-    sandboxMode: z.union(['read-only', 'workspace-write']).default('workspace-write').volatile(),
-    sandboxProxy: z.string().default('').volatile(),
-    sandboxLoopback: z.union(['exempt', 'off']).default('exempt').volatile(),
+    sandboxEnabled: vol(z.boolean().default(false)),
+    sandboxMode: vol(z.union(['read-only', 'workspace-write']).default('workspace-write')),
+    sandboxProxy: vol(z.string().default('')),
+    sandboxLoopback: vol(z.union(['exempt', 'off']).default('exempt')),
     // 0.1.7: the rules document lives on this entry as a volatile whole-object
     // field (a second settings namespace is no longer projectable). Unconfigured
     // (bare defaults) -> the rules file remains the source.
-    rules: RulesSchema.volatile(),
+    rules: vol(RulesSchema),
     // Hot reload (Phase 3)
     watch: z.boolean().default(false),
     watchDebounceMs: z.number().min(50).max(5000).default(300),
@@ -217,7 +260,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'autoAllowTools',
+    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/credential-paths.d.ts

@@ -0,0 +1,35 @@
+/**
+ * User-declared credential paths — the long tail the built-in list cannot know.
+ *
+ * The built-in credential set (`.ssh`, `.aws`, `.npmrc`, `credentials.yaml`, …) ships in
+ * `path.ts` because the layer that needs it is P0: a `read`/`grep` call is auto-allowed
+ * one stage before the rule chain runs, and mutating a file tool never reaches a model
+ * that could be talked out of it. That is also why this cannot simply be "add a rule to
+ * `rules.yml`" for the read side — see the note in `runtime.ts` about why the auto-allow
+ * does not consult the ruleset (preset entries and hand-written entries live in one
+ * document with no provenance, so `.dsh/**` would start blocking legitimate memory
+ * reads).
+ *
+ * So the *list* is what a user extends, through the `credentialPaths` setting, and the
+ * *tier* stays where it has to be: a listed path gets the same treatment as the
+ * built-ins — reading it outside the workspace is refused, writing it is refused.
+ *
+ * Matching is pure string work: no filesystem access, no resolution, no execution. A
+ * pattern that cannot be understood is dropped rather than guessed at — an unreadable
+ * entry must not silently become "protects everything".
+ */
+/**
+ * Compile the configured credential paths into one predicate.
+ *
+ * Returns a matcher that answers `false` for an empty or unusable list, so callers can
+ * pass the raw setting straight through. `home` expands a leading `~/` the way a shell
+ * would, because the setting is written in home-relative form (`~/.myco/vault.token`)
+ * while the paths being judged are absolute. **Without `home`** the `~/` is stripped and
+ * the rest matched as a path fragment — a declared secret must not silently stop
+ * protecting because one caller did not know the user directory; the widened tail match
+ * only ever denies more, never less.
+ */
+export declare function compileCredentialPaths(entries: readonly string[] | undefined, opts?: {
+    readonly caseInsensitive?: boolean;
+    readonly home?: string;
+}): (path: string) => boolean;