dsh-perm-gate 5.1.2 → 5.3.0

package/lib/index.js

@@ -3,14 +3,18 @@ import { join } from 'node:path';
 import { SandboxController } from './appcontainer/index.js';
 import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
+import { mergePresetIntoRaw } from './preset-rules.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
 // T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
 import { registerSettingsBridgeRoutes } from './bridge.js';
 import { buildReceiverInfo } from './receiver-info.js';
+import { composeReviewOpinion } from './feedback.js';
+import { redactCommandText } from './redact.js';
 import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
 import { classifySessions, sweepSessionData } from './session-sweep.js';
+import { isHumanFree } from './unattended.js';
 import { decideNetworkTarget } from './network.js';
 import { NetworkLifecycle } from './network-lifecycle.js';
 import { RuleWatcher } from './watch.js';
@@ -137,19 +141,13 @@ export function makeApprovalAnswerer(runtime) {
  * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
  * (fail-closed).
  */
-export function makePreExecuteListener(runtime) {
+export function makePreExecuteListener(runtime, feedback) {
     return async (exec, next) => {
         const decision = runtime.decideExecution(exec);
-        // Passthrough (allow / stand-down) and a hard-deny need no grading.
-        if (decision === undefined) {
-            // The call proceeds: register it so a network connection made by its
-            // child process can be attributed back to this session.
+        // The sanctioned "let it run" seam: register for network attribution, apply the
+        // AppContainer rewrite if enabled, then hand to the next waterfall listener.
+        const allowAndRun = async () => {
             runtime.beginShellExecution(exec);
-            // AppContainer sandbox (goal 2): rewrite the allowed shell call into
-            // the launcher invocation, or fail closed. The host executes THIS exec
-            // object after the waterfall resolves, so the in-place arguments swap
-            // is the sanctioned seam; the base64 wrapper keeps every pipe/&&
-            // inside the container (outer shell sees a plain exe call).
             if (typeof runtime.sandboxRewrite === 'function') {
                 const rewrite = await runtime.sandboxRewrite(exec);
                 if (rewrite !== undefined) {
@@ -162,9 +160,49 @@ export function makePreExecuteListener(runtime) {
                 }
             }
             return next();
+        };
+        // Human-free tiers — never a human prompt. A bare allow runs as usual; a
+        // deterministic deny blocks and feeds back; an ask is settled by whoever the tier put
+        // in the human's seat: YOLO hands what the mechanical floor could not name to the
+        // review model (and a grader throw fails open to allow), while the mechanical tier
+        // stops AT the floor and calls no model at all. Both block and feed the opinion back
+        // on a hit. `safety-net-ask` is NOT human-free — it is the explicit keep-the-person
+        // answer (and the one entry that beats a global yolo) — so it falls through to the
+        // ordinary waterfall below. Probed via `?.` so a stub/embedded runtime without the
+        // tier surface behaves as non-unattended.
+        const mode = runtime.unattendedModeOf?.(exec) ?? null;
+        if (mode !== null && isHumanFree(mode)) {
+            if (decision === undefined)
+                return allowAndRun();
+            if (decision.kind === 'deny') {
+                feedback?.(exec, decision);
+                return decision;
+            }
+            let resolved;
+            try {
+                resolved = mode === 'safety-net-passthrough'
+                    ? runtime.resolveSafetyNet?.(exec, decision)
+                    : await runtime.resolveYolo?.(exec, decision);
+            }
+            catch {
+                resolved = undefined; // fail-open: could not grade → allow ("其余放行")
+            }
+            if (resolved === undefined)
+                return allowAndRun();
+            feedback?.(exec, resolved);
+            return resolved;
+        }
+        // Passthrough (allow / stand-down) and a hard-deny need no grading.
+        if (decision === undefined) {
+            return allowAndRun();
+        }
+        if (decision.kind !== 'ask') {
+            // A deterministic deny (P0 hard-deny / deny-keyword / rule) never reaches a
+            // human; feed the structured opinion back so the main LLM stops retrying
+            // variants — the same guidance cc-safety-net attaches to its BLOCKED message.
+            feedback?.(exec, decision);
+            return decision;
         }
-        if (decision.kind !== 'ask')
-            return decision; // deny: it never runs
         // A cancelled call is never worth a model round-trip; the registry rechecks
         // cancellation after this gate settles.
         if (exec.signal?.aborted === true)
@@ -176,14 +214,16 @@ export function makePreExecuteListener(runtime) {
         catch {
             return decision; // fail-closed: keep the human ask
         }
-        if (refined === undefined) {
-            runtime.beginShellExecution(exec);
-            return next();
-        }
+        if (refined === undefined)
+            return allowAndRun();
         // Still an ask: the human decides. Register optimistically so a call they
         // approve is attributable; a rejection is dropped by the abort/settle path.
         if (refined.kind === 'ask')
             runtime.beginShellExecution(exec);
+        // A degraded-review block (`rulesFallback` with no reviewer) is a deny nobody
+        // ever saw a popup for — the same opinion the YOLO path owes the main LLM.
+        if (refined.kind === 'deny')
+            feedback?.(exec, refined);
         return refined;
     };
 }
@@ -206,6 +246,25 @@ export function apply(ctx, config = {}) {
     // the ref unset and the runtime falls back to its rules-file write paths.
     const ENTRY_ID = 'dsh-perm-gate';
     const settingsRef = {};
+    // 预设拒绝表播种：一次性、只走宿主设置面（写回落进 profile patch 的本插件
+    // config 条目）。刻意不再写插件自有的 `perm-gate/rules.yml` —— 那是用户手维护的
+    // 规则源，混进 51 条预设会让「我的规则」与「插件注入的规则」不可区分。
+    // 两条经实测定下的约束：① 必须在各分支「注册完成之后」调（0.1.5 上 ns 要等
+    // installSection 才注册，提前写报 `settings namespace ... is not registered`）；
+    // ② 规则与幂等位必须合成一次 update（拆两次时 0.1.7 第二次报 `Plugin entry ... is
+    // no longer configurable`，幂等位永远落不下去 ⇒ 用户全删后会被重新塞回）。
+    // 写失败不阻断启动也不置幂等位 ⇒ 下次激活重试。
+    const seedPresetDenyTable = (svc) => {
+        void (async () => {
+            if (current().presetRulesSeeded === true)
+                return;
+            const merged = mergePresetIntoRaw(readVolatileValue(config.rules));
+            await svc.update(ENTRY_ID, { rules: merged.doc, presetRulesSeeded: true });
+            console.log(`[dsh-perm-gate] preset deny table seeded via settings (+${merged.added} rules)`);
+        })().catch((e) => {
+            console.warn('[dsh-perm-gate] preset deny table 播种失败（不阻断启动，下次激活重试）:', e);
+        });
+    };
     ctx.inject(['settings'], (child) => {
         const svc = child.settings;
         settingsRef.svc = svc;
@@ -253,6 +312,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
             return;
         }
         void (async () => {
@@ -279,6 +339,7 @@ export function apply(ctx, config = {}) {
                             console.warn('[dsh-perm-gate] legacy seed update failed:', e);
                         });
                     }
+                    seedPresetDenyTable(svc);
                     return;
                 }
             }
@@ -306,6 +367,7 @@ export function apply(ctx, config = {}) {
                     console.warn('[dsh-perm-gate] rules seed write failed:', e);
                 });
             }
+            seedPresetDenyTable(svc);
         })();
     });
     const settingsWrite = (write) => {
@@ -326,6 +388,7 @@ export function apply(ctx, config = {}) {
     // entry that omits `config` still records events, snapshots and learning.
     const dataDir = resolveDataDir(typeof config.dshHome === 'string' ? config.dshHome : undefined);
     const rulesFilePath = resolveRulesFile(typeof config.rulesFile === 'string' ? config.rulesFile : undefined, dataDir);
+    // 预设拒绝表的播种在上面的 settings inject 回调里（那里才有 svc）。
     // Host model-group services (typed minimally; supplied by the dsh runtime
     // through the loader `inject` — dsh-approval-gate demonstrates the same
     // contract). The llm service backs the `host` receiver; agentDefaultModel
@@ -421,6 +484,21 @@ export function apply(ctx, config = {}) {
                 strategies: resolvePermissiveStrategies(c.permissiveStrategies),
             };
         },
+        // Read the YOLO switch live so the settings-card toggle takes effect on the next tool
+        // call. It is the switch behind the `permissive-yolo` tier only — never a flow added to
+        // sessions that did not select it.
+        readYolo: () => current().yolo ?? false,
+        // The two `safenet` switches, read live: each controls whether one implementation
+        // exists, and each implementation owns one preset, so presets never cross.
+        readSafenetPass: () => current().safenetPass ?? true,
+        readSafenetAsk: () => current().safenetAsk ?? false,
+        // Degraded review: when no reviewer can grade an ask (none configured, or the
+        // endpoint gave up), the deterministic nets decide instead of a popup nobody
+        // answers — a cc-safety-net-class gate that blocks named danger and runs the rest.
+        readRulesFallback: () => current().rulesFallback ?? false,
+        // Script review (on by default): the body of every script a call runs rides the
+        // review, so neither the grader nor the human is judging a bare filename.
+        readScriptReview: () => current().scriptReview ?? true,
         // Read the llmAssist receiver (endpoint/model/secret/timeout) live from the
         // same namespace, so editing the settings card applies to the next tool call.
         readClassifyConfig: () => {
@@ -445,6 +523,28 @@ export function apply(ctx, config = {}) {
             const c = current();
             return Array.isArray(c.denyKeywords) ? c.denyKeywords : undefined;
         },
+        // Appended blacklist entries (long-tail secrets of the user's own) and the declared
+        // credential paths: both read live, so an edit in the settings card applies to the
+        // next tool call without a reload.
+        readDenyKeywordsExtra: () => {
+            const c = current();
+            return Array.isArray(c.denyKeywordsExtra) ? c.denyKeywordsExtra : [];
+        },
+        readCredentialPaths: () => {
+            const c = current();
+            return Array.isArray(c.credentialPaths) ? c.credentialPaths : [];
+        },
+        // Which argument fields count as prose is a per-deployment fact (every host ships new
+        // document keys); read both lists live so an edit in the settings card applies to the
+        // next call rather than to the next restart.
+        readExtraContentArgKeys: () => {
+            const c = current();
+            return Array.isArray(c.extraContentArgKeys) ? c.extraContentArgKeys : [];
+        },
+        readExtraOperationArgKeys: () => {
+            const c = current();
+            return Array.isArray(c.extraOperationArgKeys) ? c.extraOperationArgKeys : [];
+        },
         // Learning sedimentation: threshold-reached samples become deterministic allows.
         readRiskSediment: () => current().riskSediment ?? true,
         // llmAssist receiver source: custom OpenAI-compatible endpoint or the host llm service.
@@ -718,7 +818,33 @@ export function apply(ctx, config = {}) {
     catch {
         // webServer unavailable: the feed remains disk-only, sediment is view-only in files
     }
-    const listener = makePreExecuteListener(runtime);
+    // YOLO feedback: when a call is blocked (YOLO block **or** a deterministic deny in
+    // any mode), append a user-role "工具审核意见" message to the owning session so the
+    // main LLM sees why + which rule + a disposition and self-corrects — modeled on
+    // cc-safety-net's BLOCKED message. Best-effort; a failed delivery never un-blocks.
+    const yoloSender = buildSessionSender(fallbackGet);
+    const blockedSubject = (exec) => {
+        const args = exec.arguments ?? {};
+        const cmd = (typeof exec.commandText === 'string' && exec.commandText !== ''
+            ? exec.commandText
+            : (typeof args.command === 'string' ? args.command : undefined));
+        if (cmd !== undefined)
+            return redactCommandText(cmd);
+        const p = ['file_path', 'path', 'cwd', 'workdir'].map((k) => args[k]).find((v) => typeof v === 'string');
+        return `${exec.name}${typeof p === 'string' ? ': ' + p : ''}`;
+    };
+    const yoloFeedback = (exec, decision) => {
+        const sessionId = (typeof exec.sessionId === 'string' && exec.sessionId !== ''
+            ? exec.sessionId
+            : (exec.agent?.sessionId ?? exec.agent?.session?.id) ?? '');
+        if (sessionId === '')
+            return;
+        const { text } = composeReviewOpinion({ command: blockedSubject(exec), reason: decision.reason, locale: 'zh' });
+        void yoloSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
+            // no delivery channel — the block still stands, the LLM just gets no note.
+        });
+    };
+    const listener = makePreExecuteListener(runtime, yoloFeedback);
     // `tools/pre-execute` / `tools/result` / `approval/request` are service events,
     // not part of cordis core's typed `Events`, so they are registered through the
     // string overload.

package/lib/irreversible.js

@@ -178,7 +178,87 @@ function isRootish(token) {
     if (t === '--no-preserve-root' || t.endsWith('--no-preserve-root'))
         return true;
     return DRIVE_ROOT.test(t) || FS_ROOT.test(t) || WIN_SYSTEM.test(t) || WIN_USERS.test(t) || NIX_SYSTEM.test(t)
-        || FLAT_DRIVE_ROOT.test(t.replace(/[\\/]+/g, ''));
+        || FLAT_DRIVE_ROOT.test(t.replace(/[\\/]+/g, ''))
+        || isHomeVariableRoot(t);
+}
+/**
+ * The user profile / home expressed as a **variable or glob**, not a literal path.
+ *
+ * `$env:USERPROFILE` (cmd `%USERPROFILE%`), the PowerShell automatic `$HOME` /
+ * `${HOME}`, `$PSHOME`, `$env:HOME`/`$HOMEPATH`/`$env:HOMEPATH`, the bare shell
+ * home `~`, and any dotfile sweep of those (`~/*`, `~/.*`, `~/?*`, `$env:USERPROFILE\.*`)
+ * all resolve at run time to `C:\Users\<name>` — the exact target `WIN_USERS` already
+ * hard-denies in literal form. The incident this closes is the *variable* spelling:
+ * `Remove-Item $home -Recurse -Force` (where `$home=` assignment silently no-ops) or
+ * `Get-ChildItem $env:USERPROFILE -Force | Remove-Item` reach the grader as an
+ * unresolvable token, are not root-shaped, so a probabilistic `safe` cleared them.
+ * Matching the root itself (or an unbounded `*`/`.?` sweep of it) — never a specific
+ * child like `~/.cache` — keeps legitimate scoped cleanup clearable while making the
+ * profile-root delete deterministic, no-model, and immune to an `llmAssist`/YOLO
+ * `safe` downgrade.
+ */
+const HOME_ROOT_VAR = /^(?:\$\{?(?:home|homeroot|userprofile|profile|pshome|env:userprofile|env:home|env:homeroot|env:profile)\}?|%userprofile%)$/i;
+// A home/profile root variable optionally followed by an unbounded sweep (`/.*`,
+// `/?*`, `/*`, or just `.*`). Separators are normalized before this test, so the
+// quoted `"$env:USERPROFILE\.*"` (arrives with a backslash) and the stripped-flat
+// `$env:USERPROFILE.*` both land here — the decomposer removes `\` from unquoted
+// args, so demanding a literal `/` would miss the more common Windows form.
+const HOME_ROOT_PREFIX = /^(?:\$\{?(?:home|homeroot|userprofile|pshome|env:userprofile|env:home|env:homeroot|env:profile)\}?|%userprofile%|~)/i;
+/** Whether one token names the home/profile root (or an unbounded sweep of it). */
+function isHomeVariableRoot(token) {
+    const t = token.trim().replace(/[\\/]+/g, '/').replace(/\/$/, '');
+    if (t === '~')
+        return true;
+    if (HOME_ROOT_VAR.test(t))
+        return true;
+    // `<home-var>/<unbounded glob>` — `~/.*`, `~/*`, `$env:USERPROFILE/.*`.
+    if (HOME_ROOT_PREFIX.test(t)) {
+        const rest = t.slice(t.indexOf('/') + 1);
+        return /^(?:\.?\*|\.\?\*|\.\?\?\*)$/.test(rest);
+    }
+    return false;
+}
+/**
+ * Other common Windows roots an agent reaches for **by environment variable**, which
+ * the literal-path rules (`WIN_SYSTEM` / `WIN_USERS`) cannot see because the token is
+ * a `$env:`/`%VAR%` name, not `C:\Windows`. Deleting one of these recursively destroys
+ * either the whole system (`SystemRoot`/`ProgramFiles`/`ProgramData`) or every app's
+ * configuration and user data (`APPDATA`/`LOCALAPPDATA`/`OneDrive`/`Public`) in one
+ * shot.
+ *
+ * These grade **never-clear** (permanent ask), not P0 deny: unlike `$HOME` (the profile
+ * root itself, already denied), a whole-`LOCALAPPDATA`/`ProgramData` wipe is sometimes
+ * deliberate maintenance the human should still decide on — so no grader `safe` may
+ * clear it and no run of confirmations may sediment it, but appeal stays open.
+ *
+ * Only the **bare root or an unbounded sweep** (`$env:APPDATA`, `"$env:LOCALAPPDATA\.*"`)
+ * qualifies — a named child (`$env:LOCALAPPDATA\Foo\bar`) is normal scoped cleanup and
+ * must stay clearable. `TEMP`/`TMP`/`TMPDIR` are explicitly **excluded**: deleting the
+ * temp root is legitimate. Separators are normalized (`\`→`/`) and matching is
+ * case-insensitive, so `$Env:AppData`, `${env:appdata}`, and `%APPDATA%` all land here.
+ */
+const PROTECTED_ENV_SYSTEM = new Set(['systemroot', 'windir', 'systemdrive', 'programfiles', 'programfiles(x86)', 'programdata']);
+const PROTECTED_ENV_USERDATA = new Set(['appdata', 'localappdata', 'onedrive', 'public', 'homedrive', 'homepath']);
+const EXCLUDED_ENV_ROOTS = new Set(['temp', 'tmp', 'tmpdir', 'tempdir']);
+const ENV_ROOT_TOKEN = /^(?:\$\{?env:([^/}]+)\}?|%([^%/]+)%)(.*)$/i;
+/** Which protected root (if any) one token names — the bare root or an unbounded sweep. */
+function protectedEnvRoot(token) {
+    const t = token.trim().replace(/[\\/]+/g, '/').replace(/\/+$/, '').toLowerCase();
+    const m = ENV_ROOT_TOKEN.exec(t);
+    if (m === null)
+        return undefined;
+    const name = (m[1] ?? m[2] ?? '').trim();
+    if (name === '' || EXCLUDED_ENV_ROOTS.has(name))
+        return undefined;
+    const rest = (m[3] ?? '').replace(/^\/+/, '');
+    // bare root (empty tail) or an unbounded glob sweep; anything else is a named child.
+    if (rest !== '' && !/^(?:\.?\*|\.\?\*|\.\?\?\*)$/.test(rest))
+        return undefined;
+    if (PROTECTED_ENV_SYSTEM.has(name))
+        return 'system';
+    if (PROTECTED_ENV_USERDATA.has(name))
+        return 'userdata';
+    return undefined;
 }
 /**
  * Forced recursive deletion aimed at a root or system tree.
@@ -274,6 +354,20 @@ export function irreversibleReason(text, opts = {}) {
     }
     if (forcedDeleteOfRoot(text, programs))
         return 'forced recursive deletion targets a system root';
+    // Forced/recursive delete aimed at the profile expressed as a home **variable**
+    // or a dotfile sweep of it (`$home`/`$HOME`/`$PSHOME`/`$env:USERPROFILE`/`~`/`~/.*`).
+    // Checked independently of `forcedDeleteOfRoot` because the incident shape nests the
+    // delete inside `if (Test-Path $home) { Remove-Item … }`, where the shell parser
+    // never surfaces `Remove-Item` as a command word, so the program-scanning path is
+    // blind to it. Requiring (recurse AND force AND a home-root token) keeps scoped
+    // cleanup of a named child (`~/.cache`, `$buildDir`) clearable — only the profile
+    // root or an unbounded sweep of it lands here. This makes it irreversible, which
+    // the ask-context grades `I` and `refineAsk` refuses to clear on a grader `safe`.
+    if (/\b(?:remove-item|rmdir|erase|unlink|shred)\b|\brm\b|\bdel\b/i.test(text)
+        && /-(?:recurse|r\b|rf|fr|\w*r\w*)/i.test(text) && /-(?:force|fo|f\b|rf|fr|\w*f\w*)/i.test(text)
+        && text.split(/[\s"',;{}()&|]+/).some(isHomeVariableRoot)) {
+        return 'forced recursive deletion targets the user profile via a home variable or a dotfile sweep of it';
+    }
     // Deleting the gate's own state directory is unrecoverable and disarms the gate:
     // no recurse flag required, because the WAL/journal files are the point.
     if (programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p)) && OWN_STATE_PATH.test(text)) {
@@ -372,5 +466,19 @@ export function neverClearReason(text) {
         return 'keys are swept off this machine and uploaded';
     if (WIPE_IN_BODY.test(text))
         return 'a wipe is hidden behind a function body expanded at runtime';
+    // Forced/recursive delete aimed at a protected Windows root reached **by environment
+    // variable** (`$env:APPDATA`/`%APPDATA%`/`$env:SystemRoot`/`%WINDIR%`/`$env:ProgramFiles`
+    // /`$env:ProgramData`/`$env:LOCALAPPDATA`/`$env:OneDrive`/`$env:Public`/`$env:HOMEDRIVE`
+    // /`$env:HOMEPATH`), or an unbounded sweep of one. Same shape as the home-variable net
+    // (delete verb + loose recurse/force + a root token), but tiered to **never-clear ask**,
+    // not P0: TEMP/TMP and named children (`$env:APPDATA\Foo`) never match, and the human
+    // keeps the appealable decision. Tokenize on whitespace/quotes only, so `${env:x}` and
+    // `$env:x\.*` stay one token. Delete-verb comes from `programs` (command position), so
+    // a commit message merely *mentioning* `rm -rf $env:APPDATA` stays clearable.
+    if (programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p))
+        && /(?:-\w*r\w*|(?:^|\s)\/s(?:\s|$))/i.test(text) && /(?:-\w*f\w*|(?:^|\s)\/(?:q|f)(?:\s|$))/i.test(text)
+        && text.split(/[\s"',;]+/).some((tok) => protectedEnvRoot(tok) !== undefined)) {
+        return 'forced recursive deletion targets a protected Windows root via an environment variable — verify the resolved path before proceeding';
+    }
     return undefined;
 }

package/lib/path.d.ts

@@ -16,6 +16,37 @@ export declare function normalizeWorkspacePath(cwd: string, candidate: string, c
 export declare function isWithin(base: string, target: string): boolean;
 /** Sensitive credential-ish path roots that reads/writes should route to review. */
 export declare function isSensitivePath(p: string): boolean;
+/**
+ * Credential / auth stores whose **mutation** grants or destroys access and must
+ * never be silently allowed. Narrower than {@link isSensitivePath}: `.env` is
+ * deliberately excluded — editing a project's own `.env` is normal dev work (a
+ * secret-reading *display* concern, not a mutation backdoor), while dropping a key
+ * into `~/.ssh/authorized_keys`, flipping `git config credential.helper store`, or
+ * rewriting `.git-credentials`/`.npmrc`/cloud cred files *creates or leaks authority*.
+ *
+ * Also excluded on purpose, because a P0 deny cannot be appealed and these are both
+ * routine *and* regenerable: the bare `~/.ssh/` directory (its `config` only holds host
+ * aliases), `known_hosts` (rebuilt with `ssh-keyscan`), and the `*.pub` half of a
+ * keypair — a hand-carried key restore writes `id_ed25519.pub` and `known_hosts` in the
+ * same breath, so blocking them would deny the owner their own credentials. Private key
+ * material itself stays denied: overwriting it destroys access with no way back, and a
+ * deliberate restore can still be done by the human outside the gate.
+ *
+ * Symmetry with the shell layer: `preset-rules` already denies deletion of these
+ * stores and asks on reading them, but the file-mutation tools (write/edit) were
+ * auto-allowed past the credential path because the P0 mutation guard only covered
+ * system roots — this is the set that guard now also checks.
+ */
+export declare function isCredentialStorePath(p: string): boolean;
+/**
+ * Whether one path is a credential worth P0 attention — the built-in store list, plus
+ * whatever the user declared in `credentialPaths` (compiled by `credential-paths.ts`).
+ *
+ * The extension point is a predicate rather than a second list so the *tier* cannot be
+ * chosen by the person adding an entry: a declared long-tail secret gets exactly what
+ * `.ssh` gets, and cannot accidentally land in a downgradable `ask` instead.
+ */
+export declare function isProtectedCredentialPath(p: string, extra?: (path: string) => boolean): boolean;
 /** Root-level / DSH_HOME / home/system paths that must never be mutated. */
 export declare function isProtectedDestructiveTarget(p: string, dshHome?: string): boolean;
 export interface ArtifactRecord {

package/lib/path.js

@@ -54,6 +54,41 @@ export function isWithin(base, target) {
 export function isSensitivePath(p) {
     return /(?:^|[\\/])(?:\.ssh|\.gnupg|\.aws|\.azure|\.kube|\.config[\\/]gh|\.docker)(?:[\\/]|$)|(?:^|[\\/])(?:id_rsa|id_ed25519|credentials\.yaml|config\.json|\.env)(?:$|[.\\/])/i.test(p);
 }
+/**
+ * Credential / auth stores whose **mutation** grants or destroys access and must
+ * never be silently allowed. Narrower than {@link isSensitivePath}: `.env` is
+ * deliberately excluded — editing a project's own `.env` is normal dev work (a
+ * secret-reading *display* concern, not a mutation backdoor), while dropping a key
+ * into `~/.ssh/authorized_keys`, flipping `git config credential.helper store`, or
+ * rewriting `.git-credentials`/`.npmrc`/cloud cred files *creates or leaks authority*.
+ *
+ * Also excluded on purpose, because a P0 deny cannot be appealed and these are both
+ * routine *and* regenerable: the bare `~/.ssh/` directory (its `config` only holds host
+ * aliases), `known_hosts` (rebuilt with `ssh-keyscan`), and the `*.pub` half of a
+ * keypair — a hand-carried key restore writes `id_ed25519.pub` and `known_hosts` in the
+ * same breath, so blocking them would deny the owner their own credentials. Private key
+ * material itself stays denied: overwriting it destroys access with no way back, and a
+ * deliberate restore can still be done by the human outside the gate.
+ *
+ * Symmetry with the shell layer: `preset-rules` already denies deletion of these
+ * stores and asks on reading them, but the file-mutation tools (write/edit) were
+ * auto-allowed past the credential path because the P0 mutation guard only covered
+ * system roots — this is the set that guard now also checks.
+ */
+export function isCredentialStorePath(p) {
+    return /(?:^|[\\/])authorized_keys2?(?:$|[.\\/])|(?:^|[\\/])(?:id_rsa|id_dsa|id_ecdsa|id_ed25519)(?:_sk)?(?!\.pub)(?:$|[.\\/])|(?:^|[\\/])(?:\.gnupg|\.aws|\.azure|\.kube|credentials\.yaml)(?:[\\/]|$)|(?:^|[\\/])(?:\.gitconfig|\.git-credentials|\.npmrc|\.netrc|\.pypirc)(?:$|[.\\/])/i.test(p);
+}
+/**
+ * Whether one path is a credential worth P0 attention — the built-in store list, plus
+ * whatever the user declared in `credentialPaths` (compiled by `credential-paths.ts`).
+ *
+ * The extension point is a predicate rather than a second list so the *tier* cannot be
+ * chosen by the person adding an entry: a declared long-tail secret gets exactly what
+ * `.ssh` gets, and cannot accidentally land in a downgradable `ask` instead.
+ */
+export function isProtectedCredentialPath(p, extra) {
+    return isCredentialStorePath(p) || (extra !== undefined && extra(p));
+}
 /** Root-level / DSH_HOME / home/system paths that must never be mutated. */
 export function isProtectedDestructiveTarget(p, dshHome) {
     const posix = toPosix(p).toLowerCase();

package/lib/preset-rules.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Preset deny rule table for dsh-perm-gate.
+ *
+ * Ported from cc-safety-net (MIT, https://github.com/kenryu42/cc-safety-net)
+ * `src/core/rules/destructive.ts` + `secret.ts`, translated into this plugin's
+ * own `permissions` YAML vocabulary (see rule.ts / rule-dims.ts). The catalog
+ * is ONE SHOT-SEEDED preset: on first activation the entries are appended to
+ * the tail of the live rules document's deny/ask lists — the settings `rules`
+ * field when it is configured, otherwise the rules file. Revocation is
+ * user-owned: every entry carries a `[deny-rule:<id>]` tag and can be flipped
+ * to `enabled: false` or deleted in the settings card or the file; the
+ * `presetRulesSeeded` config flag keeps the seed from ever re-adding them.
+ *
+ * Policy decisions baked into this table (auditable history in
+ * .agents/plans/compat-cc-safety-net-deny-table/):
+ * - `git push --force` → ask, not deny (user decision 2026-10-13; also sidesteps
+ *   the glob negation gap for --force-with-lease).
+ * - Dynamic/unverifiable targets (cc's strict-mode fail-closed family) → ask,
+ *   aligning with this gate's existing "undecidable → ask" philosophy.
+ * - Secret protection keeps this gate's ruling: read = ask, write/delete = deny,
+ *   read+egress combos stay in the prompt layer (layered-defense decision).
+ * - Root/home wipes and full-drive Remove-Item are NOT duplicated here — the P0
+ *   irreversible layer runs first and owns them.
+ * - The legacy deny-keyword blacklist (deny-defaults.ts) stays as a parallel
+ *   layer; nothing here replaces it.
+ *
+ * Pure + import-light (yaml + rule.ts only): the client bundle may render the
+ * table from `presetEntriesForView()` without pulling in the node filesystem.
+ */
+import { type PermissionsDoc } from './rule.js';
+/** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
+export declare const PRESET_RULE_MARKER = "[deny-rule:";
+/** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
+export declare function presetRuleId(reason: unknown): string | undefined;
+/**
+ * The preset document in the file's bare YAML form. `defaultAction: ask`
+ * matches the empty-ruleset default, so seeding cannot widen anything.
+ * Patterns obey the compile limits: ≤2 glob stars, ordered subcommand+flag
+ * forms through argv.pipeline (evaluated per simple command as well as over
+ * the joined pipeline — see evaluate.ts), token co-occurrence NEVER through
+ * args (args is any-token OR).
+ */
+export declare const PRESET_RULES_YAML = "defaultAction: ask\n\ndeny:\n  # \u2500\u2500 Git \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [git]\n    argv: { pipeline: [\"git reset --hard*\", \"git reset *--hard*\"] }\n    reason: \"[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git reset --merge*\", \"git reset --abort*\"] }\n    reason: \"[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed.\"\n  - command: [git]\n    argv: { pipeline: [\"git clean *-f*\", \"git clean *--force*\"] }\n    reason: \"[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd.\"\n  - command: [git]\n    argv: { pipeline: [\"git push origin *--delete*\", \"git push * --delete *\", \"git push --delete*\"] }\n    reason: \"[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent.\"\n  - command: [git]\n    argv: { pipeline: [\"git push --mirror*\", \"git push * --mirror\"] }\n    reason: \"[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale.\"\n  - command: [git]\n    argv: { pipeline: [\"git branch -D*\", \"git branch * -D\", \"git branch *--force-delete*\"] }\n    reason: \"[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash drop*\"] }\n    reason: \"[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash clear*\"] }\n    reason: \"[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state.\"\n  - command: [git]\n    argv: { pipeline: [\"git tag -d*\", \"git tag --delete*\"] }\n    reason: \"[deny-rule:git.tag-delete] Tag deletion removes release anchors.\"\n  - command: [git]\n    argv: { pipeline: [\"git reflog delete*\", \"git reflog expire*\"] }\n    reason: \"[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits.\"\n  - command: [git]\n    argv: { pipeline: [\"git rebase --abort*\"] }\n    reason: \"[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip.\"\n  - command: [git]\n    argv: { pipeline: [\"git merge --abort*\"] }\n    reason: \"[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution.\"\n  - command: [git]\n    argv: { pipeline: [\"git rm -rf *\", \"git rm *-rf *\", \"git rm * -rf\", \"git rm -fr *\", \"git rm --force *\", \"git rm * --force\", \"git rm -f *\", \"git rm * -f\"] }\n    reason: \"[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout --force *\", \"git checkout * --force\", \"git checkout -f *\", \"git checkout * -f\", \"git checkout -f\", \"git checkout * --force *\"] }\n    reason: \"[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout -- *\"] }\n    reason: \"[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout * -- *\"] }\n    reason: \"[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout *--pathspec-from-file*\"] }\n    reason: \"[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch *--discard-changes*\"] }\n    reason: \"[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch --force *\", \"git switch * --force\", \"git switch -f *\", \"git switch * -f\"] }\n    reason: \"[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first.\"\n  - command: [git]\n    # git restore <bare path> (the plain unstaged discard) is NOT ported here:\n    # any glob broad enough to catch it also catches the harmless\n    # git restore --staged <path> (G6) \u2014 only the explicit discard forms are\n    # denied, the bare-path case stays in the prompt layer.\n    argv: { pipeline: [\"git restore --worktree *\", \"git restore * --worktree *\", \"git restore * --worktree\", \"git restore -W *\"] }\n    reason: \"[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first.\"\n  - command: [git]\n    argv: { pipeline: [\"git worktree remove --force *\", \"git worktree remove * --force\", \"git worktree remove -f *\", \"git worktree remove * -f\"] }\n    reason: \"[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree.\"\n  - command: [git]\n    args: [\"alias.*\"]\n    reason: \"[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed.\"\n  # params matches the RAW command string: the env-assignment word lands as the\n  # simple command's lowercased word, so a command:[git] dimension would never\n  # see this form \u2014 match on params alone.\n  - params: { command: [\"*GIT_SSH_COMMAND=*\", \"*git_ssh_command=*\", \"*GIT_SSH=*\", \"*git_ssh=*\"] }\n    reason: \"[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code.\"\n\n  # \u2500\u2500 Filesystem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [\"rm#recursive\", \"rm#force\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors.\"\n  - command: [find]\n    argv: { pipeline: [\"find .git*\"] }\n    reason: \"[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state.\"\n  - command: [find]\n    argv: { pipeline: [\"find * -delete\"] }\n    reason: \"[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first.\"\n  - command: [find]\n    argv: { pipeline: [\"find *-exec rm*\", \"find *-delete*\"] }\n    reason: \"[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths.\"\n  - command: [dd]\n    argv: { pipeline: [\"dd * of=/dev/sd*\", \"dd * of=/dev/nvme*\", \"dd * of=/dev/mmcblk*\"] }\n    reason: \"[deny-rule:dd.device-write] dd writing to a block device destroys the disk.\"\n  - command: [mkfs, mke2fs, newfs, \"mkfs.*\"]\n    reason: \"[deny-rule:mkfs.device] Formatting a device erases it.\"\n  - command: [diskutil, wipefs, sgdisk, parted]\n    reason: \"[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data.\"\n  - command: [shred]\n    reason: \"[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it).\"\n  - command: [cat, head, tail, dd]\n    args: [\"*/dev/sd*\", \"*/dev/nvme*\", \"*/dev/disk*\", \"*/dev/mmcblk*\"]\n    reason: \"[deny-rule:redirect.block-device] Redirect target resolving to a disk device path.\"\n\n  # \u2500\u2500 PowerShell \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # Command words are lowercased by the decomposer \u2014 command dimensions must\n  # carry the lowercased verb (Remove-Item \u2192 remove-item).\n  - command: [\"remove-item#recursive\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:powershell.remove-item-git-metadata] Never target .git.\"\n  - command: [powershell, pwsh]\n    argv: { pipeline: [\"pwsh *Remove-Item*\", \"powershell *Remove-Item*\", \"pwsh *remove-item*\", \"powershell *remove-item*\"] }\n    reason: \"[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope.\"\n\n  # \u2500\u2500 Command Prompt \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with\n  # these globs \u2014 every cmd /c recursion is nested behind a second parser,\n  # so its true target is undecidable: it moves to the ask section instead.)\n  - command: [cmd, rmdir, del]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:cmd.recursive-delete-git-metadata] Never target .git.\"\n  - command: [rmdir, del]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project.\"\n  - command: [rmdir, del]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope.\"\n\n  # \u2500\u2500 Secret targets (write/delete deny; reads are the ask section below) \u2500\u2500\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.ssh\", \"*/.aws\", \"*/.gnupg\", \".ssh\", \".aws\"]\n    reason: \"[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate.\"\n  - command: [echo, \"set-content\", \"out-file\"]\n    args: [\".env\", \".env.*\"]\n    reason: \"[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines.\"\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.git-credentials\", \".git-credentials\"]\n    reason: \"[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth.\"\n\nask:\n  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).\n  - command: [git]\n    argv: { pipeline: [\"git push *--force*\", \"git push *-f*\"] }\n    reason: \"[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease.\"\n\n  # cmd /c recursion hides the real target behind a second parser (and quoting):\n  # undecidable \u2192 ask, where cc denied only the drive-root-collapse variant.\n  - command: [cmd]\n    argv: { pipeline: [\"cmd /c *rmdir /s*\", \"cmd /c *del /s*\"] }\n    reason: \"[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target.\"\n\n  # Dynamic targets: this gate's ruling is \"undecidable \u2192 ask\", not fail-closed deny.\n  - command: [\"rm#recursive\", \"remove-item#recursive\"]\n    args: [\"$*\"]\n    reason: \"[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target \u2014 verify the variable yourself.\"\n  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns\n  # never see it \u2014 match the raw command string through the params dimension.\n  - params: { command: [\"*xargs rm*\", \"*xargs del*\"] }\n    reason: \"[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets.\"\n  - command: [parallel]\n    argv: { pipeline: [\"parallel *rm*\", \"*| parallel*\"] }\n    reason: \"[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets.\"\n  - command: [awk]\n    args: [\"*system(*\"]\n    reason: \"[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed.\"\n  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported \u2014 a glob\n  # cannot tell ref candidates from paths, and a broad pattern would prompt on\n  # every git checkout -b new-branch. Documented residual gap.\n\n  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\", \"select-string\"]\n    args: [\".env\", \".env.*\", \"*.env\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"id_rsa\", \"id_ed25519\", \"id_ecdsa\"]\n    reason: \"[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command.\"\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\"]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*/.aws\", \"*/.aws/*\", \"*/.gnupg\", \"*/.gnupg/*\", \"*/.config/gcloud/*\", \"*/.claude/*\", \"*/.codex/*\"]\n    reason: \"[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation.\"\n\n  # Self-protection: editing the gate's own rule sources needs confirmation \u2014\n  # revocation must be a human act, not something an agent can slide through.\n  # (Settings-namespace edits go through the host UI, not a tool call, and are\n  # out of reach of this entry; documented gap.)\n  - args: [\"*rules.yml\", \"*rules.yaml\", \"*deny-defaults*\"]\n    reason: \"[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces.\"\n";
+export declare function parsePresetDoc(): PermissionsDoc;
+/** Every preset id, in table order. Client view + tests use this as the row key. */
+export declare function presetRuleIds(): string[];
+/**
+ * Append missing preset entries to a RAW rules document object (bare or
+ * `permissions:`-wrapped form). Idempotent and revocation-preserving: an id
+ * already present — enabled or not — is never re-added. Mutates nothing;
+ * returns the merged copy and the added count.
+ */
+export declare function mergePresetIntoRaw(rawDoc: unknown): {
+    doc: Record<string, unknown>;
+    added: number;
+};
+/**
+ * One-shot file seed: create the rules file from the preset when absent, or
+ * append missing preset entries when present (comments in a hand-written file
+ * are lost on rewrite — the file is the plugin's data dir, not user-authored
+ * by default). A sibling marker file records that the seed ran: after a full
+ * revocation (user deletes every preset entry) the seed must never re-add
+ * them, and the marker works on hosts without the settings service where the
+ * `presetRulesSeeded` config flag cannot be persisted. Returns what happened
+ * for the log line.
+ */
+export declare function ensurePresetRulesFile(rulesFile: string, markerFile?: string): {
+    action: 'created' | 'merged' | 'skipped' | 'already-seeded';
+    added: number;
+};