dsh-perm-gate 5.3.4 → 5.4.0

package/lib/config.d.ts

@@ -95,6 +95,33 @@ export interface PermGateConfig {
      * rather answer than auto-run. Uncommon by design.
      */
     readonly safenetAsk?: boolean;
+    /**
+     * Protected-branch push floor — **off by default means the floor stands**.
+     * The P0 layer hard-denies `git push --force` / `--force-with-lease` / `--delete` aimed at
+     * the protected branch list (main/master/production/release/stable). This switch is the
+     * deliberate opt-out for developers who own their remotes: when true, the floor steps
+     * aside and the call falls to the seeded `git.push-force` rule, which still **asks a
+     * person** every time unless the user revokes that entry or allowlists the form in their
+     * own rules. It cannot widen anything else: reads, wipes and credential floors are untouched.
+     */
+    readonly allowProtectedBranchPush?: boolean;
+    /**
+     * Credential-family ladder — the **readwrite** rung per family. A listed family's
+     * built-in credential paths are exempted from exactly one P0 clause (credential-store
+     * **writes** — `npm login` legitimately rewrites `~/.npmrc`). Everything else is
+     * untouched: read floors, root/drive screens, dshHome protection, neverClear and the
+     * push floor stay armed at every rung; unlisted families are fully protected.
+     * Values are family ids (`ssh|cloud|package|gitcreds|env|cli|db`); anything outside
+     * the roster is dropped at read time, never guessed at.
+     */
+    readonly credWriteExemptFamilies?: string[];
+    /**
+     * Seed watermark for the preset deny table. Activation re-runs the (per-id idempotent)
+     * merge whenever this lags the shipped table version, so entries added by a plugin
+     * update (the `cred.*` family rows) land on existing installs — and entries the user
+     * revoked stay revoked, because the merge only ever appends missing ids.
+     */
+    readonly presetRulesVersion?: number;
     /**
      * Degraded review — fall back to a **rule-only gate when there is no reviewer**.
      *
@@ -483,6 +510,12 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     safenetPass: z<boolean, boolean, "defined">;
     /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
     safenetAsk: z<boolean, boolean, "defined">;
+    /** Opt-out of the P0 protected-branch push floor; default false keeps the floor. */
+    allowProtectedBranchPush: z<boolean, boolean, "defined">;
+    /** readwrite rung per credential family; unknown ids dropped at consumption. */
+    credWriteExemptFamilies: z<string[], string[], "defined">;
+    /** Preset-table seed watermark; activation backfills when it lags the shipped version. */
+    presetRulesVersion: z<number, number, "defined">;
     scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
     permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
@@ -562,6 +595,12 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     safenetPass: z<boolean, boolean, "defined">;
     /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
     safenetAsk: z<boolean, boolean, "defined">;
+    /** Opt-out of the P0 protected-branch push floor; default false keeps the floor. */
+    allowProtectedBranchPush: z<boolean, boolean, "defined">;
+    /** readwrite rung per credential family; unknown ids dropped at consumption. */
+    credWriteExemptFamilies: z<string[], string[], "defined">;
+    /** Preset-table seed watermark; activation backfills when it lags the shipped version. */
+    presetRulesVersion: z<number, number, "defined">;
     scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
     permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
@@ -611,7 +650,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -207,6 +207,12 @@ export const Config = z.object({
     safenetPass: vol(z.boolean().default(true)),
     /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
     safenetAsk: vol(z.boolean().default(false)),
+    /** Opt-out of the P0 protected-branch push floor; default false keeps the floor. */
+    allowProtectedBranchPush: vol(z.boolean().default(false)),
+    /** readwrite rung per credential family; unknown ids dropped at consumption. */
+    credWriteExemptFamilies: vol(z.array(z.string()).default([])),
+    /** Preset-table seed watermark; activation backfills when it lags the shipped version. */
+    presetRulesVersion: vol(z.number().min(0).default(0)),
     scriptReview: vol(z.boolean().default(true)),
     gatePresets: z.array(z.string()),
     permissiveStrategies: vol(z.object({
@@ -260,7 +266,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
+    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/cred-families.d.ts

@@ -0,0 +1,22 @@
+export type CredFamily = 'ssh' | 'cloud' | 'package' | 'gitcreds' | 'env' | 'cli' | 'db';
+/**
+ * Every family id, in the order the settings face should offer them. Lowercase +
+ * dots/dashes only: the ids ride inside the `[deny-rule:<id>]` tag, whose pattern
+ * does not accept uppercase (a `gitCreds` tag would never parse and the row could
+ * never be located for revocation).
+ */
+export declare const CRED_FAMILY_IDS: readonly CredFamily[];
+/**
+ * Built-in path patterns per family, aligned with the P0 sensitive list (`path.ts`)
+ * and the cc-safety-net secret shapes the deny table was ported from. `~` forms are
+ * home-relative (the matcher strips or expands them); a bare dotted name is a
+ * segment-tail fragment matched at any depth.
+ */
+export declare const CRED_FAMILIES: Readonly<Record<CredFamily, readonly string[]>>;
+/**
+ * Which credential family, if any, claims this path. First family in
+ * {@link CRED_FAMILY_IDS} order wins (ssh before package etc.), so a path cannot
+ * flip families between calls. `undefined` = not a built-in credential path —
+ * custom `credentialPaths` entries have no family and can never be write-exempt.
+ */
+export declare function familyOfPath(path: string | undefined): CredFamily | undefined;

package/lib/cred-families.js

@@ -0,0 +1,63 @@
+/**
+ * Credential families — one shared answer to "which kind of secret is this path".
+ *
+ * The settings face exposes a four-step ladder per family (deny / ask / readonly /
+ * readwrite); the ladder's write side is enforced by `engine.hardDenyReason`, which
+ * consults `familyOfPath` against the `credWriteExemptFamilies` opt-out list. The
+ * exemption is deliberately coarse: family-level, binary, and it steps aside for
+ * exactly one P0 clause (the credential-store mutation floor). Root/drive wipes,
+ * protected destructive targets and the neverClear family are NOT family-scoped and
+ * stay armed whatever a user selects.
+ *
+ * Pure string work (no fs, no execution), so the client bundle can render the family
+ * roster from the same table. Matching reuses `compileCredentialPaths`, keeping glob
+ * semantics identical to the `credentialPaths` setting — one vocabulary, two uses.
+ */
+import { compileCredentialPaths } from './credential-paths.js';
+/**
+ * Every family id, in the order the settings face should offer them. Lowercase +
+ * dots/dashes only: the ids ride inside the `[deny-rule:<id>]` tag, whose pattern
+ * does not accept uppercase (a `gitCreds` tag would never parse and the row could
+ * never be located for revocation).
+ */
+export const CRED_FAMILY_IDS = ['ssh', 'cloud', 'package', 'gitcreds', 'env', 'cli', 'db'];
+/**
+ * Built-in path patterns per family, aligned with the P0 sensitive list (`path.ts`)
+ * and the cc-safety-net secret shapes the deny table was ported from. `~` forms are
+ * home-relative (the matcher strips or expands them); a bare dotted name is a
+ * segment-tail fragment matched at any depth.
+ */
+export const CRED_FAMILIES = {
+    ssh: ['~/.ssh', 'id_rsa', 'id_ed25519', 'id_ecdsa', 'id_dsa', 'authorized_keys'],
+    cloud: ['~/.aws', '~/.gcloud', '~/.config/gcloud', '~/.azure', '~/.azure/**', 'credentials.yaml', 'credentials.json'],
+    package: ['~/.npmrc', '.npmrc', '~/.pypirc', '~/.netrc', '.netrc', '.pypirc', '_netrc', '~/.pip/pip.conf'],
+    gitcreds: ['~/.git-credentials', '.git-credentials'],
+    env: ['.env', '.env.*', '*.env'],
+    cli: ['~/.claude', '~/.claude/**', '~/.codex', '~/.codex/**', '~/.config/gh', '~/.config/gh/**'],
+    db: ['~/.pgpass', 'pgpass', '~/.my.cnf', '.my.cnf'],
+};
+/** One compiled matcher per family (lazy; compile is pure and cheap, memoize anyway). */
+const matcherCache = new Map();
+function familyMatcher(family) {
+    let m = matcherCache.get(family);
+    if (m === undefined) {
+        m = compileCredentialPaths(CRED_FAMILIES[family], { caseInsensitive: true });
+        matcherCache.set(family, m);
+    }
+    return m;
+}
+/**
+ * Which credential family, if any, claims this path. First family in
+ * {@link CRED_FAMILY_IDS} order wins (ssh before package etc.), so a path cannot
+ * flip families between calls. `undefined` = not a built-in credential path —
+ * custom `credentialPaths` entries have no family and can never be write-exempt.
+ */
+export function familyOfPath(path) {
+    if (path === undefined || path.trim() === '')
+        return undefined;
+    for (const family of CRED_FAMILY_IDS) {
+        if (familyMatcher(family)(path))
+            return family;
+    }
+    return undefined;
+}

package/lib/engine.js

@@ -16,6 +16,7 @@ import { executableVariants, normalizeCommandText } from './command-normalize.js
 // 它看 `executableCommandOf`——已知非执行器（read/write/内部工具）的 `command` 参数是数据，
 // 其余任何带命令串的调用都按命令对待，所以工具叫什么（包括模型打错的 `pash`）都不是绕过面。
 import { INTERNAL_TOOLS, READ_TOOLS, executableCommandOf } from './tool-names.js';
+import { familyOfPath } from './cred-families.js';
 import { decomposeShellCommand } from './shell.js';
 import { dispatchCommand } from './command-dispatcher.js';
 const DESTRUCTIVE_TOOL = /(?:^|[_-])(?:delete|remove|rm|destroy|erase|purge|wipe|unlink|rmdir|reset)(?:$|[_-]|recursive)/i;
@@ -182,7 +183,11 @@ export function hardDenyReason(ctx) {
         }
         if (decodedReason !== undefined)
             return decodedReason;
-        const rewrite = gitRemoteRewriteReason(commands);
+        // The one floor a human may step aside: `allowProtectedBranchPush` (volatile setting,
+        // default false = floor stands). It is an explicit operator opt-out, never a model or
+        // grant path — and stepping aside still lands on the seeded `git.push-force` ask, so
+        // the call is named for a person unless the user separately revokes/allowlists it.
+        const rewrite = ctx.allowProtectedBranchPush === true ? undefined : gitRemoteRewriteReason(commands);
         if (rewrite !== undefined)
             return rewrite;
     }
@@ -218,7 +223,16 @@ export function hardDenyReason(ctx) {
         ...(ctx.userHome === undefined ? {} : { home: ctx.userHome }),
     });
     if (path !== undefined && (ctx.tool === 'write' || ctx.tool === 'edit' || DESTRUCTIVE_TOOL.test(ctx.tool)) && isProtectedCredentialPath(path, declared)) {
-        return `mutation targets a credential store: ${path}`;
+        // The one credential-floor a human may step aside per family: `credWriteExempt`
+        // (the readwrite rung of the credential-family ladder, fed by the volatile
+        // `credWriteExemptFamilies` setting). Family-level and binary — and it steps aside
+        // for **this clause only**: the protected-destructive-target screen above, the
+        // neverClear family and the push floor stay armed whatever a family is set to,
+        // which is why `readwrite` never means "write anything freely".
+        const exemptFamily = familyOfPath(path);
+        if (exemptFamily === undefined || !(ctx.credWriteExempt ?? []).includes(exemptFamily)) {
+            return `mutation targets a credential store: ${path}`;
+        }
     }
     if (READ_TOOLS.has(ctx.tool) && path !== undefined) {
         const normalized = path.startsWith('/') || /^[A-Za-z]:/.test(path) ? path : path;
@@ -239,7 +253,26 @@ autoAllowExtra = NO_EXTRA_AUTO_ALLOW) {
     // they cannot modify the workspace or execute a command, so asking a human
     // about each one is pure noise. P0 hard-deny already protects sensitive-path
     // reads and credential material, and the deny-keyword layer runs even earlier.
-    if (READ_TOOLS.has(ctx.tool) || INTERNAL_TOOLS.has(ctx.tool) || autoAllowExtra.has(ctx.tool)) {
+    //
+    // READ tools first **consult the rule layer** (the credential-family ladder's
+    // read rung): a seeded `cred.*` entry (or any user rule naming a path) can route a
+    // read to ask/deny. Only a **named hit** counts — the ruleset's own default action
+    // (ruleIndex undefined) is not an opinion about this call, and treating it as one
+    // would turn every read into an ask under `defaultAction: ask` (measured: it did).
+    // A miss still auto-allows silently, so the popup budget is unchanged. INTERNAL
+    // tools are deliberately NOT pre-queried: session/memory tools reading their own
+    // stores is how the host works; a path rule blocking them would be host self-harm.
+    if (READ_TOOLS.has(ctx.tool) || autoAllowExtra.has(ctx.tool)) {
+        const pre = ruleset.decide(ctx);
+        if (pre.ruleIndex !== undefined) {
+            if (pre.action === 'deny')
+                return { ...pre, stage: 'rule' };
+            if (pre.action === 'ask')
+                return { ...pre, stage: 'default' };
+        }
+        return { action: 'allow', reason: 'read-only internal tool', stage: 'grant', ruleIndex: undefined };
+    }
+    if (INTERNAL_TOOLS.has(ctx.tool)) {
         return { action: 'allow', reason: 'read-only internal tool', stage: 'grant', ruleIndex: undefined };
     }
     if (grants(ctx.tool, ctx.args) === 'allow') {

package/lib/evaluate.d.ts

@@ -31,6 +31,14 @@ export interface ToolCallContext {
     readonly scanKeys?: ScanKeyPolicy;
     /** Agent identity candidates from session context. */
     readonly agentCandidates?: readonly string[];
+    /** Opt-out of the P0 protected-branch push floor (setting `allowProtectedBranchPush`). */
+    readonly allowProtectedBranchPush?: boolean;
+    /**
+     * Credential families whose P0 credential-store **write** floor is exempted
+     * (setting `credWriteExemptFamilies`, the readwrite rung of the family ladder).
+     * Consulted by exactly one hardDeny clause; read floors never look at this.
+     */
+    readonly credWriteExempt?: readonly string[];
     /** Network request info (for network dimension matching). */
     readonly network?: {
         readonly domain?: string;

package/lib/events.d.ts

@@ -318,3 +318,22 @@ export declare function registerRulesRoute(server: unknown, provider: RulesRoute
  * learning or drops one sedimented sample. Returns whether registered.
  */
 export declare function registerLearningRoute(server: unknown, provider: LearningRouteProvider): (() => void) | undefined;
+export declare const CRED_ROUTE = "/api/dsh-perm-gate/cred";
+export interface CredRouteProvider {
+    /** Current raw rules document + the stored write-exemption list (no mutation). */
+    read(): {
+        doc: unknown;
+        exempt: readonly string[];
+    };
+    /** Persist the pair in ONE settings update (doc + exempt travel together). */
+    persist(doc: Record<string, unknown>, exempt: readonly string[]): Promise<void>;
+}
+/**
+ * `GET  /api/dsh-perm-gate/cred` → `{ ok, rungs: {family: deny|ask|readonly|readwrite}, exempt }`
+ * `POST /api/dsh-perm-gate/cred` → `{ family, rung }` applies one rung: rewrites the
+ * family's `cred.<id>` row in the rules document and the paired `credWriteExemptFamilies`
+ * list, persisted in a single settings update. The two stores are written only through
+ * here, so the ladder state cannot half-apply. Registration is optional like every
+ * other route (no webServer ⇒ the settings face degrades to read-only, never errors).
+ */
+export declare function registerCredRoute(server: unknown, provider: CredRouteProvider): (() => void) | undefined;

package/lib/events.js

@@ -14,6 +14,8 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { credRungsOf, setCredFamilyAction } from './preset-rules.js';
+import { CRED_FAMILY_IDS } from './cred-families.js';
 const REASON_MAX = 200;
 const JUSTIFICATION_MAX = 400;
 const FILES_MAX = 8;
@@ -367,14 +369,49 @@ function json(res, code, body) {
 }
 function readBody(req, limit = 1024 * 1024) {
     return new Promise((resolve, reject) => {
+        // Some embedded servers (the desktop webServer among them) hand the handler a
+        // pre-parsed body object instead of a readable stream — take it when present.
+        const pre = req.body ?? req.payload;
+        if (typeof pre === 'object' && pre !== null) {
+            resolve(pre);
+            return;
+        }
+        // A stream-less, body-less req must fail loud, not hang: with `req.on?.()` only,
+        // a missing `on` attached no listener and the promise never settled — the POST
+        // response never came, and the settings face sat on a silent spinner (the exact
+        // "only readwrite reacts" symptom reported on the desktop tier).
+        if (typeof req.on !== 'function') {
+            reject(new Error('request body stream unavailable'));
+            return;
+        }
         let body = '';
-        req.on?.('data', (chunk) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error('body read timeout'));
+        }, 8000);
+        req.on('data', (chunk) => {
             body += String(chunk);
-            if (body.length > limit)
+            if (body.length > limit && !settled) {
+                settled = true;
+                clearTimeout(timer);
                 reject(new Error('payload too large'));
+            }
         });
-        req.on?.('error', (err) => reject(err instanceof Error ? err : new Error(String(err))));
-        req.on?.('end', () => {
+        req.on('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(err instanceof Error ? err : new Error(String(err)));
+        });
+        req.on('end', () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
             try {
                 resolve(body === '' ? {} : JSON.parse(body));
             }
@@ -950,3 +987,61 @@ export function registerLearningRoute(server, provider) {
         },
     });
 }
+// ─── cred-family ladder (GET state / POST rung) ────────────────────────────
+export const CRED_ROUTE = '/api/dsh-perm-gate/cred';
+/**
+ * `GET  /api/dsh-perm-gate/cred` → `{ ok, rungs: {family: deny|ask|readonly|readwrite}, exempt }`
+ * `POST /api/dsh-perm-gate/cred` → `{ family, rung }` applies one rung: rewrites the
+ * family's `cred.<id>` row in the rules document and the paired `credWriteExemptFamilies`
+ * list, persisted in a single settings update. The two stores are written only through
+ * here, so the ladder state cannot half-apply. Registration is optional like every
+ * other route (no webServer ⇒ the settings face degrades to read-only, never errors).
+ */
+export function registerCredRoute(server, provider) {
+    const ws = routeServer(server);
+    if (ws === undefined)
+        return undefined;
+    return ws.register({
+        kind: 'exact',
+        path: CRED_ROUTE,
+        handler: (rawReq, rawRes) => {
+            void (async () => {
+                const req = rawReq;
+                const res = rawRes;
+                try {
+                    if (req.method === 'GET' || req.method === 'HEAD') {
+                        const cur = provider.read();
+                        json(res, 200, { ok: true, rungs: credRungsOf(cur.doc, cur.exempt), exempt: cur.exempt });
+                        return;
+                    }
+                    if (req.method !== 'POST') {
+                        json(res, 405, { ok: false, error: 'method not allowed' });
+                        return;
+                    }
+                    const body = await readBody(req);
+                    const family = String(body.family ?? '');
+                    const rung = String(body.rung ?? '');
+                    if (!CRED_FAMILY_IDS.includes(family)) {
+                        json(res, 400, { ok: false, error: `unknown credential family: ${family}` });
+                        return;
+                    }
+                    const rungs = ['deny', 'ask', 'readonly', 'readwrite'];
+                    if (!rungs.includes(rung)) {
+                        json(res, 400, { ok: false, error: `unknown rung: ${rung}` });
+                        return;
+                    }
+                    const cur = provider.read();
+                    const next = setCredFamilyAction(cur.doc, cur.exempt, family, rung);
+                    console.log(`[dsh-perm-gate] cred POST apply family=${family} rung=${rung}`);
+                    await provider.persist(next.doc, next.exempt);
+                    console.log(`[dsh-perm-gate] cred POST applied (exempt: ${next.exempt.join(',') || '-'})`);
+                    json(res, 200, { ok: true, rungs: credRungsOf(next.doc, next.exempt), exempt: next.exempt });
+                }
+                catch (e) {
+                    console.warn('[dsh-perm-gate] cred POST failed:', String(e?.message ?? e));
+                    json(res, 400, { ok: false, error: String(e?.message ?? e) });
+                }
+            })();
+        },
+    });
+}

package/lib/index.js

@@ -3,9 +3,10 @@ import { join } from 'node:path';
 import { SandboxController } from './appcontainer/index.js';
 import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
-import { mergePresetIntoRaw } from './preset-rules.js';
+import { mergePresetIntoRaw, PRESET_TABLE_VERSION } from './preset-rules.js';
+import { CRED_FAMILY_IDS } from './cred-families.js';
 import { runDryRun } from './dry-run.js';
-import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
+import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute, registerCredRoute } from './events.js';
 // T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
 import { registerSettingsBridgeRoutes } from './bridge.js';
 import { buildReceiverInfo } from './receiver-info.js';
@@ -256,10 +257,12 @@ export function apply(ctx, config = {}) {
     // 写失败不阻断启动也不置幂等位 ⇒ 下次激活重试。
     const seedPresetDenyTable = (svc) => {
         void (async () => {
-            if (current().presetRulesSeeded === true)
+            // 水位线代替布尔位：首装（未播）全量注入；升版后只补新增 id（merge 按 tag 幂等，
+            // 用户撤销过的条目永不复活），补完把 shipped 版本写回。
+            if (current().presetRulesSeeded === true && Number(current().presetRulesVersion ?? 0) >= PRESET_TABLE_VERSION)
                 return;
             const merged = mergePresetIntoRaw(readVolatileValue(config.rules));
-            await svc.update(ENTRY_ID, { rules: merged.doc, presetRulesSeeded: true });
+            await svc.update(ENTRY_ID, { rules: merged.doc, presetRulesSeeded: true, presetRulesVersion: PRESET_TABLE_VERSION });
             console.log(`[dsh-perm-gate] preset deny table seeded via settings (+${merged.added} rules)`);
         })().catch((e) => {
             console.warn('[dsh-perm-gate] preset deny table 播种失败（不阻断启动，下次激活重试）:', e);
@@ -492,6 +495,17 @@ export function apply(ctx, config = {}) {
         // exists, and each implementation owns one preset, so presets never cross.
         readSafenetPass: () => current().safenetPass ?? true,
         readSafenetAsk: () => current().safenetAsk ?? false,
+        // Protected-branch push floor opt-out, read live so the settings-card toggle takes effect
+        // on the next tool call. Default false keeps the floor; true steps aside to the seeded
+        // git.push-force ask (and exempts the flat push keywords). See runtime.ts liveAllowProtectedBranchPush.
+        readAllowProtectedBranchPush: () => current().allowProtectedBranchPush ?? false,
+        // Credential-family ladder, readwrite rung: the exempted family ids, filtered to the
+        // roster (a typo in the stored list must not read as "exempt everything guessed").
+        readCredWriteExemptFamilies: () => {
+            const c = current();
+            const raw = Array.isArray(c.credWriteExemptFamilies) ? c.credWriteExemptFamilies : [];
+            return raw.filter((f) => typeof f === 'string' && CRED_FAMILY_IDS.includes(f));
+        },
         // Degraded review: when no reviewer can grade an ask (none configured, or the
         // endpoint gave up), the deterministic nets decide instead of a popup nobody
         // answers — a cc-safety-net-class gate that blocks named danger and runs the rest.
@@ -783,6 +797,27 @@ export function apply(ctx, config = {}) {
             });
             if (offRules !== undefined)
                 ctx.effect(() => () => { offRules(); }, 'dsh-perm-gate: rules route');
+            // cred-family ladder: GET renders the per-family rungs, POST applies one rung
+            // (rules row + credWriteExemptFamilies travel together — one update, no half-state).
+            const offCred = registerCredRoute(webServer, {
+                read: () => {
+                    const c = current();
+                    return {
+                        doc: readRulesDocument() ?? readVolatileValue(config.rules),
+                        exempt: Array.isArray(c.credWriteExemptFamilies)
+                            ? c.credWriteExemptFamilies.filter((f) => typeof f === 'string')
+                            : [],
+                    };
+                },
+                persist: async (doc, exempt) => {
+                    const svc = settingsRef.svc;
+                    if (svc === undefined)
+                        throw new Error('settings service unavailable');
+                    await svc.update(ENTRY_ID, { rules: doc, credWriteExemptFamilies: [...exempt] });
+                },
+            });
+            if (offCred !== undefined)
+                ctx.effect(() => () => { offCred(); }, 'dsh-perm-gate: cred route');
             // Receiver projection for the settings card (provider/model catalog is
             // potentially slow to enumerate — cached briefly).
             let receiverCache = null;

package/lib/preset-rules.d.ts

@@ -28,6 +28,14 @@
  * table from `presetEntriesForView()` without pulling in the node filesystem.
  */
 import { type PermissionsDoc } from './rule.js';
+import { type CredFamily } from './cred-families.js';
+/**
+ * Shipped version of the preset table. Activation backfills (idempotent, revocation-
+ * preserving) whenever the stored `presetRulesVersion` lags this number — bump it
+ * whenever `PRESET_RULES_YAML` gains entries that existing installs must receive
+ * (v1 added the seven `cred.*` family rows).
+ */
+export declare const PRESET_TABLE_VERSION = 1;
 /** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
 export declare const PRESET_RULE_MARKER = "[deny-rule:";
 /** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
@@ -40,7 +48,7 @@ export declare function presetRuleId(reason: unknown): string | undefined;
  * the joined pipeline — see evaluate.ts), token co-occurrence NEVER through
  * args (args is any-token OR).
  */
-export declare const PRESET_RULES_YAML = "defaultAction: ask\n\ndeny:\n  # \u2500\u2500 Git \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [git]\n    argv: { pipeline: [\"git reset --hard*\", \"git reset *--hard*\"] }\n    reason: \"[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git reset --merge*\", \"git reset --abort*\"] }\n    reason: \"[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed.\"\n  - command: [git]\n    argv: { pipeline: [\"git clean *-f*\", \"git clean *--force*\"] }\n    reason: \"[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd.\"\n  - command: [git]\n    argv: { pipeline: [\"git push origin *--delete*\", \"git push * --delete *\", \"git push --delete*\"] }\n    reason: \"[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent.\"\n  - command: [git]\n    argv: { pipeline: [\"git push --mirror*\", \"git push * --mirror\"] }\n    reason: \"[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale.\"\n  - command: [git]\n    argv: { pipeline: [\"git branch -D*\", \"git branch * -D\", \"git branch *--force-delete*\"] }\n    reason: \"[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash drop*\"] }\n    reason: \"[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash clear*\"] }\n    reason: \"[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state.\"\n  - command: [git]\n    argv: { pipeline: [\"git tag -d*\", \"git tag --delete*\"] }\n    reason: \"[deny-rule:git.tag-delete] Tag deletion removes release anchors.\"\n  - command: [git]\n    argv: { pipeline: [\"git reflog delete*\", \"git reflog expire*\"] }\n    reason: \"[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits.\"\n  - command: [git]\n    argv: { pipeline: [\"git rebase --abort*\"] }\n    reason: \"[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip.\"\n  - command: [git]\n    argv: { pipeline: [\"git merge --abort*\"] }\n    reason: \"[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution.\"\n  - command: [git]\n    argv: { pipeline: [\"git rm -rf *\", \"git rm *-rf *\", \"git rm * -rf\", \"git rm -fr *\", \"git rm --force *\", \"git rm * --force\", \"git rm -f *\", \"git rm * -f\"] }\n    reason: \"[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout --force *\", \"git checkout * --force\", \"git checkout -f *\", \"git checkout * -f\", \"git checkout -f\", \"git checkout * --force *\"] }\n    reason: \"[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout -- *\"] }\n    reason: \"[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout * -- *\"] }\n    reason: \"[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout *--pathspec-from-file*\"] }\n    reason: \"[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch *--discard-changes*\"] }\n    reason: \"[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch --force *\", \"git switch * --force\", \"git switch -f *\", \"git switch * -f\"] }\n    reason: \"[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first.\"\n  - command: [git]\n    # git restore <bare path> (the plain unstaged discard) is NOT ported here:\n    # any glob broad enough to catch it also catches the harmless\n    # git restore --staged <path> (G6) \u2014 only the explicit discard forms are\n    # denied, the bare-path case stays in the prompt layer.\n    argv: { pipeline: [\"git restore --worktree *\", \"git restore * --worktree *\", \"git restore * --worktree\", \"git restore -W *\"] }\n    reason: \"[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first.\"\n  - command: [git]\n    argv: { pipeline: [\"git worktree remove --force *\", \"git worktree remove * --force\", \"git worktree remove -f *\", \"git worktree remove * -f\"] }\n    reason: \"[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree.\"\n  - command: [git]\n    args: [\"alias.*\"]\n    reason: \"[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed.\"\n  # params matches the RAW command string: the env-assignment word lands as the\n  # simple command's lowercased word, so a command:[git] dimension would never\n  # see this form \u2014 match on params alone.\n  - params: { command: [\"*GIT_SSH_COMMAND=*\", \"*git_ssh_command=*\", \"*GIT_SSH=*\", \"*git_ssh=*\"] }\n    reason: \"[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code.\"\n\n  # \u2500\u2500 Filesystem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [\"rm#recursive\", \"rm#force\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors.\"\n  - command: [find]\n    argv: { pipeline: [\"find .git*\"] }\n    reason: \"[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state.\"\n  - command: [find]\n    argv: { pipeline: [\"find * -delete\"] }\n    reason: \"[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first.\"\n  - command: [find]\n    argv: { pipeline: [\"find *-exec rm*\", \"find *-delete*\"] }\n    reason: \"[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths.\"\n  - command: [dd]\n    argv: { pipeline: [\"dd * of=/dev/sd*\", \"dd * of=/dev/nvme*\", \"dd * of=/dev/mmcblk*\"] }\n    reason: \"[deny-rule:dd.device-write] dd writing to a block device destroys the disk.\"\n  - command: [mkfs, mke2fs, newfs, \"mkfs.*\"]\n    reason: \"[deny-rule:mkfs.device] Formatting a device erases it.\"\n  - command: [diskutil, wipefs, sgdisk, parted]\n    reason: \"[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data.\"\n  - command: [shred]\n    reason: \"[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it).\"\n  - command: [cat, head, tail, dd]\n    args: [\"*/dev/sd*\", \"*/dev/nvme*\", \"*/dev/disk*\", \"*/dev/mmcblk*\"]\n    reason: \"[deny-rule:redirect.block-device] Redirect target resolving to a disk device path.\"\n\n  # \u2500\u2500 PowerShell \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # Command words are lowercased by the decomposer \u2014 command dimensions must\n  # carry the lowercased verb (Remove-Item \u2192 remove-item).\n  - command: [\"remove-item#recursive\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:powershell.remove-item-git-metadata] Never target .git.\"\n  - command: [powershell, pwsh]\n    argv: { pipeline: [\"pwsh *Remove-Item*\", \"powershell *Remove-Item*\", \"pwsh *remove-item*\", \"powershell *remove-item*\"] }\n    reason: \"[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope.\"\n\n  # \u2500\u2500 Command Prompt \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with\n  # these globs \u2014 every cmd /c recursion is nested behind a second parser,\n  # so its true target is undecidable: it moves to the ask section instead.)\n  - command: [cmd, rmdir, del]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:cmd.recursive-delete-git-metadata] Never target .git.\"\n  - command: [rmdir, del]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project.\"\n  - command: [rmdir, del]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope.\"\n\n  # \u2500\u2500 Secret targets (write/delete deny; reads are the ask section below) \u2500\u2500\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.ssh\", \"*/.aws\", \"*/.gnupg\", \".ssh\", \".aws\"]\n    reason: \"[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate.\"\n  - command: [echo, \"set-content\", \"out-file\"]\n    args: [\".env\", \".env.*\"]\n    reason: \"[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines.\"\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.git-credentials\", \".git-credentials\"]\n    reason: \"[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth.\"\n\nask:\n  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).\n  - command: [git]\n    argv: { pipeline: [\"git push *--force*\", \"git push *-f*\"] }\n    reason: \"[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease.\"\n\n  # cmd /c recursion hides the real target behind a second parser (and quoting):\n  # undecidable \u2192 ask, where cc denied only the drive-root-collapse variant.\n  - command: [cmd]\n    argv: { pipeline: [\"cmd /c *rmdir /s*\", \"cmd /c *del /s*\"] }\n    reason: \"[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target.\"\n\n  # Dynamic targets: this gate's ruling is \"undecidable \u2192 ask\", not fail-closed deny.\n  - command: [\"rm#recursive\", \"remove-item#recursive\"]\n    args: [\"$*\"]\n    reason: \"[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target \u2014 verify the variable yourself.\"\n  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns\n  # never see it \u2014 match the raw command string through the params dimension.\n  - params: { command: [\"*xargs rm*\", \"*xargs del*\"] }\n    reason: \"[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets.\"\n  - command: [parallel]\n    argv: { pipeline: [\"parallel *rm*\", \"*| parallel*\"] }\n    reason: \"[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets.\"\n  - command: [awk]\n    args: [\"*system(*\"]\n    reason: \"[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed.\"\n  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported \u2014 a glob\n  # cannot tell ref candidates from paths, and a broad pattern would prompt on\n  # every git checkout -b new-branch. Documented residual gap.\n\n  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\", \"select-string\"]\n    args: [\".env\", \".env.*\", \"*.env\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"id_rsa\", \"id_ed25519\", \"id_ecdsa\"]\n    reason: \"[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command.\"\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\"]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*/.aws\", \"*/.aws/*\", \"*/.gnupg\", \"*/.gnupg/*\", \"*/.config/gcloud/*\", \"*/.claude/*\", \"*/.codex/*\"]\n    reason: \"[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation.\"\n\n  # Self-protection: editing the gate's own rule sources needs confirmation \u2014\n  # revocation must be a human act, not something an agent can slide through.\n  # (Settings-namespace edits go through the host UI, not a tool call, and are\n  # out of reach of this entry; documented gap.)\n  - args: [\"*rules.yml\", \"*rules.yaml\", \"*deny-defaults*\"]\n    reason: \"[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces.\"\n";
+export declare const PRESET_RULES_YAML = "defaultAction: ask\n\ndeny:\n  # \u2500\u2500 Git \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [git]\n    argv: { pipeline: [\"git reset --hard*\", \"git reset *--hard*\"] }\n    reason: \"[deny-rule:git.reset-hard] Hard reset discards uncommitted changes. Use git reset --soft/--mixed, or git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git reset --merge*\", \"git reset --abort*\"] }\n    reason: \"[deny-rule:git.reset-merge] Merge reset discards in-progress merge work. Stash first, then reset --soft/--mixed.\"\n  - command: [git]\n    argv: { pipeline: [\"git clean *-f*\", \"git clean *--force*\"] }\n    reason: \"[deny-rule:git.clean-force] git clean permanently deletes untracked files. Dry-run first: git clean -nd.\"\n  - command: [git]\n    argv: { pipeline: [\"git push origin *--delete*\", \"git push * --delete *\", \"git push --delete*\"] }\n    reason: \"[deny-rule:git.push-delete] Deleting remote refs is visible to collaborators and needs explicit consent.\"\n  - command: [git]\n    argv: { pipeline: [\"git push --mirror*\", \"git push * --mirror\"] }\n    reason: \"[deny-rule:git.push-mirror] Mirror push force-updates and deletes remote refs wholesale.\"\n  - command: [git]\n    argv: { pipeline: [\"git branch -D*\", \"git branch * -D\", \"git branch *--force-delete*\"] }\n    reason: \"[deny-rule:git.branch-force-delete] git branch -D drops unmerged commits. Prefer merged-safe git branch -d.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash drop*\"] }\n    reason: \"[deny-rule:git.stash-drop] Dropping a stash entry is unrecoverable after GC. Verify with git stash list.\"\n  - command: [git]\n    argv: { pipeline: [\"git stash clear*\"] }\n    reason: \"[deny-rule:git.stash-clear] Clearing all stashes destroys every saved worktree state.\"\n  - command: [git]\n    argv: { pipeline: [\"git tag -d*\", \"git tag --delete*\"] }\n    reason: \"[deny-rule:git.tag-delete] Tag deletion removes release anchors.\"\n  - command: [git]\n    argv: { pipeline: [\"git reflog delete*\", \"git reflog expire*\"] }\n    reason: \"[deny-rule:git.reflog-delete] Reflog deletion removes the last recovery path for lost commits.\"\n  - command: [git]\n    argv: { pipeline: [\"git rebase --abort*\"] }\n    reason: \"[deny-rule:git.rebase-abort] Aborting a rebase discards resolution work. Prefer --continue/--skip.\"\n  - command: [git]\n    argv: { pipeline: [\"git merge --abort*\"] }\n    reason: \"[deny-rule:git.merge-abort] Aborting a merge discards conflict resolution.\"\n  - command: [git]\n    argv: { pipeline: [\"git rm -rf *\", \"git rm *-rf *\", \"git rm * -rf\", \"git rm -fr *\", \"git rm --force *\", \"git rm * --force\", \"git rm -f *\", \"git rm * -f\"] }\n    reason: \"[deny-rule:git.rm-force] git rm -f deletes working-tree files even when modified. Stash them first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout --force *\", \"git checkout * --force\", \"git checkout -f *\", \"git checkout * -f\", \"git checkout -f\", \"git checkout * --force *\"] }\n    reason: \"[deny-rule:git.checkout-force] Forced checkout overwrites local changes. git stash, then checkout.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout -- *\"] }\n    reason: \"[deny-rule:git.checkout-double-dash] Path restore from checkout discards local edits. Use git stash push -- <path>.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout * -- *\"] }\n    reason: \"[deny-rule:git.checkout-ref-path] Checking out a ref with a path overwrites working-tree files. Stash the paths first.\"\n  - command: [git]\n    argv: { pipeline: [\"git checkout *--pathspec-from-file*\"] }\n    reason: \"[deny-rule:git.checkout-pathspec-from-file] Bulk path restore from a file can silently overwrite edits. List the pathspec, stash, then restore.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch *--discard-changes*\"] }\n    reason: \"[deny-rule:git.switch-discard-changes] --discard-changes throws away edits. git stash first.\"\n  - command: [git]\n    argv: { pipeline: [\"git switch --force *\", \"git switch * --force\", \"git switch -f *\", \"git switch * -f\"] }\n    reason: \"[deny-rule:git.switch-force] Forced switch overwrites local changes. git stash first.\"\n  - command: [git]\n    # git restore <bare path> (the plain unstaged discard) is NOT ported here:\n    # any glob broad enough to catch it also catches the harmless\n    # git restore --staged <path> (G6) \u2014 only the explicit discard forms are\n    # denied, the bare-path case stays in the prompt layer.\n    argv: { pipeline: [\"git restore --worktree *\", \"git restore * --worktree *\", \"git restore * --worktree\", \"git restore -W *\"] }\n    reason: \"[deny-rule:git.restore-worktree] Worktree restore discards local edits. git stash push -- <path> first.\"\n  - command: [git]\n    argv: { pipeline: [\"git worktree remove --force *\", \"git worktree remove * --force\", \"git worktree remove -f *\", \"git worktree remove * -f\"] }\n    reason: \"[deny-rule:git.worktree-remove-force] Forced worktree removal discards uncommitted work in that tree.\"\n  - command: [git]\n    args: [\"alias.*\"]\n    reason: \"[deny-rule:git.alias-config] Command-line Git aliases run arbitrary shell and cannot be analyzed.\"\n  # params matches the RAW command string: the env-assignment word lands as the\n  # simple command's lowercased word, so a command:[git] dimension would never\n  # see this form \u2014 match on params alone.\n  - params: { command: [\"*GIT_SSH_COMMAND=*\", \"*git_ssh_command=*\", \"*GIT_SSH=*\", \"*git_ssh=*\"] }\n    reason: \"[deny-rule:git.ssh-env] Git network ops with an SSH env override execute unanalyzable code.\"\n\n  # \u2500\u2500 Filesystem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  - command: [\"rm#recursive\", \"rm#force\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:rm.git-metadata] Removing Git metadata destroys history and the gate's audit anchors.\"\n  - command: [find]\n    argv: { pipeline: [\"find .git*\"] }\n    reason: \"[deny-rule:find.delete-git-metadata] Selecting .git for deletion destroys repository state.\"\n  - command: [find]\n    argv: { pipeline: [\"find * -delete\"] }\n    reason: \"[deny-rule:find.delete] find -delete removes everything selected. Enumerate with plain find first.\"\n  - command: [find]\n    argv: { pipeline: [\"find *-exec rm*\", \"find *-delete*\"] }\n    reason: \"[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths.\"\n  - command: [rsync]\n    argv: { pipeline: [\"rsync * --delete*\", \"rsync --delete*\"] }\n    reason: \"[deny-rule:rsync.delete] rsync --delete erases destination files absent from the source. Dry-run with rsync -n --delete first.\"\n  - command: [dd]\n    argv: { pipeline: [\"dd * of=/dev/sd*\", \"dd * of=/dev/nvme*\", \"dd * of=/dev/mmcblk*\"] }\n    reason: \"[deny-rule:dd.device-write] dd writing to a block device destroys the disk.\"\n  - command: [mkfs, mke2fs, newfs, \"mkfs.*\"]\n    reason: \"[deny-rule:mkfs.device] Formatting a device erases it.\"\n  - command: [diskutil, wipefs, sgdisk, parted]\n    reason: \"[deny-rule:disk.erase] Disk erase/partition/wipe operations destroy data.\"\n  - command: [shred]\n    reason: \"[deny-rule:shred.target] shred irreversibly destroys files (even --help/--version reach it).\"\n  - command: [cat, head, tail, dd]\n    args: [\"*/dev/sd*\", \"*/dev/nvme*\", \"*/dev/disk*\", \"*/dev/mmcblk*\"]\n    reason: \"[deny-rule:redirect.block-device] Redirect target resolving to a disk device path.\"\n\n  # \u2500\u2500 PowerShell \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # Command words are lowercased by the decomposer \u2014 command dimensions must\n  # carry the lowercased verb (Remove-Item \u2192 remove-item).\n  - command: [\"remove-item#recursive\"]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:powershell.remove-item-git-metadata] Never target .git.\"\n  - command: [powershell, pwsh]\n    argv: { pipeline: [\"pwsh *Remove-Item*\", \"powershell *Remove-Item*\", \"pwsh *remove-item*\", \"powershell *remove-item*\"] }\n    reason: \"[deny-rule:powershell.nested-recursive-delete-unread] A delete handed to pwsh/powershell in a non-literal form cannot be verified before it runs.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-cwd-self] Deleting the current directory removes the project.\"\n  - command: [\"remove-item#recursive\"]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:powershell.remove-item-recursive-force-outside-cwd] Deleting above the cwd escapes task scope.\"\n\n  # \u2500\u2500 Command Prompt \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # (The cc escaped-quote-collapse rule cannot be expressed faithfully with\n  # these globs \u2014 every cmd /c recursion is nested behind a second parser,\n  # so its true target is undecidable: it moves to the ask section instead.)\n  - command: [cmd, rmdir, del]\n    args: [\".git\", \".git/*\", \"*/.git\"]\n    reason: \"[deny-rule:cmd.recursive-delete-git-metadata] Never target .git.\"\n  - command: [rmdir, del]\n    args: [\".\", \"./\"]\n    reason: \"[deny-rule:cmd.recursive-delete-cwd-self] Deleting the current directory removes the project.\"\n  - command: [rmdir, del]\n    args: [\"../*\", \"..\\\\*\"]\n    reason: \"[deny-rule:cmd.recursive-delete-outside-cwd] Delete above cwd escapes task scope.\"\n\n  # \u2500\u2500 Secret targets (write/delete deny; reads are the ask section below) \u2500\u2500\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.ssh\", \"*/.aws\", \"*/.gnupg\", \".ssh\", \".aws\"]\n    reason: \"[deny-rule:secret.delete-credential-path] Deleting credential stores destroys keys you cannot regenerate.\"\n  - command: [echo, \"set-content\", \"out-file\"]\n    args: [\".env\", \".env.*\"]\n    reason: \"[deny-rule:secret.write-overwrite-env] Overwriting .env destroys existing secrets. Edit specific lines.\"\n  - command: [\"rm#recursive\", \"remove-item#recursive\", rmdir, del]\n    args: [\"*/.git-credentials\", \".git-credentials\"]\n    reason: \"[deny-rule:secret.delete-git-credentials] Deleting the git credential store breaks push/pull auth.\"\n\nask:\n  # Force push: ask, not deny (revoked from cc's deny ruling 2026-10-13).\n  - command: [git]\n    argv: { pipeline: [\"git push *--force*\", \"git push *-f*\"] }\n    reason: \"[deny-rule:git.push-force] Force push rewrites shared history. Prefer git push --force-with-lease.\"\n\n  # cmd /c recursion hides the real target behind a second parser (and quoting):\n  # undecidable \u2192 ask, where cc denied only the drive-root-collapse variant.\n  - command: [cmd]\n    argv: { pipeline: [\"cmd /c *rmdir /s*\", \"cmd /c *del /s*\"] }\n    reason: \"[deny-rule:cmd.recursive-delete-nested] cmd /c recursion nests a second parser; the real target cannot be resolved. Run rmdir/del directly so the gate can see the target.\"\n\n  # Dynamic targets: this gate's ruling is \"undecidable \u2192 ask\", not fail-closed deny.\n  - command: [\"rm#recursive\", \"remove-item#recursive\"]\n    args: [\"$*\"]\n    reason: \"[deny-rule:rm.recursive-force-dynamic-target] Recursive delete of a substitution-assembled target \u2014 verify the variable yourself.\"\n  # The wrapper word xargs is stripped by the decomposer, so pipeline patterns\n  # never see it \u2014 match the raw command string through the params dimension.\n  - params: { command: [\"*xargs rm*\", \"*xargs del*\"] }\n    reason: \"[deny-rule:xargs.rm-recursive-force-dynamic] xargs-fed removals have unverifiable target sets.\"\n  - command: [parallel]\n    argv: { pipeline: [\"parallel *rm*\", \"*| parallel*\"] }\n    reason: \"[deny-rule:parallel.rm-recursive-force-dynamic] parallel-fed rm has unresolvable targets.\"\n  - command: [awk]\n    args: [\"*system(*\"]\n    reason: \"[deny-rule:awk.system-dynamic] awk program text containing system() cannot be analyzed.\"\n  # NOTE: cc's git checkout <ref> <path> ambiguity (G5) is NOT ported \u2014 a glob\n  # cannot tell ref candidates from paths, and a broad pattern would prompt on\n  # every git checkout -b new-branch. Documented residual gap.\n\n  # Credential reads: ask (A2 ruling kept; egress combos stay in the prompt layer).\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\", \"select-string\"]\n    args: [\".env\", \".env.*\", \"*.env\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"id_rsa\", \"id_ed25519\", \"id_ecdsa\"]\n    reason: \"[deny-rule:secret.read-credential-file] Reading a credential file requires confirmation. Echo only the keys you need via a filtered command.\"\n  - command: [cat, head, tail, type, \"get-content\", ls, dir, \"get-childitem\"]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*/.aws\", \"*/.aws/*\", \"*/.gnupg\", \"*/.gnupg/*\", \"*/.config/gcloud/*\", \"*/.claude/*\", \"*/.codex/*\"]\n    reason: \"[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation.\"\n\n  # \u2500\u2500 Credential family ladder (read side) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  # One row per family, restricted to the file-READ tools: decide() pre-queries the\n  # rule layer for READ calls, so these rows are what a read hits (shell reads stay\n  # under the secret.* rows above, which match first in this section). The settings\n  # face rewrites each row as the family's rung: deny - moved to the deny section;\n  # ask - stays here; readonly/readwrite - enabled:false (readwrite additionally\n  # lists the family in credWriteExemptFamilies for the engine's write clause).\n  # Custom credentialPaths have no family and are never write-exempt.\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.ssh\", \"*/.ssh/*\", \"*id_rsa\", \"*id_ed25519\", \"*id_ecdsa\", \"*id_dsa\", \"*authorized_keys\"]\n    reason: \"[deny-rule:cred.ssh] Reading SSH keys or authorized_keys needs confirmation (family rung: ask).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.aws\", \"*/.aws/*\", \"*/.config/gcloud\", \"*/.config/gcloud/*\", \"*/.azure\", \"*/.azure/*\", \"*credentials.yaml\", \"*credentials.json\"]\n    reason: \"[deny-rule:cred.cloud] Reading cloud-provider credential stores needs confirmation (family rung: ask).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.npmrc\", \"*.npmrc\", \"*/.pypirc\", \"*/.netrc\", \"*_netrc\", \"*/pip.conf\"]\n    reason: \"[deny-rule:cred.package] Reading package-registry auth files needs confirmation (family rung: ask).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.git-credentials\", \"*.git-credentials\"]\n    reason: \"[deny-rule:cred.gitcreds] Reading the git credential store needs confirmation (family rung: ask).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.env\", \"*/.env.*\", \"*.env\"]\n    reason: \"[deny-rule:cred.env] Reading project env files needs confirmation (family rung: ask; readwrite also lets edits, npm-login-style).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.claude\", \"*/.claude/*\", \"*/.codex\", \"*/.codex/*\", \"*/.config/gh\", \"*/.config/gh/*\"]\n    reason: \"[deny-rule:cred.cli] Reading coding-CLI credential stores needs confirmation (family rung: ask).\"\n  - tools: [read, read_image, grep, glob, ls, lsp]\n    args: [\"*/.pgpass\", \"*pgpass\", \"*/.my.cnf\"]\n    reason: \"[deny-rule:cred.db] Reading database credential files needs confirmation (family rung: ask).\"\n\n  # Self-protection: editing the gate's own rule sources needs confirmation \u2014\n  # revocation must be a human act, not something an agent can slide through.\n  # (Settings-namespace edits go through the host UI, not a tool call, and are\n  # out of reach of this entry; documented gap.)\n  - args: [\"*rules.yml\", \"*rules.yaml\", \"*deny-defaults*\"]\n    reason: \"[deny-rule:gate.self-protection] This call touches the permission gate's own rule sources; changes here alter what the gate enforces.\"\n";
 export declare function parsePresetDoc(): PermissionsDoc;
 /** Every preset id, in table order. Client view + tests use this as the row key. */
 export declare function presetRuleIds(): string[];
@@ -68,3 +76,27 @@ export declare function ensurePresetRulesFile(rulesFile: string, markerFile?: st
     action: 'created' | 'merged' | 'skipped' | 'already-seeded';
     added: number;
 };
+/** One rung of the credential-family ladder (settings face; see the cred block above). */
+export type CredRung = 'deny' | 'ask' | 'readonly' | 'readwrite';
+/**
+ * The current rung per family, read out of a RAW rules document plus the write-exemption
+ * list (GET side of the settings face; the card renders straight from this map).
+ * A missing row reports 'ask' — the shipped default every fresh seed writes.
+ */
+export declare function credRungsOf(rawDoc: unknown, exempt?: readonly string[]): Record<CredFamily, CredRung>;
+/**
+ * Rewrite one `cred.<family>` row of a RAW rules document to the chosen rung, and
+ * maintain the paired write-exemption list. Both stores are returned together; the
+ * caller persists them in one settings update. Idempotent: applying the same rung
+ * twice is a no-op. Revocation-preserving elsewhere untouched — this function only
+ * ever moves or enables/disables the family's own row.
+ *
+ * `readonly` and `readwrite` both disable the read row (reads then fall through to
+ * the READ auto-allow); they differ only in `exempt`: readwrite additionally lists
+ * the family, which steps the engine's credential-store WRITE clause aside for that
+ * family's built-in paths — and nothing else.
+ */
+export declare function setCredFamilyAction(rawDoc: unknown, exempt: readonly string[], family: CredFamily, rung: CredRung): {
+    doc: Record<string, unknown>;
+    exempt: string[];
+};