dsh-perm-gate 5.3.4 → 5.4.0

package/lib/preset-rules.js

@@ -30,6 +30,14 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { parse, stringify } from 'yaml';
 import { parsePermissionsDocument } from './rule.js';
+import { CRED_FAMILY_IDS } from './cred-families.js';
+/**
+ * Shipped version of the preset table. Activation backfills (idempotent, revocation-
+ * preserving) whenever the stored `presetRulesVersion` lags this number — bump it
+ * whenever `PRESET_RULES_YAML` gains entries that existing installs must receive
+ * (v1 added the seven `cred.*` family rows).
+ */
+export const PRESET_TABLE_VERSION = 1;
 /** Tag prefix carried by every preset entry's reason; locates an entry for revocation. */
 export const PRESET_RULE_MARKER = '[deny-rule:';
 /** Extract the `[deny-rule:<id>]` tag from one reason string (undefined when untagged). */
@@ -140,6 +148,9 @@ deny:
   - command: [find]
     argv: { pipeline: ["find *-exec rm*", "find *-delete*"] }
     reason: "[deny-rule:find.exec-rm-recursive-force] find -exec rm removes the whole tree per match. Dry-run plain find, delete explicit paths."
+  - command: [rsync]
+    argv: { pipeline: ["rsync * --delete*", "rsync --delete*"] }
+    reason: "[deny-rule:rsync.delete] rsync --delete erases destination files absent from the source. Dry-run with rsync -n --delete first."
   - command: [dd]
     argv: { pipeline: ["dd * of=/dev/sd*", "dd * of=/dev/nvme*", "dd * of=/dev/mmcblk*"] }
     reason: "[deny-rule:dd.device-write] dd writing to a block device destroys the disk."
@@ -232,6 +243,36 @@ ask:
     args: ["*/.ssh", "*/.ssh/*", "*/.aws", "*/.aws/*", "*/.gnupg", "*/.gnupg/*", "*/.config/gcloud/*", "*/.claude/*", "*/.codex/*"]
     reason: "[deny-rule:secret.read-home-credential-dirs] Browsing ssh/cloud/coding-CLI credential stores requires confirmation."
 
+  # ── Credential family ladder (read side) ──────────────────────────────────
+  # One row per family, restricted to the file-READ tools: decide() pre-queries the
+  # rule layer for READ calls, so these rows are what a read hits (shell reads stay
+  # under the secret.* rows above, which match first in this section). The settings
+  # face rewrites each row as the family's rung: deny - moved to the deny section;
+  # ask - stays here; readonly/readwrite - enabled:false (readwrite additionally
+  # lists the family in credWriteExemptFamilies for the engine's write clause).
+  # Custom credentialPaths have no family and are never write-exempt.
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.ssh", "*/.ssh/*", "*id_rsa", "*id_ed25519", "*id_ecdsa", "*id_dsa", "*authorized_keys"]
+    reason: "[deny-rule:cred.ssh] Reading SSH keys or authorized_keys needs confirmation (family rung: ask)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.aws", "*/.aws/*", "*/.config/gcloud", "*/.config/gcloud/*", "*/.azure", "*/.azure/*", "*credentials.yaml", "*credentials.json"]
+    reason: "[deny-rule:cred.cloud] Reading cloud-provider credential stores needs confirmation (family rung: ask)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.npmrc", "*.npmrc", "*/.pypirc", "*/.netrc", "*_netrc", "*/pip.conf"]
+    reason: "[deny-rule:cred.package] Reading package-registry auth files needs confirmation (family rung: ask)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.git-credentials", "*.git-credentials"]
+    reason: "[deny-rule:cred.gitcreds] Reading the git credential store needs confirmation (family rung: ask)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.env", "*/.env.*", "*.env"]
+    reason: "[deny-rule:cred.env] Reading project env files needs confirmation (family rung: ask; readwrite also lets edits, npm-login-style)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.claude", "*/.claude/*", "*/.codex", "*/.codex/*", "*/.config/gh", "*/.config/gh/*"]
+    reason: "[deny-rule:cred.cli] Reading coding-CLI credential stores needs confirmation (family rung: ask)."
+  - tools: [read, read_image, grep, glob, ls, lsp]
+    args: ["*/.pgpass", "*pgpass", "*/.my.cnf"]
+    reason: "[deny-rule:cred.db] Reading database credential files needs confirmation (family rung: ask)."
+
   # Self-protection: editing the gate's own rule sources needs confirmation —
   # revocation must be a human act, not something an agent can slide through.
   # (Settings-namespace edits go through the host UI, not a tool call, and are
@@ -386,3 +427,99 @@ export function ensurePresetRulesFile(rulesFile, markerFile) {
         return { action: 'skipped', added: 0 };
     }
 }
+/**
+ * The current rung per family, read out of a RAW rules document plus the write-exemption
+ * list (GET side of the settings face; the card renders straight from this map).
+ * A missing row reports 'ask' — the shipped default every fresh seed writes.
+ */
+export function credRungsOf(rawDoc, exempt = []) {
+    const root = rawDoc !== null && typeof rawDoc === 'object' && !Array.isArray(rawDoc)
+        ? rawDoc
+        : {};
+    const target = root['permissions'] !== null && typeof root['permissions'] === 'object' && !Array.isArray(root['permissions'])
+        ? root['permissions']
+        : root;
+    const out = {};
+    for (const family of CRED_FAMILY_IDS) {
+        const tag = `cred.${family}`;
+        let rung = 'ask';
+        for (const key of ['deny', 'ask']) {
+            const arr = Array.isArray(target[key]) ? target[key] : [];
+            const row = arr.find((e) => presetRuleId(e.reason) === tag);
+            if (row !== undefined) {
+                if (row.enabled === false)
+                    rung = exempt.includes(family) ? 'readwrite' : 'readonly';
+                else
+                    rung = key === 'deny' ? 'deny' : 'ask';
+                break;
+            }
+        }
+        out[family] = rung;
+    }
+    return out;
+}
+/**
+ * Rewrite one `cred.<family>` row of a RAW rules document to the chosen rung, and
+ * maintain the paired write-exemption list. Both stores are returned together; the
+ * caller persists them in one settings update. Idempotent: applying the same rung
+ * twice is a no-op. Revocation-preserving elsewhere untouched — this function only
+ * ever moves or enables/disables the family's own row.
+ *
+ * `readonly` and `readwrite` both disable the read row (reads then fall through to
+ * the READ auto-allow); they differ only in `exempt`: readwrite additionally lists
+ * the family, which steps the engine's credential-store WRITE clause aside for that
+ * family's built-in paths — and nothing else.
+ */
+export function setCredFamilyAction(rawDoc, exempt, family, rung) {
+    const root = rawDoc !== null && typeof rawDoc === 'object' && !Array.isArray(rawDoc)
+        ? { ...rawDoc }
+        : {};
+    const hasWrapper = root['permissions'] !== null && typeof root['permissions'] === 'object' && !Array.isArray(root['permissions']);
+    // Always work on a fresh wrapper copy — the shared `permissions` object is frozen
+    // on the live host, and `defaultAction` writes below must not hit it.
+    const target = hasWrapper ? { ...root['permissions'] } : root;
+    if (hasWrapper)
+        root['permissions'] = target;
+    const tag = `cred.${family}`;
+    // Settings snapshots are deep-frozen on the live host: containers AND elements.
+    // Every section array we touch is replaced by a copy first — `splice` on a frozen
+    // array throws in strict mode (`Cannot delete property`), the same class of failure
+    // as the frozen-row write. Copy-on-write for arrays and rows alike.
+    const takeSection = (key) => {
+        const cur = Array.isArray(target[key]) ? target[key] : [];
+        const copy = [...cur];
+        target[key] = copy;
+        return copy;
+    };
+    // Detach this family's row from wherever it sits. NO whole-table merge here: the
+    // merge dedupes per section, so a row previously moved deny↔ask would be
+    // re-appended to its preset section and the rung would silently revert (measured
+    // on the frozen-snapshot regression). Only this family's row is touched.
+    let entry;
+    for (const key of ['deny', 'ask']) {
+        const arr = takeSection(key);
+        const i = arr.findIndex((e) => presetRuleId(e.reason) === tag);
+        if (i >= 0) {
+            // Copy before mutate: settings snapshots are deep-frozen on the live host.
+            entry = { ...arr.splice(i, 1)[0] };
+            break;
+        }
+    }
+    if (entry === undefined) {
+        // Row absent (fresh doc or pruned): seed just this family's preset row.
+        const src = parsePresetDoc().ask.find((e) => presetRuleId(e.reason) === tag);
+        if (src !== undefined)
+            entry = rawEntry(src);
+    }
+    if (entry !== undefined) {
+        entry.enabled = rung !== 'readonly' && rung !== 'readwrite';
+        const destKey = rung === 'deny' ? 'deny' : 'ask';
+        const dest = takeSection(destKey);
+        dest.push(entry);
+    }
+    if (typeof root.defaultAction !== 'string' && typeof target.defaultAction !== 'string') {
+        target.defaultAction = 'ask';
+    }
+    const nextExempt = rung === 'readwrite' ? [...new Set([...exempt, family])] : exempt.filter((f) => f !== family);
+    return { doc: root, exempt: nextExempt };
+}

package/lib/runtime.d.ts

@@ -156,6 +156,21 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
      */
     readonly readSafenetPass?: () => boolean;
     readonly readSafenetAsk?: () => boolean;
+    /**
+     * Live read of the `allowProtectedBranchPush` opt-out (volatile setting, default false
+     * keeps the P0 protected-branch floor). When true the floor steps aside AND the three
+     * flat push keywords in the deny-keyword blacklist are exempted — the keyword layer runs
+     * before every ask, so leaving them armed would make the switch a silent no-op. Nothing
+     * else widens: wipes, redirects, credentials and the rest of the floor stay armed, and
+     * the seeded `git.push-force` rule still asks a person.
+     */
+    readonly readAllowProtectedBranchPush?: () => boolean;
+    /**
+     * Live read of `credWriteExemptFamilies` — the readwrite rung of the credential-family
+     * ladder. Consulted ONLY by the engine's credential-store write clause; already filtered
+     * to the family roster by the wiring.
+     */
+    readonly readCredWriteExemptFamilies?: () => readonly string[];
     /**
      * Optional live source of the script-review switch: attach the body of every script a
      * call runs to the review, so the grader and the human judge code, not a filename.
@@ -529,6 +544,13 @@ export declare class PermGateRuntime {
      * An empty override is treated as "no meaningful override" (the blacklist is
      * protective and stays on); schemastery materializes unset arrays as `[]`. */
     private liveDenyKeywords;
+    /**
+     * The push-floor opt-out, read live so the settings toggle lands on the next call.
+     * `PUSH_FLOOR_KEYWORDS` are the flat blacklist entries that encode the same intent as
+     * the P0 protected-branch floor; the opt-out exempts exactly these, nothing more.
+     */
+    private liveAllowProtectedBranchPush;
+    private effectiveDenyKeywords;
     /** The user-declared credential paths, as configured (may be empty). */
     private liveCredentialPaths;
     /**

package/lib/runtime.js

@@ -36,6 +36,12 @@ import { DEFAULT_DENY_KEYWORDS } from './deny-defaults.js';
 import { permissionPresetOf, presetInScope } from './preset.js';
 import { resolveTierMode } from './unattended.js';
 import { resolveGatePresets } from './config.js';
+/**
+ * The flat blacklist entries that encode the same intent as the P0 protected-branch push
+ * floor. `allowProtectedBranchPush` exempts exactly these (and the floor itself) — every
+ * other keyword and floor branch stays armed.
+ */
+const PUSH_FLOOR_KEYWORDS = new Set(['push --force', 'force-push', 'force push']);
 /** Locate a rule by its chain-wide index (deny entries first, then allow, then ask). */
 function findRuleByIndex(ruleset, index) {
     return (ruleset.deny.find((entry) => entry.index === index) ??
@@ -410,6 +416,8 @@ export class PermGateRuntime {
             caseInsensitive: this.options.caseInsensitivePaths ?? true,
             dshHome: this.options.dshHome,
             credentialPaths: this.liveCredentialPaths(),
+            allowProtectedBranchPush: this.liveAllowProtectedBranchPush(),
+            credWriteExempt: this.options.readCredWriteExemptFamilies?.() ?? [],
             scanKeys: this.liveScanKeys(),
             agentCandidates: extractAgentCandidates(exec),
         };
@@ -817,6 +825,20 @@ export class PermGateRuntime {
         const appended = extra.map((k) => String(k).trim()).filter((k) => k !== '');
         return appended.length === 0 ? base : [...new Set([...base, ...appended])];
     }
+    /**
+     * The push-floor opt-out, read live so the settings toggle lands on the next call.
+     * `PUSH_FLOOR_KEYWORDS` are the flat blacklist entries that encode the same intent as
+     * the P0 protected-branch floor; the opt-out exempts exactly these, nothing more.
+     */
+    liveAllowProtectedBranchPush() {
+        return this.options.readAllowProtectedBranchPush?.() ?? this.options.allowProtectedBranchPush ?? false;
+    }
+    effectiveDenyKeywords() {
+        const keywords = this.liveDenyKeywords();
+        if (!this.liveAllowProtectedBranchPush())
+            return keywords;
+        return keywords.filter((k) => !PUSH_FLOOR_KEYWORDS.has(String(k).trim()));
+    }
     /** The user-declared credential paths, as configured (may be empty). */
     liveCredentialPaths() {
         const read = this.options.readCredentialPaths;
@@ -855,7 +877,7 @@ export class PermGateRuntime {
      * call, the reason, or the event: the reason names the keyword, never the blob.
      */
     denyKeywordHit(exec) {
-        const keywords = this.liveDenyKeywords();
+        const keywords = this.effectiveDenyKeywords();
         if (keywords.length === 0)
             return undefined;
         const text = keywordScanText(exec.name, exec.arguments ?? {}, exec.commandText, this.liveScanKeys());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.3.4",
+  "version": "5.4.0",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"