dsh-permission-rules 0.2.0

package/lib/index.js

@@ -0,0 +1,1606 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import chokidar from "chokidar";
+import z from "@deepseek-ai/schemastery";
+import { parse } from "yaml";
+//#region src/config.ts
+/**
+* Config schema and resolution for `dsh-permission-rules`. Every tunable is
+* a validated {@link Config} field changeable from cordis.yml; the
+* resolution step validates the numeric bounds and compiles nothing — rule
+* files are external documents resolved per session cwd at load time.
+* @module dsh-permission-rules/config
+*/
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+const Config = z.object({
+	rulesFile: z.string().default(".dsh/rules.yaml"),
+	fallbackPath: z.string(),
+	badFilePolicy: z.union(["fail", "ignore-with-warning"]).default("fail"),
+	maxRules: z.number().default(256),
+	maxCachedWorkspaces: z.number().default(512),
+	patternMode: z.union(["glob", "regex"]).default("glob"),
+	watch: z.boolean().default(true),
+	watchStabilityThresholdMs: z.number().default(200),
+	language: z.union([
+		"en",
+		"zh",
+		"es",
+		"pt",
+		"hi"
+	]).default("en"),
+	caseInsensitivePaths: z.boolean().default(process.platform === "win32"),
+	audit: z.union(["all", "hits"]).default("all"),
+	searchUp: z.boolean().default(false),
+	maxGlobStars: z.number().default(2)
+});
+/**
+* Validate raw values and fill explicit defaults. A `maxRules`,
+* `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
+* integer, a non-positive stability window, or `searchUp` combined with an
+* absolute `rulesFile` throws here — misconfiguration fails loud at mount.
+* @param config - raw (possibly partial) plugin config.
+* @returns the fully resolved config.
+*/
+function resolveConfig(config = {}) {
+	const rulesFile = config.rulesFile ?? ".dsh/rules.yaml";
+	const searchUp = config.searchUp ?? false;
+	if (searchUp && isAbsolute(rulesFile)) throw new TypeError(`searchUp cannot be combined with an absolute rulesFile (${JSON.stringify(rulesFile)}): parent-directory walking needs a relative file name`);
+	const maxRules = config.maxRules ?? 256;
+	if (!Number.isSafeInteger(maxRules) || maxRules <= 0) throw new TypeError(`maxRules must be a positive safe integer, got ${String(config.maxRules)}`);
+	const watchStabilityThresholdMs = config.watchStabilityThresholdMs ?? 200;
+	if (!Number.isSafeInteger(watchStabilityThresholdMs) || watchStabilityThresholdMs < 0) throw new TypeError(`watchStabilityThresholdMs must be a non-negative safe integer, got ${String(config.watchStabilityThresholdMs)}`);
+	const maxCachedWorkspaces = config.maxCachedWorkspaces ?? 512;
+	if (!Number.isSafeInteger(maxCachedWorkspaces) || maxCachedWorkspaces <= 0) throw new TypeError(`maxCachedWorkspaces must be a positive safe integer, got ${String(config.maxCachedWorkspaces)}`);
+	const maxGlobStars = config.maxGlobStars ?? 2;
+	if (!Number.isSafeInteger(maxGlobStars) || maxGlobStars <= 0) throw new TypeError(`maxGlobStars must be a positive safe integer, got ${String(config.maxGlobStars)}`);
+	return {
+		rulesFile,
+		fallbackPath: config.fallbackPath,
+		badFilePolicy: config.badFilePolicy ?? "fail",
+		maxRules,
+		maxCachedWorkspaces,
+		patternMode: config.patternMode ?? "glob",
+		watch: config.watch ?? true,
+		watchStabilityThresholdMs,
+		language: config.language ?? "en",
+		caseInsensitivePaths: config.caseInsensitivePaths ?? process.platform === "win32",
+		audit: config.audit ?? "all",
+		searchUp,
+		maxGlobStars
+	};
+}
+//#endregion
+//#region src/glob.ts
+/**
+* Strict glob→RegExp compilation and regex-safety validation for rule
+* patterns. A conservative, validated glob subset: `*` (within one path
+* segment), `**` (any depth, including zero), `?` (one character),
+* `[abc]` / `[!abc]` character classes, and `\x` escapes. Unbalanced
+* brackets, empty classes, and trailing escapes throw at compile time — a
+* bad glob must fail loudly at load, never silently match nothing at
+* runtime.
+*
+* Catastrophic-backtracking defense, tuned per pattern flavor:
+* - Glob output is fully machine-generated, so the backtracking degree is
+*   exactly the number of star expansions: each `*`/`**` emits exactly one
+*   unbounded quantifier and no group is ever emitted. {@link compileGlob}
+*   therefore caps that count via `maxStars`.
+* - User regexes (patternMode `regex`) are scanned structurally: a
+*   quantifier applied to a group containing an unbounded quantifier, and a
+*   quantified group whose literal alternation branches overlap, are
+*   rejected at load. Chains of independent top-level quantifiers
+*   (`\d+\.\d+\.\d+`) stay allowed — a documented, deliberate limitation:
+*   regex mode is the escape hatch, glob mode is the guarded default.
+* @module dsh-permission-rules/glob
+*/
+/** Raised by {@link compileGlob} on a syntactically invalid or over-quantified pattern. */
+var GlobError = class extends TypeError {
+	constructor(message) {
+		super(message);
+		this.name = "GlobError";
+	}
+};
+/**
+* Compile one glob pattern to an anchored regular expression.
+* @param pattern - the glob source.
+* @param options - segment semantics, case handling, and the star cap.
+* @returns a RegExp matching the whole candidate string.
+* @throws {@link GlobError} on unbalanced `[`, empty classes, a trailing
+*   escape, or more star expansions than `options.maxStars` allows.
+*/
+function compileGlob(pattern, options) {
+	let out = "";
+	let stars = 0;
+	let i = 0;
+	while (i < pattern.length) {
+		const ch = pattern[i];
+		if (ch === "\\") {
+			const next = pattern[i + 1];
+			if (next === void 0) throw new GlobError(`glob ${JSON.stringify(pattern)} ends with a dangling escape`);
+			out += escapeRegExpChar(next);
+			i += 2;
+			continue;
+		}
+		if (ch === "*") {
+			if (pattern[i + 1] === "*") {
+				out += ".*";
+				stars += 1;
+				i += 2;
+				while (pattern[i] === "*") i += 1;
+				if (pattern[i] === "/") i += 1;
+				continue;
+			}
+			out += options.segments ? "[^/]*" : ".*";
+			stars += 1;
+			i += 1;
+			continue;
+		}
+		if (ch === "?") {
+			out += options.segments ? "[^/]" : ".";
+			i += 1;
+			continue;
+		}
+		if (ch === "[") {
+			const end = pattern.indexOf("]", i + 1);
+			if (end < 0) throw new GlobError(`glob ${JSON.stringify(pattern)} has an unbalanced "["`);
+			const body = pattern.slice(i + 1, end);
+			if (body.length === 0) throw new GlobError(`glob ${JSON.stringify(pattern)} has an empty character class`);
+			let content = body;
+			let negate = false;
+			if (content.startsWith("!")) {
+				negate = true;
+				content = content.slice(1);
+			}
+			if (content.length === 0) throw new GlobError(`glob ${JSON.stringify(pattern)} has an empty character class`);
+			out += `[${negate ? "^" : ""}${content.replaceAll("\\", "\\\\")}]`;
+			i = end + 1;
+			continue;
+		}
+		if (ch === "]") throw new GlobError(`glob ${JSON.stringify(pattern)} has an unbalanced "]"`);
+		out += escapeRegExpChar(ch);
+		i += 1;
+	}
+	if (options.maxStars !== void 0 && stars > options.maxStars) throw new GlobError(`glob ${JSON.stringify(pattern)} expands to ${stars} unbounded star quantifiers (max ${options.maxStars}); split it into several patterns`);
+	try {
+		return new RegExp(`^${out}$`, options.caseInsensitive === true ? "iu" : "u");
+	} catch (error) {
+		throw new GlobError(`glob ${JSON.stringify(pattern)} compiles to an invalid regular expression: ${String(error)}`);
+	}
+}
+/** Escape one literal character for a RegExp source. */
+function escapeRegExpChar(ch) {
+	return /[.*+?^${}()|[\]\\/]/.test(ch) ? `\\${ch}` : ch;
+}
+/**
+* Compile one pattern as an unanchored regex, rejecting syntax errors and
+* catastrophic-backtracking structures loudly.
+* @param pattern - the regex source.
+* @returns the compiled RegExp.
+* @throws TypeError when the pattern is invalid, nests an unbounded
+*   quantifier, or quantifies a group with overlapping literal alternation
+*   branches.
+*/
+function compilePatternRegex(pattern) {
+	let compiled;
+	try {
+		compiled = new RegExp(pattern, "u");
+	} catch (error) {
+		throw new TypeError(`pattern ${JSON.stringify(pattern)} is not a valid regular expression: ${String(error)}`, { cause: error });
+	}
+	assertSafeRegexStructure(pattern);
+	return compiled;
+}
+/**
+* Structural ReDoS scan. Rejects (a) an unbounded quantifier (`*`, `+`,
+* `{m,}`) applied to a group whose body contains an unbounded quantifier,
+* and (b) a quantified group whose fully-literal alternation branches
+* overlap as prefixes. Everything else — including chains of independent
+* top-level quantifiers — compiles untouched.
+* @param pattern - the already-syntax-valid regex source.
+* @throws TypeError on a rejected structure.
+*/
+function assertSafeRegexStructure(pattern) {
+	const stack = [];
+	let i = 0;
+	const markUnbounded = () => {
+		const top = stack[stack.length - 1];
+		if (top !== void 0) top.unbounded = true;
+	};
+	const reject = (message) => {
+		throw new TypeError(`pattern ${JSON.stringify(pattern)} is rejected: ${message} risks catastrophic backtracking; restructure the pattern or use glob mode`);
+	};
+	while (i < pattern.length) {
+		const ch = pattern[i];
+		if (ch === "\\") {
+			i += 2;
+			continue;
+		}
+		if (ch === "[") {
+			i += 1;
+			while (i < pattern.length && pattern[i] !== "]") {
+				if (pattern[i] === "\\") i += 1;
+				i += 1;
+			}
+			i += 1;
+			continue;
+		}
+		if (ch === "(") {
+			stack.push({
+				start: i,
+				unbounded: false
+			});
+			i += 1;
+			continue;
+		}
+		if (ch === ")") {
+			const group = stack.pop();
+			if (group === void 0) {
+				i += 1;
+				continue;
+			}
+			const quantifier = quantifierAt(pattern, i + 1);
+			if (quantifier !== void 0) {
+				if (quantifier.unbounded) {
+					if (group.unbounded) reject(`quantifier ${quantifier.text} applies to a group containing an unbounded quantifier`);
+					if (hasAmbiguousAlternation(pattern, group.start + 1, i)) reject(`quantified group ${JSON.stringify(pattern.slice(group.start, quantifier.end + 1))} has overlapping alternation branches`);
+					markUnbounded();
+				}
+				i = quantifier.end + 1;
+				continue;
+			}
+			if (group.unbounded) markUnbounded();
+			i += 1;
+			continue;
+		}
+		if (ch === "*" || ch === "+") {
+			markUnbounded();
+			i += 1;
+			continue;
+		}
+		if (ch === "{") {
+			const parsed = parseBraceQuantifier(pattern, i);
+			if (parsed !== void 0) {
+				if (parsed.unbounded) markUnbounded();
+				i = parsed.end + 1;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		i += 1;
+	}
+}
+/** One parsed quantifier token, when the character at `index` starts one. */
+function quantifierAt(pattern, index) {
+	const ch = pattern[index];
+	if (ch === "*" || ch === "+") return {
+		text: ch,
+		end: index,
+		unbounded: true
+	};
+	if (ch === "?") return {
+		text: ch,
+		end: index,
+		unbounded: false
+	};
+	if (ch === "{") return parseBraceQuantifier(pattern, index);
+}
+/** Parse `{m}`, `{m,}`, or `{m,n}` at `start`; other braces are not quantifiers. */
+function parseBraceQuantifier(pattern, start) {
+	const close = pattern.indexOf("}", start + 1);
+	if (close < 0) return void 0;
+	const body = pattern.slice(start + 1, close);
+	if (!/^\d+(,\d*)?$/.test(body)) return void 0;
+	const unbounded = body.includes(",") && body.endsWith(",");
+	return {
+		text: pattern.slice(start, close + 1),
+		end: close,
+		unbounded
+	};
+}
+/**
+* Whether a group body (between the parens) contains a top-level
+* alternation with two fully-literal branches where one is a prefix of the
+* other — the `(a|aa)+` ambiguity that makes repetition exponential.
+* @param pattern - the full pattern.
+* @param start - index just after the group's `(`.
+* @param end - index of the group's `)`.
+* @returns true when such an overlap exists.
+*/
+function hasAmbiguousAlternation(pattern, start, end) {
+	const branches = [];
+	let depth = 0;
+	let branchStart = start;
+	let hasPipe = false;
+	for (let i = start; i < end; i += 1) {
+		const ch = pattern[i];
+		if (ch === "\\") {
+			i += 1;
+			continue;
+		}
+		if (ch === "[") {
+			while (i < end && pattern[i] !== "]") {
+				if (pattern[i] === "\\") i += 1;
+				i += 1;
+			}
+			continue;
+		}
+		if (ch === "(") {
+			depth += 1;
+			continue;
+		}
+		if (ch === ")") {
+			depth -= 1;
+			continue;
+		}
+		if (ch === "|" && depth === 0) {
+			hasPipe = true;
+			branches.push(pattern.slice(branchStart, i));
+			branchStart = i + 1;
+		}
+	}
+	if (!hasPipe) return false;
+	branches.push(pattern.slice(branchStart, end));
+	for (let a = 0; a < branches.length; a += 1) for (let b = a + 1; b < branches.length; b += 1) if (literalPrefixOf(branches[a], branches[b])) return true;
+	return false;
+}
+/** True when two fully-literal branches share their complete shorter text as a prefix. */
+function literalPrefixOf(x, y) {
+	const literal = /^[^*+?()|[\]{}^$.\\]+$/;
+	if (!literal.test(x) || !literal.test(y)) return false;
+	const min = Math.min(x.length, y.length);
+	return x.slice(0, min) === y.slice(0, min);
+}
+//#endregion
+//#region src/rules.ts
+/**
+* The pure rule vocabulary: parsing a `.dsh/rules.yaml` document into a
+* validated {@link RulesFileDoc}, compiling patterns, and first-match
+* evaluation. Every function here is pure — no filesystem, clock, or
+* process state — so the parser, the matcher, and the failure modes are all
+* unit-testable and replayable.
+* @module dsh-permission-rules/rules
+*/
+/** Closed action list for runtime normalization of untrusted values. */
+const RULE_ACTIONS = [
+	"allow",
+	"deny",
+	"ask"
+];
+/** Platform names a `when.platform` entry may name (Node `process.platform` values). */
+const PLATFORMS = [
+	"aix",
+	"android",
+	"darwin",
+	"freebsd",
+	"linux",
+	"openbsd",
+	"sunos",
+	"win32"
+];
+/** Recursion bound for nested argument walks (path candidates and scalar leaves). */
+const MAX_ARGUMENT_DEPTH = 8;
+/** Display-truncation length for reasons/descriptions in `/rules` output. */
+const DISPLAY_TRUNCATE = 120;
+/**
+* Raised when a rule document cannot be parsed or compiled. The message
+* names the failing rule and field; loading code maps it onto the
+* `badFilePolicy`.
+*/
+var RuleError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RuleError";
+	}
+};
+/**
+* Parse one rules file body. Unknown document/rule/match fields, invalid
+* actions, missing reasons, and wrong-shaped collections all throw
+* {@link RuleError} — a malformed file fails loudly at load, never silently.
+* @param text - the raw YAML text.
+* @returns the validated document.
+*/
+function parseRulesDocument(text) {
+	const parsed = parseYaml(text);
+	if (parsed === null || parsed === void 0) return { rules: [] };
+	const root = asRecord(parsed, "rules document root");
+	const unknownRoot = Object.keys(root).filter((key) => key !== "rules");
+	if (unknownRoot.length > 0) throw new RuleError(`unknown top-level field${unknownRoot.length > 1 ? "s" : ""} ${unknownRoot.map((k) => JSON.stringify(k)).join(", ")} (only "rules" is allowed)`);
+	const rawRules = root["rules"];
+	if (rawRules === void 0) return { rules: [] };
+	if (!Array.isArray(rawRules)) throw new RuleError("\"rules\" must be a list");
+	return { rules: rawRules.map((raw, index) => parseRuleEntry(raw, index)) };
+}
+/**
+* Compile a parsed document for the hot path: pattern strings become
+* RegExps (invalid globs/regexes throw here, at load), and the rule count
+* is capped by `maxRules`.
+* @param doc - the parsed document.
+* @param options - pattern mode, caps, and case handling.
+* @returns the compiled ruleset (every rule attributed to source 0).
+*/
+function compileRules(doc, options) {
+	if (doc.rules.length > options.maxRules) throw new RuleError(`rule count ${doc.rules.length} exceeds maxRules ${options.maxRules}`);
+	return {
+		rules: doc.rules.map((entry, index) => compileRule(entry, index, 0, options)),
+		caseInsensitivePaths: options.caseInsensitivePaths
+	};
+}
+/**
+* Parse and compile an ordered source chain (nearest file first). Rules
+* keep per-file order and are evaluated in chain order, so a nearer file
+* can override a farther one on first-match semantics; `sourceIndex`
+* attributes every rule to its file. The TOTAL rule count is capped by
+* `maxRules`.
+* @param entries - the rule-file texts, nearest file first.
+* @param options - compile options.
+* @returns the merged ruleset and the source paths it references.
+*/
+function compileRulesChain(entries, options) {
+	const sources = entries.map((entry) => entry.path);
+	const merged = [];
+	for (const entry of entries) {
+		const doc = parseRulesDocument(entry.text);
+		for (const rule of doc.rules) merged.push(compileRule(rule, merged.length, sources.indexOf(entry.path), options));
+	}
+	if (merged.length > options.maxRules) throw new RuleError(`rule count ${merged.length} exceeds maxRules ${options.maxRules}`);
+	return {
+		ruleset: {
+			rules: merged,
+			caseInsensitivePaths: options.caseInsensitivePaths
+		},
+		sources
+	};
+}
+/** Compile one parsed rule into its hot-path form. */
+function compileRule(entry, index, sourceIndex, options) {
+	const tools = entry.match.tools.map((pattern) => compileToolPattern(pattern, options.maxGlobStars));
+	const params = /* @__PURE__ */ new Map();
+	for (const [key, patterns] of Object.entries(entry.match.params)) params.set(key, compileParamPatterns(key, patterns, options));
+	const paths = entry.match.paths.map((pattern) => compilePathPattern(pattern, options));
+	const env = /* @__PURE__ */ new Map();
+	for (const [key, patterns] of Object.entries(entry.match.when.env)) env.set(key, patterns.map((pattern) => compileValuePattern(pattern, options.patternMode, options.maxGlobStars)));
+	return {
+		index,
+		sourceIndex,
+		action: entry.action,
+		reason: entry.reason,
+		enabled: entry.enabled,
+		...entry.description !== void 0 ? { description: entry.description } : {},
+		tags: entry.tags,
+		tools,
+		params,
+		paths,
+		absent: entry.match.absent,
+		...env.size === 0 && entry.match.when.platform.length === 0 ? {} : { when: {
+			env,
+			platform: entry.match.when.platform
+		} },
+		source: entry
+	};
+}
+/**
+* Evaluate rules in order against one pending tool call. First match wins;
+* no match returns `undefined` (passthrough). Pure and synchronous — this
+* is the `tools/pre-execute` hot path, so it runs no I/O.
+* @param ruleset - compiled rules.
+* @param toolName - the tool being called.
+* @param args - the parsed (JSON) tool arguments; non-object values satisfy
+*   only tools/when/absent rules.
+* @param cwd - the session's absolute workspace root, for path normalization.
+* @param context - host facts for `when` evaluation; defaults resolve at match time.
+* @returns the first hit, or undefined when every rule passed.
+*/
+function matchRules(ruleset, toolName, args, cwd, context = {}) {
+	const argRecord = isRecord(args) ? args : void 0;
+	for (const rule of ruleset.rules) {
+		if (!rule.enabled) continue;
+		if (!matchTools(rule, toolName)) continue;
+		if (!matchWhen(rule, context)) continue;
+		if (rule.params.size > 0 && (argRecord === void 0 || !matchParams(rule, argRecord))) continue;
+		if (rule.absent.length > 0 && !matchAbsent(rule, argRecord)) continue;
+		if (rule.paths.length > 0 && (argRecord === void 0 || !matchPaths(rule, argRecord, cwd, ruleset.caseInsensitivePaths))) continue;
+		return {
+			ruleIndex: rule.index,
+			rule
+		};
+	}
+}
+/**
+* Indices of rules that can never fire: every ENABLED rule after the first
+* enabled rule whose every dimension is empty (an unconditional catch-all).
+* Disabled rules are excluded from both roles. Conservative on purpose —
+* pattern-set inclusion across globs is not analyzed.
+* @param ruleset - the compiled rules.
+* @returns 0-based indices of unreachable rules.
+*/
+function findUnreachableRules(ruleset) {
+	const unreachable = [];
+	let catchAllSeen = false;
+	for (const rule of ruleset.rules) {
+		if (!rule.enabled) continue;
+		if (catchAllSeen) {
+			unreachable.push(rule.index);
+			continue;
+		}
+		if (isCatchAll(rule)) catchAllSeen = true;
+	}
+	return unreachable;
+}
+/** Whether every match dimension of one rule is empty. */
+function isCatchAll(rule) {
+	return rule.tools.length === 0 && rule.params.size === 0 && rule.paths.length === 0 && rule.absent.length === 0 && rule.when === void 0;
+}
+/**
+* One-line human summary of a compiled rule, for `/rules` output. The
+* 1-based number, action, match dimensions, and reason render first; a
+* disabled marker, tags, and a truncated description follow.
+* @param rule - the compiled rule.
+* @param tokens - dimension-prefix vocabulary for the configured language.
+* @returns a single display line.
+*/
+function describeRule(rule, tokens) {
+	const parts = [];
+	if (rule.source.match.tools.length > 0) parts.push(`${tokens.tools}:${rule.source.match.tools.join(",")}`);
+	const params = Object.entries(rule.source.match.params).map(([key, patterns]) => `${key}=${patterns.join("|")}`).join(" ");
+	if (params.length > 0) parts.push(`${tokens.params}:${params}`);
+	if (rule.source.match.paths.length > 0) parts.push(`${tokens.paths}:${rule.source.match.paths.join(",")}`);
+	if (rule.source.match.absent.length > 0) parts.push(`${tokens.absent}:${rule.source.match.absent.join(",")}`);
+	const whenParts = Object.entries(rule.source.match.when.env).map(([key, patterns]) => `${key}=${patterns.join("|")}`).join(" ");
+	const platformPart = rule.source.match.when.platform.length > 0 ? `${tokens.platform}:${rule.source.match.when.platform.join(",")}` : "";
+	if (whenParts.length > 0 || platformPart.length > 0) parts.push(`${tokens.when}:${whenParts}${whenParts.length > 0 && platformPart.length > 0 ? " " : ""}${platformPart}`);
+	const match = parts.length > 0 ? `[${parts.join(" ")}]` : `[${tokens.allTools}]`;
+	const disabled = rule.enabled ? "" : ` (${tokens.disabled})`;
+	const description = rule.description !== void 0 ? ` (${truncate(rule.description, DISPLAY_TRUNCATE)})` : "";
+	const tags = rule.tags.length > 0 ? ` [${tokens.tags}:${rule.tags.join(",")}]` : "";
+	return `${rule.index + 1}. ${rule.action}${disabled} ${match}: ${truncate(rule.reason, DISPLAY_TRUNCATE)}${description}${tags}`;
+}
+/** Cut a display string at `limit` characters, marking truncation with `…`. */
+function truncate(text, limit) {
+	return text.length > limit ? `${text.slice(0, limit)}…` : text;
+}
+/** Whether a rule's tools dimension selects the tool. */
+function matchTools(rule, toolName) {
+	if (rule.tools.length === 0) return true;
+	return rule.tools.some((regex) => regex.test(toolName));
+}
+/** Whether a rule's params dimension holds: EVERY key present and matching. */
+function matchParams(rule, args) {
+	for (const [key, { positive, negative }] of rule.params) {
+		const value = args[key];
+		if (value === void 0) return false;
+		const candidates = scalarCandidates(value, 0);
+		if (candidates.length === 0) return false;
+		if (positive.length > 0 && !candidates.some((candidate) => positive.some((regex) => regex.test(candidate)))) return false;
+		if (negative.length > 0 && candidates.some((candidate) => negative.some((regex) => regex.test(candidate)))) return false;
+	}
+	return true;
+}
+/** Whether a rule's absent dimension holds: EVERY listed key missing. */
+function matchAbsent(rule, argRecord) {
+	for (const key of rule.absent) if (argRecord !== void 0 && argRecord[key] !== void 0) return false;
+	return true;
+}
+/** Whether a rule's when dimension holds for the host facts. */
+function matchWhen(rule, context) {
+	const when = rule.when;
+	if (when === void 0) return true;
+	if (when.platform.length > 0 && !when.platform.includes(context.platform ?? process.platform)) return false;
+	const env = context.env ?? process.env;
+	for (const [key, patterns] of when.env) {
+		const value = env[key];
+		if (value === void 0) return false;
+		if (!patterns.some((regex) => regex.test(value))) return false;
+	}
+	return true;
+}
+/** Whether a rule's paths dimension holds: at least one candidate matches one pattern. */
+function matchPaths(rule, args, cwd, caseInsensitive) {
+	const candidates = extractPathCandidates(args).map((candidate) => normalizeWorkspacePath(cwd, candidate, caseInsensitive)).filter((candidate) => candidate.length > 0);
+	if (candidates.length === 0) return false;
+	return candidates.some((candidate) => rule.paths.some((regex) => regex.test(candidate)));
+}
+/** Tool-name patterns are always globs (a tool name is not a path). */
+function compileToolPattern(pattern, maxGlobStars) {
+	return compileGlob(pattern, {
+		segments: false,
+		maxStars: maxGlobStars
+	});
+}
+/** Param-value patterns follow the configured mode; `/` is an ordinary character. */
+function compileValuePattern(pattern, mode, maxGlobStars) {
+	return mode === "regex" ? compilePatternRegex(pattern) : compileGlob(pattern, {
+		segments: false,
+		maxStars: maxGlobStars
+	});
+}
+/** Path patterns follow the configured mode with path-segment glob semantics. */
+function compilePathPattern(pattern, options) {
+	return options.patternMode === "regex" ? compilePatternRegex(pattern) : compileGlob(pattern, {
+		segments: true,
+		maxStars: options.maxGlobStars,
+		caseInsensitive: options.caseInsensitivePaths
+	});
+}
+/**
+* Split one param key's patterns into positive and negative lists. A
+* leading `!` negates: the value must NOT match any negated pattern; a bare
+* `!` is a load-time error.
+*/
+function compileParamPatterns(key, patterns, options) {
+	const positive = [];
+	const negative = [];
+	for (const pattern of patterns) if (pattern.startsWith("!")) {
+		const body = pattern.slice(1);
+		if (body.length === 0) throw new RuleError(`param key "${key}" has an empty negated pattern`);
+		negative.push(compileValuePattern(body, options.patternMode, options.maxGlobStars));
+	} else positive.push(compileValuePattern(pattern, options.patternMode, options.maxGlobStars));
+	return {
+		positive,
+		negative
+	};
+}
+/** Parse YAML through the `yaml` dependency, mapping parse failures onto {@link RuleError}. */
+function parseYaml(text) {
+	try {
+		return parse(text);
+	} catch (error) {
+		throw new RuleError(`invalid YAML: ${String(error)}`);
+	}
+}
+/** Validate one raw rule entry from the YAML document. */
+function parseRuleEntry(raw, index) {
+	const at = `rule ${index + 1}`;
+	const record = asRecord(raw, at);
+	const unknownFields = Object.keys(record).filter((key) => key !== "match" && key !== "action" && key !== "reason" && key !== "enabled" && key !== "description" && key !== "tags");
+	if (unknownFields.length > 0) throw new RuleError(`${at}: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: match, action, reason, enabled, description, tags)`);
+	const action = record["action"];
+	if (typeof action !== "string" || !RULE_ACTIONS.includes(action)) throw new RuleError(`${at}: action must be one of ${RULE_ACTIONS.map((a) => JSON.stringify(a)).join(" | ")}, got ${JSON.stringify(action)}`);
+	const reason = record["reason"];
+	if (typeof reason !== "string" || reason.trim().length === 0) throw new RuleError(`${at}: reason must be a non-empty string`);
+	const enabled = record["enabled"];
+	if (enabled !== void 0 && typeof enabled !== "boolean") throw new RuleError(`${at}: enabled must be a boolean, got ${typeof enabled}`);
+	const description = record["description"];
+	if (description !== void 0 && (typeof description !== "string" || description.trim().length === 0)) throw new RuleError(`${at}: description must be a non-empty string`);
+	return {
+		match: parseMatch(record["match"], at),
+		action,
+		reason,
+		enabled: enabled !== false,
+		...description !== void 0 ? { description } : {},
+		tags: parseStringList(record["tags"], `${at}.tags`)
+	};
+}
+/** Validate the `match` block of one rule. */
+function parseMatch(raw, at) {
+	if (raw === void 0) return {
+		tools: [],
+		params: {},
+		paths: [],
+		absent: [],
+		when: {
+			env: {},
+			platform: []
+		}
+	};
+	const record = asRecord(raw, `${at}.match`);
+	const unknownFields = Object.keys(record).filter((key) => key !== "tools" && key !== "params" && key !== "paths" && key !== "absent" && key !== "when");
+	if (unknownFields.length > 0) throw new RuleError(`${at}.match: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: tools, params, paths, absent, when)`);
+	return {
+		tools: parseStringList(record["tools"], `${at}.match.tools`),
+		params: parseParams(record["params"], `${at}.match.params`),
+		paths: parseStringList(record["paths"], `${at}.match.paths`),
+		absent: parseStringList(record["absent"], `${at}.match.absent`),
+		when: parseWhen(record["when"], `${at}.match.when`)
+	};
+}
+/** Validate the params map: non-empty string keys → one pattern or a pattern list. */
+function parseParams(raw, at) {
+	if (raw === void 0) return {};
+	const record = asRecord(raw, at);
+	const out = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (key.length === 0) throw new RuleError(`${at}: param keys must be non-empty strings`);
+		const patterns = parsePatternValues(value, `${at}.${key}`);
+		if (patterns.length === 0) throw new RuleError(`${at}.${key}: param patterns must be non-empty`);
+		out[key] = patterns;
+	}
+	return out;
+}
+/** Validate the `when` block: env patterns and a closed platform vocabulary. */
+function parseWhen(raw, at) {
+	if (raw === void 0) return {
+		env: {},
+		platform: []
+	};
+	const record = asRecord(raw, at);
+	const unknownFields = Object.keys(record).filter((key) => key !== "env" && key !== "platform");
+	if (unknownFields.length > 0) throw new RuleError(`${at}: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: env, platform)`);
+	const env = {};
+	const rawEnv = record["env"];
+	if (rawEnv !== void 0) {
+		const envRecord = asRecord(rawEnv, `${at}.env`);
+		for (const [key, value] of Object.entries(envRecord)) {
+			if (key.length === 0) throw new RuleError(`${at}.env: env var names must be non-empty strings`);
+			const patterns = parsePatternValues(value, `${at}.env.${key}`);
+			if (patterns.length === 0) throw new RuleError(`${at}.env.${key}: env patterns must be non-empty`);
+			env[key] = patterns;
+		}
+	}
+	const platform = parseStringList(record["platform"], `${at}.platform`);
+	for (const name of platform) if (!PLATFORMS.includes(name)) throw new RuleError(`${at}.platform: unknown platform ${JSON.stringify(name)} (allowed: ${PLATFORMS.map((p) => JSON.stringify(p)).join(", ")})`);
+	return {
+		env,
+		platform
+	};
+}
+/**
+* Validate one pattern or a pattern list; scalar strings/numbers/booleans
+* are single patterns (matching the runtime scalar-stringify semantics).
+*/
+function parsePatternValues(raw, at) {
+	if (typeof raw === "string") return [raw];
+	if (typeof raw === "number" || typeof raw === "boolean") return [String(raw)];
+	if (raw === void 0) return [];
+	if (Array.isArray(raw)) return raw.map((value, index) => {
+		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") throw new RuleError(`${at}[${index}] must be a string, number, or boolean`);
+		const pattern = String(value);
+		if (pattern.length === 0) throw new RuleError(`${at}[${index}] must be non-empty`);
+		return pattern;
+	});
+	throw new RuleError(`${at} must be a string, number, boolean, or a list of them`);
+}
+/** Validate a string or string list, absent = empty list. */
+function parseStringList(raw, at) {
+	if (raw === void 0) return [];
+	const values = typeof raw === "string" ? [raw] : raw;
+	if (!Array.isArray(values)) throw new RuleError(`${at} must be a string or a list of strings`);
+	return values.map((value, index) => {
+		if (typeof value !== "string" || value.length === 0) throw new RuleError(`${at}[${index}] must be a non-empty string`);
+		return value;
+	});
+}
+/** Narrow an unknown value to a plain record, throwing a {@link RuleError}. */
+function asRecord(value, at) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new RuleError(`${at} must be a mapping, got ${Array.isArray(value) ? "a list" : typeof value}`);
+	return value;
+}
+/** Narrow an unknown value to a plain string-keyed record (tool arguments). */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Top-level argument keys whose string values are path candidates. */
+const PATH_CANDIDATE_KEYS = [
+	"path",
+	"paths",
+	"file",
+	"files",
+	"file_path",
+	"dir",
+	"directory",
+	"directories",
+	"cwd",
+	"workspace",
+	"root",
+	"target",
+	"targets",
+	"output"
+];
+/**
+* Collect path-candidate strings from tool arguments at ANY nesting depth
+* (capped at {@link MAX_ARGUMENT_DEPTH}): scalar strings under the
+* documented {@link PATH_CANDIDATE_KEYS}, plus string elements of arrays
+* under those keys. Nested objects are walked so MCP-style
+* `{ arguments: { path } }` shapes still feed path matching. Iterates the
+* argument object's own key order, so extraction order is deterministic.
+* @param args - the parsed tool arguments.
+* @returns candidate strings in argument key order (duplicates kept).
+*/
+function extractPathCandidates(args) {
+	const candidates = [];
+	const walk = (node, depth) => {
+		if (depth > MAX_ARGUMENT_DEPTH) return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, depth + 1);
+			return;
+		}
+		if (typeof node !== "object" || node === null) return;
+		for (const [key, value] of Object.entries(node)) {
+			if (PATH_CANDIDATE_KEYS.includes(key)) {
+				if (typeof value === "string") candidates.push(value);
+				else if (Array.isArray(value)) {
+					for (const element of value) if (typeof element === "string") candidates.push(element);
+				}
+			}
+			walk(value, depth + 1);
+		}
+	};
+	walk(args, 0);
+	return candidates;
+}
+/**
+* Normalize one candidate path against the workspace root: separators
+* become `/`, `./` prefixes drop, and in-root paths become workspace
+* relative. Candidates OUTSIDE the root (absolute or drive-prefixed
+* elsewhere) yield `''` — path patterns address workspace-relative paths
+* only; a still-relative `../…` input is kept so explicit out-of-root
+* globs like `../shared/**` can address it. When `caseInsensitive` is set
+* (Windows default), the drive and root-prefix comparisons ignore ASCII
+* case, matching the case-insensitive filesystem.
+* @param cwd - the session's absolute workspace root (any separator).
+* @param candidate - the raw candidate path.
+* @param caseInsensitive - compare root prefixes without ASCII case.
+* @returns the workspace-relative posix path, or `''` to drop the candidate.
+*/
+function normalizeWorkspacePath(cwd, candidate, caseInsensitive = false) {
+	const root = toPosix(cwd).replace(/\/+$/, "");
+	const raw = toPosix(candidate);
+	if (raw.length === 0) return "";
+	let path = raw;
+	while (path.startsWith("./")) path = path.slice(2);
+	if (/^[A-Za-z]:\//.test(path)) {
+		if (!/^[A-Za-z]:\//.test(root)) return "";
+		if (path.slice(0, 2).toLowerCase() !== root.slice(0, 2).toLowerCase()) return "";
+		return relFromRoot(root, path, path.slice(2), root.slice(2), caseInsensitive);
+	}
+	if (path.startsWith("/")) return relFromRoot(root, path, path, root, caseInsensitive);
+	return path;
+}
+/** Strip a common root prefix from one absolute path, else drop the path. */
+function relFromRoot(root, path, rest, rootRest, caseInsensitive) {
+	const restLower = caseInsensitive ? rest.toLowerCase() : rest;
+	const rootRestLower = caseInsensitive ? rootRest.toLowerCase() : rootRest;
+	if (rootRestLower.length === 0) return rest.slice(1);
+	if (path.toLowerCase() === root.toLowerCase()) return "";
+	return restLower.startsWith(`${rootRestLower}/`) ? rest.slice(rootRest.length + 1) : "";
+}
+/** Convert a path to posix separators. */
+function toPosix(path) {
+	return path.replaceAll("\\", "/");
+}
+/** Collect scalar candidate strings from one param value, recursing into arrays and objects. */
+function scalarCandidates(value, depth) {
+	if (depth > MAX_ARGUMENT_DEPTH) return [];
+	if (typeof value === "string") return [value];
+	if (typeof value === "number" || typeof value === "boolean") return [String(value)];
+	if (Array.isArray(value)) return value.flatMap((element) => scalarCandidates(element, depth + 1));
+	if (typeof value === "object" && value !== null) return Object.values(value).flatMap((child) => scalarCandidates(child, depth + 1));
+	return [];
+}
+//#endregion
+//#region src/prose.ts
+/** Truncate long reasons/descriptions in one-line displays. */
+function short(text, limit = 120) {
+	return text.length > limit ? `${text.slice(0, limit)}…` : text;
+}
+const EN = {
+	rulesHeader: (count, sources, cwd) => `Permission rules: ${count} rule(s) from ${sources.join(", ")} (workspace ${cwd}).`,
+	noRules: (cwd, fallbackNote) => `No permission rules active: no rule file found for workspace ${cwd}${fallbackNote}; the empty rule set passes everything through.`,
+	fallbackMissing: " (and the configured fallback path is missing)",
+	reloaded: (count, source) => `Reloaded ${count} rule(s) from ${source}.`,
+	reloadFailed: (error) => `Reload failed: ${error}. The previous rules are still active.`,
+	lastReloadWarning: (error) => `Warning: the last reload failed (${error}); the rules listed above are the previous ones.`,
+	unknownArg: (arg) => `Unknown /rules argument "${arg}". ${EN.usage}`,
+	usage: "Usage: /rules [reload | decisions [n] | test <tool> <json-args>]",
+	decisionsHeader: (shown, total) => `Last ${shown} of ${total} permission decision(s) for this session:`,
+	noDecisions: "No permission decisions recorded in this session yet.",
+	invalidDecisionsCount: (arg) => `Invalid decisions count "${arg}": give a positive integer (default 10).`,
+	decisionLine: (seq, action, toolName, ruleIndex, reason) => {
+		return `- #${seq} ${action} ${toolName}${ruleIndex === void 0 ? "" : ` (rule ${ruleIndex + 1})`}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	},
+	testHit: (tool, ruleIndex, action, reason) => `"${tool}" matches rule ${ruleIndex + 1} (${action}): ${short(reason)}`,
+	testNoMatch: (tool) => `"${tool}" matches no rule — the call passes through.`,
+	testBadJson: (text) => `Invalid JSON arguments "${text}": the arguments must parse as JSON.`,
+	testUsage: "Usage: /rules test <tool> <json-args>, e.g. /rules test bash {\"command\":\"git push origin main\"}",
+	unreachableWarning: (numbers) => `Warning: rule${numbers.length > 1 ? "s" : ""} ${numbers.join(", ")} ${numbers.length > 1 ? "are" : "is"} unreachable (shadowed by an earlier catch-all rule).`,
+	emptySource: "(no rule file — empty rule set)"
+};
+const ZH = {
+	rulesHeader: (count, sources, cwd) => `权限规则：共 ${count} 条，来自 ${sources.join("、")}（工作区 ${cwd}）。`,
+	noRules: (cwd, fallbackNote) => `当前没有生效的权限规则：工作区 ${cwd} 未找到规则文件${fallbackNote}；空规则集全部放行。`,
+	fallbackMissing: "（且配置的回退路径不存在）",
+	reloaded: (count, source) => `已重载 ${count} 条规则，来自 ${source}。`,
+	reloadFailed: (error) => `重载失败：${error}。之前的规则仍然生效。`,
+	lastReloadWarning: (error) => `警告：上次重载失败（${error}）；以上列出的是之前的规则。`,
+	unknownArg: (arg) => `未知的 /rules 参数 "${arg}"。${ZH.usage}`,
+	usage: "用法：/rules [reload | decisions [n] | test <工具名> <json-参数>]",
+	decisionsHeader: (shown, total) => `本会话最近 ${shown}/${total} 条权限裁决：`,
+	noDecisions: "本会话还没有记录任何权限裁决。",
+	invalidDecisionsCount: (arg) => `无效的裁决条数 "${arg}"：请给正整数（默认 10）。`,
+	decisionLine: (seq, action, toolName, ruleIndex, reason) => {
+		return `- #${seq} ${action} ${toolName}${ruleIndex === void 0 ? "" : `（规则 ${ruleIndex + 1}）`}${reason === void 0 ? "" : `：${short(reason)}`}`;
+	},
+	testHit: (tool, ruleIndex, action, reason) => `"${tool}" 命中规则 ${ruleIndex + 1}（${action}）：${short(reason)}`,
+	testNoMatch: (tool) => `"${tool}" 未命中任何规则——该调用将透传。`,
+	testBadJson: (text) => `无效的 JSON 参数 "${text}"：参数必须能被解析为 JSON。`,
+	testUsage: "用法：/rules test <工具名> <json-参数>，例如 /rules test bash {\"command\":\"git push origin main\"}",
+	unreachableWarning: (numbers) => `警告：规则 ${numbers.join("、")} 不可达（被前面的通配规则遮蔽）。`,
+	emptySource: "（无规则文件——空规则集）"
+};
+const ES = {
+	rulesHeader: (count, sources, cwd) => `Reglas de permiso: ${count} regla(s) desde ${sources.join(", ")} (espacio de trabajo ${cwd}).`,
+	noRules: (cwd, fallbackNote) => `No hay reglas de permiso activas: no se encontró archivo de reglas para el espacio de trabajo ${cwd}${fallbackNote}; el conjunto vacío lo permite todo.`,
+	fallbackMissing: " (y la ruta de respaldo configurada no existe)",
+	reloaded: (count, source) => `Recargadas ${count} regla(s) desde ${source}.`,
+	reloadFailed: (error) => `Error de recarga: ${error}. Las reglas anteriores siguen activas.`,
+	lastReloadWarning: (error) => `Aviso: la última recarga falló (${error}); las reglas mostradas son las anteriores.`,
+	unknownArg: (arg) => `Argumento de /rules desconocido "${arg}". ${ES.usage}`,
+	usage: "Uso: /rules [reload | decisions [n] | test <herramienta> <json-args>]",
+	decisionsHeader: (shown, total) => `Últimas ${shown} de ${total} decisión(es) de permiso de esta sesión:`,
+	noDecisions: "Esta sesión aún no registra decisiones de permiso.",
+	invalidDecisionsCount: (arg) => `Cantidad de decisiones inválida "${arg}": indique un entero positivo (por defecto 10).`,
+	decisionLine: (seq, action, toolName, ruleIndex, reason) => {
+		return `- #${seq} ${action} ${toolName}${ruleIndex === void 0 ? "" : ` (regla ${ruleIndex + 1})`}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	},
+	testHit: (tool, ruleIndex, action, reason) => `"${tool}" coincide con la regla ${ruleIndex + 1} (${action}): ${short(reason)}`,
+	testNoMatch: (tool) => `"${tool}" no coincide con ninguna regla — la llamada pasa sin restricciones.`,
+	testBadJson: (text) => `Argumentos JSON inválidos "${text}": los argumentos deben poderse analizar como JSON.`,
+	testUsage: "Uso: /rules test <herramienta> <json-args>, p. ej. /rules test bash {\"command\":\"git push origin main\"}",
+	unreachableWarning: (numbers) => `Aviso: ${numbers.length > 1 ? "las reglas" : "la regla"} ${numbers.join(", ")} ${numbers.length > 1 ? "son inalcanzables" : "es inalcanzable"} (tapada por una regla general anterior).`,
+	emptySource: "(sin archivo de reglas — conjunto vacío)"
+};
+const PT = {
+	rulesHeader: (count, sources, cwd) => `Regras de permissão: ${count} regra(s) de ${sources.join(", ")} (workspace ${cwd}).`,
+	noRules: (cwd, fallbackNote) => `Nenhuma regra de permissão ativa: nenhum arquivo de regras encontrado para o workspace ${cwd}${fallbackNote}; o conjunto vazio permite tudo.`,
+	fallbackMissing: " (e o caminho de fallback configurado não existe)",
+	reloaded: (count, source) => `Recarregadas ${count} regra(s) de ${source}.`,
+	reloadFailed: (error) => `Falha ao recarregar: ${error}. As regras anteriores continuam ativas.`,
+	lastReloadWarning: (error) => `Aviso: a última recarga falhou (${error}); as regras listadas são as anteriores.`,
+	unknownArg: (arg) => `Argumento de /rules desconhecido "${arg}". ${PT.usage}`,
+	usage: "Uso: /rules [reload | decisions [n] | test <ferramenta> <json-args>]",
+	decisionsHeader: (shown, total) => `Últimas ${shown} de ${total} decisão(ões) de permissão desta sessão:`,
+	noDecisions: "Esta sessão ainda não registrou decisões de permissão.",
+	invalidDecisionsCount: (arg) => `Quantidade de decisões inválida "${arg}": informe um inteiro positivo (padrão 10).`,
+	decisionLine: (seq, action, toolName, ruleIndex, reason) => {
+		return `- #${seq} ${action} ${toolName}${ruleIndex === void 0 ? "" : ` (regra ${ruleIndex + 1})`}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	},
+	testHit: (tool, ruleIndex, action, reason) => `"${tool}" corresponde à regra ${ruleIndex + 1} (${action}): ${short(reason)}`,
+	testNoMatch: (tool) => `"${tool}" não corresponde a nenhuma regra — a chamada passa livremente.`,
+	testBadJson: (text) => `Argumentos JSON inválidos "${text}": os argumentos precisam ser JSON analisável.`,
+	testUsage: "Uso: /rules test <ferramenta> <json-args>, ex.: /rules test bash {\"command\":\"git push origin main\"}",
+	unreachableWarning: (numbers) => `Aviso: ${numbers.length > 1 ? "as regras" : "a regra"} ${numbers.join(", ")} ${numbers.length > 1 ? "são inalcançáveis" : "é inalcançável"} (encoberta por uma regra geral anterior).`,
+	emptySource: "(sem arquivo de regras — conjunto vazio)"
+};
+const HI = {
+	rulesHeader: (count, sources, cwd) => `अनुमति नियम: ${count} नियम, स्रोत ${sources.join(", ")} (कार्यक्षेत्र ${cwd})।`,
+	noRules: (cwd, fallbackNote) => `कोई अनुमति नियम सक्रिय नहीं: कार्यक्षेत्र ${cwd} के लिए नियम फ़ाइल नहीं मिली${fallbackNote}; खाली नियम-समूह सब कुछ पास कर देता है।`,
+	fallbackMissing: " (और कॉन्फ़िगर किया गया फ़ॉलबैक पथ मौजूद नहीं है)",
+	reloaded: (count, source) => `${count} नियम पुनः लोड किए गए, स्रोत ${source}।`,
+	reloadFailed: (error) => `पुनः लोड विफल: ${error}। पिछले नियम अब भी सक्रिय हैं।`,
+	lastReloadWarning: (error) => `चेतावनी: अंतिम पुनः लोड विफल रहा (${error}); ऊपर सूचीबद्ध नियम पिछले वाले हैं।`,
+	unknownArg: (arg) => `अज्ञात /rules तर्क "${arg}"। ${HI.usage}`,
+	usage: "उपयोग: /rules [reload | decisions [n] | test <टूल> <json-args>]",
+	decisionsHeader: (shown, total) => `इस सत्र के अंतिम ${shown}/${total} अनुमति निर्णय:`,
+	noDecisions: "इस सत्र में अभी कोई अनुमति निर्णय दर्ज नहीं है।",
+	invalidDecisionsCount: (arg) => `अमान्य निर्णय-संख्या "${arg}": एक धनात्मक पूर्णांक दें (डिफ़ॉल्ट 10)।`,
+	decisionLine: (seq, action, toolName, ruleIndex, reason) => {
+		return `- #${seq} ${action} ${toolName}${ruleIndex === void 0 ? "" : ` (नियम ${ruleIndex + 1})`}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	},
+	testHit: (tool, ruleIndex, action, reason) => `"${tool}" नियम ${ruleIndex + 1} से मेल खाता है (${action}): ${short(reason)}`,
+	testNoMatch: (tool) => `"${tool}" किसी नियम से मेल नहीं खाता — कॉल बिना रोक पास होगी।`,
+	testBadJson: (text) => `अमान्य JSON तर्क "${text}": तर्क JSON के रूप में पार्स होने चाहिए।`,
+	testUsage: "उपयोग: /rules test <टूल> <json-args>, जैसे /rules test bash {\"command\":\"git push origin main\"}",
+	unreachableWarning: (numbers) => `चेतावनी: नियम ${numbers.join(", ")} अप्राप्य हैं (पहले वाले सर्व-मिलान नियम से ढके हुए)।`,
+	emptySource: "(कोई नियम फ़ाइल नहीं — खाली नियम-समूह)"
+};
+/** The localized prose tables by language. */
+const UI_PROSE = {
+	en: EN,
+	zh: ZH,
+	es: ES,
+	pt: PT,
+	hi: HI
+};
+/** `describeRule` match-dimension tokens by language. */
+const DESCRIBE_TOKENS = {
+	en: {
+		allTools: "all tools",
+		tools: "tools",
+		params: "params",
+		paths: "paths",
+		absent: "absent",
+		when: "when",
+		platform: "platform",
+		disabled: "disabled",
+		tags: "tags"
+	},
+	zh: {
+		allTools: "全部工具",
+		tools: "工具",
+		params: "参数",
+		paths: "路径",
+		absent: "缺省键",
+		when: "条件",
+		platform: "平台",
+		disabled: "已禁用",
+		tags: "标签"
+	},
+	es: {
+		allTools: "todas las herramientas",
+		tools: "herramientas",
+		params: "parámetros",
+		paths: "rutas",
+		absent: "ausentes",
+		when: "cuándo",
+		platform: "plataforma",
+		disabled: "deshabilitada",
+		tags: "etiquetas"
+	},
+	pt: {
+		allTools: "todas as ferramentas",
+		tools: "ferramentas",
+		params: "parâmetros",
+		paths: "caminhos",
+		absent: "ausentes",
+		when: "quando",
+		platform: "plataforma",
+		disabled: "desativada",
+		tags: "etiquetas"
+	},
+	hi: {
+		allTools: "सभी टूल",
+		tools: "टूल",
+		params: "पैरामीटर",
+		paths: "पथ",
+		absent: "अनुपस्थित",
+		when: "शर्त",
+		platform: "प्लेटफ़ॉर्म",
+		disabled: "अक्षम",
+		tags: "टैग"
+	}
+};
+//#endregion
+//#region src/runtime.ts
+/**
+* Runtime of `dsh-permission-rules`: per-workspace rule loading (project
+* file chain by session cwd → fallback path → empty set), the
+* `tools/pre-execute` listener that turns a first-match hit into a
+* deny/ask decision (and NEVER short-circuits on allow or passthrough),
+* the `permissionRules/decision` audit event, the `/rules` session command
+* (`list | reload | decisions [n] | test <tool> <json>`), and
+* Chokidar-driven reloads. Every registration is an effect.
+* @module dsh-permission-rules/runtime
+*/
+/**
+* State and behavior. One instance per plugin mount; disposals are owned by
+* the watcher/timer effects registered in {@link apply}.
+*/
+var PermissionRulesRuntime = class {
+	ctx;
+	config;
+	/** Loaded (or failed) rules per workspace cwd, least-recently-used first for eviction. */
+	byCwd = /* @__PURE__ */ new Map();
+	/** Live watchers per rule-file path, with the cwds each serves. */
+	watchers = /* @__PURE__ */ new Map();
+	/** Debounce timers per rule-file path. */
+	timers = /* @__PURE__ */ new Map();
+	constructor(ctx, config) {
+		this.ctx = ctx;
+		this.config = config;
+	}
+	/** The shared compile options derived from config. */
+	compileOptions() {
+		return {
+			patternMode: this.config.patternMode,
+			maxRules: this.config.maxRules,
+			maxGlobStars: this.config.maxGlobStars,
+			caseInsensitivePaths: this.config.caseInsensitivePaths
+		};
+	}
+	/**
+	* Resolve which files serve a workspace, nearest first: the project file
+	* under the session cwd (or an absolute `rulesFile`), with `searchUp`
+	* also merging every parent directory's file on the way to the root,
+	* else the configured fallback, else `[]` (empty rule set). Nearer files
+	* evaluate first, so a child can override a parent rule.
+	* @param cwd - the session's absolute workspace root.
+	* @returns the absolute rule-file paths in effect, nearest first.
+	*/
+	resolveSources(cwd) {
+		if (this.config.searchUp) {
+			const sources = [];
+			let dir = cwd;
+			for (;;) {
+				const candidate = join(dir, this.config.rulesFile);
+				if (existsSync(candidate)) sources.push(candidate);
+				const parent = dirname(dir);
+				if (parent === dir) break;
+				dir = parent;
+			}
+			return sources.length === 0 ? this.resolveFallback() : sources;
+		}
+		const projectPath = isAbsolute(this.config.rulesFile) ? this.config.rulesFile : join(cwd, this.config.rulesFile);
+		if (existsSync(projectPath)) return [projectPath];
+		return this.resolveFallback();
+	}
+	/** The configured fallback file when it exists, else `[]`. */
+	resolveFallback() {
+		const fallback = this.config.fallbackPath;
+		if (fallback !== void 0) {
+			const fallbackPath = isAbsolute(fallback) ? fallback : resolve(fallback);
+			if (existsSync(fallbackPath)) return [fallbackPath];
+		}
+		return [];
+	}
+	/**
+	* Read, parse, and compile the rule-file chain serving `cwd`. Under
+	* `badFilePolicy: 'ignore-with-warning'` a bad file degrades to an empty
+	* rule set with a warning and keeps its source paths (so a later fix is
+	* watched and adopted); under `'fail'` it throws.
+	* @param cwd - the workspace root.
+	* @returns the loaded state.
+	*/
+	load(cwd) {
+		const sources = this.resolveSources(cwd);
+		if (sources.length === 0) return {
+			cwd,
+			sources: [],
+			compiled: {
+				rules: [],
+				caseInsensitivePaths: this.config.caseInsensitivePaths
+			}
+		};
+		try {
+			const { ruleset } = compileRulesChain(sources.map((path) => ({
+				path,
+				text: readFileSync(path, "utf8")
+			})), this.compileOptions());
+			return {
+				cwd,
+				sources,
+				compiled: ruleset
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			if (this.config.badFilePolicy === "ignore-with-warning") {
+				this.ctx.logger.warn(`permission-rules: ignoring ${sources.join(", ")}: ${message} (empty rule set)`);
+				return {
+					cwd,
+					sources,
+					compiled: {
+						rules: [],
+						caseInsensitivePaths: this.config.caseInsensitivePaths
+					},
+					lastError: message
+				};
+			}
+			throw error instanceof RuleError ? error : new RuleError(`cannot load ${sources.join(", ")}: ${message}`);
+		}
+	}
+	/**
+	* The rules in effect for one cwd, loading on first use. Under
+	* `badFilePolicy: 'fail'` a bad initial load throws on EVERY use (the
+	* pending tool call errors loudly) while the watcher keeps observing the
+	* files so a fix reloads into active rules. Cache hits refresh the
+	* least-recently-used position, so eviction drops the workspace that
+	* went longest without a decision.
+	* @param cwd - the workspace root.
+	* @returns the loaded rules.
+	*/
+	rulesFor(cwd) {
+		const existing = this.byCwd.get(cwd);
+		if (existing !== void 0) {
+			if (existing.failed === true) throw new RuleError(existing.lastError ?? `rule load failed for ${cwd}`);
+			this.byCwd.delete(cwd);
+			this.byCwd.set(cwd, existing);
+			return existing;
+		}
+		this.evictIfFull(cwd);
+		try {
+			const loaded = this.load(cwd);
+			this.byCwd.set(cwd, loaded);
+			this.reconcileWatch(cwd, loaded.sources);
+			return loaded;
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const sources = this.resolveSources(cwd);
+			this.byCwd.set(cwd, {
+				cwd,
+				sources,
+				compiled: {
+					rules: [],
+					caseInsensitivePaths: this.config.caseInsensitivePaths
+				},
+				lastError: message,
+				failed: true
+			});
+			this.reconcileWatch(cwd, sources);
+			throw error;
+		}
+	}
+	/**
+	* Re-read the rule-file chain for one cwd (watch-driven or
+	* `/rules reload`). A bad file NEVER crashes the process: the previous
+	* rules stay active, the error is logged and reported on the next
+	* `/rules` output.
+	* @param cwd - the workspace root.
+	*/
+	reload(cwd) {
+		const previous = this.byCwd.get(cwd);
+		try {
+			const loaded = this.load(cwd);
+			this.byCwd.set(cwd, loaded);
+			this.reconcileWatch(cwd, loaded.sources);
+			this.ctx.logger.info(`permission-rules: reloaded ${loaded.compiled.rules.length} rule(s) from ${loaded.sources.join(", ") || "(empty rule set)"} for ${cwd}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.ctx.logger.warn(`permission-rules: reload failed for ${cwd}: ${message} (keeping previous rules)`);
+			if (previous !== void 0) this.byCwd.set(cwd, {
+				...previous,
+				lastError: message
+			});
+			else this.byCwd.set(cwd, {
+				cwd,
+				sources: this.resolveSources(cwd),
+				compiled: {
+					rules: [],
+					caseInsensitivePaths: this.config.caseInsensitivePaths
+				},
+				lastError: message,
+				failed: true
+			});
+		}
+	}
+	/** The match context `when` conditions evaluate against. */
+	matchContext() {
+		return {
+			platform: process.platform,
+			env: process.env
+		};
+	}
+	/**
+	* The `tools/pre-execute` listener. A deny/ask hit returns the decision
+	* (first match wins, short-circuiting downstream listeners); an allow hit
+	* and a passthrough MUST delegate via `next()` so later listeners keep
+	* their say. Audit is appended once the final outcome is known, so the
+	* recorded `outcome` matches what the waterfall settled on.
+	* @param exec - the pending call (name, parsed arguments, caller agent).
+	* @param next - the downstream chain.
+	* @returns the pre-execute decision.
+	*/
+	async preExecute(exec, next) {
+		const cwd = exec.agent?.session.header.cwd ?? process.cwd();
+		const loaded = this.rulesFor(cwd);
+		const hit = matchRules(loaded.compiled, exec.name, exec.arguments, cwd, this.matchContext());
+		if (hit === void 0 || hit.rule.action === "allow") {
+			const decision = await next();
+			this.audit(exec, loaded, hit, decision.kind);
+			return decision;
+		}
+		const outcome = hit.rule.action;
+		this.audit(exec, loaded, hit, outcome);
+		if (outcome === "deny") return {
+			kind: "deny",
+			reason: hit.rule.reason
+		};
+		return {
+			kind: "ask",
+			reason: hit.rule.reason
+		};
+	}
+	/**
+	* Append the log-only `permissionRules/decision` audit event for every
+	* decision (passthrough included unless `audit: 'hits'`), requesting the
+	* envelope's `ignorable: true` marker so any harness build can load the
+	* log (readers that do not know the type skip the audit record instead of
+	* refusing the session). `source` names the matched rule's file, or the
+	* nearest effective file on a passthrough. Agentless calls have no
+	* session to audit; append failures are contained so an audit hiccup can
+	* never change a permission decision.
+	* @param exec - the pending call.
+	* @param loaded - the rules in effect.
+	* @param hit - the first matching rule, or undefined for passthrough.
+	* @param outcome - the final pre-execute decision.
+	*/
+	audit(exec, loaded, hit, outcome) {
+		if (this.config.audit === "hits" && hit === void 0) return;
+		const agent = exec.agent;
+		if (agent === void 0) return;
+		try {
+			agent.session.append("permissionRules/decision", {
+				toolName: exec.name,
+				callId: exec.callId,
+				source: hit === void 0 ? loaded.sources[0] ?? "" : loaded.sources[hit.rule.sourceIndex] ?? "",
+				action: hit === void 0 ? "passthrough" : hit.rule.action,
+				outcome,
+				...hit !== void 0 ? {
+					ruleIndex: hit.ruleIndex,
+					reason: hit.rule.reason
+				} : {}
+			}, { ignorable: true });
+		} catch (error) {
+			this.ctx.logger.warn(`permission-rules: audit append failed: ${String(error)}`);
+		}
+	}
+	/**
+	* Execute the `/rules` command: bare `/rules` lists the active rules and
+	* their sources; `/rules reload` re-reads the chain; `/rules decisions
+	* [n]` shows the session's audit trail; `/rules test <tool> <json>`
+	* dry-evaluates the rules against a hypothetical call. Command output
+	* stays in the UI — nothing here is injected into the model context.
+	* @param invocation - the received command invocation.
+	* @returns the command result shown to the user.
+	*/
+	command(invocation) {
+		const prose = UI_PROSE[this.config.language];
+		const raw = invocation.rawInput.trim();
+		const [verbRaw, ...rest] = raw.split(/\s+/);
+		const verb = (verbRaw ?? "").toLowerCase();
+		const cwd = invocation.agent.session.header.cwd ?? process.cwd();
+		if (verb === "reload") {
+			if (rest.length > 0) return {
+				kind: "error",
+				text: prose.unknownArg(invocation.rawInput.trim())
+			};
+			this.reload(cwd);
+			const reloaded = this.byCwd.get(cwd);
+			if (reloaded?.lastError !== void 0) return {
+				kind: "error",
+				text: prose.reloadFailed(reloaded.lastError)
+			};
+			const rules = reloaded?.compiled.rules ?? [];
+			const source = reloaded === void 0 || reloaded.sources.length === 0 ? prose.emptySource : reloaded.sources.join(", ");
+			return {
+				kind: "success",
+				text: prose.reloaded(rules.length, source)
+			};
+		}
+		if (verb === "decisions") {
+			if (rest.length > 1) return {
+				kind: "error",
+				text: prose.unknownArg(invocation.rawInput.trim())
+			};
+			let count = 10;
+			if (rest.length === 1) {
+				const parsed = Number(rest[0]);
+				if (!Number.isSafeInteger(parsed) || parsed <= 0) return {
+					kind: "error",
+					text: prose.invalidDecisionsCount(rest[0])
+				};
+				count = parsed;
+			}
+			return this.decisionsCommand(invocation, count, prose);
+		}
+		if (verb === "test") {
+			const verbText = verbRaw ?? "";
+			const restLine = raw.length > verbText.length ? raw.slice(verbText.length).trim() : "";
+			const match = /^(\S+)\s*(.*)$/s.exec(restLine);
+			const tool = match?.[1];
+			const jsonText = match?.[2] ?? "";
+			if (tool === void 0 || tool.length === 0) return {
+				kind: "error",
+				text: prose.testUsage
+			};
+			let args;
+			try {
+				args = jsonText.length > 0 ? JSON.parse(jsonText) : {};
+			} catch {
+				return {
+					kind: "error",
+					text: prose.testBadJson(jsonText)
+				};
+			}
+			let loaded;
+			try {
+				loaded = this.rulesFor(cwd);
+			} catch (error) {
+				return {
+					kind: "error",
+					text: error instanceof Error ? error.message : String(error)
+				};
+			}
+			const hit = matchRules(loaded.compiled, tool, args, cwd, this.matchContext());
+			return {
+				kind: "success",
+				text: hit === void 0 ? prose.testNoMatch(tool) : prose.testHit(tool, hit.ruleIndex, hit.rule.action, hit.rule.reason)
+			};
+		}
+		if (verb !== "") return {
+			kind: "error",
+			text: prose.unknownArg(invocation.rawInput.trim())
+		};
+		let loaded;
+		try {
+			loaded = this.rulesFor(cwd);
+		} catch (error) {
+			return {
+				kind: "error",
+				text: error instanceof Error ? error.message : String(error)
+			};
+		}
+		const lines = [];
+		if (loaded.sources.length === 0) lines.push(prose.noRules(cwd, this.config.fallbackPath !== void 0 ? prose.fallbackMissing : ""));
+		else {
+			lines.push(prose.rulesHeader(loaded.compiled.rules.length, loaded.sources, cwd));
+			lines.push(...loaded.compiled.rules.map((rule) => describeRule(rule, DESCRIBE_TOKENS[this.config.language])));
+			const unreachable = findUnreachableRules(loaded.compiled);
+			if (unreachable.length > 0) lines.push(prose.unreachableWarning(unreachable.map((index) => index + 1)));
+		}
+		if (loaded.lastError !== void 0) lines.push(prose.lastReloadWarning(loaded.lastError));
+		lines.push(prose.usage);
+		return {
+			kind: "success",
+			text: lines.join("\n")
+		};
+	}
+	/** Render the session's `permissionRules/decision` audit trail, newest last. */
+	decisionsCommand(invocation, count, prose) {
+		const decisions = invocation.agent.session.events.filter((event) => event.type === "permissionRules/decision");
+		if (decisions.length === 0) return {
+			kind: "success",
+			text: prose.noDecisions
+		};
+		const shown = decisions.slice(-count);
+		const lines = [prose.decisionsHeader(shown.length, decisions.length)];
+		for (const event of shown) {
+			const data = event.data;
+			lines.push(prose.decisionLine(event.seq, data.action, data.toolName, data.ruleIndex, data.reason));
+		}
+		return {
+			kind: "success",
+			text: lines.join("\n")
+		};
+	}
+	/**
+	* Validate deployment-level file references at mount — the earliest
+	* resolvable point. An absolute `rulesFile` or a configured
+	* `fallbackPath` must exist and parse; a missing referent fails the mount
+	* loudly instead of silently degrading later.
+	* @throws when a mandated file is missing or invalid.
+	*/
+	validateDeploymentFiles() {
+		if (isAbsolute(this.config.rulesFile)) this.loadForValidation(this.config.rulesFile);
+		if (this.config.fallbackPath !== void 0) {
+			const fallbackPath = isAbsolute(this.config.fallbackPath) ? this.config.fallbackPath : resolve(this.config.fallbackPath);
+			if (!existsSync(fallbackPath)) throw new RuleError(`permission-rules: fallbackPath ${JSON.stringify(this.config.fallbackPath)} does not exist`);
+			this.loadForValidation(fallbackPath);
+		}
+	}
+	/** Parse and compile one mandated file, rethrowing as a mount failure. */
+	loadForValidation(filePath) {
+		try {
+			compileRules(parseRulesDocument(readFileSync(filePath, "utf8")), this.compileOptions());
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			throw error instanceof RuleError ? error : new RuleError(`permission-rules: cannot load ${filePath}: ${message}`);
+		}
+	}
+	/** Attach (once per file path) the Chokidar watcher feeding {@link reload}. */
+	attachWatch(cwd, source) {
+		if (!this.config.watch || source === "") return;
+		const existing = this.watchers.get(source);
+		if (existing !== void 0) {
+			existing.cwds.add(cwd);
+			return;
+		}
+		const cwds = /* @__PURE__ */ new Set([cwd]);
+		const watcher = chokidar.watch(source, {
+			persistent: true,
+			ignoreInitial: true
+		});
+		const onEvent = () => this.scheduleReload(source);
+		watcher.on("add", onEvent);
+		watcher.on("change", onEvent);
+		watcher.on("unlink", onEvent);
+		watcher.on("error", (error) => {
+			this.ctx.logger.warn(`permission-rules: watcher error on ${source}: ${String(error)}`);
+		});
+		this.watchers.set(source, {
+			cwds,
+			close: () => {
+				watcher.close().catch((error) => {
+					this.ctx.logger.warn(`permission-rules: failed to close watcher on ${source}: ${String(error)}`);
+				});
+			}
+		});
+		this.ctx.effect(() => () => {
+			this.watchers.get(source)?.close();
+			this.watchers.delete(source);
+			const timer = this.timers.get(source);
+			if (timer !== void 0) {
+				clearTimeout(timer);
+				this.timers.delete(source);
+			}
+		});
+	}
+	/**
+	* Rebind `cwd` to its current rule-source chain. When a concrete source
+	* left the chain (deleted file, fallback switch), detach the workspace
+	* from watchers serving other sources and close the ones left empty, so
+	* long-running hosts cannot accumulate stale watchers. An empty chain (no
+	* rule file in effect) keeps the previous watchers alive: they own the
+	* "file recreated → adopted" signal, and the workspace-cache bound keeps
+	* the set of such watchers finite.
+	*/
+	reconcileWatch(cwd, sources) {
+		if (sources.length === 0) return;
+		for (const [watchedSource, entry] of this.watchers) if (!sources.includes(watchedSource)) entry.cwds.delete(cwd);
+		this.pruneWatchers();
+		for (const source of sources) this.attachWatch(cwd, source);
+	}
+	/** Close and drop watchers whose workspace sets are empty, clearing their debounce timers. */
+	pruneWatchers() {
+		for (const [source, entry] of this.watchers) {
+			if (entry.cwds.size > 0) continue;
+			entry.close();
+			this.watchers.delete(source);
+			const timer = this.timers.get(source);
+			if (timer !== void 0) {
+				clearTimeout(timer);
+				this.timers.delete(source);
+			}
+		}
+	}
+	/**
+	* Bound the per-workspace cache: when a NEW workspace would exceed
+	* `maxCachedWorkspaces`, evict the least-recently-used entry (the Map
+	* head, refreshed by every {@link rulesFor} hit) and release its watcher
+	* slots. Long-lived hosts that visit many workspaces therefore keep a
+	* bounded memory footprint.
+	*/
+	evictIfFull(cwd) {
+		if (this.byCwd.size < this.config.maxCachedWorkspaces || this.byCwd.has(cwd)) return;
+		const oldest = this.byCwd.keys().next().value;
+		if (oldest === void 0) return;
+		this.byCwd.delete(oldest);
+		for (const entry of this.watchers.values()) entry.cwds.delete(oldest);
+		this.pruneWatchers();
+	}
+	/** Number of live watchers, for observability and tests. */
+	activeWatcherCount() {
+		return this.watchers.size;
+	}
+	/** Number of pending debounce timers, for observability and tests. */
+	pendingReloadCount() {
+		return this.timers.size;
+	}
+	/** Debounce watch events into one reload per stability window. */
+	scheduleReload(source) {
+		const existing = this.timers.get(source);
+		if (existing !== void 0) clearTimeout(existing);
+		const timer = setTimeout(() => {
+			this.timers.delete(source);
+			for (const cwd of this.watchers.get(source)?.cwds ?? []) this.reload(cwd);
+		}, this.config.watchStabilityThresholdMs);
+		this.timers.set(source, timer);
+	}
+};
+/**
+* Mount the plugin: resolve config, validate deployment-level rule files,
+* register the pre-execute listener and the `/rules` command.
+* @param ctx - the host context.
+* @param config - raw plugin config.
+*/
+function apply(ctx, config) {
+	const runtime = new PermissionRulesRuntime(ctx, resolveConfig(config));
+	runtime.validateDeploymentFiles();
+	ctx.provide("permissionRulesRuntime", runtime);
+	ctx.on("tools/pre-execute", (exec, next) => runtime.preExecute(exec, next));
+	ctx.commands.register({
+		name: "rules",
+		description: "list, reload, audit, or dry-test the active permission rules for this workspace",
+		input: { hint: "[reload | decisions [n] | test <tool> <json-args>]" },
+		handler: (invocation) => runtime.command(invocation)
+	});
+}
+//#endregion
+//#region src/index.ts
+/**
+* `dsh-permission-rules` — Claude Code-style declarative permission rules
+* for DeepSeek Harness. A `tools/pre-execute` waterfall listener evaluates
+* an ordered `allow`/`deny`/`ask` rule list (tool-name globs, argument
+* glob/regex matching, workspace-path matching) per session cwd; deny and
+* ask decisions short-circuit the chain, while allow and passthrough always
+* delegate via `next()`. `ask` rides the official approval seam, where
+* answerers such as `dsh-auto-review` or a human UI decide — the plugin
+* itself never runs a reviewer. Every decision is audit-logged.
+*
+* Function plugin — no default export (the Loader unwraps
+* `exports.default ?? exports`, and a stray default would discard
+* `name`/`inject`/`Config`/`apply`).
+* @module dsh-permission-rules
+*/
+const name = "permission-rules";
+const inject = ["commands", "tools"];
+//#endregion
+export { Config, GlobError, PATH_CANDIDATE_KEYS, PLATFORMS, PermissionRulesRuntime, RULE_ACTIONS, RuleError, apply, compileGlob, compilePatternRegex, compileRules, compileRulesChain, describeRule, extractPathCandidates, findUnreachableRules, inject, matchRules, name, normalizeWorkspacePath, parseRulesDocument, resolveConfig };