dsh-permission-rules 0.4.2 → 0.5.2

package/lib/types/client/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `dsh-permission-rules`, browser half: mounts the `permissionRules`
+ * Remote contribution, then registers the "Permission Rules" settings
+ * page (`settings.section`, id `permission-rules`) with the network-policy
+ * summary, block counters, the recent interception list, and the rule
+ * editor. All data arrives through the `remote.permissionRules`
+ * namespace — the page issues no other RPC.
+ *
+ * The slot and remote services are accessed structurally (through
+ * `ctx.get`/`ctx.inject`) so this bundle compiles against the published
+ * rc.6 client peers without hard value imports beyond the platform
+ * modules.
+ * @module dsh-permission-rules/client
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Dictionary namespace owned by this plugin. */
+export declare const NS = "settings.permissionRules";
+/** Plugin name: matches the package name, the graph row id, and the bundle id. */
+export declare const name = "dsh-permission-rules";
+/** Services the page reads; `remote.permissionRules` appears once this plugin mounts its contribution. */
+export declare const inject: string[];
+/**
+ * Browser plugin body: dictionaries, the Remote contribution mount, and
+ * the settings-section registration.
+ * @param ctx - client root context.
+ */
+export declare function apply(ctx: Context): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAQlD,iDAAiD;AACjD,eAAO,MAAM,EAAE,6BAA6B,CAAA;AAE5C,kFAAkF;AAClF,eAAO,MAAM,IAAI,yBAAyB,CAAA;AAE1C,0GAA0G;AAC1G,eAAO,MAAM,MAAM,UAAgC,CAAA;AAmBnD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDvD"}

package/lib/types/client/locales.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Settings-page copy for `dsh-permission-rules`, `en`/`zh` (the two UI
+ * language codes the harness locale registry accepts today).
+ * @module dsh-permission-rules/client/locales
+ */
+export type PermissionRulesLocaleKey = 'nav' | 'policyTitle' | 'mode' | 'preset' | 'configured' | 'proxy' | 'proxyActive' | 'proxyInactive' | 'proxyDisabled' | 'counters' | 'denied' | 'askBlocked' | 'recentTitle' | 'noBlocks' | 'blockBy' | 'blockDefault' | 'blockUnattributed' | 'editorTitle' | 'editorPath' | 'editorLoad' | 'editorSave' | 'editorReload' | 'editorEmpty' | 'editorSaved' | 'editorFailed' | 'editorUntitled' | 'unknown';
+export declare const en: Record<PermissionRulesLocaleKey, string>;
+export declare const zh: Record<PermissionRulesLocaleKey, string>;
+//# sourceMappingURL=locales.d.ts.map

package/lib/types/client/locales.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,wBAAwB,GAChC,KAAK,GACL,aAAa,GACb,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,aAAa,GACb,eAAe,GACf,eAAe,GACf,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,aAAa,GACb,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,SAAS,CAAA;AAEb,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CA4BvD,CAAA;AAED,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CA4BvD,CAAA"}

package/lib/types/client/remote.d.ts

@@ -0,0 +1,181 @@
+/**
+ * The client-side Remote face of the `permissionRules` namespace: the
+ * hand-written `TypertRemoteContribution` mounted through
+ * `ctx.remote.$mount`, plus the declaration merging that types
+ * `ctx.remote.permissionRules`. The descriptor list is shared with the
+ * host `./typert` manifest (`../wire.ts`), so the two faces can never
+ * drift.
+ * @module dsh-permission-rules/client/remote
+ */
+import type { RemoteResult } from '@deepseek-ai/dsh-typert-protocol';
+import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.js';
+declare module '@deepseek-ai/dsh-typert-protocol' {
+    interface TypertRemoteNamespace$permissionRules {
+        /** Read the network-policy snapshot (mode, counters, recent blocks, editable rule sources). */
+        networkStatus: () => Promise<RemoteResult<PermissionRulesSnapshot>>;
+        /** Read one known rule file for the editor. */
+        rulesRead: (path: string) => Promise<RemoteResult<RulesReadResult>>;
+        /** Validate and write one known rule file. */
+        rulesSave: (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>;
+        /** Re-read every cached workspace chain. */
+        reload: () => Promise<RemoteResult<RulesReloadResult>>;
+    }
+    interface TypertRemoteMap {
+        'permissionRules/networkStatus': () => Promise<RemoteResult<PermissionRulesSnapshot>>;
+        'permissionRules/rulesRead': (path: string) => Promise<RemoteResult<RulesReadResult>>;
+        'permissionRules/rulesSave': (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>;
+        'permissionRules/reload': () => Promise<RemoteResult<RulesReloadResult>>;
+    }
+    interface TypertRemoteNamespaceMap {
+        permissionRules: TypertRemoteNamespace$permissionRules;
+    }
+}
+/** The client Remote contribution for the `permissionRules` namespace. */
+export declare const PERMISSION_RULES_REMOTE: Readonly<{
+    package: string;
+    descriptors: readonly (Readonly<{
+        readonly id: "dsh-permission-rules#permissionRules/networkStatus";
+        readonly service: "permissionRules";
+        readonly namespace: "permissionRules";
+        readonly method: "networkStatus";
+        readonly invocation: Readonly<{
+            kind: "direct";
+        }>;
+        readonly parameters: readonly never[];
+        readonly result: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+            schema: import("zod").ZodObject<{
+                enabled: import("zod").ZodBoolean;
+                mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                configuredMode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"auto">, import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                sandboxMode: import("zod").ZodNullable<import("zod").ZodString>;
+                proxyPort: import("zod").ZodNumber;
+                proxyActive: import("zod").ZodBoolean;
+                denied: import("zod").ZodNumber;
+                askBlocked: import("zod").ZodNumber;
+                recent: import("zod").ZodArray<import("zod").ZodObject<{
+                    time: import("zod").ZodNumber;
+                    tool: import("zod").ZodString;
+                    attributed: import("zod").ZodBoolean;
+                    domain: import("zod").ZodString;
+                    scheme: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"http">, import("zod").ZodLiteral<"https">, import("zod").ZodNull]>;
+                    port: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    action: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny">, import("zod").ZodLiteral<"ask">]>;
+                    mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                    matched: import("zod").ZodBoolean;
+                    source: import("zod").ZodString;
+                    ruleIndex: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    reason: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>>;
+                sources: import("zod").ZodArray<import("zod").ZodObject<{
+                    path: import("zod").ZodString;
+                    exists: import("zod").ZodBoolean;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>>;
+            }, import("zod/v4/core").$strip>;
+        }>;
+        readonly sourceLocation: Readonly<{
+            file: "src/wire.ts";
+            line: 1;
+            column: 1;
+        }>;
+    }> | Readonly<{
+        readonly id: "dsh-permission-rules#permissionRules/rulesRead";
+        readonly service: "permissionRules";
+        readonly namespace: "permissionRules";
+        readonly method: "rulesRead";
+        readonly invocation: Readonly<{
+            kind: "direct";
+        }>;
+        readonly parameters: readonly Readonly<{
+            name: string;
+            wire: string;
+            source: "json";
+            codec: Readonly<{
+                mode: "strict";
+                typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+                schema: import("zod").ZodString;
+            }>;
+        }>[];
+        readonly result: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+            schema: import("zod").ZodObject<{
+                path: import("zod").ZodString;
+                exists: import("zod").ZodBoolean;
+                text: import("zod").ZodString;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+        }>;
+        readonly sourceLocation: Readonly<{
+            file: "src/wire.ts";
+            line: 1;
+            column: 1;
+        }>;
+    }> | Readonly<{
+        readonly id: "dsh-permission-rules#permissionRules/rulesSave";
+        readonly service: "permissionRules";
+        readonly namespace: "permissionRules";
+        readonly method: "rulesSave";
+        readonly invocation: Readonly<{
+            kind: "direct";
+        }>;
+        readonly parameters: readonly (Readonly<{
+            name: string;
+            wire: string;
+            source: "json";
+            codec: Readonly<{
+                mode: "strict";
+                typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
+                schema: import("zod").ZodString;
+            }>;
+        }> | Readonly<{
+            name: string;
+            wire: string;
+            source: "json";
+            codec: Readonly<{
+                mode: "strict";
+                typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+                schema: import("zod").ZodString;
+            }>;
+        }>)[];
+        readonly result: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+            schema: import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+                reloaded: import("zod").ZodNullable<import("zod").ZodNumber>;
+            }, import("zod/v4/core").$strip>;
+        }>;
+        readonly sourceLocation: Readonly<{
+            file: "src/wire.ts";
+            line: 1;
+            column: 1;
+        }>;
+    }> | Readonly<{
+        readonly id: "dsh-permission-rules#permissionRules/reload";
+        readonly service: "permissionRules";
+        readonly namespace: "permissionRules";
+        readonly method: "reload";
+        readonly invocation: Readonly<{
+            kind: "direct";
+        }>;
+        readonly parameters: readonly never[];
+        readonly result: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+            schema: import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+        }>;
+        readonly sourceLocation: Readonly<{
+            file: "src/wire.ts";
+            line: 1;
+            column: 1;
+        }>;
+    }>)[];
+}>;
+//# sourceMappingURL=remote.d.ts.map

package/lib/types/client/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/client/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,kCAAkC,CAAA;AAE9F,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE9G,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,qCAAqC;QAC7C,+FAA+F;QAC/F,aAAa,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC,CAAA;QACnE,+CAA+C;QAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAA;QACnE,8CAA8C;QAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAA;QACjF,4CAA4C;QAC5C,MAAM,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAA;KACvD;IACD,UAAU,eAAe;QACvB,+BAA+B,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC,CAAA;QACrF,2BAA2B,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAA;QACrF,2BAA2B,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAA;QACnG,wBAAwB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAA;KACzE;IACD,UAAU,wBAAwB;QAChC,eAAe,EAAE,qCAAqC,CAAA;KACvD;CACF;AAED,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGC,CAAA"}

package/lib/types/client/section.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The "Permission Rules" settings page: network-policy summary (mode
+ * mapping, proxy liveness), block counters, the recent interception list
+ * (source tool + target domain), and the rule editor over known rule
+ * sources. All data arrives through the `permissionRules` Remote
+ * namespace; the page holds no state beyond the selected file and the
+ * draft text. Written with `React.createElement` only — the client
+ * bundle is plain JavaScript.
+ * @module dsh-permission-rules/client/section
+ */
+import type { ReactElement } from 'react';
+import type { PermissionRulesLocaleKey } from './locales.js';
+import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.js';
+/** Functions the registration injects (wired to the Remote namespace in `./index.ts`). */
+export interface PermissionRulesSectionInjected {
+    /** Read the network-policy snapshot. */
+    status: () => Promise<PermissionRulesSnapshot>;
+    /** Read one known rule file. */
+    rulesRead: (path: string) => Promise<RulesReadResult>;
+    /** Validate and write one known rule file. */
+    rulesSave: (path: string, text: string) => Promise<RulesSaveResult>;
+    /** Re-read every cached workspace chain. */
+    reload: () => Promise<RulesReloadResult>;
+    /** The locale-bound translator. */
+    t: T;
+}
+/** One bound dictionary. */
+export type T = (key: PermissionRulesLocaleKey, vars?: Record<string, string | number>) => string;
+/** The shell supplies `close`; everything else arrives through the slot injection. */
+export type PermissionRulesSectionProps = PermissionRulesSectionInjected & {
+    close: () => void;
+};
+/** The settings section component. */
+export declare function PermissionRulesSection({ close, t, ...injected }: PermissionRulesSectionProps): ReactElement;
+//# sourceMappingURL=section.d.ts.map

package/lib/types/client/section.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"section.d.ts","sourceRoot":"","sources":["../../../src/client/section.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AACzC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE9G,0FAA0F;AAC1F,MAAM,WAAW,8BAA8B;IAC7C,wCAAwC;IACxC,MAAM,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC9C,gCAAgC;IAChC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACrD,8CAA8C;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACnE,4CAA4C;IAC5C,MAAM,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxC,mCAAmC;IACnC,CAAC,EAAE,CAAC,CAAA;CACL;AAED,4BAA4B;AAC5B,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,wBAAwB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,MAAM,CAAA;AAEjG,sFAAsF;AACtF,MAAM,MAAM,2BAA2B,GAAG,8BAA8B,GAAG;IACzE,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB,CAAA;AAmBD,sCAAsC;AACtC,wBAAgB,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,2BAA2B,GAAG,YAAY,CAgJ3G"}

package/lib/types/config.d.ts

@@ -6,12 +6,48 @@
  * @module dsh-permission-rules/config
  */
 import z from '@deepseek-ai/schemastery';
-import type { PatternMode } from './rules.ts';
-import type { UiLanguage } from './prose.ts';
+import type { PatternMode } from './rules.js';
+import type { NetworkMode, UnlistedAction } from './network.js';
+import type { UiLanguage } from './prose.js';
 /** What happens when a discovered rule file exists but cannot be parsed or compiled. */
 export type BadFilePolicy = 'fail' | 'ignore-with-warning';
 /** Which decisions are audit-logged: every call, or only rule hits. */
 export type AuditGranularity = 'all' | 'hits';
+/** Loopback-target handling at the proxy layer. */
+export type LoopbackPolicy = 'allow' | 'policy';
+/** NO_PROXY handling for policy-injected subprocess environment. */
+export type NoProxyPolicy = 'clear' | 'preserve';
+/**
+ * The process-level network policy block. Every field is optional —
+ * {@link ResolvedConfig} supplies the defaults. `mode: 'auto'` maps the
+ * official sandbox preset onto the three network modes (read-only →
+ * deny-all, workspace-write → whitelist, danger-full-access → allow-all);
+ * on hosts without the sandbox-policy service `auto` resolves to
+ * `autoFallback` (`allow-all` by default, so pre-network hosts keep their
+ * permissive behavior until configured).
+ */
+export interface NetworkConfig {
+    /** Master switch: `false` disables the proxy, the env injection, and the web-tool mode defaults. */
+    enabled?: boolean;
+    /** Policy mode: `auto` follows the sandbox preset, or an explicit mode. */
+    mode?: 'auto' | NetworkMode;
+    /** Mode used when `mode: 'auto'` and the sandbox-policy service is absent or unknown. */
+    autoFallback?: NetworkMode;
+    /** Whitelist-mode handling of targets no rule matched: `ask` (default) or `deny`. */
+    unlisted?: UnlistedAction;
+    /** Local proxy bind address (loopback only — the proxy never listens publicly). */
+    proxyBind?: string;
+    /** Local proxy port; `0` picks a free ephemeral port. */
+    proxyPort?: number;
+    /** Cap on recent-block records kept for the settings page. */
+    proxyMaxRecent?: number;
+    /** Loopback targets: `allow` (default, Codex parity) or `policy` (evaluated like any target). */
+    loopback?: LoopbackPolicy;
+    /** Whether proxy environment variables are injected for subprocesses. */
+    injectEnv?: boolean;
+    /** Subprocess NO_PROXY handling: `clear` enforces the policy (default) or `preserve` keeps ambient values. */
+    noProxy?: NoProxyPolicy;
+}
 /** Raw plugin config — every field optional; {@link Config} supplies the defaults. */
 export interface Config {
     /**
@@ -70,6 +106,21 @@ export interface Config {
      * `scripts/repair-session-logs.mjs` before loading on a newer harness).
      */
     allowUnmarkedAudit?: boolean;
+    /** Process-level network policy (all optional; defaults inside). */
+    network?: NetworkConfig;
+}
+/** Network config after {@link resolveConfig}: every optional field has its explicit default. */
+export interface ResolvedNetworkConfig {
+    readonly enabled: boolean;
+    readonly mode: 'auto' | NetworkMode;
+    readonly autoFallback: NetworkMode;
+    readonly unlisted: UnlistedAction;
+    readonly proxyBind: string;
+    readonly proxyPort: number;
+    readonly proxyMaxRecent: number;
+    readonly loopback: LoopbackPolicy;
+    readonly injectEnv: boolean;
+    readonly noProxy: NoProxyPolicy;
 }
 /** Config after {@link resolveConfig}: every optional field has its explicit default. */
 export interface ResolvedConfig {
@@ -88,6 +139,7 @@ export interface ResolvedConfig {
     readonly maxGlobStars: number;
     readonly enforce: boolean;
     readonly allowUnmarkedAudit: boolean;
+    readonly network: ResolvedNetworkConfig;
 }
 /** Schemastery schema: the loader validates and fills defaults before `apply`. */
 export declare const Config: z<Config>;

package/lib/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,qBAAqB,CAAA;AAE1D,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAA;AAE7C,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2GAA2G;IAC3G,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uGAAuG;IACvG,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAA;IACrB,iHAAiH;IACjH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,oGAAoG;IACpG,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACrC;AAED,kFAAkF;AAClF,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAgB3B,CAAA;AAEF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,cAAc,CAgDjE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,qBAAqB,CAAA;AAE1D,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAA;AAE7C,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE/C,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAA;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAA;IAC3B,yFAAyF;IACzF,YAAY,CAAC,EAAE,WAAW,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2GAA2G;IAC3G,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uGAAuG;IACvG,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAA;IACrB,iHAAiH;IACjH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,oGAAoG;IACpG,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,oEAAoE;IACpE,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;CACxC;AAED,kFAAkF;AAClF,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CA4B3B,CAAA;AAEF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,cAAc,CAkDjE"}

package/lib/types/events.d.ts

@@ -55,6 +55,34 @@ declare module '@deepseek-ai/dsh-session/types' {
             cwd: string;
             dryRun?: true;
         };
+        /**
+         * One process-level network block (proxy layer), appended when the
+         * block can be attributed to a session — log-only audit with the same
+         * `ignorable` marker discipline as `permissionRules/decision`. `tool`
+         * is the attributed shell tool (`bash`/`pwsh`) or `'subprocess'` when
+         * no in-flight shell execution could be named; `attributed` records
+         * which case. `domain`/`scheme`/`port` name the blocked target,
+         * `action` is `deny` or `ask` (an ask at the proxy cannot ride the
+         * approval seam — no session context — and blocks with a message),
+         * `mode` is the network policy mode in effect, and `ruleIndex`/`reason`
+         * appear only on rule hits.
+         */
+        'permissionRules/network': {
+            kind: 'block';
+            tool: string;
+            attributed: boolean;
+            callId?: CallId;
+            domain: string;
+            scheme?: 'http' | 'https';
+            port?: number;
+            action: 'deny' | 'ask';
+            mode: string;
+            matched: boolean;
+            source: string;
+            ruleIndex?: number;
+            reason?: string;
+            time: number;
+        };
     }
 }
 /** Every action a decision event can carry. */
@@ -75,6 +103,23 @@ export interface AuditDecision {
     /** `true` on dry-run records (`enforce: false`) — matched but never enforced. */
     dryRun?: true;
 }
+/** The payload of one `permissionRules/network` audit record. */
+export interface AuditNetworkBlock {
+    kind: 'block';
+    tool: string;
+    attributed: boolean;
+    callId?: CallId;
+    domain: string;
+    scheme?: 'http' | 'https';
+    port?: number;
+    action: 'deny' | 'ask';
+    mode: string;
+    matched: boolean;
+    source: string;
+    ruleIndex?: number;
+    reason?: string;
+    time: number;
+}
 /**
  * `Session.append` narrowed to this plugin's audit event. The options bag
  * exists only on host builds that expose the `ignorable` envelope-marker

package/lib/types/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,QAAQ,gCAAgC,CAAC;IAC9C,UAAU,eAAe;QACvB;;;;;;;;;;WAUG;QACH,0BAA0B,EAAE;YAC1B,QAAQ,EAAE,MAAM,CAAA;YAChB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;YAChD,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;YAClC,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,GAAG,EAAE,MAAM,CAAA;YACX,MAAM,CAAC,EAAE,IAAI,CAAA;SACd,CAAA;KACF;CACF;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;AAErE,iEAAiE;AACjE,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AAErD,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,cAAc,CAAA;IACtB,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,iFAAiF;IACjF,MAAM,CAAC,EAAE,IAAI,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,0BAA0B,EAChC,IAAI,EAAE,aAAa,EACnB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,KAC3B,OAAO,CAAA;AAEZ;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,QAAQ,gCAAgC,CAAC;IAC9C,UAAU,eAAe;QACvB;;;;;;;;;;WAUG;QACH,0BAA0B,EAAE;YAC1B,QAAQ,EAAE,MAAM,CAAA;YAChB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;YAChD,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;YAClC,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,GAAG,EAAE,MAAM,CAAA;YACX,MAAM,CAAC,EAAE,IAAI,CAAA;SACd,CAAA;QACD;;;;;;;;;;;WAWG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,OAAO,CAAA;YACb,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,OAAO,CAAA;YACnB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;YACzB,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;YACtB,IAAI,EAAE,MAAM,CAAA;YACZ,OAAO,EAAE,OAAO,CAAA;YAChB,MAAM,EAAE,MAAM,CAAA;YACd,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,IAAI,EAAE,MAAM,CAAA;SACb,CAAA;KACF;CACF;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;AAErE,iEAAiE;AACjE,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AAErD,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,cAAc,CAAA;IACtB,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,iFAAiF;IACjF,MAAM,CAAC,EAAE,IAAI,CAAA;CACd;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,0BAA0B,EAChC,IAAI,EAAE,aAAa,EACnB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,KAC3B,OAAO,CAAA;AAEZ;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D"}

package/lib/types/index.d.ts

@@ -15,13 +15,15 @@
  * `name`/`inject`/`Config`/`apply`).
  * @module dsh-permission-rules
  */
-import { apply } from './runtime.ts';
+import { apply } from './runtime.js';
 export declare const name = "permission-rules";
 export declare const inject: string[];
 export { apply };
-export { PermissionRulesRuntime, isUnmarkedHostVersion } from './runtime.ts';
-export * from './config.ts';
-export * from './events.ts';
-export * from './rules.ts';
-export * from './glob.ts';
+export { PermissionRulesRuntime, isUnmarkedHostVersion } from './runtime.js';
+export * from './config.js';
+export * from './events.js';
+export * from './rules.js';
+export * from './glob.js';
+export * from './network.js';
+export * from './proxy.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAEpC,eAAO,MAAM,IAAI,qBAAqB,CAAA;AACtC,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,CAAA;AAChB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAC5E,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAEpC,eAAO,MAAM,IAAI,qBAAqB,CAAA;AACtC,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,CAAA;AAChB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAC5E,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/lib/types/network.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Pure network-policy orchestration shared by the `tools/pre-execute` gate
+ * and the local HTTP/CONNECT proxy: the three policy modes mapped onto the
+ * official sandbox presets, proxy-layer first-match evaluation over the
+ * loaded rule chains, and the mode-default fallback decision. No I/O, no
+ * process state — unit-testable and replayable.
+ * @module dsh-permission-rules/network
+ */
+import type { CompiledRule, CompiledRuleset, NetworkTarget } from './rules.js';
+import type { MatchContext } from './rules.js';
+/** The three network policy modes. */
+export type NetworkMode = 'deny-all' | 'whitelist' | 'allow-all';
+/** Closed mode list for runtime normalization of untrusted values. */
+export declare const NETWORK_MODES: readonly NetworkMode[];
+/** The official file-sandbox presets the `auto` mode maps onto. */
+export type SandboxModeName = 'read-only' | 'workspace-write' | 'danger-full-access';
+/** How a whitelist-mode unlisted target is handled: ask (blocked at the proxy, approval seam for web tools) or deny. */
+export type UnlistedAction = 'ask' | 'deny';
+/**
+ * Map one official sandbox preset onto its network mode, Codex-style:
+ * `read-only` defaults to no network (whitelist only), `workspace-write`
+ * keeps a whitelist with ask/deny for unlisted targets, and
+ * `danger-full-access` opens everything (rules can still narrow it). Any
+ * other value falls back to `fallback` — hosts without the sandbox-policy
+ * service therefore stay permissive, preserving pre-network behavior.
+ * @param sandbox - the resolved sandbox mode, or undefined.
+ * @param fallback - the mode used when the preset is unknown/absent.
+ * @returns the effective network mode.
+ */
+export declare function networkModeForSandbox(sandbox: string | undefined, fallback: NetworkMode): NetworkMode;
+/** One rule chain the proxy evaluates (ruleset + its source-file paths for attribution). */
+export interface NetworkChain {
+    readonly ruleset: CompiledRuleset;
+    readonly sources: readonly string[];
+}
+/** Proxy-layer evaluation options. */
+export interface NetworkDecisionOptions {
+    /** The policy mode in effect (already resolved by the runtime). */
+    readonly mode: NetworkMode;
+    /** Whitelist-mode handling of unlisted targets. */
+    readonly unlisted: UnlistedAction;
+    /** `allow` short-circuits loopback targets before rules; `policy` evaluates them normally. */
+    readonly loopback: 'allow' | 'policy';
+    /** Host facts for `when` evaluation (proxy has no agent identity). */
+    readonly context?: MatchContext;
+}
+/** One network decision: a rule hit or the mode-default fallback. */
+export interface NetworkDecision {
+    readonly action: 'allow' | 'deny' | 'ask';
+    /** Whether a rule (true) or the mode default (false) produced the decision. */
+    readonly matched: boolean;
+    /** The mode the fallback was computed from. */
+    readonly mode: NetworkMode;
+    readonly ruleIndex?: number;
+    readonly rule?: CompiledRule;
+    /** Source file of the matched rule, for audit attribution. */
+    readonly source?: string;
+}
+/** The default decision a mode yields for a target no rule matched. */
+export declare function defaultDecision(mode: NetworkMode, unlisted: UnlistedAction): NetworkDecision;
+/**
+ * Evaluate the network policy for one target across the loaded rule
+ * chains (nearest workspace first, first match wins). Proxy-layer tool
+ * attribution: a shell subprocess connection counts as `bash`/`pwsh`
+ * candidates, so a rule scoped to either shell tool can fire and one
+ * scoped to web tools never does. Agent identity is unknown at the proxy,
+ * so agent-scoped network rules fail closed there (the pre-execute path
+ * is where agents are known). Loopback targets short-circuit before any
+ * rule when `loopback: 'allow'` (Codex parity: local dev servers stay
+ * reachable in the read-only default).
+ * @param chains - the loaded chains, insertion (nearest) order first.
+ * @param target - the parsed connection/URL target.
+ * @param options - mode, unlisted handling, loopback policy, host facts.
+ * @returns the decision.
+ */
+export declare function decideNetworkTarget(chains: readonly NetworkChain[], target: NetworkTarget, options: NetworkDecisionOptions): NetworkDecision;
+/** Whether a target addresses the loopback range. */
+export declare function isLoopbackTarget(target: NetworkTarget): boolean;
+/**
+ * The short structured message a blocked proxy connection receives (403
+ * body for plain HTTP, CONNECT error body for tunnels). Clients such as
+ * curl print it verbatim, so the model sees the reason through the shell
+ * tool output. An `ask` at the proxy layer is worded as a pending-approval
+ * block because the proxy has no session context for the interactive
+ * approval seam.
+ * @param decision - the decision that blocked the connection.
+ * @returns a short text/plain message.
+ */
+export declare function blockMessage(decision: NetworkDecision): string;
+//# sourceMappingURL=network.d.ts.map

package/lib/types/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/network.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,sCAAsC;AACtC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEhE,sEAAsE;AACtE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAA2C,CAAA;AAE3F,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAA;AAEpF,wHAAwH;AACxH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,WAAW,GAAG,WAAW,CAOrG;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;CAChC;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,GAAG,eAAe,CAS5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAuB5I;AAYD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAM/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAmB9D"}

package/lib/types/prose.d.ts

@@ -56,6 +56,16 @@ export interface UiProse {
     unreachableWarning: (numbers: readonly number[]) => string;
     /** Empty-source placeholder in the rules header. */
     emptySource: string;
+    /** Line shown when the network policy is disabled (`network.enabled: false`). */
+    networkDisabled: string;
+    /** Header naming the network mode, its sandbox preset, and proxy liveness. */
+    networkHeader: (mode: string, sandboxMode: string | undefined, configuredMode: string, proxyActive: boolean, proxyPort: number) => string;
+    /** Cumulative block counters line. */
+    networkCounters: (denied: number, askBlocked: number) => string;
+    /** Line shown when no proxy blocks were recorded yet. */
+    noNetworkBlocks: string;
+    /** One recent proxy-block row. */
+    networkBlockLine: (time: number, tool: string, attributed: boolean, domain: string, scheme: string | undefined, port: number | undefined, action: string, matched: boolean, ruleIndex: number | undefined, reason: string | undefined) => string;
 }
 /** Tokens `describeRule` uses for its match-dimension prefixes. */
 export interface DescribeTokens {
@@ -67,6 +77,11 @@ export interface DescribeTokens {
     absent: string;
     when: string;
     platform: string;
+    network: string;
+    domains: string;
+    ips: string;
+    ports: string;
+    schemes: string;
     disabled: string;
     tags: string;
     /** Prefix of the per-rule source-file attribution. */

package/lib/types/prose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prose.d.ts","sourceRoot":"","sources":["../../src/prose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAEzD,2EAA2E;AAC3E,MAAM,WAAW,OAAO;IACtB,6EAA6E;IAC7E,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC/E,iDAAiD;IACjD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACtD,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAA;IACvB,uCAAuC;IACvC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;IACnD,qCAAqC;IACrC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACvC,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC5C,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IACnC,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAA;IACnB,4HAA4H;IAC5H,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gDAAgD;IAChD,qBAAqB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,qEAAqE;IACrE,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAA;IAChL,iCAAiC;IACjC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;IACpF,sCAAsC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,6DAA6D;IAC7D,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,kDAAkD;IAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,kFAAkF;IAClF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,kDAAkD;IAClD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,kBAAkB,EAAE,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAA;IAC1D,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAA;CACZ;AAkKD,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAA8C,CAAA;AAEzG,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAMxE,CAAA"}
+{"version":3,"file":"prose.d.ts","sourceRoot":"","sources":["../../src/prose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAEzD,2EAA2E;AAC3E,MAAM,WAAW,OAAO;IACtB,6EAA6E;IAC7E,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC/E,iDAAiD;IACjD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACtD,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAA;IACvB,uCAAuC;IACvC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;IACnD,qCAAqC;IACrC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACvC,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC5C,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IACnC,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAA;IACnB,4HAA4H;IAC5H,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gDAAgD;IAChD,qBAAqB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,qEAAqE;IACrE,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAA;IAChL,iCAAiC;IACjC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;IACpF,sCAAsC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,6DAA6D;IAC7D,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,kDAAkD;IAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,kFAAkF;IAClF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,kDAAkD;IAClD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,kBAAkB,EAAE,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAA;IAC1D,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAA;IACvB,8EAA8E;IAC9E,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IACzI,sCAAsC;IACtC,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAA;IAC/D,yDAAyD;IACzD,eAAe,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAA;CACjP;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAA;CACZ;AA8ND,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAA8C,CAAA;AAEzG,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAMxE,CAAA"}