dsh-permission-rules 0.4.2 → 0.5.2

package/lib/types/proxy.d.ts

@@ -0,0 +1,128 @@
+/**
+ * The plugin's built-in local HTTP/CONNECT proxy: the process-level
+ * network gate for shell subprocess traffic. Bash/pwsh children inherit
+ * `HTTP(S)_PROXY`/`ALL_PROXY` environment variables pointing here, and the
+ * proxy adjudicates EVERY connection target against the loaded network
+ * rules and the active policy mode — the domain decision lives in the
+ * proxy layer, not in per-command wrappers.
+ *
+ * Boundaries (documented in the README): DSH's official `ctx.sandbox`
+ * enforces FILE effects only, so network interception is entirely this
+ * plugin's job; the proxy has no session context, so an `ask` decision at
+ * the proxy layer cannot ride the interactive approval seam — it blocks
+ * the connection with a structured message and is audit-logged instead
+ * (web tools get the real approval seam at `tools/pre-execute`).
+ * @module dsh-permission-rules/proxy
+ */
+import type { CallId } from '@deepseek-ai/dsh-llm';
+import type { NetworkDecision, NetworkMode } from './network.js';
+import type { NetworkTarget, SchemeName } from './rules.js';
+/** Proxy environment variable names the injector sets/restores (uppercase + lowercase for mixed-ecosystem CLIs). */
+export declare const PROXY_ENV_NAMES: readonly string[];
+/** NO_PROXY names cleared (or preserved) by the injector. */
+export declare const NO_PROXY_ENV_NAMES: readonly string[];
+/** One recorded proxy-layer block (settings-page list + session audit + logger). */
+export interface NetworkBlockRecord {
+    readonly time: number;
+    readonly tool: string;
+    readonly attributed: boolean;
+    readonly callId?: CallId;
+    readonly domain: string;
+    readonly scheme?: SchemeName;
+    readonly port?: number;
+    readonly action: 'deny' | 'ask';
+    readonly mode: NetworkMode;
+    readonly matched: boolean;
+    readonly source: string;
+    readonly ruleIndex?: number;
+    readonly reason?: string;
+}
+/** Cumulative proxy-layer block counters. */
+export interface NetworkStats {
+    denied: number;
+    askBlocked: number;
+}
+/** The attribution the runtime supplies for one connection (the newest in-flight shell execution). */
+export interface ProxyAttribution {
+    readonly tool: string;
+    readonly callId?: CallId;
+    readonly agent?: {
+        readonly session: {
+            append(type: 'permissionRules/network', data: unknown, options?: {
+                ignorable?: true;
+            }): unknown;
+        };
+    };
+}
+/** Construction options for {@link NetworkProxy}. */
+export interface NetworkProxyOptions {
+    /** Bind address (loopback by config). */
+    readonly bind: string;
+    /** Requested port; `0` binds an ephemeral port. */
+    readonly port: number;
+    /** Cap on recent-block records kept in memory. */
+    readonly maxRecent: number;
+    /** Decision function supplied by the runtime (rules + mode). */
+    readonly decide: (target: NetworkTarget) => NetworkDecision;
+    /** Current attribution (newest in-flight shell execution), or undefined. */
+    readonly attribution?: () => ProxyAttribution | undefined;
+    /** Called for every blocked connection, after the response is sent. */
+    readonly onBlock?: (record: NetworkBlockRecord, attribution: ProxyAttribution | undefined) => void;
+    /** Logger sink (proxy failures must never crash the host). */
+    readonly logger: {
+        warn(message: string): void;
+    };
+}
+/**
+ * The local HTTP/CONNECT policy proxy. Binds on demand (the plugin calls
+ * {@link start} inside an effect and {@link close} from its disposer);
+ * every live tunnel socket is tracked and destroyed on close so updates
+ * and uninstalls leave no orphaned connections.
+ */
+export declare class NetworkProxy {
+    private readonly options;
+    private server;
+    private readonly sockets;
+    private readonly recent;
+    private readonly stats;
+    private actualPort;
+    constructor(options: NetworkProxyOptions);
+    /** The bound port (valid after {@link start} resolves). */
+    get port(): number;
+    /** Deny/ask blocks recorded since mount, newest first (settings-page list). */
+    recentBlocks(): readonly NetworkBlockRecord[];
+    /** Cumulative block counters. */
+    blockStats(): NetworkStats;
+    /** Bind the server and return the actual port. */
+    start(): Promise<number>;
+    /** Stop the server and destroy every tunnel; resolves when sockets are closed. */
+    close(): Promise<void>;
+    /** Plain-HTTP proxying: absolute-form requests are adjudicated and forwarded (or blocked with a structured 403). */
+    private handleRequest;
+    /** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */
+    private handleConnect;
+    /** Adjudicate one plain-HTTP request; deny/ask blocks with a structured 403 before any forwarding. */
+    private forwardOrBlock;
+    /** Resolve a hostname once so `ips`-scoped rules see the real addresses, then decide. */
+    private decideWithResolution;
+    /** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */
+    private recordBlock;
+}
+/**
+ * Inject the proxy environment variables for subprocesses and return a
+ * disposer restoring every previous value exactly (so updates and
+ * uninstalls leave the host environment untouched). `noProxy: 'clear'`
+ * empties NO_PROXY so the policy cannot be bypassed through ambient
+ * exclusions; `preserve` keeps ambient values.
+ *
+ * The snapshot pass covers EVERY name BEFORE any write: on Windows
+ * `process.env` is case-insensitive, so the uppercase/lowercase spellings
+ * share one variable — writing `HTTP_PROXY` mid-loop would otherwise
+ * poison the later snapshot of `http_proxy` and make the restore write
+ * the proxy address back over the original.
+ * @param port - the bound proxy port.
+ * @param noProxy - the configured NO_PROXY handling.
+ * @returns the restore disposer.
+ */
+export declare function injectProxyEnv(port: number, noProxy: 'clear' | 'preserve'): () => void;
+//# sourceMappingURL=proxy.d.ts.map

package/lib/types/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE3D,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAyF,CAAA;AAEtI,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE7E,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,IAAI,CAAA;aAAE,GAAG,OAAO,CAAA;SAAE,CAAA;KACtH,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,eAAe,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAA;IACzD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAA;IAClG,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,UAAU,CAAI;gBAEO,OAAO,EAAE,mBAAmB;IAEzD,2DAA2D;IAC3D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IAC/E,YAAY,IAAI,SAAS,kBAAkB,EAAE;IAI7C,iCAAiC;IACjC,UAAU,IAAI,YAAY;IAI1B,kDAAkD;IAClD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BxB,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,oHAAoH;YACtG,aAAa;IA0B3B,uGAAuG;YACzF,aAAa;IAgC3B,sGAAsG;YACxF,cAAc;IAY5B,yFAAyF;YAC3E,oBAAoB;IAalC,4FAA4F;IAC5F,OAAO,CAAC,WAAW;CA4BpB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI,CAyBtF"}

package/lib/types/remote-service.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The settings-page Remote service: exposes the `permissionRules` Typert
+ * namespace (network snapshot + rule-file read/save/reload) to the
+ * browser half. All state lives in the {@link PermissionRulesRuntime}
+ * this service delegates to; the service itself only bridges the wire
+ * vocabulary. The rule editor only ever touches KNOWN rule sources —
+ * arbitrary paths are refused by the runtime.
+ * @module dsh-permission-rules/remote-service
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import type { PermissionRulesRuntime } from './runtime.js';
+import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from './wire.js';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /** Settings-page snapshot + rule-editor bridge (this package). */
+        permissionRules: PermissionRulesRemoteService;
+    }
+}
+/** Service config: the runtime instance whose state the wire exposes. */
+export interface PermissionRulesRemoteServiceConfig {
+    /** The runtime holding the loaded rules, proxy state, and block records. */
+    runtime: PermissionRulesRuntime;
+}
+/**
+ * The Typert Remote service behind the settings page. Registered through
+ * `ctx.plugin(PermissionRulesRemoteService, { runtime })` in
+ * {@link apply}; the typert gateway binds its public methods to the
+ * invocation descriptors in `./wire.ts`.
+ */
+export declare class PermissionRulesRemoteService extends TypertRemoteService {
+    private readonly config;
+    static inject: string[];
+    constructor(ctx: Context, config: PermissionRulesRemoteServiceConfig);
+    /** The settings-page snapshot: mode mapping, proxy liveness, counters, recent blocks, editable rule sources. */
+    networkStatus(): PermissionRulesSnapshot;
+    /** Read one known rule file for the editor. */
+    rulesRead(path: string): RulesReadResult;
+    /** Validate and write one known rule file; invalid edits are rejected before anything touches disk. */
+    rulesSave(path: string, text: string): RulesSaveResult;
+    /** Re-read every cached workspace chain (after an external edit). */
+    reload(): RulesReloadResult;
+}
+export default PermissionRulesRemoteService;
+//# sourceMappingURL=remote-service.d.ts.map

package/lib/types/remote-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-service.d.ts","sourceRoot":"","sources":["../../src/remote-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE7G,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,kEAAkE;QAClE,eAAe,EAAE,4BAA4B,CAAA;KAC9C;CACF;AAED,yEAAyE;AACzE,MAAM,WAAW,kCAAkC;IACjD,4EAA4E;IAC5E,OAAO,EAAE,sBAAsB,CAAA;CAChC;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,mBAAmB;IAGzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFjD,MAAM,CAAC,MAAM,EAAS,MAAM,EAAE,CAAA;gBAElB,GAAG,EAAE,OAAO,EAAmB,MAAM,EAAE,kCAAkC;IAIrF,gHAAgH;IAChH,aAAa,IAAI,uBAAuB;IAiCxC,+CAA+C;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAUxC,uGAAuG;IACvG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe;IAStD,qEAAqE;IACrE,MAAM,IAAI,iBAAiB;CAQ5B;AAED,eAAe,4BAA4B,CAAA"}

package/lib/types/rules.d.ts

@@ -12,6 +12,12 @@ export type RuleAction = 'allow' | 'deny' | 'ask';
 export type PatternMode = 'glob' | 'regex';
 /** Closed action list for runtime normalization of untrusted values. */
 export declare const RULE_ACTIONS: readonly RuleAction[];
+/** URL schemes a network rule may name (the proxy classifies CONNECT tunnels as `https`). */
+export type SchemeName = 'http' | 'https';
+/** Closed scheme list for runtime normalization of untrusted values. */
+export declare const SCHEMES: readonly SchemeName[];
+/** Hostname characters that make a URL candidate parseable as a network target. */
+export declare const URL_CANDIDATE_KEYS: readonly string[];
 /** Platform names a `when.platform` entry may name (Node `process.platform` values). */
 export declare const PLATFORMS: readonly string[];
 /**
@@ -58,6 +64,11 @@ export interface RuleMatchDoc {
     agents: string[];
     /** Environment/platform conditions; every listed env key must be present and match. */
     when: WhenDoc;
+    /**
+     * Network scope, when this rule is a network rule; absent means the rule
+     * never evaluates URL/connection targets.
+     */
+    network?: NetworkDoc;
 }
 /** The parsed `when` conditions. */
 export interface WhenDoc {
@@ -66,6 +77,40 @@ export interface WhenDoc {
     /** Platform names; ANY match satisfies the dimension. */
     platform: string[];
 }
+/**
+ * The parsed network match dimensions; a rule WITHOUT this block has no
+ * network scope (it stays a file/command rule exactly as before). A rule
+ * WITH this block is a network rule: it matches a tool call only when the
+ * call carries a URL candidate satisfying every listed dimension (AND),
+ * and it matches proxy-layer connections (shell subprocess traffic)
+ * against the connection target.
+ */
+export interface NetworkDoc {
+    /**
+     * Domain patterns (lowercased; a trailing `.` is stripped). A pattern
+     * WITHOUT wildcards is subdomain-inclusive — `example.com` also matches
+     * `api.example.com` — while `*.example.com` matches subdomains only and
+     * `*`/`**` compile as ordinary globs. ANY pattern matching the target
+     * host satisfies the dimension.
+     */
+    domains: string[];
+    /**
+     * IP patterns: an exact IPv4/IPv6 literal, a glob (e.g. `10.0.*.*`), or
+     * an IPv4 CIDR (`10.0.0.0/8`). A literal IP in the URL is always a
+     * candidate; the proxy additionally resolves hostnames and tests their
+     * addresses, while `tools/pre-execute` matches literal IPs only (no DNS
+     * in the hot path). ANY match satisfies the dimension.
+     */
+    ips: string[];
+    /**
+     * Port patterns: `*`, one port (`443`), or an inclusive range
+     * (`8000-9000`). Evaluated against the effective port (URL port, else
+     * 80/443 by scheme). ANY match satisfies the dimension.
+     */
+    ports: string[];
+    /** Schemes; the target scheme must be one of them (ANY). */
+    schemes: SchemeName[];
+}
 /** One compiled rule, ready for the `tools/pre-execute` hot path. */
 export interface CompiledRule {
     /** 0-based position in the merged rule chain. */
@@ -91,9 +136,33 @@ export interface CompiledRule {
         readonly env: ReadonlyMap<string, readonly RegExp[]>;
         readonly platform: readonly string[];
     };
+    /** Compiled network dimensions, when this rule has network scope. */
+    readonly network?: CompiledNetwork;
     /** The original source strings, kept for the `/rules` display. */
     readonly source: RuleDocEntry;
 }
+/** One compiled port pattern: an inclusive range; `max: Infinity` is the `*` catch-all. */
+export interface CompiledPortRange {
+    readonly min: number;
+    readonly max: number;
+}
+/** One compiled IP pattern: a glob RegExp, an IPv4 CIDR block, or an exact literal (IPv6/odd shapes). */
+export interface CompiledIpPattern {
+    readonly regex?: RegExp;
+    readonly cidr?: {
+        readonly network: number;
+        readonly prefix: number;
+    };
+    readonly literal?: string;
+}
+/** The compiled network dimensions of one rule (absent block = no network scope). */
+export interface CompiledNetwork {
+    /** Subdomain-inclusive exact domains and glob domains, all anchored + case-insensitive. */
+    readonly domains: readonly RegExp[];
+    readonly ips: readonly CompiledIpPattern[];
+    readonly ports: readonly CompiledPortRange[];
+    readonly schemes: readonly SchemeName[];
+}
 /** A compiled, size-capped ruleset. */
 export interface CompiledRuleset {
     readonly rules: readonly CompiledRule[];
@@ -213,11 +282,20 @@ export interface DescribeTokens {
     readonly absent: string;
     readonly when: string;
     readonly platform: string;
+    readonly network: string;
+    readonly domains: string;
+    readonly ips: string;
+    readonly ports: string;
+    readonly schemes: string;
     readonly disabled: string;
     readonly tags: string;
     /** Prefix of the per-rule source-file attribution. */
     readonly src: string;
 }
+/** Whether a rule's tools dimension selects the tool. */
+export declare function matchTools(rule: CompiledRule, toolName: string): boolean;
+/** Whether a rule's when dimension holds for the host facts. */
+export declare function matchWhen(rule: CompiledRule, context: MatchContext): boolean;
 /** Top-level argument keys whose string values are path candidates. */
 export declare const PATH_CANDIDATE_KEYS: readonly string[];
 /**
@@ -231,6 +309,59 @@ export declare const PATH_CANDIDATE_KEYS: readonly string[];
  * @returns candidate strings in argument key order (duplicates kept).
  */
 export declare function extractPathCandidates(args: Record<string, unknown>): string[];
+/** One parsed network target (a URL candidate or a proxy connection target). */
+export interface NetworkTarget {
+    /** `http` or `https`, or undefined for scheme-less host candidates. */
+    readonly scheme: SchemeName | undefined;
+    /** Lowercased hostname (brackets stripped for IPv6) or literal IP, trailing dot stripped. */
+    readonly host: string;
+    /** Effective port: URL port, else 80/443 by scheme; undefined for bare hostnames. */
+    readonly port: number | undefined;
+    /** Literal IP when `host` is one; the proxy appends resolved addresses here. */
+    readonly ips: readonly string[];
+}
+/**
+ * Whether the tool is a shell tool: its `command` argument is scanned for
+ * embedded URLs. Every other tool contributes URL candidates only through
+ * {@link URL_CANDIDATE_KEYS}.
+ */
+export declare function isShellTool(toolName: string): boolean;
+/**
+ * Collect URL-candidate strings from tool arguments: values under the
+ * {@link URL_CANDIDATE_KEYS} at ANY nesting depth (capped like path
+ * extraction), plus embedded `http(s)://` substrings of command-shaped
+ * arguments (shell command text). Deterministic: own key order, duplicates
+ * kept.
+ * @param args - the parsed tool arguments.
+ * @returns raw candidate strings, each already an http(s) URL or a bare host.
+ */
+export declare function extractUrlCandidates(args: Record<string, unknown>): string[];
+/**
+ * Parse one raw candidate into a {@link NetworkTarget}. Full `http(s)://`
+ * URLs parse through WHATWG URL semantics; a bare `host[:port]` candidate
+ * (no spaces, no slashes) becomes a scheme-less target (the `scheme` key
+ * is present with value `undefined`). Anything else yields `undefined` —
+ * a rule simply cannot match a non-target candidate.
+ * @param raw - the candidate string.
+ * @returns the parsed target, or undefined.
+ */
+export declare function parseUrlTarget(raw: string): NetworkTarget | undefined;
+/** Whether a host string is an IP literal (IPv4 or IPv6). */
+export declare function isIpLiteral(host: string): boolean;
+/**
+ * Evaluate one target against one compiled network block (pure; shared by
+ * the pre-execute path and the proxy layer). Domain patterns are tested
+ * against the host string as-is — including literal-IP hosts, so a
+ * catch-all glob like `*` matches `127.0.0.1` too (Codex parity keeps
+ * loopback reachable only via the `loopback` short-circuit, never by
+ * name matching). Literal-IP hosts are tested against `ips` patterns
+ * directly; `target.ips` may carry additional resolved addresses
+ * supplied by the proxy.
+ * @param target - the parsed target.
+ * @param network - the compiled network dimensions.
+ * @returns true when EVERY listed dimension holds.
+ */
+export declare function targetMatchesNetwork(target: NetworkTarget, network: CompiledNetwork): boolean;
 /**
  * Normalize one candidate path against the workspace root: separators
  * become `/`, `./` prefixes drop, and in-root paths become workspace

package/lib/types/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAQxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAa/I;AAiCD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAarB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAqBhG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AA+PD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AAEzC,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAsB,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAA;AAKD,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAQxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAa/I;AAkCD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAcrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CA6BhG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAOD,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxE;AAoCD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAW5E;AAsOD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAID,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CA0B5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYrE;AAuCD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAoGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAgB7F;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}

package/lib/types/runtime.d.ts

@@ -13,9 +13,11 @@
 import type { Context } from '@deepseek-ai/cordis';
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools';
-import type { Config, ResolvedConfig } from './config.ts';
-import type { CompiledRuleset, RuleHit } from './rules.ts';
-import type { DecisionOutcome } from './events.ts';
+import type { Config, ResolvedConfig } from './config.js';
+import type { CompiledRuleset, RuleHit } from './rules.js';
+import type { NetworkMode } from './network.js';
+import type { NetworkBlockRecord } from './proxy.js';
+import type { DecisionOutcome } from './events.js';
 export declare const name = "permission-rules";
 /** Services required before the plugin mounts. */
 export declare const inject: string[];
@@ -33,11 +35,10 @@ interface LoadedRules {
 }
 /**
  * State and behavior. One instance per plugin mount; disposals are owned by
- * the watcher/timer effects registered in {@link apply}.
+ * the watcher/timer/proxy effects registered in {@link apply}.
  */
 export declare class PermissionRulesRuntime {
     private readonly ctx;
-    readonly config: ResolvedConfig;
     /** Loaded (or failed) rules per workspace cwd, least-recently-used first for eviction. */
     private readonly byCwd;
     /** Live watchers per watched path (rule file or candidate ancestor directory), with the cwds each serves. */
@@ -46,7 +47,19 @@ export declare class PermissionRulesRuntime {
     private readonly timers;
     /** Whether the host honors the audit envelope's `ignorable` marker: unknown until the first decision (or peer-version check). */
     private auditSupport;
+    /** In-flight bash/pwsh executions (insertion order = start order), for proxy-block attribution. */
+    private readonly inFlight;
+    /** The network proxy, when the policy is enabled and mounted. */
+    private networkProxy;
+    /** Restores the injected proxy environment (set after a successful bind). */
+    private envRestore;
+    /** The authoritative config source: the composition entry, replaced by the settings scope while attached. */
+    private configSource;
     constructor(ctx: Context, config: ResolvedConfig);
+    /** The currently authoritative config (settings scope or composition entry). */
+    get config(): ResolvedConfig;
+    /** Rebind the config source (the settings section hooks call this on attach/detach/change). */
+    setConfigSource(source: () => ResolvedConfig): void;
     /** The shared compile options derived from config. */
     private compileOptions;
     /**
@@ -109,16 +122,28 @@ export declare class PermissionRulesRuntime {
      * The `tools/pre-execute` listener. A deny/ask hit returns the decision
      * (first match wins, short-circuiting downstream listeners); an allow hit
      * and a passthrough MUST delegate via `next()` so later listeners keep
-     * their say. Under `enforce: false` (dry-run) a deny/ask hit also
-     * delegates — the record keeps the would-be action with `dryRun: true`
-     * and the actual downstream outcome. Audit is appended once the final
-     * outcome is known, so the recorded `outcome` matches what the waterfall
-     * settled on.
+     * their say. Network-scoped rule hits on tool calls carry the structured
+     * `[network: …]` marker; when NO rule matches a web tool
+     * (`web_fetch`/`web_search`) the network mode default applies (deny-all
+     * denies, whitelist asks/denies, allow-all passes) — shell tools are
+     * NOT gated here, the proxy enforces their traffic per connection.
+     * Under `enforce: false` (dry-run) a deny/ask hit also delegates — the
+     * record keeps the would-be action with `dryRun: true` and the actual
+     * downstream outcome. Audit is appended once the final outcome is
+     * known, so the recorded `outcome` matches what the waterfall settled
+     * on.
      * @param exec - the pending call (name, parsed arguments, caller agent).
      * @param next - the downstream chain.
      * @returns the pre-execute decision.
      */
     preExecute(exec: ToolExecution, next: () => Promise<PreToolDecision>): Promise<PreToolDecision>;
+    /**
+     * The mode-default decision for an unlisted web-tool call, or undefined
+     * when the policy is disabled, the tool is not a web tool, or the mode
+     * allows. Shell tools always yield undefined here (the proxy decides
+     * their traffic per connection).
+     */
+    private webToolFallback;
     /**
      * Append the log-only `permissionRules/decision` audit event for every
      * decision (passthrough included unless `audit: 'hits'`), requesting the
@@ -131,18 +156,120 @@ export declare class PermissionRulesRuntime {
      * `allowUnmarkedAudit: true` opts back in. `source` names the matched
      * rule's file, or the nearest effective file on a passthrough; `cwd`
      * names the workspace the rules were resolved for; `dryRun` marks
-     * would-be deny/ask hits under `enforce: false`. Agentless calls have no
-     * session to audit; append failures are contained so an audit hiccup can
-     * never change a permission decision.
+     * would-be deny/ask hits under `enforce: false`; `modeDefault` records a
+     * network mode-default decision on a web tool (no rule fired).
+     * Agentless calls have no session to audit; append failures are
+     * contained so an audit hiccup can never change a permission decision.
      * @param exec - the pending call.
      * @param loaded - the rules in effect.
      * @param hit - the first matching rule, or undefined for passthrough.
      * @param outcome - the final pre-execute decision.
      * @param dryRun - mark the record as a would-be decision (dry-run mode).
+     * @param modeDefault - the network mode-default action when no rule fired.
      */
-    audit(exec: ToolExecution, loaded: LoadedRules, hit: RuleHit | undefined, outcome: DecisionOutcome, dryRun?: boolean): void;
+    audit(exec: ToolExecution, loaded: LoadedRules, hit: RuleHit | undefined, outcome: DecisionOutcome, dryRun?: boolean, modeDefault?: 'deny' | 'ask'): void;
+    /** After the first append, probe the returned envelope for the ignorable marker (host capability detection). */
+    private probeAuditResult;
     /** Append one audit event through the session surface; the probe seam for host-capability detection. */
     private appendAudit;
+    /**
+     * Resolve the network policy mode. An explicit config mode wins; `auto`
+     * maps the official sandbox preset (`read-only` → deny-all,
+     * `workspace-write` → whitelist, `danger-full-access` → allow-all) with
+     * `network.autoFallback` covering hosts without the sandbox-policy
+     * service (rc.6 and friends stay permissive until configured). For web
+     * tools the SESSION's resolved mode is used; the proxy resolves without
+     * a session (its connections carry no session context).
+     * @param session - optional session whose override outranks the default.
+     * @returns the resolved mode plus the sandbox preset it came from.
+     */
+    resolveNetworkMode(session?: {
+        events?: unknown;
+    }): {
+        mode: NetworkMode;
+        sandboxMode: string | undefined;
+    };
+    /**
+     * The proxy-layer decision for one connection target: first-match
+     * network rules across every loaded workspace chain (insertion order),
+     * then the mode default. Shell subprocess traffic counts as `bash`/
+     * `pwsh` tool candidates; loopback handling follows config.
+     */
+    private decideProxyTarget;
+    /** The loaded rule chains in cache order, nearest workspace first. */
+    private proxyChains;
+    /** Mark one delegated shell execution as in-flight (newest attribution wins). */
+    private markShell;
+    /** Drop one shell execution when it settles. */
+    unmarkShell(exec: ToolExecution): void;
+    /** The newest in-flight shell execution within the TTL, or undefined (best-effort attribution). */
+    private proxyAttribution;
+    /**
+     * Audit one proxy-layer block: the in-memory record is always kept
+     * (settings page), the logger always warns, and when the block can be
+     * attributed to an agent the `permissionRules/network` event is appended
+     * with the same ignorable-marker discipline as the decision audit.
+     */
+    private auditNetworkBlock;
+    /**
+     * Mount the network proxy and the subprocess environment injection.
+     * Called from {@link apply}; the proxy binds an ephemeral (or
+     * configured) loopback port, the env injection only happens after a
+     * successful bind, and every side effect is owned by an effect
+     * disposer. A bind failure degrades loudly (file rules stay active,
+     * the settings page and `/rules network` show the inactive proxy)
+     * instead of taking the permission plugin down.
+     */
+    attachNetworkProxy(): Promise<void>;
+    /**
+     * Apply a live settings change to the network policy: rebind the proxy
+     * when a bind/env-relevant knob changed (old proxy closed, old env
+     * restored, new proxy + env installed). Web-tool gating and the decision
+     * path read the config per call, so they need no rebind.
+     */
+    onNetworkConfigChanged(): Promise<void>;
+    /** The network snapshot the settings page and `/rules network` render. */
+    networkSnapshot(): {
+        readonly enabled: boolean;
+        readonly mode: NetworkMode;
+        readonly configuredMode: 'auto' | NetworkMode;
+        readonly sandboxMode: string | undefined;
+        readonly proxyPort: number;
+        readonly proxyActive: boolean;
+        readonly denied: number;
+        readonly askBlocked: number;
+        readonly recent: readonly NetworkBlockRecord[];
+    };
+    /**
+     * The rule-file paths the settings-page editor may read or write: every
+     * currently loaded source plus the per-workspace project files and the
+     * configured fallback (so a not-yet-existing project file can be
+     * created). The editor never touches arbitrary paths.
+     */
+    knownRuleSources(): readonly string[];
+    /** Read one known rule file for the editor: `{ exists, text, error }`. */
+    readRuleFile(path: string): {
+        path: string;
+        exists: boolean;
+        text: string;
+        error?: string;
+    };
+    /** The workspace a rule source belongs to (for the editor's file list), or undefined for the fallback. */
+    sourceOwner(path: string): string | undefined;
+    /** Re-read every cached workspace chain (the settings-page reload action). */
+    reloadAll(): void;
+    /**
+     * Validate and write one known rule file. The document must parse and
+     * compile (same checks as a load) BEFORE anything is written — an
+     * invalid edit is rejected with its error and the file stays untouched.
+     * After a successful write every cached workspace reloads so the edit
+     * is in effect immediately.
+     */
+    saveRuleFile(path: string, text: string): {
+        ok: boolean;
+        error?: string;
+        reloaded?: number;
+    };
     /** The installed `@deepseek-ai/dsh-session` version, or `null` when unresolvable (falls back to the append probe). */
     private peerVersion;
     /** One-time warning that session-log audit was disabled to keep session logs loadable. */
@@ -179,6 +306,8 @@ export declare class PermissionRulesRuntime {
     private displaySource;
     /** Render the session's `permissionRules/decision` audit trail, newest last. */
     private decisionsCommand;
+    /** Render the network policy state: mode mapping, proxy liveness, counters, recent blocks. */
+    private networkCommand;
     /**
      * Validate deployment-level file references at mount — the earliest
      * resolvable point. An absolute `rulesFile` or a configured
@@ -249,16 +378,19 @@ export declare class PermissionRulesRuntime {
  * @param ctx - the host context.
  * @param config - raw plugin config.
  */
-export declare function apply(ctx: Context, config: Config): void;
+export declare function apply(ctx: Context, config: Config): Promise<void>;
 /**
  * Whether a `@deepseek-ai/dsh-session` version line predates the
- * `ignorable` envelope-marker surface: the `0.1.0-rc.6` line and earlier
- * silently drop the marker from `Session.append` options, so audit events
- * written by those builds land unmarked and break resume on stricter
- * hosts. Non-matching (post-rc.6, stable, or unresolvable) versions are
- * treated as possibly-marker-aware and verified by the append probe.
+ * `ignorable` envelope-marker surface: every released rc line through
+ * `0.1.0-rc.7` silently drops the marker from `Session.append` options
+ * (the stamping fix exists on harness master only — no release carries it
+ * yet), so audit events written by those builds land unmarked and break
+ * resume on stricter hosts. Extend the bound when a new rc line ships that
+ * still drops the marker. Non-matching (later rc, stable, or unresolvable)
+ * versions are treated as possibly-marker-aware and verified by the
+ * append probe.
  * @param version - the installed peer version string.
- * @returns true for the known-unmarked rc.1–rc.6 lines.
+ * @returns true for the known-unmarked rc.1–rc.7 lines.
  */
 export declare function isUnmarkedHostVersion(version: string): boolean;
 export {};