dsh-permission-rules 0.4.2 → 0.5.2

package/package.json

@@ -1,144 +1,182 @@
-{
-  "name": "dsh-permission-rules",
-  "version": "0.4.2",
-  "description": "Declarative Claude Code-style permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, full session-log audit, and HMR rule reload.",
-  "private": false,
-  "type": "module",
-  "main": "./lib/index.js",
-  "types": "./lib/types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/types/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "src",
-    "cordis.patch.yml",
-    "docs",
-    "scripts/repair-session-logs.mjs",
-    "README.md",
-    "README.zh.md",
-    "README.es.md",
-    "README.pt.md",
-    "README.hi.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "sideEffects": false,
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "dshWorkshop": {
-    "schema": "omdsh-workshop-package/v1",
-    "type": "plugin",
-    "integration": {
-      "protocol": "harness-profile",
-      "artifact": "cordis.patch.yml"
-    },
-    "install": {
-      "mode": "transactional",
-      "adapter": "profile-bundle",
-      "failurePolicy": "generation-rollback",
-      "touchesCurrentBeforeActivation": false
-    },
-    "lifecycle": {
-      "activation": "restart-profile",
-      "dispose": "supported"
-    },
-    "permissions": [
-      "files:read",
-      "files:watch",
-      "session:append",
-      "network:none"
-    ],
-    "compatibility": {
-      "dshVersions": [
-        "0.1.0-rc.6"
-      ]
-    },
-    "capability": {
-      "id": "rules",
-      "kind": "command",
-      "invocation": "/rules",
-      "expected": "lists the active permission rules with their source files"
-    },
-    "evidence": {
-      "install": null,
-      "failureIsolation": null,
-      "hotReload": null,
-      "remove": null
-    }
-  },
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "permission",
-    "policy",
-    "allow-deny-ask",
-    "approval",
-    "safety"
-  ],
-  "author": "dsh-permission-rules contributors",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/PerryLink/dsh-permission-rules.git"
-  },
-  "homepage": "https://github.com/PerryLink/dsh-permission-rules#readme",
-  "bugs": {
-    "url": "https://github.com/PerryLink/dsh-permission-rules/issues"
-  },
-  "engines": {
-    "node": "^22.19.0 || >=24.0.0"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "^3.18.0"
-  },
-  "dependencies": {
-    "chokidar": "^5.0.0",
-    "tsdown": "^0.22.14",
-    "typescript": "^5.9.0",
-    "yaml": "^2.8.0"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-subagent": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "^3.18.0",
-    "@eslint/js": "^10.0.1",
-    "@types/node": "^22.19.0",
-    "@vitest/coverage-v8": "^3.2.0",
-    "dsh-auto-review": "file:vendor/dsh-auto-review-0.4.0.tgz",
-    "eslint": "^10.8.1",
-    "globals": "^17.11.0",
-    "typescript-eslint": "^8.67.0",
-    "vitest": "^3.2.0"
-  },
-  "scripts": {
-    "build": "node scripts/prepare.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
-    "lint": "eslint src test scripts",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "pack:check": "node scripts/prepare.mjs && pnpm pack",
-    "prepare": "node scripts/prepare.mjs"
-  },
-  "packageManager": "pnpm@11.7.0",
-  "license": "Apache-2.0"
-}
+{
+  "name": "dsh-permission-rules",
+  "version": "0.5.2",
+  "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
+  "private": false,
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./typert": {
+      "types": "./lib/types/typert.host.d.ts",
+      "default": "./lib/typert.host.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "cordis.patch.yml",
+    "docs",
+    "scripts/repair-session-logs.mjs",
+    "README.md",
+    "README.zh.md",
+    "README.es.md",
+    "README.pt.md",
+    "README.hi.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    }
+  },
+  "dshWorkshop": {
+    "schema": "omdsh-workshop-package/v1",
+    "type": "plugin",
+    "integration": {
+      "protocol": "harness-profile",
+      "artifact": "cordis.patch.yml"
+    },
+    "install": {
+      "mode": "transactional",
+      "adapter": "profile-bundle",
+      "failurePolicy": "generation-rollback",
+      "touchesCurrentBeforeActivation": false
+    },
+    "lifecycle": {
+      "activation": "restart-profile",
+      "dispose": "supported"
+    },
+    "permissions": [
+      "files:read",
+      "files:watch",
+      "files:write",
+      "session:append",
+      "network:outbound"
+    ],
+    "compatibility": {
+      "dshVersions": [
+        "0.1.0-rc.5",
+        "0.1.0-rc.7",
+        "0.1.0-rc.7"
+      ]
+    },
+    "capability": {
+      "id": "rules",
+      "kind": "command",
+      "invocation": "/rules",
+      "expected": "lists the active permission rules with their source files"
+    },
+    "evidence": {
+      "install": null,
+      "failureIsolation": null,
+      "hotReload": null,
+      "remove": null
+    }
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "permission",
+    "policy",
+    "allow-deny-ask",
+    "approval",
+    "safety",
+    "network",
+    "network-policy",
+    "proxy"
+  ],
+  "author": "dsh-permission-rules contributors",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PerryLink/dsh-permission-rules.git"
+  },
+  "homepage": "https://github.com/PerryLink/dsh-permission-rules#readme",
+  "bugs": {
+    "url": "https://github.com/PerryLink/dsh-permission-rules/issues"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.0-rc.7",
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "react": "^18.2.0"
+  },
+  "dependencies": {
+    "@types/react": "18.3.31",
+    "chokidar": "^5.0.0",
+    "tsdown": "^0.22.14",
+    "typescript": "^5.9.0",
+    "yaml": "^2.8.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-subagent": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.7",
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.19.0",
+    "@vitest/coverage-v8": "^3.2.0",
+    "dsh-auto-review": "file:vendor/dsh-auto-review-0.5.1.tgz",
+    "eslint": "^10.8.1",
+    "globals": "^17.11.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "typescript-eslint": "^8.67.0",
+    "vitest": "^3.2.0"
+  },
+  "scripts": {
+    "build": "node scripts/prepare.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "lint": "eslint src test scripts",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "check:readmes": "node scripts/check-readme-sync.mjs",
+    "verify:self-contained": "node scripts/verify-self-contained.mjs",
+    "pack:check": "node scripts/prepare.mjs && pnpm pack",
+    "prepare": "node scripts/prepare.mjs"
+  },
+  "packageManager": "pnpm@11.7.0",
+  "license": "Apache-2.0"
+}

package/scripts/repair-session-logs.mjs

@@ -24,8 +24,10 @@
  *
  * `--home` defaults to `$env:DSH_HOME/sessions` or `~/.dsh/sessions`.
  * The default target set is the log-only audit vocabulary owned by the
- * dsh-permission-rules / dsh-auto-review plugins; only types you understand
- * to be reconstruction-safe may be added via `--types`.
+ * dsh-permission-rules / dsh-auto-review plugins (all five `autoReview/*`
+ * event types — `state`, `verdict`, `circuit`, `override`, `rejection`);
+ * only types you understand to be reconstruction-safe may be added via
+ * `--types`.
  */
 
 import { constants, zstdCompressSync, zstdDecompressSync } from 'node:zlib'
@@ -40,6 +42,9 @@ const DEFAULT_TARGET_TYPES = [
   'permissionRules/decision',
   'autoReview/verdict',
   'autoReview/state',
+  'autoReview/circuit',
+  'autoReview/override',
+  'autoReview/rejection',
 ]
 
 /** Row types that are storage records, never session events (leave untouched). */

package/src/client/index.ts

@@ -0,0 +1,111 @@
+/**
+ * `dsh-permission-rules`, browser half: mounts the `permissionRules`
+ * Remote contribution, then registers the "Permission Rules" settings
+ * page (`settings.section`, id `permission-rules`) with the network-policy
+ * summary, block counters, the recent interception list, and the rule
+ * editor. All data arrives through the `remote.permissionRules`
+ * namespace — the page issues no other RPC.
+ *
+ * The slot and remote services are accessed structurally (through
+ * `ctx.get`/`ctx.inject`) so this bundle compiles against the published
+ * rc.6 client peers without hard value imports beyond the platform
+ * modules.
+ * @module dsh-permission-rules/client
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import type { RemoteResult } from '@deepseek-ai/dsh-typert-protocol'
+import { PERMISSION_RULES_REMOTE } from './remote.ts'
+import { PermissionRulesSection } from './section.ts'
+import type { PermissionRulesSectionInjected } from './section.ts'
+import { en, zh, type PermissionRulesLocaleKey } from './locales.ts'
+import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
+
+/** Dictionary namespace owned by this plugin. */
+export const NS = 'settings.permissionRules'
+
+/** Plugin name: matches the package name, the graph row id, and the bundle id. */
+export const name = 'dsh-permission-rules'
+
+/** Services the page reads; `remote.permissionRules` appears once this plugin mounts its contribution. */
+export const inject = ['slots', 'locale', 'remote']
+
+/** The locale registry face (structural; the real `ctx.locale` satisfies it). */
+interface LocaleLike {
+  register(namespace: string, dictionaries: { en: Record<string, string>; zh: Record<string, string> }): () => void
+  bind(namespace: string): (key: PermissionRulesLocaleKey, vars?: Record<string, string | number>) => string
+}
+
+/** The remote-contribution host face (structural; the real `ctx.remote` satisfies it). */
+interface RemoteLike {
+  $mount(contribution: unknown): Promise<void>
+}
+
+/** The slots registry face (structural; the real `ctx.slots` satisfies it). */
+interface SlotsLike {
+  inject(slot: string, register: () => unknown): void
+  register(options: object, component: unknown): unknown
+}
+
+/**
+ * Browser plugin body: dictionaries, the Remote contribution mount, and
+ * the settings-section registration.
+ * @param ctx - client root context.
+ */
+export async function apply(ctx: Context): Promise<void> {
+  const locale = ctx.get('locale') as LocaleLike | undefined
+  const remote = ctx.get('remote') as RemoteLike | undefined
+  const slots = ctx.get('slots') as SlotsLike | undefined
+  if (locale === undefined || remote === undefined || slots === undefined) return
+
+  // locale.register returns the only unregister disposer and throws on a
+  // duplicate namespace: ride this fiber's effect so unload/reload cycles
+  // can re-register the dictionaries.
+  ctx.effect(() => locale.register(NS, { zh, en }), 'dsh-permission-rules: dictionaries')
+
+  // $mount registers the 'remote.permissionRules' namespace service and owns
+  // its removal for this fiber's lifetime.
+  await remote.$mount(PERMISSION_RULES_REMOTE)
+
+  ctx.inject(['remote.permissionRules'], (scope) => {
+    const t = locale.bind(NS)
+    const bridge = scope.get('remote.permissionRules') as {
+      networkStatus: () => Promise<RemoteResult<PermissionRulesSnapshot>>
+      rulesRead: (path: string) => Promise<RemoteResult<RulesReadResult>>
+      rulesSave: (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
+      reload: () => Promise<RemoteResult<RulesReloadResult>>
+    } | undefined
+    if (bridge === undefined) return
+    const injected = (): PermissionRulesSectionInjected => ({
+      status: async () => {
+        const result = await bridge.networkStatus()
+        if (!result.ok) throw new Error(`networkStatus failed: ${result.error.code}: ${result.error.message}`)
+        return result.value
+      },
+      rulesRead: async (path) => {
+        const result = await bridge.rulesRead(path)
+        if (!result.ok) throw new Error(`rulesRead failed: ${result.error.code}: ${result.error.message}`)
+        return result.value
+      },
+      rulesSave: async (path, text) => {
+        const result = await bridge.rulesSave(path, text)
+        if (!result.ok) throw new Error(`rulesSave failed: ${result.error.code}: ${result.error.message}`)
+        return result.value
+      },
+      reload: async () => {
+        const result = await bridge.reload()
+        if (!result.ok) throw new Error(`reload failed: ${result.error.code}: ${result.error.message}`)
+        return result.value
+      },
+      t,
+    })
+    slots.inject('settings.section', () => slots.register({
+      name: 'settings.section',
+      id: 'permission-rules',
+      order: 20,
+      label: () => t('nav'),
+      locale: NS,
+      inject: injected,
+    }, PermissionRulesSection))
+  })
+}

package/src/client/locales.ts

@@ -0,0 +1,94 @@
+/**
+ * Settings-page copy for `dsh-permission-rules`, `en`/`zh` (the two UI
+ * language codes the harness locale registry accepts today).
+ * @module dsh-permission-rules/client/locales
+ */
+
+export type PermissionRulesLocaleKey =
+  | 'nav'
+  | 'policyTitle'
+  | 'mode'
+  | 'preset'
+  | 'configured'
+  | 'proxy'
+  | 'proxyActive'
+  | 'proxyInactive'
+  | 'proxyDisabled'
+  | 'counters'
+  | 'denied'
+  | 'askBlocked'
+  | 'recentTitle'
+  | 'noBlocks'
+  | 'blockBy'
+  | 'blockDefault'
+  | 'blockUnattributed'
+  | 'editorTitle'
+  | 'editorPath'
+  | 'editorLoad'
+  | 'editorSave'
+  | 'editorReload'
+  | 'editorEmpty'
+  | 'editorSaved'
+  | 'editorFailed'
+  | 'editorUntitled'
+  | 'unknown'
+
+export const en: Record<PermissionRulesLocaleKey, string> = {
+  nav: 'Permission Rules',
+  policyTitle: 'Network policy',
+  mode: 'Mode',
+  preset: 'Sandbox preset',
+  configured: 'Configured',
+  proxy: 'Proxy',
+  proxyActive: 'active on 127.0.0.1:{port}',
+  proxyInactive: 'INACTIVE (bind failed — shell network policy is not enforced)',
+  proxyDisabled: 'network policy disabled',
+  counters: 'Blocks',
+  denied: 'denied',
+  askBlocked: 'ask-blocked',
+  recentTitle: 'Recent blocks',
+  noBlocks: 'No network blocks recorded yet.',
+  blockBy: 'rule {index}',
+  blockDefault: 'mode default',
+  blockUnattributed: 'unattributed',
+  editorTitle: 'Rule editor',
+  editorPath: 'Rule file',
+  editorLoad: 'Load',
+  editorSave: 'Save',
+  editorReload: 'Reload rules',
+  editorEmpty: 'Choose a rule file to edit. The editor only touches rule files the plugin already loads.',
+  editorSaved: 'Saved and reloaded ({reloaded} workspace(s)).',
+  editorFailed: 'Save rejected: {error}',
+  editorUntitled: '(new file)',
+  unknown: 'Unknown error',
+}
+
+export const zh: Record<PermissionRulesLocaleKey, string> = {
+  nav: '权限规则',
+  policyTitle: '网络策略',
+  mode: '模式',
+  preset: '沙箱预设',
+  configured: '显式配置',
+  proxy: '代理',
+  proxyActive: '运行于 127.0.0.1:{port}',
+  proxyInactive: '未激活（绑定失败——shell 网络策略未生效）',
+  proxyDisabled: '网络策略已停用',
+  counters: '拦截',
+  denied: '拒绝',
+  askBlocked: '待审批阻断',
+  recentTitle: '近期拦截',
+  noBlocks: '尚未记录任何网络拦截。',
+  blockBy: '规则 {index}',
+  blockDefault: '模式默认',
+  blockUnattributed: '未归属',
+  editorTitle: '规则编辑器',
+  editorPath: '规则文件',
+  editorLoad: '载入',
+  editorSave: '保存',
+  editorReload: '重载规则',
+  editorEmpty: '选择要编辑的规则文件。编辑器只能读写插件已加载的规则文件。',
+  editorSaved: '已保存并重载（{reloaded} 个工作区）。',
+  editorFailed: '保存被拒绝：{error}',
+  editorUntitled: '（新文件）',
+  unknown: '未知错误',
+}

package/src/client/remote.ts

@@ -0,0 +1,41 @@
+/**
+ * The client-side Remote face of the `permissionRules` namespace: the
+ * hand-written `TypertRemoteContribution` mounted through
+ * `ctx.remote.$mount`, plus the declaration merging that types
+ * `ctx.remote.permissionRules`. The descriptor list is shared with the
+ * host `./typert` manifest (`../wire.ts`), so the two faces can never
+ * drift.
+ * @module dsh-permission-rules/client/remote
+ */
+
+import type { RemoteResult, TypertRemoteContribution } from '@deepseek-ai/dsh-typert-protocol'
+import { PERMISSION_RULES_INVOCATIONS } from '../wire.ts'
+import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
+
+declare module '@deepseek-ai/dsh-typert-protocol' {
+  interface TypertRemoteNamespace$permissionRules {
+    /** Read the network-policy snapshot (mode, counters, recent blocks, editable rule sources). */
+    networkStatus: () => Promise<RemoteResult<PermissionRulesSnapshot>>
+    /** Read one known rule file for the editor. */
+    rulesRead: (path: string) => Promise<RemoteResult<RulesReadResult>>
+    /** Validate and write one known rule file. */
+    rulesSave: (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
+    /** Re-read every cached workspace chain. */
+    reload: () => Promise<RemoteResult<RulesReloadResult>>
+  }
+  interface TypertRemoteMap {
+    'permissionRules/networkStatus': () => Promise<RemoteResult<PermissionRulesSnapshot>>
+    'permissionRules/rulesRead': (path: string) => Promise<RemoteResult<RulesReadResult>>
+    'permissionRules/rulesSave': (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
+    'permissionRules/reload': () => Promise<RemoteResult<RulesReloadResult>>
+  }
+  interface TypertRemoteNamespaceMap {
+    permissionRules: TypertRemoteNamespace$permissionRules
+  }
+}
+
+/** The client Remote contribution for the `permissionRules` namespace. */
+export const PERMISSION_RULES_REMOTE = Object.freeze({
+  package: 'dsh-permission-rules',
+  descriptors: PERMISSION_RULES_INVOCATIONS,
+} satisfies TypertRemoteContribution)