dsh-permission-rules 0.4.2 → 0.5.2

package/lib/index.js

@@ -1,105 +1,14 @@
 import { createRequire } from "node:module";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import chokidar from "chokidar";
 import z from "@deepseek-ai/schemastery";
 import { parse } from "yaml";
-//#region src/config.ts
-/**
-* Config schema and resolution for `dsh-permission-rules`. Every tunable is
-* a validated {@link Config} field changeable from cordis.yml; the
-* resolution step validates the numeric bounds and compiles nothing — rule
-* files are external documents resolved per session cwd at load time.
-* @module dsh-permission-rules/config
-*/
-/** Schemastery schema: the loader validates and fills defaults before `apply`. */
-const Config = z.object({
-	rulesFile: z.string().default(".dsh/rules.yaml"),
-	fallbackPath: z.string(),
-	badFilePolicy: z.union(["fail", "ignore-with-warning"]).default("fail"),
-	maxRules: z.number().default(256),
-	maxCachedWorkspaces: z.number().default(512),
-	patternMode: z.union(["glob", "regex"]).default("glob"),
-	watch: z.boolean().default(true),
-	watchStabilityThresholdMs: z.number().default(200),
-	language: z.union([
-		"en",
-		"zh",
-		"es",
-		"pt",
-		"hi"
-	]).default("en"),
-	caseInsensitivePaths: z.boolean().default(process.platform === "win32"),
-	audit: z.union(["all", "hits"]).default("all"),
-	searchUp: z.boolean().default(false),
-	maxGlobStars: z.number().default(2),
-	enforce: z.boolean().default(true),
-	allowUnmarkedAudit: z.boolean().default(false)
-});
-/**
-* Validate raw values and fill explicit defaults. A `maxRules`,
-* `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
-* integer, a non-positive stability window, `searchUp` combined with an
-* absolute `rulesFile`, a value outside a closed enum, or a non-boolean
-* flag throws here — misconfiguration fails loud at mount even when the
-* plugin is mounted without the Schemastery loader.
-* @param config - raw (possibly partial) plugin config.
-* @returns the fully resolved config.
-*/
-function resolveConfig(config = {}) {
-	const rulesFile = config.rulesFile ?? ".dsh/rules.yaml";
-	const searchUp = config.searchUp ?? false;
-	if (searchUp && isAbsolute(rulesFile)) throw new TypeError(`searchUp cannot be combined with an absolute rulesFile (${JSON.stringify(rulesFile)}): parent-directory walking needs a relative file name`);
-	const maxRules = config.maxRules ?? 256;
-	if (!Number.isSafeInteger(maxRules) || maxRules <= 0) throw new TypeError(`maxRules must be a positive safe integer, got ${String(config.maxRules)}`);
-	const watchStabilityThresholdMs = config.watchStabilityThresholdMs ?? 200;
-	if (!Number.isSafeInteger(watchStabilityThresholdMs) || watchStabilityThresholdMs < 0) throw new TypeError(`watchStabilityThresholdMs must be a non-negative safe integer, got ${String(config.watchStabilityThresholdMs)}`);
-	const maxCachedWorkspaces = config.maxCachedWorkspaces ?? 512;
-	if (!Number.isSafeInteger(maxCachedWorkspaces) || maxCachedWorkspaces <= 0) throw new TypeError(`maxCachedWorkspaces must be a positive safe integer, got ${String(config.maxCachedWorkspaces)}`);
-	const maxGlobStars = config.maxGlobStars ?? 2;
-	if (!Number.isSafeInteger(maxGlobStars) || maxGlobStars <= 0) throw new TypeError(`maxGlobStars must be a positive safe integer, got ${String(config.maxGlobStars)}`);
-	assertEnum("badFilePolicy", config.badFilePolicy ?? "fail", ["fail", "ignore-with-warning"]);
-	assertEnum("patternMode", config.patternMode ?? "glob", ["glob", "regex"]);
-	assertEnum("language", config.language ?? "en", [
-		"en",
-		"zh",
-		"es",
-		"pt",
-		"hi"
-	]);
-	assertEnum("audit", config.audit ?? "all", ["all", "hits"]);
-	assertBoolean("watch", config.watch ?? true);
-	assertBoolean("searchUp", searchUp);
-	assertBoolean("caseInsensitivePaths", config.caseInsensitivePaths ?? process.platform === "win32");
-	assertBoolean("enforce", config.enforce ?? true);
-	assertBoolean("allowUnmarkedAudit", config.allowUnmarkedAudit ?? false);
-	return {
-		rulesFile,
-		fallbackPath: config.fallbackPath,
-		badFilePolicy: config.badFilePolicy ?? "fail",
-		maxRules,
-		maxCachedWorkspaces,
-		patternMode: config.patternMode ?? "glob",
-		watch: config.watch ?? true,
-		watchStabilityThresholdMs,
-		language: config.language ?? "en",
-		caseInsensitivePaths: config.caseInsensitivePaths ?? process.platform === "win32",
-		audit: config.audit ?? "all",
-		searchUp,
-		maxGlobStars,
-		enforce: config.enforce ?? true,
-		allowUnmarkedAudit: config.allowUnmarkedAudit ?? false
-	};
-}
-/** Throw unless `key` is one of `allowed` (TypeScript's closed enums are not runtime checks). */
-function assertEnum(key, value, allowed) {
-	if (!allowed.includes(value)) throw new TypeError(`${key} must be one of ${allowed.map((item) => JSON.stringify(item)).join(" | ")}, got ${JSON.stringify(value)}`);
-}
-/** Throw unless `key` is a boolean (plain-JS mounts bypass the Schemastery coercion). */
-function assertBoolean(key, value) {
-	if (typeof value !== "boolean") throw new TypeError(`${key} must be a boolean, got ${typeof value}`);
-}
-//#endregion
+import { createServer, request } from "node:http";
+import { request as request$1 } from "node:https";
+import { connect } from "node:net";
+import { lookup } from "node:dns/promises";
+import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 //#region src/glob.ts
 /**
 * Strict glob→RegExp compilation and regex-safety validation for rule
@@ -397,6 +306,32 @@ const RULE_ACTIONS = [
 	"deny",
 	"ask"
 ];
+/** Closed scheme list for runtime normalization of untrusted values. */
+const SCHEMES = ["http", "https"];
+/** Hostname characters that make a URL candidate parseable as a network target. */
+const URL_CANDIDATE_KEYS = [
+	"url",
+	"urls",
+	"uri",
+	"endpoint",
+	"base_url",
+	"baseUrl",
+	"webhook",
+	"link",
+	"href",
+	"origin",
+	"remote",
+	"repository",
+	"repo"
+];
+/** Top-level argument keys whose string values hold a shell command (URL-scanned for shell tools). */
+const COMMAND_CANDIDATE_KEYS = [
+	"command",
+	"cmd",
+	"script",
+	"command_line",
+	"commandLine"
+];
 /** Platform names a `when.platform` entry may name (Node `process.platform` values). */
 const PLATFORMS = [
 	"aix",
@@ -508,6 +443,7 @@ function compileRule(entry, index, sourceIndex, options) {
 			env,
 			platform: entry.match.when.platform
 		} },
+		...entry.match.network === void 0 ? {} : { network: compileNetwork(entry.match.network, options.maxGlobStars) },
 		source: entry
 	};
 }
@@ -533,6 +469,7 @@ function matchRules(ruleset, toolName, args, cwd, context = {}) {
 		if (rule.params.size > 0 && (argRecord === void 0 || !matchParams(rule, argRecord))) continue;
 		if (rule.absent.length > 0 && !matchAbsent(rule, argRecord)) continue;
 		if (rule.paths.length > 0 && (argRecord === void 0 || !matchPaths(rule, argRecord, cwd, ruleset.caseInsensitivePaths))) continue;
+		if (rule.network !== void 0 && (argRecord === void 0 || !matchNetwork(rule, argRecord))) continue;
 		return {
 			ruleIndex: rule.index,
 			rule
@@ -562,7 +499,7 @@ function findUnreachableRules(ruleset) {
 }
 /** Whether every match dimension of one rule is empty. */
 function isCatchAll(rule) {
-	return rule.tools.length === 0 && rule.agents.length === 0 && rule.params.size === 0 && rule.paths.length === 0 && rule.absent.length === 0 && rule.when === void 0;
+	return rule.tools.length === 0 && rule.agents.length === 0 && rule.params.size === 0 && rule.paths.length === 0 && rule.absent.length === 0 && rule.when === void 0 && rule.network === void 0;
 }
 /**
 * One-line human summary of a compiled rule, for `/rules` output. The
@@ -587,6 +524,14 @@ function describeRule(rule, tokens, source) {
 	const whenParts = Object.entries(rule.source.match.when.env).map(([key, patterns]) => `${key}=${patterns.join("|")}`).join(" ");
 	const platformPart = rule.source.match.when.platform.length > 0 ? `${tokens.platform}:${rule.source.match.when.platform.join(",")}` : "";
 	if (whenParts.length > 0 || platformPart.length > 0) parts.push(`${tokens.when}:${whenParts}${whenParts.length > 0 && platformPart.length > 0 ? " " : ""}${platformPart}`);
+	const networkParts = [];
+	if (rule.source.match.network !== void 0) {
+		if (rule.source.match.network.domains.length > 0) networkParts.push(`${tokens.domains}:${rule.source.match.network.domains.join(",")}`);
+		if (rule.source.match.network.ips.length > 0) networkParts.push(`${tokens.ips}:${rule.source.match.network.ips.join(",")}`);
+		if (rule.source.match.network.ports.length > 0) networkParts.push(`${tokens.ports}:${rule.source.match.network.ports.join(",")}`);
+		if (rule.source.match.network.schemes.length > 0) networkParts.push(`${tokens.schemes}:${rule.source.match.network.schemes.join(",")}`);
+	}
+	if (networkParts.length > 0) parts.push(`${tokens.network}:${networkParts.join(" ")}`);
 	const match = parts.length > 0 ? `[${parts.join(" ")}]` : `[${tokens.allTools}]`;
 	const disabled = rule.enabled ? "" : ` (${tokens.disabled})`;
 	const sourcePart = source !== void 0 && source.length > 0 ? ` [${tokens.src}:${source}]` : "";
@@ -736,15 +681,16 @@ function parseMatch(raw, at) {
 		}
 	};
 	const record = asRecord(raw, `${at}.match`);
-	const unknownFields = Object.keys(record).filter((key) => key !== "tools" && key !== "agents" && key !== "params" && key !== "paths" && key !== "absent" && key !== "when");
-	if (unknownFields.length > 0) throw new RuleError(`${at}.match: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: tools, agents, params, paths, absent, when)`);
+	const unknownFields = Object.keys(record).filter((key) => key !== "tools" && key !== "agents" && key !== "params" && key !== "paths" && key !== "absent" && key !== "when" && key !== "network");
+	if (unknownFields.length > 0) throw new RuleError(`${at}.match: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: tools, agents, params, paths, absent, when, network)`);
 	return {
 		tools: parseStringList(record["tools"], `${at}.match.tools`),
 		agents: parseStringList(record["agents"], `${at}.match.agents`),
 		params: parseParams(record["params"], `${at}.match.params`),
 		paths: parseStringList(record["paths"], `${at}.match.paths`),
 		absent: parseStringList(record["absent"], `${at}.match.absent`),
-		when: parseWhen(record["when"], `${at}.match.when`)
+		when: parseWhen(record["when"], `${at}.match.when`),
+		...record["network"] === void 0 ? {} : { network: parseNetwork(record["network"], `${at}.match.network`) }
 	};
 }
 /** Validate the params map: non-empty string keys → one pattern or a pattern list. */
@@ -788,6 +734,37 @@ function parseWhen(raw, at) {
 	};
 }
 /**
+* Validate the `network` block of one rule. Every listed pattern is
+* shape-validated here (port ranges, CIDR strings, closed scheme
+* vocabulary); compilation of globs happens in {@link compileNetwork}.
+* Scalar values (YAML numbers like `443` for ports) are stringified like
+* every other pattern list, so numeric ports parse as their decimal
+* strings. A block with every dimension empty is rejected — a network
+* rule must name at least one target dimension.
+*/
+function parseNetwork(raw, at) {
+	const record = asRecord(raw, at);
+	const unknownFields = Object.keys(record).filter((key) => key !== "domains" && key !== "ips" && key !== "ports" && key !== "schemes");
+	if (unknownFields.length > 0) throw new RuleError(`${at}: unknown field${unknownFields.length > 1 ? "s" : ""} ${unknownFields.map((k) => JSON.stringify(k)).join(", ")} (allowed: domains, ips, ports, schemes)`);
+	const domains = parsePatternValues(record["domains"], `${at}.domains`);
+	const ips = parsePatternValues(record["ips"], `${at}.ips`);
+	for (const pattern of ips) parseIpPattern(pattern, `${at}.ips`);
+	const ports = parsePatternValues(record["ports"], `${at}.ports`);
+	for (const pattern of ports) parsePortPattern(pattern, `${at}.ports`);
+	const schemes = [];
+	for (const [index, value] of parsePatternValues(record["schemes"], `${at}.schemes`).entries()) {
+		if (!SCHEMES.includes(value)) throw new RuleError(`${at}.schemes[${index}] must be one of ${SCHEMES.map((s) => JSON.stringify(s)).join(" | ")}, got ${JSON.stringify(value)}`);
+		schemes.push(value);
+	}
+	if (domains.length === 0 && ips.length === 0 && ports.length === 0 && schemes.length === 0) throw new RuleError(`${at}: a network block must name at least one of domains, ips, ports, schemes (drop the block for a tool-level rule)`);
+	return {
+		domains,
+		ips,
+		ports,
+		schemes
+	};
+}
+/**
 * Validate one pattern or a pattern list; scalar strings/numbers/booleans
 * are single patterns (matching the runtime scalar-stringify semantics).
 */
@@ -871,6 +848,263 @@ function extractPathCandidates(args) {
 	walk(args, 0);
 	return candidates;
 }
+/** One regex the command-scan extracts URL substrings with (embedded URLs in shell command text). */
+const EMBEDDED_URL = /https?:\/\/[^\s"'<>)\]\\]+/g;
+/**
+* Whether the tool is a shell tool: its `command` argument is scanned for
+* embedded URLs. Every other tool contributes URL candidates only through
+* {@link URL_CANDIDATE_KEYS}.
+*/
+function isShellTool(toolName) {
+	return toolName === "bash" || toolName === "pwsh";
+}
+/**
+* Collect URL-candidate strings from tool arguments: values under the
+* {@link URL_CANDIDATE_KEYS} at ANY nesting depth (capped like path
+* extraction), plus embedded `http(s)://` substrings of command-shaped
+* arguments (shell command text). Deterministic: own key order, duplicates
+* kept.
+* @param args - the parsed tool arguments.
+* @returns raw candidate strings, each already an http(s) URL or a bare host.
+*/
+function extractUrlCandidates(args) {
+	const candidates = [];
+	const walk = (node, depth) => {
+		if (depth > MAX_ARGUMENT_DEPTH) return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, depth + 1);
+			return;
+		}
+		if (typeof node !== "object" || node === null) return;
+		for (const [key, value] of Object.entries(node)) {
+			if (URL_CANDIDATE_KEYS.includes(key)) {
+				if (typeof value === "string") candidates.push(value);
+				else if (Array.isArray(value)) {
+					for (const element of value) if (typeof element === "string") candidates.push(element);
+				}
+			}
+			if (COMMAND_CANDIDATE_KEYS.includes(key) && typeof value === "string") for (const match of value.matchAll(EMBEDDED_URL)) candidates.push(match[0]);
+			walk(value, depth + 1);
+		}
+	};
+	walk(args, 0);
+	return candidates;
+}
+/**
+* Parse one raw candidate into a {@link NetworkTarget}. Full `http(s)://`
+* URLs parse through WHATWG URL semantics; a bare `host[:port]` candidate
+* (no spaces, no slashes) becomes a scheme-less target (the `scheme` key
+* is present with value `undefined`). Anything else yields `undefined` —
+* a rule simply cannot match a non-target candidate.
+* @param raw - the candidate string.
+* @returns the parsed target, or undefined.
+*/
+function parseUrlTarget(raw) {
+	const text = raw.trim();
+	if (text.length === 0 || /\s/.test(text)) return void 0;
+	const parsed = tryParseHttpUrl(text);
+	if (parsed !== void 0) return parsed;
+	if (!/^[A-Za-z0-9._[\]-]+(?::\d+)?$/.test(text)) return void 0;
+	const colon = text.lastIndexOf(":");
+	const host = normalizeHost(colon < 0 ? text : text.slice(0, colon));
+	if (host.length === 0) return void 0;
+	const port = colon < 0 ? void 0 : parsePortNumber(text.slice(colon + 1));
+	if (colon >= 0 && port === void 0) return void 0;
+	return {
+		scheme: void 0,
+		host,
+		port,
+		ips: literalIpOf(host)
+	};
+}
+/** Parse a full http(s) URL, or undefined when it is not one. */
+function tryParseHttpUrl(text) {
+	let url;
+	try {
+		url = new URL(text);
+	} catch {
+		const bare = /^(https?):\/\/([0-9a-fA-F:]+)(?::(\d+))?(\/.*)?$/.exec(text);
+		if (bare === null || bare[2] === void 0 || bare[2].split(":").length < 3) return void 0;
+		const rewritten = `${bare[1]}://[${bare[2]}]${bare[3] !== void 0 ? `:${bare[3]}` : ""}${bare[4] ?? ""}`;
+		try {
+			url = new URL(rewritten);
+		} catch {
+			return;
+		}
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+	const host = normalizeHost(url.hostname);
+	if (host.length === 0) return void 0;
+	const port = url.port.length > 0 ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+	return {
+		scheme: url.protocol === "https:" ? "https" : "http",
+		host,
+		port,
+		ips: literalIpOf(host)
+	};
+}
+/** Lowercase, strip IPv6 brackets, strip one trailing dot. */
+function normalizeHost(host) {
+	let out = host.toLowerCase().replace(/^\[|\]$/g, "");
+	while (out.endsWith(".")) out = out.slice(0, -1);
+	return out;
+}
+/** The literal IP of a host, or `[]` when the host is a name. */
+function literalIpOf(host) {
+	return isIpLiteral(host) ? [host.toLowerCase()] : [];
+}
+/** Whether a host string is an IP literal (IPv4 or IPv6). */
+function isIpLiteral(host) {
+	return /^[0-9.]+$/.test(host) ? /^\d{1,3}(\.\d{1,3}){3}$/.test(host) : host.includes(":");
+}
+/** Parse `80` or `8000-9000` or `*`; invalid shapes throw at load. */
+function parsePortPattern(pattern, at) {
+	if (pattern === "*") return;
+	const single = /^\d+$/.exec(pattern);
+	if (single !== null) {
+		if (Number(single[0]) > 65535) throw new RuleError(`${at}: port ${JSON.stringify(pattern)} is out of range (0-65535)`);
+		return;
+	}
+	const range = /^(\d+)-(\d+)$/.exec(pattern);
+	if (range === null) throw new RuleError(`${at}: port ${JSON.stringify(pattern)} must be "*", a single port, or a low-high range like "8000-9000"`);
+	const low = Number(range[1]);
+	const high = Number(range[2]);
+	if (low > high || low > 65535 || high > 65535) throw new RuleError(`${at}: port range ${JSON.stringify(pattern)} is invalid (0-65535, low <= high)`);
+}
+/** Validate one IP pattern shape (exact literal, glob, or IPv4 CIDR). */
+function parseIpPattern(pattern, at) {
+	if (pattern.length === 0) throw new RuleError(`${at}: IP patterns must be non-empty`);
+	const cidr = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(pattern);
+	if (cidr !== null) {
+		if (cidr.slice(1, 5).map(Number).some((octet) => octet > 255) || Number(cidr[5]) > 32) throw new RuleError(`${at}: CIDR ${JSON.stringify(pattern)} is invalid (octets 0-255, prefix 0-32)`);
+	}
+}
+/** Parse one port pattern into its compiled range; shape-validated at parse time. */
+function compilePortPattern(pattern) {
+	if (pattern === "*") return {
+		min: 0,
+		max: Infinity
+	};
+	const single = /^\d+$/.exec(pattern);
+	if (single !== null) {
+		const port = Number(single[0]);
+		return {
+			min: port,
+			max: port
+		};
+	}
+	const range = /^(\d+)-(\d+)$/.exec(pattern);
+	return {
+		min: Number(range?.[1] ?? 0),
+		max: Number(range?.[2] ?? 0)
+	};
+}
+/** Compile one IP pattern: CIDR first, then glob; exact literals glob-compile to themselves. */
+function compileIpPattern(pattern, maxGlobStars) {
+	const cidr = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(pattern);
+	if (cidr !== null) {
+		const octets = cidr.slice(1, 5).map(Number);
+		const prefix = Number(cidr[5]);
+		return { cidr: {
+			network: (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0,
+			prefix
+		} };
+	}
+	if (!/[[*?]/.test(pattern) && !pattern.includes(":")) return { literal: pattern.toLowerCase() };
+	return { regex: compileGlob(pattern, {
+		segments: false,
+		maxStars: maxGlobStars,
+		caseInsensitive: true
+	}) };
+}
+/**
+* Compile one domain pattern. A pattern without glob metacharacters is
+* subdomain-inclusive (Codex semantics: `example.com` also matches
+* `api.example.com`); anything with `*`/`?`/`[` compiles as a
+* case-insensitive glob (so `*.example.com` matches subdomains only).
+*/
+function compileDomainPattern(pattern, maxGlobStars) {
+	const normalized = normalizeHost(pattern);
+	if (normalized.length === 0) throw new RuleError(`network domain patterns must be non-empty, got ${JSON.stringify(pattern)}`);
+	if (/[*?[\]\\]/.test(normalized)) return compileGlob(normalized, {
+		segments: false,
+		maxStars: maxGlobStars,
+		caseInsensitive: true
+	});
+	const literal = normalized.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+	return new RegExp(`^(?:[A-Za-z0-9_-]+\\.)*${literal}$`, "iu");
+}
+/** Compile the network block of one rule; pattern errors throw at load. */
+function compileNetwork(doc, maxGlobStars) {
+	return {
+		domains: doc.domains.map((pattern) => compileDomainPattern(pattern, maxGlobStars)),
+		ips: doc.ips.map((pattern) => compileIpPattern(pattern, maxGlobStars)),
+		ports: doc.ports.map(compilePortPattern),
+		schemes: doc.schemes
+	};
+}
+/**
+* Whether a rule's network dimension holds for a tool call: at least one
+* URL candidate must parse into a target satisfying EVERY listed
+* dimension. Calls without any URL candidate can never satisfy a
+* network-scoped rule (like the paths dimension).
+*/
+function matchNetwork(rule, args) {
+	const network = rule.network;
+	if (network === void 0) return true;
+	return extractUrlCandidates(args).map(parseUrlTarget).filter((target) => target !== void 0).some((target) => targetMatchesNetwork(target, network));
+}
+/**
+* Evaluate one target against one compiled network block (pure; shared by
+* the pre-execute path and the proxy layer). Domain patterns are tested
+* against the host string as-is — including literal-IP hosts, so a
+* catch-all glob like `*` matches `127.0.0.1` too (Codex parity keeps
+* loopback reachable only via the `loopback` short-circuit, never by
+* name matching). Literal-IP hosts are tested against `ips` patterns
+* directly; `target.ips` may carry additional resolved addresses
+* supplied by the proxy.
+* @param target - the parsed target.
+* @param network - the compiled network dimensions.
+* @returns true when EVERY listed dimension holds.
+*/
+function targetMatchesNetwork(target, network) {
+	if (network.domains.length > 0) {
+		if (!network.domains.some((regex) => regex.test(target.host))) return false;
+	}
+	if (network.ips.length > 0) {
+		const candidates = [...target.ips];
+		if (!network.ips.some((pattern) => candidates.some((candidate) => ipMatches(pattern, candidate)))) return false;
+	}
+	if (network.ports.length > 0) {
+		const port = target.port;
+		if (port === void 0 || !network.ports.some((range) => port >= range.min && port <= range.max)) return false;
+	}
+	if (network.schemes.length > 0) {
+		if (target.scheme === void 0 || !network.schemes.includes(target.scheme)) return false;
+	}
+	return true;
+}
+/** Whether one compiled IP pattern matches one candidate address (lowercased, unbracketed). */
+function ipMatches(pattern, candidate) {
+	const normalized = normalizeHost(candidate);
+	if (pattern.cidr !== void 0) {
+		const parts = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(normalized);
+		if (parts === null) return false;
+		const octets = parts.slice(1, 5).map(Number);
+		if (octets.some((octet) => octet > 255)) return false;
+		const value = (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+		const mask = pattern.cidr.prefix === 0 ? 0 : 4294967295 << 32 - pattern.cidr.prefix >>> 0;
+		return (value & mask) === (pattern.cidr.network & mask);
+	}
+	if (pattern.literal !== void 0) return normalized === pattern.literal;
+	return pattern.regex?.test(normalized) ?? false;
+}
+/** Parse one explicit port number, or undefined when out of range. */
+function parsePortNumber(text) {
+	if (!/^\d+$/.test(text)) return void 0;
+	const port = Number(text);
+	return port <= 65535 ? port : void 0;
+}
 /**
 * Normalize one candidate path against the workspace root: separators
 * become `/`, `./` prefixes drop, and in-root paths become workspace
@@ -907,18 +1141,287 @@ function relFromRoot(root, path, rest, rootRest, caseInsensitive) {
 	if (path === root || caseInsensitive && path.toLowerCase() === root.toLowerCase()) return "";
 	return restLower.startsWith(`${rootRestLower}/`) ? rest.slice(rootRest.length + 1) : "";
 }
-/** Convert a path to posix separators. */
-function toPosix(path) {
-	return path.replaceAll("\\", "/");
+/** Convert a path to posix separators. */
+function toPosix(path) {
+	return path.replaceAll("\\", "/");
+}
+/** Collect scalar candidate strings from one param value, recursing into arrays and objects. */
+function scalarCandidates(value, depth) {
+	if (depth > MAX_ARGUMENT_DEPTH) return [];
+	if (typeof value === "string") return [value];
+	if (typeof value === "number" || typeof value === "boolean") return [String(value)];
+	if (Array.isArray(value)) return value.flatMap((element) => scalarCandidates(element, depth + 1));
+	if (typeof value === "object" && value !== null) return Object.values(value).flatMap((child) => scalarCandidates(child, depth + 1));
+	return [];
+}
+//#endregion
+//#region src/network.ts
+/** Closed mode list for runtime normalization of untrusted values. */
+const NETWORK_MODES = [
+	"deny-all",
+	"whitelist",
+	"allow-all"
+];
+/**
+* Map one official sandbox preset onto its network mode, Codex-style:
+* `read-only` defaults to no network (whitelist only), `workspace-write`
+* keeps a whitelist with ask/deny for unlisted targets, and
+* `danger-full-access` opens everything (rules can still narrow it). Any
+* other value falls back to `fallback` — hosts without the sandbox-policy
+* service therefore stay permissive, preserving pre-network behavior.
+* @param sandbox - the resolved sandbox mode, or undefined.
+* @param fallback - the mode used when the preset is unknown/absent.
+* @returns the effective network mode.
+*/
+function networkModeForSandbox(sandbox, fallback) {
+	switch (sandbox) {
+		case "read-only": return "deny-all";
+		case "workspace-write": return "whitelist";
+		case "danger-full-access": return "allow-all";
+		default: return fallback;
+	}
+}
+/** The default decision a mode yields for a target no rule matched. */
+function defaultDecision(mode, unlisted) {
+	switch (mode) {
+		case "deny-all": return {
+			action: "deny",
+			matched: false,
+			mode
+		};
+		case "whitelist": return {
+			action: unlisted,
+			matched: false,
+			mode
+		};
+		case "allow-all": return {
+			action: "allow",
+			matched: false,
+			mode
+		};
+	}
+}
+/**
+* Evaluate the network policy for one target across the loaded rule
+* chains (nearest workspace first, first match wins). Proxy-layer tool
+* attribution: a shell subprocess connection counts as `bash`/`pwsh`
+* candidates, so a rule scoped to either shell tool can fire and one
+* scoped to web tools never does. Agent identity is unknown at the proxy,
+* so agent-scoped network rules fail closed there (the pre-execute path
+* is where agents are known). Loopback targets short-circuit before any
+* rule when `loopback: 'allow'` (Codex parity: local dev servers stay
+* reachable in the read-only default).
+* @param chains - the loaded chains, insertion (nearest) order first.
+* @param target - the parsed connection/URL target.
+* @param options - mode, unlisted handling, loopback policy, host facts.
+* @returns the decision.
+*/
+function decideNetworkTarget(chains, target, options) {
+	if (options.loopback === "allow" && isLoopbackTarget(target)) return {
+		action: "allow",
+		matched: false,
+		mode: options.mode
+	};
+	const context = options.context ?? {};
+	for (const chain of chains) for (const rule of chain.ruleset.rules) {
+		if (!rule.enabled) continue;
+		if (rule.network === void 0) continue;
+		if (!matchToolsProxy(rule)) continue;
+		if (rule.when !== void 0 && !matchWhen(rule, context)) continue;
+		if (!targetMatchesNetwork(target, rule.network)) continue;
+		return {
+			action: rule.action,
+			matched: true,
+			mode: options.mode,
+			ruleIndex: rule.index,
+			rule,
+			source: chain.sources[rule.sourceIndex] ?? ""
+		};
+	}
+	return defaultDecision(options.mode, options.unlisted);
+}
+/**
+* Tool-scope check for proxy traffic: shell subprocess connections carry
+* the `bash`/`pwsh` identity candidates (ANY match satisfies, like the
+* agents dimension); rules scoped to other tools never fire here.
+*/
+function matchToolsProxy(rule) {
+	if (rule.tools.length === 0) return true;
+	return matchTools(rule, "bash") || matchTools(rule, "pwsh");
+}
+/** Whether a target addresses the loopback range. */
+function isLoopbackTarget(target) {
+	const host = target.host;
+	if (host === "localhost" || host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
+	const parts = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (parts === null) return false;
+	return parts.slice(1).every((octet) => Number(octet) <= 255) && parts[1] === "127";
+}
+/**
+* The short structured message a blocked proxy connection receives (403
+* body for plain HTTP, CONNECT error body for tunnels). Clients such as
+* curl print it verbatim, so the model sees the reason through the shell
+* tool output. An `ask` at the proxy layer is worded as a pending-approval
+* block because the proxy has no session context for the interactive
+* approval seam.
+* @param decision - the decision that blocked the connection.
+* @returns a short text/plain message.
+*/
+function blockMessage(decision) {
+	const reason = decision.rule?.reason ?? "";
+	if (decision.matched) {
+		const rulePart = decision.ruleIndex !== void 0 ? ` by rule ${decision.ruleIndex + 1}` : "";
+		if (decision.action === "ask") return `[network: blocked pending approval${rulePart}] ${reason}\n(subprocess connections cannot ride the interactive approval seam — ask your user or add an allow rule for this target)`;
+		return `[network: denied${rulePart}] ${reason}`;
+	}
+	switch (decision.mode) {
+		case "deny-all": return "[network: denied] network mode deny-all (read-only sandbox preset): only whitelisted targets are reachable";
+		case "whitelist": return decision.action === "ask" ? "[network: blocked pending approval] whitelist mode: the target is not matched by an allow rule" : "[network: denied] whitelist mode: the target is not matched by an allow rule";
+		case "allow-all": return "[network: denied]";
+	}
+}
+//#endregion
+//#region src/config.ts
+/**
+* Config schema and resolution for `dsh-permission-rules`. Every tunable is
+* a validated {@link Config} field changeable from cordis.yml; the
+* resolution step validates the numeric bounds and compiles nothing — rule
+* files are external documents resolved per session cwd at load time.
+* @module dsh-permission-rules/config
+*/
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+const Config = z.object({
+	rulesFile: z.string().default(".dsh/rules.yaml"),
+	fallbackPath: z.string(),
+	badFilePolicy: z.union(["fail", "ignore-with-warning"]).default("fail"),
+	maxRules: z.number().default(256),
+	maxCachedWorkspaces: z.number().default(512),
+	patternMode: z.union(["glob", "regex"]).default("glob"),
+	watch: z.boolean().default(true),
+	watchStabilityThresholdMs: z.number().default(200),
+	language: z.union([
+		"en",
+		"zh",
+		"es",
+		"pt",
+		"hi"
+	]).default("en"),
+	caseInsensitivePaths: z.boolean().default(process.platform === "win32"),
+	audit: z.union(["all", "hits"]).default("all"),
+	searchUp: z.boolean().default(false),
+	maxGlobStars: z.number().default(2),
+	enforce: z.boolean().default(true),
+	allowUnmarkedAudit: z.boolean().default(false),
+	network: z.object({
+		enabled: z.boolean().default(true),
+		mode: z.union(["auto", ...NETWORK_MODES]).default("auto"),
+		autoFallback: z.union(NETWORK_MODES).default("allow-all"),
+		unlisted: z.union(["ask", "deny"]).default("ask"),
+		proxyBind: z.string().default("127.0.0.1"),
+		proxyPort: z.number().default(0),
+		proxyMaxRecent: z.number().default(100),
+		loopback: z.union(["allow", "policy"]).default("allow"),
+		injectEnv: z.boolean().default(true),
+		noProxy: z.union(["clear", "preserve"]).default("clear")
+	})
+});
+/**
+* Validate raw values and fill explicit defaults. A `maxRules`,
+* `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
+* integer, a non-positive stability window, `searchUp` combined with an
+* absolute `rulesFile`, a value outside a closed enum, or a non-boolean
+* flag throws here — misconfiguration fails loud at mount even when the
+* plugin is mounted without the Schemastery loader.
+* @param config - raw (possibly partial) plugin config.
+* @returns the fully resolved config.
+*/
+function resolveConfig(config = {}) {
+	const rulesFile = config.rulesFile ?? ".dsh/rules.yaml";
+	const searchUp = config.searchUp ?? false;
+	if (searchUp && isAbsolute(rulesFile)) throw new TypeError(`searchUp cannot be combined with an absolute rulesFile (${JSON.stringify(rulesFile)}): parent-directory walking needs a relative file name`);
+	const maxRules = config.maxRules ?? 256;
+	if (!Number.isSafeInteger(maxRules) || maxRules <= 0) throw new TypeError(`maxRules must be a positive safe integer, got ${String(config.maxRules)}`);
+	const watchStabilityThresholdMs = config.watchStabilityThresholdMs ?? 200;
+	if (!Number.isSafeInteger(watchStabilityThresholdMs) || watchStabilityThresholdMs < 0) throw new TypeError(`watchStabilityThresholdMs must be a non-negative safe integer, got ${String(config.watchStabilityThresholdMs)}`);
+	const maxCachedWorkspaces = config.maxCachedWorkspaces ?? 512;
+	if (!Number.isSafeInteger(maxCachedWorkspaces) || maxCachedWorkspaces <= 0) throw new TypeError(`maxCachedWorkspaces must be a positive safe integer, got ${String(config.maxCachedWorkspaces)}`);
+	const maxGlobStars = config.maxGlobStars ?? 2;
+	if (!Number.isSafeInteger(maxGlobStars) || maxGlobStars <= 0) throw new TypeError(`maxGlobStars must be a positive safe integer, got ${String(config.maxGlobStars)}`);
+	assertEnum("badFilePolicy", config.badFilePolicy ?? "fail", ["fail", "ignore-with-warning"]);
+	assertEnum("patternMode", config.patternMode ?? "glob", ["glob", "regex"]);
+	assertEnum("language", config.language ?? "en", [
+		"en",
+		"zh",
+		"es",
+		"pt",
+		"hi"
+	]);
+	assertEnum("audit", config.audit ?? "all", ["all", "hits"]);
+	assertBoolean("watch", config.watch ?? true);
+	assertBoolean("searchUp", searchUp);
+	assertBoolean("caseInsensitivePaths", config.caseInsensitivePaths ?? process.platform === "win32");
+	assertBoolean("enforce", config.enforce ?? true);
+	assertBoolean("allowUnmarkedAudit", config.allowUnmarkedAudit ?? false);
+	const network = resolveNetworkConfig(config.network);
+	return {
+		rulesFile,
+		fallbackPath: config.fallbackPath,
+		badFilePolicy: config.badFilePolicy ?? "fail",
+		maxRules,
+		maxCachedWorkspaces,
+		patternMode: config.patternMode ?? "glob",
+		watch: config.watch ?? true,
+		watchStabilityThresholdMs,
+		language: config.language ?? "en",
+		caseInsensitivePaths: config.caseInsensitivePaths ?? process.platform === "win32",
+		audit: config.audit ?? "all",
+		searchUp,
+		maxGlobStars,
+		enforce: config.enforce ?? true,
+		allowUnmarkedAudit: config.allowUnmarkedAudit ?? false,
+		network
+	};
+}
+/** Validate and default the optional `network` block; bad values fail the mount loudly. */
+function resolveNetworkConfig(raw) {
+	const mode = raw?.mode ?? "auto";
+	if (mode !== "auto") assertEnum("network.mode", mode, NETWORK_MODES);
+	const autoFallback = raw?.autoFallback ?? "allow-all";
+	assertEnum("network.autoFallback", autoFallback, NETWORK_MODES);
+	const unlisted = raw?.unlisted ?? "ask";
+	assertEnum("network.unlisted", unlisted, ["ask", "deny"]);
+	const loopback = raw?.loopback ?? "allow";
+	assertEnum("network.loopback", loopback, ["allow", "policy"]);
+	const noProxy = raw?.noProxy ?? "clear";
+	assertEnum("network.noProxy", noProxy, ["clear", "preserve"]);
+	assertBoolean("network.enabled", raw?.enabled ?? true);
+	assertBoolean("network.injectEnv", raw?.injectEnv ?? true);
+	const proxyBind = raw?.proxyBind ?? "127.0.0.1";
+	if (typeof proxyBind !== "string" || proxyBind.trim().length === 0) throw new TypeError(`network.proxyBind must be a non-empty string, got ${typeof proxyBind}`);
+	const proxyPort = raw?.proxyPort ?? 0;
+	if (!Number.isSafeInteger(proxyPort) || proxyPort < 0 || proxyPort > 65535) throw new TypeError(`network.proxyPort must be an integer 0-65535, got ${String(raw?.proxyPort)}`);
+	const proxyMaxRecent = raw?.proxyMaxRecent ?? 100;
+	if (!Number.isSafeInteger(proxyMaxRecent) || proxyMaxRecent <= 0) throw new TypeError(`network.proxyMaxRecent must be a positive safe integer, got ${String(raw?.proxyMaxRecent)}`);
+	return {
+		enabled: raw?.enabled ?? true,
+		mode,
+		autoFallback,
+		unlisted,
+		proxyBind: proxyBind.trim(),
+		proxyPort,
+		proxyMaxRecent,
+		loopback,
+		injectEnv: raw?.injectEnv ?? true,
+		noProxy
+	};
+}
+/** Throw unless `key` is one of `allowed` (TypeScript's closed enums are not runtime checks). */
+function assertEnum(key, value, allowed) {
+	if (!allowed.includes(value)) throw new TypeError(`${key} must be one of ${allowed.map((item) => JSON.stringify(item)).join(" | ")}, got ${JSON.stringify(value)}`);
 }
-/** Collect scalar candidate strings from one param value, recursing into arrays and objects. */
-function scalarCandidates(value, depth) {
-	if (depth > MAX_ARGUMENT_DEPTH) return [];
-	if (typeof value === "string") return [value];
-	if (typeof value === "number" || typeof value === "boolean") return [String(value)];
-	if (Array.isArray(value)) return value.flatMap((element) => scalarCandidates(element, depth + 1));
-	if (typeof value === "object" && value !== null) return Object.values(value).flatMap((child) => scalarCandidates(child, depth + 1));
-	return [];
+/** Throw unless `key` is a boolean (plain-JS mounts bypass the Schemastery coercion). */
+function assertBoolean(key, value) {
+	if (typeof value !== "boolean") throw new TypeError(`${key} must be a boolean, got ${typeof value}`);
 }
 //#endregion
 //#region src/prose.ts
@@ -935,7 +1438,7 @@ const EN = {
 	lastReloadWarning: (error) => `Warning: the last reload failed (${error}); the rules listed above are the previous ones.`,
 	dryRunNotice: "Dry-run mode (enforce: false): deny/ask hits are audit-logged only — every call is passed through.",
 	unknownArg: (arg) => `Unknown /rules argument "${arg}". ${EN.usage}`,
-	usage: "Usage: /rules [list | reload | decisions [n] | test <tool> <json-args>]",
+	usage: "Usage: /rules [list | reload | network | decisions [n] | test <tool> <json-args>]",
 	decisionsHeader: (shown, total) => `Last ${shown} of ${total} permission decision(s) for this session:`,
 	noDecisions: "No permission decisions recorded in this session yet.",
 	auditDisabledNotice: "Session-log audit is disabled on this host: its Session.append predates the ignorable marker and would make sessions unresumable elsewhere (set allowUnmarkedAudit: true to opt back in).",
@@ -951,7 +1454,14 @@ const EN = {
 	testBadPlatform: (value) => `Unknown platform "${value}" in --platform: expected one of aix, android, darwin, freebsd, linux, openbsd, sunos, win32. ${EN.testUsage}`,
 	testUsage: "Usage: /rules test [--cwd <dir>] [--env KEY=VALUE]... [--agent <selector>]... [--platform <name>] <tool> <json-args>, e.g. /rules test bash {\"command\":\"git push origin main\"}",
 	unreachableWarning: (numbers) => `Warning: rule${numbers.length > 1 ? "s" : ""} ${numbers.join(", ")} ${numbers.length > 1 ? "are" : "is"} unreachable (shadowed by an earlier catch-all rule).`,
-	emptySource: "(no rule file — empty rule set)"
+	emptySource: "(no rule file — empty rule set)",
+	networkDisabled: "Network policy disabled (network.enabled: false): no proxy, no web-tool mode defaults.",
+	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Network policy: mode ${mode}${sandboxMode === void 0 ? "" : ` (sandbox preset ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configured ${configuredMode})`}; proxy ${proxyActive ? `active on 127.0.0.1:${proxyPort}` : "INACTIVE (bind failed — shell network policy is not enforced)"}.`,
+	networkCounters: (denied, askBlocked) => `Blocks: ${denied} denied, ${askBlocked} ask-blocked.`,
+	noNetworkBlocks: "No network blocks recorded yet.",
+	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
+		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (unattributed)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (rule ${ruleIndex + 1})` : " (mode default)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	}
 };
 const ZH = {
 	rulesHeader: (count, sources, cwd) => `权限规则：共 ${count} 条，来自 ${sources.join("、")}（工作区 ${cwd}）。`,
@@ -962,7 +1472,7 @@ const ZH = {
 	lastReloadWarning: (error) => `警告：上次重载失败（${error}）；以上列出的是之前的规则。`,
 	dryRunNotice: "干跑模式（enforce: false）：deny/ask 命中仅写入审计日志——所有调用照常透传。",
 	unknownArg: (arg) => `未知的 /rules 参数 "${arg}"。${ZH.usage}`,
-	usage: "用法：/rules [list | reload | decisions [n] | test <工具名> <json-参数>]",
+	usage: "用法：/rules [list | reload | network | decisions [n] | test <工具名> <json-参数>]",
 	decisionsHeader: (shown, total) => `本会话最近 ${shown}/${total} 条权限裁决：`,
 	noDecisions: "本会话还没有记录任何权限裁决。",
 	auditDisabledNotice: "本宿主上会话日志审计已停用：其 Session.append 早于 ignorable 标记支持，会令会话在其他宿主上无法恢复（设 allowUnmarkedAudit: true 可重新开启）。",
@@ -978,7 +1488,14 @@ const ZH = {
 	testBadPlatform: (value) => `未知的平台 "${value}"（--platform）：应为 aix、android、darwin、freebsd、linux、openbsd、sunos、win32 之一。${ZH.testUsage}`,
 	testUsage: "用法：/rules test [--cwd <目录>] [--env 键=值]... [--agent <选择器>]... [--platform <平台名>] <工具名> <json-参数>，例如 /rules test bash {\"command\":\"git push origin main\"}",
 	unreachableWarning: (numbers) => `警告：规则 ${numbers.join("、")} 不可达（被前面的通配规则遮蔽）。`,
-	emptySource: "（无规则文件——空规则集）"
+	emptySource: "（无规则文件——空规则集）",
+	networkDisabled: "网络策略已停用（network.enabled: false）：无代理、无 web 工具模式默认裁决。",
+	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `网络策略：模式 ${mode}${sandboxMode === void 0 ? "" : `（沙箱预设 ${sandboxMode}）`}${configuredMode === "auto" ? "" : `（显式配置 ${configuredMode}）`}；代理${proxyActive ? `运行于 127.0.0.1:${proxyPort}` : "未激活（绑定失败——shell 网络策略未生效）"}。`,
+	networkCounters: (denied, askBlocked) => `拦截：拒绝 ${denied} 次，待审批阻断 ${askBlocked} 次。`,
+	noNetworkBlocks: "尚未记录任何网络拦截。",
+	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
+		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : "（未归属）"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : `（规则 ${ruleIndex + 1}）` : "（模式默认）"}${reason === void 0 ? "" : `：${short(reason)}`}`;
+	}
 };
 const ES = {
 	rulesHeader: (count, sources, cwd) => `Reglas de permiso: ${count} regla(s) desde ${sources.join(", ")} (espacio de trabajo ${cwd}).`,
@@ -989,7 +1506,7 @@ const ES = {
 	lastReloadWarning: (error) => `Aviso: la última recarga falló (${error}); las reglas mostradas son las anteriores.`,
 	dryRunNotice: "Modo simulación (enforce: false): los aciertos deny/ask solo se registran en auditoría — todas las llamadas pasan.",
 	unknownArg: (arg) => `Argumento de /rules desconocido "${arg}". ${ES.usage}`,
-	usage: "Uso: /rules [list | reload | decisions [n] | test <herramienta> <json-args>]",
+	usage: "Uso: /rules [list | reload | network | decisions [n] | test <herramienta> <json-args>]",
 	decisionsHeader: (shown, total) => `Últimas ${shown} de ${total} decisión(es) de permiso de esta sesión:`,
 	noDecisions: "Esta sesión aún no registra decisiones de permiso.",
 	auditDisabledNotice: "La auditoría del registro de sesión está desactivada en este host: su Session.append es anterior al marcador ignorable y haría las sesiones irrecuperables en otros hosts (establece allowUnmarkedAudit: true para reactivarla).",
@@ -1005,7 +1522,14 @@ const ES = {
 	testBadPlatform: (value) => `Plataforma desconocida "${value}" en --platform: se esperaba una de aix, android, darwin, freebsd, linux, openbsd, sunos, win32. ${ES.testUsage}`,
 	testUsage: "Uso: /rules test [--cwd <dir>] [--env CLAVE=VALOR]... [--agent <selector>]... [--platform <nombre>] <herramienta> <json-args>, p. ej. /rules test bash {\"command\":\"git push origin main\"}",
 	unreachableWarning: (numbers) => `Aviso: ${numbers.length > 1 ? "las reglas" : "la regla"} ${numbers.join(", ")} ${numbers.length > 1 ? "son inalcanzables" : "es inalcanzable"} (tapada por una regla general anterior).`,
-	emptySource: "(sin archivo de reglas — conjunto vacío)"
+	emptySource: "(sin archivo de reglas — conjunto vacío)",
+	networkDisabled: "Política de red desactivada (network.enabled: false): sin proxy, sin valores predeterminados de modo para herramientas web.",
+	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Política de red: modo ${mode}${sandboxMode === void 0 ? "" : ` (preset sandbox ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configurado ${configuredMode})`}; proxy ${proxyActive ? `activo en 127.0.0.1:${proxyPort}` : "INACTIVO (fallo de bind — la política de red de shell no se aplica)"}.`,
+	networkCounters: (denied, askBlocked) => `Bloqueos: ${denied} denegados, ${askBlocked} bloqueados por aprobación.`,
+	noNetworkBlocks: "Aún no se han registrado bloqueos de red.",
+	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
+		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (sin atribuir)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (regla ${ruleIndex + 1})` : " (modo predeterminado)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	}
 };
 const PT = {
 	rulesHeader: (count, sources, cwd) => `Regras de permissão: ${count} regra(s) de ${sources.join(", ")} (workspace ${cwd}).`,
@@ -1016,7 +1540,7 @@ const PT = {
 	lastReloadWarning: (error) => `Aviso: a última recarga falhou (${error}); as regras listadas são as anteriores.`,
 	dryRunNotice: "Modo simulação (enforce: false): acertos deny/ask são apenas registrados na auditoria — todas as chamadas passam.",
 	unknownArg: (arg) => `Argumento de /rules desconhecido "${arg}". ${PT.usage}`,
-	usage: "Uso: /rules [list | reload | decisions [n] | test <ferramenta> <json-args>]",
+	usage: "Uso: /rules [list | reload | network | decisions [n] | test <ferramenta> <json-args>]",
 	decisionsHeader: (shown, total) => `Últimas ${shown} de ${total} decisão(ões) de permissão desta sessão:`,
 	noDecisions: "Esta sessão ainda não registrou decisões de permissão.",
 	auditDisabledNotice: "A auditoria do registro da sessão está desativada neste host: seu Session.append é anterior ao marcador ignorable e tornaria as sessões irrecuperáveis em outros hosts (defina allowUnmarkedAudit: true para reativar).",
@@ -1032,7 +1556,14 @@ const PT = {
 	testBadPlatform: (value) => `Plataforma desconhecida "${value}" em --platform: esperava-se uma de aix, android, darwin, freebsd, linux, openbsd, sunos, win32. ${PT.testUsage}`,
 	testUsage: "Uso: /rules test [--cwd <dir>] [--env CHAVE=VALOR]... [--agent <seletor>]... [--platform <nome>] <ferramenta> <json-args>, ex.: /rules test bash {\"command\":\"git push origin main\"}",
 	unreachableWarning: (numbers) => `Aviso: ${numbers.length > 1 ? "as regras" : "a regra"} ${numbers.join(", ")} ${numbers.length > 1 ? "são inalcançáveis" : "é inalcançável"} (encoberta por uma regra geral anterior).`,
-	emptySource: "(sem arquivo de regras — conjunto vazio)"
+	emptySource: "(sem arquivo de regras — conjunto vazio)",
+	networkDisabled: "Política de rede desativada (network.enabled: false): sem proxy, sem padrões de modo para ferramentas web.",
+	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Política de rede: modo ${mode}${sandboxMode === void 0 ? "" : ` (preset sandbox ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configurado ${configuredMode})`}; proxy ${proxyActive ? `ativo em 127.0.0.1:${proxyPort}` : "INATIVO (falha de bind — a política de rede do shell não está ativa)"}.`,
+	networkCounters: (denied, askBlocked) => `Bloqueios: ${denied} negados, ${askBlocked} bloqueados por aprovação.`,
+	noNetworkBlocks: "Nenhum bloqueio de rede registrado ainda.",
+	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
+		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (não atribuído)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (regra ${ruleIndex + 1})` : " (modo padrão)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	}
 };
 const HI = {
 	rulesHeader: (count, sources, cwd) => `अनुमति नियम: ${count} नियम, स्रोत ${sources.join(", ")} (कार्यक्षेत्र ${cwd})।`,
@@ -1043,7 +1574,7 @@ const HI = {
 	lastReloadWarning: (error) => `चेतावनी: अंतिम पुनः लोड विफल रहा (${error}); ऊपर सूचीबद्ध नियम पिछले वाले हैं।`,
 	dryRunNotice: "ड्राई-रन मोड (enforce: false): deny/ask हिट केवल ऑडिट में दर्ज होते हैं — हर कॉल पास हो जाती है।",
 	unknownArg: (arg) => `अज्ञात /rules तर्क "${arg}"। ${HI.usage}`,
-	usage: "उपयोग: /rules [list | reload | decisions [n] | test <टूल> <json-args>]",
+	usage: "उपयोग: /rules [list | reload | network | decisions [n] | test <टूल> <json-args>]",
 	decisionsHeader: (shown, total) => `इस सत्र के अंतिम ${shown}/${total} अनुमति निर्णय:`,
 	noDecisions: "इस सत्र में अभी कोई अनुमति निर्णय दर्ज नहीं है।",
 	auditDisabledNotice: "इस होस्ट पर सत्र-लॉग ऑडिट अक्षम है: इसका Session.append ignorable मार्कर से पुराना है और सत्र अन्य होस्ट पर अप्राप्य बन जाते (पुनः चालू करने के लिए allowUnmarkedAudit: true सेट करें)।",
@@ -1059,7 +1590,14 @@ const HI = {
 	testBadPlatform: (value) => `अज्ञात प्लेटफ़ॉर्म "${value}" (--platform): aix, android, darwin, freebsd, linux, openbsd, sunos, win32 में से एक अपेक्षित। ${HI.testUsage}`,
 	testUsage: "उपयोग: /rules test [--cwd <dir>] [--env KEY=मान]... [--agent <चयनकर्ता>]... [--platform <नाम>] <टूल> <json-args>, जैसे /rules test bash {\"command\":\"git push origin main\"}",
 	unreachableWarning: (numbers) => `चेतावनी: नियम ${numbers.join(", ")} अप्राप्य हैं (पहले वाले सर्व-मिलान नियम से ढके हुए)।`,
-	emptySource: "(कोई नियम फ़ाइल नहीं — खाली नियम-समूह)"
+	emptySource: "(कोई नियम फ़ाइल नहीं — खाली नियम-समूह)",
+	networkDisabled: "नेटवर्क नीति अक्षम (network.enabled: false): कोई प्रॉक्सी नहीं, कोई वेब-टूल मोड डिफ़ॉल्ट नहीं।",
+	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `नेटवर्क नीति: मोड ${mode}${sandboxMode === void 0 ? "" : ` (सैंडबॉक्स प्रीसेट ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (कॉन्फ़िगर किया ${configuredMode})`}; प्रॉक्सी ${proxyActive ? `सक्रिय 127.0.0.1:${proxyPort} पर` : "निष्क्रिय (बाइंड विफल — शेल नेटवर्क नीति लागू नहीं)"}।`,
+	networkCounters: (denied, askBlocked) => `ब्लॉक: ${denied} अस्वीकृत, ${askBlocked} अनुमोदन-ब्लॉक।`,
+	noNetworkBlocks: "अभी तक कोई नेटवर्क ब्लॉक दर्ज नहीं हुआ।",
+	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
+		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (असाइन नहीं)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (नियम ${ruleIndex + 1})` : " (मोड डिफ़ॉल्ट)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
+	}
 };
 /** The localized prose tables by language. */
 const UI_PROSE = {
@@ -1080,6 +1618,11 @@ const DESCRIBE_TOKENS = {
 		absent: "absent",
 		when: "when",
 		platform: "platform",
+		network: "network",
+		domains: "domains",
+		ips: "ips",
+		ports: "ports",
+		schemes: "schemes",
 		disabled: "disabled",
 		tags: "tags",
 		src: "src"
@@ -1093,6 +1636,11 @@ const DESCRIBE_TOKENS = {
 		absent: "缺省键",
 		when: "条件",
 		platform: "平台",
+		network: "网络",
+		domains: "域名",
+		ips: "IP",
+		ports: "端口",
+		schemes: "协议",
 		disabled: "已禁用",
 		tags: "标签",
 		src: "来源"
@@ -1106,6 +1654,11 @@ const DESCRIBE_TOKENS = {
 		absent: "ausentes",
 		when: "cuándo",
 		platform: "plataforma",
+		network: "red",
+		domains: "dominios",
+		ips: "IP",
+		ports: "puertos",
+		schemes: "esquemas",
 		disabled: "deshabilitada",
 		tags: "etiquetas",
 		src: "origen"
@@ -1119,6 +1672,11 @@ const DESCRIBE_TOKENS = {
 		absent: "ausentes",
 		when: "quando",
 		platform: "plataforma",
+		network: "rede",
+		domains: "domínios",
+		ips: "IP",
+		ports: "portas",
+		schemes: "esquemas",
 		disabled: "desativada",
 		tags: "etiquetas",
 		src: "origem"
@@ -1132,12 +1690,410 @@ const DESCRIBE_TOKENS = {
 		absent: "अनुपस्थित",
 		when: "शर्त",
 		platform: "प्लेटफ़ॉर्म",
+		network: "नेटवर्क",
+		domains: "डोमेन",
+		ips: "IP",
+		ports: "पोर्ट",
+		schemes: "स्कीम",
 		disabled: "अक्षम",
 		tags: "टैग",
 		src: "स्रोत"
 	}
 };
 //#endregion
+//#region src/proxy.ts
+/**
+* The plugin's built-in local HTTP/CONNECT proxy: the process-level
+* network gate for shell subprocess traffic. Bash/pwsh children inherit
+* `HTTP(S)_PROXY`/`ALL_PROXY` environment variables pointing here, and the
+* proxy adjudicates EVERY connection target against the loaded network
+* rules and the active policy mode — the domain decision lives in the
+* proxy layer, not in per-command wrappers.
+*
+* Boundaries (documented in the README): DSH's official `ctx.sandbox`
+* enforces FILE effects only, so network interception is entirely this
+* plugin's job; the proxy has no session context, so an `ask` decision at
+* the proxy layer cannot ride the interactive approval seam — it blocks
+* the connection with a structured message and is audit-logged instead
+* (web tools get the real approval seam at `tools/pre-execute`).
+* @module dsh-permission-rules/proxy
+*/
+/** Proxy environment variable names the injector sets/restores (uppercase + lowercase for mixed-ecosystem CLIs). */
+const PROXY_ENV_NAMES = [
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"all_proxy"
+];
+/** NO_PROXY names cleared (or preserved) by the injector. */
+const NO_PROXY_ENV_NAMES = ["NO_PROXY", "no_proxy"];
+/**
+* The local HTTP/CONNECT policy proxy. Binds on demand (the plugin calls
+* {@link start} inside an effect and {@link close} from its disposer);
+* every live tunnel socket is tracked and destroyed on close so updates
+* and uninstalls leave no orphaned connections.
+*/
+var NetworkProxy = class {
+	options;
+	server;
+	sockets = /* @__PURE__ */ new Set();
+	recent = [];
+	stats = {
+		denied: 0,
+		askBlocked: 0
+	};
+	actualPort = 0;
+	constructor(options) {
+		this.options = options;
+	}
+	/** The bound port (valid after {@link start} resolves). */
+	get port() {
+		return this.actualPort;
+	}
+	/** Deny/ask blocks recorded since mount, newest first (settings-page list). */
+	recentBlocks() {
+		return this.recent;
+	}
+	/** Cumulative block counters. */
+	blockStats() {
+		return { ...this.stats };
+	}
+	/** Bind the server and return the actual port. */
+	start() {
+		const server = createServer((req, res) => {
+			this.handleRequest(req, res);
+		});
+		server.on("connect", (req, socket, head) => {
+			this.handleConnect(req, socket, head);
+		});
+		server.on("error", (error) => {
+			this.options.logger.warn(`permission-rules: proxy server error: ${String(error)}`);
+		});
+		this.server = server;
+		return new Promise((resolve, reject) => {
+			const onError = (error) => {
+				server.off("listening", onListening);
+				reject(error);
+			};
+			const onListening = () => {
+				server.off("error", onError);
+				const address = server.address();
+				this.actualPort = address.port;
+				resolve(address.port);
+			};
+			server.once("error", onError);
+			server.once("listening", onListening);
+			server.listen(this.options.port, this.options.bind);
+		});
+	}
+	/** Stop the server and destroy every tunnel; resolves when sockets are closed. */
+	close() {
+		const server = this.server;
+		this.server = void 0;
+		for (const socket of this.sockets) socket.destroy();
+		this.sockets.clear();
+		if (server === void 0) return Promise.resolve();
+		return new Promise((resolve) => {
+			server.close(() => resolve());
+		});
+	}
+	/** Plain-HTTP proxying: absolute-form requests are adjudicated and forwarded (or blocked with a structured 403). */
+	async handleRequest(req, res) {
+		const target = parseUrlTarget(req.url ?? "");
+		if (target === void 0 || target.scheme === void 0) {
+			res.writeHead(404, { "content-type": "text/plain" });
+			res.end("permission-rules proxy: only absolute-form proxy requests are served here\n");
+			return;
+		}
+		await this.forwardOrBlock(res, target, () => {
+			const upstream = new URL(req.url);
+			const proxyReq = (upstream.protocol === "https:" ? request$1 : request)(upstream, {
+				method: req.method,
+				headers: req.headers
+			}, (proxyRes) => {
+				res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+				proxyRes.pipe(res);
+			});
+			proxyReq.on("error", (error) => {
+				if (!res.headersSent) {
+					res.writeHead(502, { "content-type": "text/plain" });
+					res.end(`[network: upstream error] ${String(error)}\n`);
+				} else res.destroy();
+			});
+			req.pipe(proxyReq);
+		});
+	}
+	/** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */
+	async handleConnect(req, socket, head) {
+		const target = connectTarget(req.url ?? "");
+		if (target === void 0) {
+			socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+			return;
+		}
+		const decision = await this.decideWithResolution(target);
+		if (decision.action !== "allow") {
+			this.recordBlock(decision, target);
+			const body = blockMessage(decision);
+			socket.end(`HTTP/1.1 403 Forbidden\r\ncontent-type: text/plain\r\ncontent-length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+			return;
+		}
+		const upstream = connect(target.port ?? 443, target.host);
+		this.sockets.add(socket);
+		this.sockets.add(upstream);
+		const cleanup = () => {
+			this.sockets.delete(socket);
+			this.sockets.delete(upstream);
+		};
+		socket.on("close", cleanup);
+		upstream.on("close", cleanup);
+		upstream.on("error", () => socket.destroy());
+		socket.on("error", () => upstream.destroy());
+		upstream.once("connect", () => {
+			socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+			if (head.length > 0) upstream.write(head);
+			upstream.pipe(socket);
+			socket.pipe(upstream);
+		});
+	}
+	/** Adjudicate one plain-HTTP request; deny/ask blocks with a structured 403 before any forwarding. */
+	async forwardOrBlock(res, target, forward) {
+		const decision = await this.decideWithResolution(target);
+		if (decision.action !== "allow") {
+			this.recordBlock(decision, target);
+			const body = blockMessage(decision);
+			res.writeHead(403, {
+				"content-type": "text/plain; charset=utf-8",
+				"content-length": Buffer.byteLength(body)
+			});
+			res.end(body);
+			return;
+		}
+		forward();
+	}
+	/** Resolve a hostname once so `ips`-scoped rules see the real addresses, then decide. */
+	async decideWithResolution(target) {
+		if (!isIpLiteral(target.host)) try {
+			const resolved = (await lookup(target.host, {
+				all: true,
+				verbatim: true
+			})).map((entry) => entry.address);
+			if (resolved.length > 0) return this.options.decide({
+				...target,
+				ips: [...target.ips, ...resolved]
+			});
+		} catch {}
+		return this.options.decide(target);
+	}
+	/** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */
+	recordBlock(decision, target) {
+		const attribution = this.options.attribution?.();
+		const record = {
+			time: Date.now(),
+			tool: attribution?.tool ?? "subprocess",
+			attributed: attribution !== void 0,
+			...attribution?.callId !== void 0 ? { callId: attribution.callId } : {},
+			domain: target.host,
+			...target.scheme !== void 0 ? { scheme: target.scheme } : {},
+			...target.port !== void 0 ? { port: target.port } : {},
+			action: decision.action === "ask" ? "ask" : "deny",
+			mode: decision.mode,
+			matched: decision.matched,
+			source: decision.source ?? "",
+			...decision.ruleIndex !== void 0 ? { ruleIndex: decision.ruleIndex } : {},
+			...decision.rule !== void 0 ? { reason: decision.rule.reason } : {}
+		};
+		if (record.action === "deny") this.stats.denied += 1;
+		else this.stats.askBlocked += 1;
+		this.recent.unshift(record);
+		if (this.recent.length > this.options.maxRecent) this.recent.length = this.options.maxRecent;
+		this.options.logger.warn(`permission-rules: network ${record.action === "deny" ? "denied" : "ask-blocked"} ${target.scheme ?? "?"}://${target.host}${target.port !== void 0 ? `:${target.port}` : ""} (mode ${decision.mode}${decision.matched ? `, rule ${(decision.ruleIndex ?? 0) + 1}` : ", mode default"})`);
+		try {
+			this.options.onBlock?.(record, attribution);
+		} catch (error) {
+			this.options.logger.warn(`permission-rules: network block hook failed: ${String(error)}`);
+		}
+	}
+};
+/** Parse a CONNECT authority (`host:port`) into an https target with an explicit port. */
+function connectTarget(authority) {
+	const colon = authority.lastIndexOf(":");
+	if (colon <= 0) return void 0;
+	const host = authority.slice(0, colon).replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
+	const port = Number(authority.slice(colon + 1));
+	if (host.length === 0 || !Number.isInteger(port) || port < 1 || port > 65535) return void 0;
+	return {
+		scheme: "https",
+		host,
+		port,
+		ips: isIpLiteral(host) ? [host] : []
+	};
+}
+/**
+* Inject the proxy environment variables for subprocesses and return a
+* disposer restoring every previous value exactly (so updates and
+* uninstalls leave the host environment untouched). `noProxy: 'clear'`
+* empties NO_PROXY so the policy cannot be bypassed through ambient
+* exclusions; `preserve` keeps ambient values.
+*
+* The snapshot pass covers EVERY name BEFORE any write: on Windows
+* `process.env` is case-insensitive, so the uppercase/lowercase spellings
+* share one variable — writing `HTTP_PROXY` mid-loop would otherwise
+* poison the later snapshot of `http_proxy` and make the restore write
+* the proxy address back over the original.
+* @param port - the bound proxy port.
+* @param noProxy - the configured NO_PROXY handling.
+* @returns the restore disposer.
+*/
+function injectProxyEnv(port, noProxy) {
+	const previous = /* @__PURE__ */ new Map();
+	const value = `http://127.0.0.1:${port}`;
+	for (const name of PROXY_ENV_NAMES) previous.set(name, process.env[name]);
+	if (noProxy === "clear") for (const name of NO_PROXY_ENV_NAMES) previous.set(name, process.env[name]);
+	for (const name of PROXY_ENV_NAMES) process.env[name] = value;
+	if (noProxy === "clear") for (const name of NO_PROXY_ENV_NAMES) process.env[name] = "";
+	return () => {
+		for (const name of PROXY_ENV_NAMES) {
+			const old = previous.get(name);
+			if (old === void 0) delete process.env[name];
+			else process.env[name] = old;
+		}
+		if (noProxy === "clear") for (const name of NO_PROXY_ENV_NAMES) {
+			const old = previous.get(name);
+			if (old === void 0) delete process.env[name];
+			else process.env[name] = old;
+		}
+	};
+}
+//#endregion
+//#region src/remote-service.ts
+/**
+* The settings-page Remote service: exposes the `permissionRules` Typert
+* namespace (network snapshot + rule-file read/save/reload) to the
+* browser half. All state lives in the {@link PermissionRulesRuntime}
+* this service delegates to; the service itself only bridges the wire
+* vocabulary. The rule editor only ever touches KNOWN rule sources —
+* arbitrary paths are refused by the runtime.
+* @module dsh-permission-rules/remote-service
+*/
+/**
+* The Typert Remote service behind the settings page. Registered through
+* `ctx.plugin(PermissionRulesRemoteService, { runtime })` in
+* {@link apply}; the typert gateway binds its public methods to the
+* invocation descriptors in `./wire.ts`.
+*/
+var PermissionRulesRemoteService = class extends TypertRemoteService {
+	config;
+	static inject = [];
+	constructor(ctx, config) {
+		super(ctx, "permissionRules");
+		this.config = config;
+	}
+	/** The settings-page snapshot: mode mapping, proxy liveness, counters, recent blocks, editable rule sources. */
+	networkStatus() {
+		const snapshot = this.config.runtime.networkSnapshot();
+		const sources = this.config.runtime.knownRuleSources().map((path) => {
+			const owner = this.config.runtime.sourceOwner(path);
+			return {
+				path,
+				exists: existsSync(path),
+				cwd: owner ?? null
+			};
+		});
+		return {
+			enabled: snapshot.enabled,
+			mode: snapshot.mode,
+			configuredMode: snapshot.configuredMode,
+			sandboxMode: snapshot.sandboxMode ?? null,
+			proxyPort: snapshot.proxyPort,
+			proxyActive: snapshot.proxyActive,
+			denied: snapshot.denied,
+			askBlocked: snapshot.askBlocked,
+			recent: snapshot.recent.map((block) => ({
+				time: block.time,
+				tool: block.tool,
+				attributed: block.attributed,
+				domain: block.domain,
+				scheme: block.scheme ?? null,
+				port: block.port ?? null,
+				action: block.action,
+				mode: block.mode,
+				matched: block.matched,
+				source: block.source,
+				ruleIndex: block.ruleIndex ?? null,
+				reason: block.reason ?? null
+			})),
+			sources
+		};
+	}
+	/** Read one known rule file for the editor. */
+	rulesRead(path) {
+		const result = this.config.runtime.readRuleFile(path);
+		return {
+			path: result.path,
+			exists: result.exists,
+			text: result.text,
+			error: result.error ?? null
+		};
+	}
+	/** Validate and write one known rule file; invalid edits are rejected before anything touches disk. */
+	rulesSave(path, text) {
+		const result = this.config.runtime.saveRuleFile(path, text);
+		return {
+			ok: result.ok,
+			error: result.error ?? null,
+			reloaded: result.reloaded ?? null
+		};
+	}
+	/** Re-read every cached workspace chain (after an external edit). */
+	reload() {
+		try {
+			this.config.runtime.reloadAll();
+			return {
+				ok: true,
+				error: null
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+};
+//#endregion
+//#region src/settings.ts
+/** The settings namespace this plugin owns (kebab-case, per the provider contract). */
+const SETTINGS_NAMESPACE = "permission-rules";
+/**
+* Register the settings section and bind the runtime's live config
+* source. Runs only where a settings service is composed.
+* @param ctx - the plugin context.
+* @param runtime - the runtime whose config source follows the section.
+* @param entry - the composition entry config (the section's `base` layer).
+*/
+function attachSettingsSection(ctx, runtime, entry) {
+	ctx.inject(["settings"], (scope) => {
+		const settings = scope.get("settings");
+		if (settings === void 0) return;
+		const registration = settings.register(SETTINGS_NAMESPACE, Config, {
+			base: entry,
+			expose: true,
+			applies: "live",
+			validate: (value) => {
+				resolveConfig(value);
+			}
+		});
+		runtime.setConfigSource(() => resolveConfig(registration.get()));
+		registration.watch((next, prev) => {
+			const nextConfig = resolveConfig(next);
+			const prevConfig = resolveConfig(prev);
+			if (nextConfig.network.proxyPort !== prevConfig.network.proxyPort || nextConfig.network.proxyBind !== prevConfig.network.proxyBind || nextConfig.network.injectEnv !== prevConfig.network.injectEnv || nextConfig.network.noProxy !== prevConfig.network.noProxy) runtime.onNetworkConfigChanged();
+		});
+	});
+}
+//#endregion
 //#region src/events.ts
 /**
 * Whether an `append` call actually honored the `ignorable` marker: the
@@ -1165,13 +2121,16 @@ function isMarkedAuditEvent(result) {
 * registration is an effect.
 * @module dsh-permission-rules/runtime
 */
+/** The network-capable tools whose unlisted calls fall back to the mode default at `tools/pre-execute`. */
+const WEB_TOOLS = ["web_fetch", "web_search"];
+/** Stale in-flight entries are dropped after this many milliseconds (attribution is best-effort). */
+const IN_FLIGHT_TTL_MS = 6e5;
 /**
 * State and behavior. One instance per plugin mount; disposals are owned by
-* the watcher/timer effects registered in {@link apply}.
+* the watcher/timer/proxy effects registered in {@link apply}.
 */
 var PermissionRulesRuntime = class {
 	ctx;
-	config;
 	/** Loaded (or failed) rules per workspace cwd, least-recently-used first for eviction. */
 	byCwd = /* @__PURE__ */ new Map();
 	/** Live watchers per watched path (rule file or candidate ancestor directory), with the cwds each serves. */
@@ -1180,17 +2139,34 @@ var PermissionRulesRuntime = class {
 	timers = /* @__PURE__ */ new Map();
 	/** Whether the host honors the audit envelope's `ignorable` marker: unknown until the first decision (or peer-version check). */
 	auditSupport = "unknown";
+	/** In-flight bash/pwsh executions (insertion order = start order), for proxy-block attribution. */
+	inFlight = /* @__PURE__ */ new Map();
+	/** The network proxy, when the policy is enabled and mounted. */
+	networkProxy;
+	/** Restores the injected proxy environment (set after a successful bind). */
+	envRestore;
+	/** The authoritative config source: the composition entry, replaced by the settings scope while attached. */
+	configSource;
 	constructor(ctx, config) {
 		this.ctx = ctx;
-		this.config = config;
+		this.configSource = () => config;
+	}
+	/** The currently authoritative config (settings scope or composition entry). */
+	get config() {
+		return this.configSource();
+	}
+	/** Rebind the config source (the settings section hooks call this on attach/detach/change). */
+	setConfigSource(source) {
+		this.configSource = source;
 	}
 	/** The shared compile options derived from config. */
 	compileOptions() {
+		const config = this.configSource();
 		return {
-			patternMode: this.config.patternMode,
-			maxRules: this.config.maxRules,
-			maxGlobStars: this.config.maxGlobStars,
-			caseInsensitivePaths: this.config.caseInsensitivePaths
+			patternMode: config.patternMode,
+			maxRules: config.maxRules,
+			maxGlobStars: config.maxGlobStars,
+			caseInsensitivePaths: config.caseInsensitivePaths
 		};
 	}
 	/**
@@ -1382,11 +2358,16 @@ var PermissionRulesRuntime = class {
 	* The `tools/pre-execute` listener. A deny/ask hit returns the decision
 	* (first match wins, short-circuiting downstream listeners); an allow hit
 	* and a passthrough MUST delegate via `next()` so later listeners keep
-	* their say. Under `enforce: false` (dry-run) a deny/ask hit also
-	* delegates — the record keeps the would-be action with `dryRun: true`
-	* and the actual downstream outcome. Audit is appended once the final
-	* outcome is known, so the recorded `outcome` matches what the waterfall
-	* settled on.
+	* their say. Network-scoped rule hits on tool calls carry the structured
+	* `[network: …]` marker; when NO rule matches a web tool
+	* (`web_fetch`/`web_search`) the network mode default applies (deny-all
+	* denies, whitelist asks/denies, allow-all passes) — shell tools are
+	* NOT gated here, the proxy enforces their traffic per connection.
+	* Under `enforce: false` (dry-run) a deny/ask hit also delegates — the
+	* record keeps the would-be action with `dryRun: true` and the actual
+	* downstream outcome. Audit is appended once the final outcome is
+	* known, so the recorded `outcome` matches what the waterfall settled
+	* on.
 	* @param exec - the pending call (name, parsed arguments, caller agent).
 	* @param next - the downstream chain.
 	* @returns the pre-execute decision.
@@ -1395,26 +2376,52 @@ var PermissionRulesRuntime = class {
 		const cwd = exec.agent?.session.header.cwd ?? process.cwd();
 		const loaded = this.rulesFor(cwd);
 		const hit = matchRules(loaded.compiled, exec.name, exec.arguments, cwd, this.matchContext(exec));
-		if (hit === void 0 || hit.rule.action === "allow") {
-			const decision = await next();
-			this.audit(exec, loaded, hit, decision.kind);
-			return decision;
-		}
-		if (!this.config.enforce) {
-			const decision = await next();
-			this.audit(exec, loaded, hit, decision.kind, true);
-			return decision;
-		}
-		const outcome = hit.rule.action;
-		this.audit(exec, loaded, hit, outcome);
-		if (outcome === "deny") return {
-			kind: "deny",
-			reason: hit.rule.reason
-		};
-		return {
-			kind: "ask",
-			reason: hit.rule.reason
-		};
+		if (hit !== void 0 && hit.rule.action !== "allow") {
+			const reason = hit.rule.network !== void 0 ? `${hit.rule.action === "deny" ? "[network: denied]" : "[network: approval required]"} ${hit.rule.reason}` : hit.rule.reason;
+			if (!this.config.enforce) {
+				const decision = await next();
+				this.audit(exec, loaded, hit, decision.kind, true);
+				return decision;
+			}
+			const outcome = hit.rule.action;
+			this.audit(exec, loaded, hit, outcome);
+			return {
+				kind: outcome,
+				reason
+			};
+		}
+		if (hit === void 0) {
+			const fallback = this.webToolFallback(exec);
+			if (fallback !== void 0) {
+				if (!this.config.enforce) {
+					const decision = await next();
+					this.audit(exec, loaded, void 0, decision.kind, true, fallback);
+					return decision;
+				}
+				this.audit(exec, loaded, void 0, fallback, false, fallback);
+				return {
+					kind: fallback,
+					reason: blockMessage(defaultDecision(this.resolveNetworkMode(exec.agent?.session).mode, this.config.network.unlisted))
+				};
+			}
+		}
+		if (isShellTool(exec.name)) this.markShell(exec);
+		const decision = await next();
+		this.audit(exec, loaded, hit, decision.kind);
+		return decision;
+	}
+	/**
+	* The mode-default decision for an unlisted web-tool call, or undefined
+	* when the policy is disabled, the tool is not a web tool, or the mode
+	* allows. Shell tools always yield undefined here (the proxy decides
+	* their traffic per connection).
+	*/
+	webToolFallback(exec) {
+		const network = this.config.network;
+		if (!network.enabled || isShellTool(exec.name) || !WEB_TOOLS.includes(exec.name)) return void 0;
+		const { mode } = this.resolveNetworkMode(exec.agent?.session);
+		const fallback = defaultDecision(mode, network.unlisted);
+		return fallback.action === "allow" ? void 0 : fallback.action;
 	}
 	/**
 	* Append the log-only `permissionRules/decision` audit event for every
@@ -1428,17 +2435,19 @@ var PermissionRulesRuntime = class {
 	* `allowUnmarkedAudit: true` opts back in. `source` names the matched
 	* rule's file, or the nearest effective file on a passthrough; `cwd`
 	* names the workspace the rules were resolved for; `dryRun` marks
-	* would-be deny/ask hits under `enforce: false`. Agentless calls have no
-	* session to audit; append failures are contained so an audit hiccup can
-	* never change a permission decision.
+	* would-be deny/ask hits under `enforce: false`; `modeDefault` records a
+	* network mode-default decision on a web tool (no rule fired).
+	* Agentless calls have no session to audit; append failures are
+	* contained so an audit hiccup can never change a permission decision.
 	* @param exec - the pending call.
 	* @param loaded - the rules in effect.
 	* @param hit - the first matching rule, or undefined for passthrough.
 	* @param outcome - the final pre-execute decision.
 	* @param dryRun - mark the record as a would-be decision (dry-run mode).
+	* @param modeDefault - the network mode-default action when no rule fired.
 	*/
-	audit(exec, loaded, hit, outcome, dryRun = false) {
-		if (this.config.audit === "hits" && hit === void 0) return;
+	audit(exec, loaded, hit, outcome, dryRun = false, modeDefault) {
+		if (this.config.audit === "hits" && hit === void 0 && modeDefault === void 0) return;
 		const agent = exec.agent;
 		if (agent === void 0) return;
 		if (this.auditSupport === "unsupported") return;
@@ -1451,34 +2460,329 @@ var PermissionRulesRuntime = class {
 			}
 		}
 		try {
+			const action = hit === void 0 ? modeDefault ?? "passthrough" : hit.rule.action;
 			const result = this.appendAudit(agent, {
 				toolName: exec.name,
 				callId: exec.callId,
 				source: hit === void 0 ? loaded.sources[0] ?? "" : loaded.sources[hit.rule.sourceIndex] ?? "",
-				action: hit === void 0 ? "passthrough" : hit.rule.action,
+				action,
 				outcome,
 				cwd: loaded.cwd,
 				...hit !== void 0 ? {
 					ruleIndex: hit.ruleIndex,
 					reason: hit.rule.reason
 				} : {},
+				...modeDefault !== void 0 ? { reason: `${modeDefault === "deny" ? "[network: denied]" : "[network: approval required]"} network mode default (no rule matched)` } : {},
 				...dryRun ? { dryRun: true } : {}
 			});
-			if (this.auditSupport === "unknown" && !this.config.allowUnmarkedAudit) {
-				if (isMarkedAuditEvent(result)) this.auditSupport = "supported";
-				else {
-					this.auditSupport = "unsupported";
-					this.warnUnmarkedAuditHost();
-				}
-			}
+			this.probeAuditResult(result);
 		} catch (error) {
 			this.ctx.logger.warn(`permission-rules: audit append failed: ${String(error)}`);
 		}
 	}
+	/** After the first append, probe the returned envelope for the ignorable marker (host capability detection). */
+	probeAuditResult(result) {
+		if (this.auditSupport === "unknown" && !this.config.allowUnmarkedAudit) {
+			if (isMarkedAuditEvent(result)) this.auditSupport = "supported";
+			else {
+				this.auditSupport = "unsupported";
+				this.warnUnmarkedAuditHost();
+			}
+		}
+	}
 	/** Append one audit event through the session surface; the probe seam for host-capability detection. */
 	appendAudit(agent, data) {
 		return agent.session.append("permissionRules/decision", data, { ignorable: true });
 	}
+	/**
+	* Resolve the network policy mode. An explicit config mode wins; `auto`
+	* maps the official sandbox preset (`read-only` → deny-all,
+	* `workspace-write` → whitelist, `danger-full-access` → allow-all) with
+	* `network.autoFallback` covering hosts without the sandbox-policy
+	* service (rc.6 and friends stay permissive until configured). For web
+	* tools the SESSION's resolved mode is used; the proxy resolves without
+	* a session (its connections carry no session context).
+	* @param session - optional session whose override outranks the default.
+	* @returns the resolved mode plus the sandbox preset it came from.
+	*/
+	resolveNetworkMode(session) {
+		const cfg = this.config.network;
+		if (cfg.mode !== "auto") return {
+			mode: cfg.mode,
+			sandboxMode: void 0
+		};
+		const policy = this.ctx.get("sandboxPolicy");
+		if (policy === void 0) return {
+			mode: cfg.autoFallback,
+			sandboxMode: void 0
+		};
+		const sandboxMode = session === void 0 ? policy.defaultMode : policy.resolve?.({ session })?.mode ?? policy.defaultMode;
+		return {
+			mode: networkModeForSandbox(sandboxMode, cfg.autoFallback),
+			sandboxMode
+		};
+	}
+	/**
+	* The proxy-layer decision for one connection target: first-match
+	* network rules across every loaded workspace chain (insertion order),
+	* then the mode default. Shell subprocess traffic counts as `bash`/
+	* `pwsh` tool candidates; loopback handling follows config.
+	*/
+	decideProxyTarget(target) {
+		const { mode } = this.resolveNetworkMode();
+		return decideNetworkTarget(this.proxyChains(), target, {
+			mode,
+			unlisted: this.config.network.unlisted,
+			loopback: this.config.network.loopback
+		});
+	}
+	/** The loaded rule chains in cache order, nearest workspace first. */
+	proxyChains() {
+		const chains = [];
+		for (const loaded of this.byCwd.values()) chains.push({
+			ruleset: loaded.compiled,
+			sources: loaded.sources
+		});
+		return chains;
+	}
+	/** Mark one delegated shell execution as in-flight (newest attribution wins). */
+	markShell(exec) {
+		this.inFlight.set(String(exec.callId), {
+			tool: exec.name,
+			callId: exec.callId,
+			startedAt: Date.now(),
+			agent: exec.agent
+		});
+	}
+	/** Drop one shell execution when it settles. */
+	unmarkShell(exec) {
+		this.inFlight.delete(String(exec.callId));
+	}
+	/** The newest in-flight shell execution within the TTL, or undefined (best-effort attribution). */
+	proxyAttribution() {
+		const cutoff = Date.now() - IN_FLIGHT_TTL_MS;
+		let newest;
+		for (const entry of this.inFlight.values()) {
+			if (entry.startedAt < cutoff) {
+				this.inFlight.delete(String(entry.callId));
+				continue;
+			}
+			if (newest === void 0 || entry.startedAt > newest.startedAt) newest = entry;
+		}
+		if (newest === void 0) return void 0;
+		return {
+			tool: newest.tool,
+			...newest.callId !== void 0 ? { callId: newest.callId } : {},
+			...newest.agent !== void 0 ? { agent: newest.agent } : {}
+		};
+	}
+	/**
+	* Audit one proxy-layer block: the in-memory record is always kept
+	* (settings page), the logger always warns, and when the block can be
+	* attributed to an agent the `permissionRules/network` event is appended
+	* with the same ignorable-marker discipline as the decision audit.
+	*/
+	auditNetworkBlock(record, attribution) {
+		const agent = attribution?.agent;
+		if (agent === void 0 || this.auditSupport === "unsupported") return;
+		if (this.auditSupport === "unknown" && !this.config.allowUnmarkedAudit) {
+			const version = this.peerVersion();
+			if (version !== null && isUnmarkedHostVersion(version)) {
+				this.auditSupport = "unsupported";
+				this.warnUnmarkedAuditHost();
+				return;
+			}
+		}
+		const data = {
+			kind: "block",
+			tool: record.tool,
+			attributed: record.attributed,
+			...record.callId !== void 0 ? { callId: record.callId } : {},
+			domain: record.domain,
+			...record.scheme !== void 0 ? { scheme: record.scheme } : {},
+			...record.port !== void 0 ? { port: record.port } : {},
+			action: record.action,
+			mode: record.mode,
+			matched: record.matched,
+			source: record.source,
+			...record.ruleIndex !== void 0 ? { ruleIndex: record.ruleIndex } : {},
+			...record.reason !== void 0 ? { reason: record.reason } : {},
+			time: record.time
+		};
+		try {
+			const result = agent.session.append("permissionRules/network", data, { ignorable: true });
+			this.probeAuditResult(result);
+		} catch (error) {
+			this.ctx.logger.warn(`permission-rules: network audit append failed: ${String(error)}`);
+		}
+	}
+	/**
+	* Mount the network proxy and the subprocess environment injection.
+	* Called from {@link apply}; the proxy binds an ephemeral (or
+	* configured) loopback port, the env injection only happens after a
+	* successful bind, and every side effect is owned by an effect
+	* disposer. A bind failure degrades loudly (file rules stay active,
+	* the settings page and `/rules network` show the inactive proxy)
+	* instead of taking the permission plugin down.
+	*/
+	async attachNetworkProxy() {
+		const cfg = this.config.network;
+		const proxy = new NetworkProxy({
+			bind: cfg.proxyBind,
+			port: cfg.proxyPort,
+			maxRecent: cfg.proxyMaxRecent,
+			decide: (target) => this.decideProxyTarget(target),
+			attribution: () => this.proxyAttribution(),
+			onBlock: (record, attribution) => this.auditNetworkBlock(record, attribution),
+			logger: this.ctx.logger
+		});
+		this.networkProxy = proxy;
+		this.ctx.effect(() => () => {
+			proxy.close();
+			this.networkProxy = void 0;
+		});
+		try {
+			const port = await proxy.start();
+			if (cfg.injectEnv) {
+				this.envRestore = injectProxyEnv(port, cfg.noProxy);
+				this.ctx.effect(() => {
+					const restore = this.envRestore;
+					this.envRestore = void 0;
+					return () => restore?.();
+				});
+			}
+			const { mode, sandboxMode } = this.resolveNetworkMode();
+			this.ctx.logger.info(`permission-rules: network proxy listening on ${cfg.proxyBind}:${port} (mode ${mode}${sandboxMode !== void 0 ? `, sandbox ${sandboxMode}` : ""})`);
+		} catch (error) {
+			this.ctx.logger.warn(`permission-rules: network proxy failed to bind on ${cfg.proxyBind}:${cfg.proxyPort} (${String(error)}) — shell network policy is INACTIVE; file/command rules stay active`);
+		}
+	}
+	/**
+	* Apply a live settings change to the network policy: rebind the proxy
+	* when a bind/env-relevant knob changed (old proxy closed, old env
+	* restored, new proxy + env installed). Web-tool gating and the decision
+	* path read the config per call, so they need no rebind.
+	*/
+	async onNetworkConfigChanged() {
+		if (!this.config.network.enabled) return;
+		await this.networkProxy?.close();
+		this.envRestore?.();
+		this.envRestore = void 0;
+		await this.attachNetworkProxy();
+	}
+	/** The network snapshot the settings page and `/rules network` render. */
+	networkSnapshot() {
+		const cfg = this.config.network;
+		const { mode, sandboxMode } = this.resolveNetworkMode();
+		const proxy = this.networkProxy;
+		const stats = proxy?.blockStats() ?? {
+			denied: 0,
+			askBlocked: 0
+		};
+		return {
+			enabled: cfg.enabled,
+			mode,
+			configuredMode: cfg.mode,
+			sandboxMode,
+			proxyPort: proxy?.port ?? 0,
+			proxyActive: proxy !== void 0 && proxy.port > 0,
+			denied: stats.denied,
+			askBlocked: stats.askBlocked,
+			recent: proxy?.recentBlocks() ?? []
+		};
+	}
+	/**
+	* The rule-file paths the settings-page editor may read or write: every
+	* currently loaded source plus the per-workspace project files and the
+	* configured fallback (so a not-yet-existing project file can be
+	* created). The editor never touches arbitrary paths.
+	*/
+	knownRuleSources() {
+		const cfg = this.config;
+		const set = /* @__PURE__ */ new Set();
+		for (const loaded of this.byCwd.values()) {
+			for (const source of loaded.sources) set.add(source);
+			if (!isAbsolute(cfg.rulesFile)) set.add(join(loaded.cwd, cfg.rulesFile));
+		}
+		if (cfg.fallbackPath !== void 0) set.add(isAbsolute(cfg.fallbackPath) ? cfg.fallbackPath : resolve(cfg.fallbackPath));
+		if (isAbsolute(cfg.rulesFile)) set.add(cfg.rulesFile);
+		return [...set];
+	}
+	/** Read one known rule file for the editor: `{ exists, text, error }`. */
+	readRuleFile(path) {
+		if (!this.knownRuleSources().includes(path)) return {
+			path,
+			exists: false,
+			text: "",
+			error: `refusing to read ${path}: not a known rule source`
+		};
+		if (!existsSync(path)) return {
+			path,
+			exists: false,
+			text: ""
+		};
+		try {
+			return {
+				path,
+				exists: true,
+				text: readFileSync(path, "utf8")
+			};
+		} catch (error) {
+			return {
+				path,
+				exists: true,
+				text: "",
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** The workspace a rule source belongs to (for the editor's file list), or undefined for the fallback. */
+	sourceOwner(path) {
+		for (const loaded of this.byCwd.values()) if (loaded.sources.includes(path) || !isAbsolute(this.config.rulesFile) && join(loaded.cwd, this.config.rulesFile) === path) return loaded.cwd;
+	}
+	/** Re-read every cached workspace chain (the settings-page reload action). */
+	reloadAll() {
+		for (const cwd of [...this.byCwd.keys()]) this.reload(cwd);
+	}
+	/**
+	* Validate and write one known rule file. The document must parse and
+	* compile (same checks as a load) BEFORE anything is written — an
+	* invalid edit is rejected with its error and the file stays untouched.
+	* After a successful write every cached workspace reloads so the edit
+	* is in effect immediately.
+	*/
+	saveRuleFile(path, text) {
+		if (!this.knownRuleSources().includes(path)) return {
+			ok: false,
+			error: `refusing to write ${path}: not a known rule source`
+		};
+		try {
+			compileRules(parseRulesDocument(text), this.compileOptions());
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+		try {
+			mkdirSync(dirname(path), { recursive: true });
+			writeFileSync(path, text, "utf8");
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+		let reloaded = 0;
+		for (const cwd of [...this.byCwd.keys()]) {
+			this.reload(cwd);
+			reloaded += 1;
+		}
+		return {
+			ok: true,
+			reloaded
+		};
+	}
 	/** The installed `@deepseek-ai/dsh-session` version, or `null` when unresolvable (falls back to the append probe). */
 	peerVersion() {
 		try {
@@ -1530,6 +2834,13 @@ var PermissionRulesRuntime = class {
 			kind: "error",
 			text: prose.unknownArg(invocation.rawInput.trim())
 		};
+		if (verb === "network") {
+			if (rest.length > 0) return {
+				kind: "error",
+				text: prose.unknownArg(invocation.rawInput.trim())
+			};
+			return this.networkCommand(prose);
+		}
 		if (verb === "decisions") {
 			if (rest.length > 1) return {
 				kind: "error",
@@ -1693,6 +3004,26 @@ var PermissionRulesRuntime = class {
 			text: lines.join("\n")
 		};
 	}
+	/** Render the network policy state: mode mapping, proxy liveness, counters, recent blocks. */
+	networkCommand(prose) {
+		const snapshot = this.networkSnapshot();
+		const lines = [];
+		if (!snapshot.enabled) {
+			lines.push(prose.networkDisabled);
+			return {
+				kind: "success",
+				text: lines.join("\n")
+			};
+		}
+		lines.push(prose.networkHeader(snapshot.mode, snapshot.sandboxMode, snapshot.configuredMode, snapshot.proxyActive, snapshot.proxyPort));
+		lines.push(prose.networkCounters(snapshot.denied, snapshot.askBlocked));
+		if (snapshot.recent.length === 0) lines.push(prose.noNetworkBlocks);
+		else for (const block of snapshot.recent.slice(0, 10)) lines.push(prose.networkBlockLine(block.time, block.tool, block.attributed, block.domain, block.scheme, block.port, block.action, block.matched, block.ruleIndex, block.reason));
+		return {
+			kind: "success",
+			text: lines.join("\n")
+		};
+	}
 	/**
 	* Validate deployment-level file references at mount — the earliest
 	* resolvable point. An absolute `rulesFile` or a configured
@@ -1918,32 +3249,52 @@ var PermissionRulesRuntime = class {
 * @param ctx - the host context.
 * @param config - raw plugin config.
 */
-function apply(ctx, config) {
-	const runtime = new PermissionRulesRuntime(ctx, resolveConfig(config));
+async function apply(ctx, config) {
+	const resolved = resolveConfig(config);
+	const runtime = new PermissionRulesRuntime(ctx, resolved);
 	runtime.validateDeploymentFiles();
 	ctx.provide("permissionRulesRuntime", runtime);
 	ctx.on("tools/pre-execute", (exec, next) => runtime.preExecute(exec, next));
+	ctx.on("tools/post-execute", (exec, _result, next) => {
+		runtime.unmarkShell(exec);
+		return next();
+	});
+	attachSettingsSection(ctx, runtime, config);
+	if (resolved.network.enabled) await runtime.attachNetworkProxy();
+	ctx.inject(["systemPrompt"], (scope) => {
+		const systemPrompt = scope.get("systemPrompt");
+		if (systemPrompt?.context === void 0) return;
+		systemPrompt.context({
+			name: "network:policy",
+			order: 115,
+			text: "Network policy (permission-rules): shell commands reach the network only through a local policy proxy, and web tools are gated the same way — every target is allowed or blocked per the active rules and sandbox mode, and a blocked connection fails with a [network: …] message. Follow the denial messages and do not attempt to bypass the proxy."
+		});
+	});
+	await ctx.plugin(PermissionRulesRemoteService, { runtime });
 	ctx.commands.register({
 		name: "rules",
-		description: "list, reload, audit, or dry-test the active permission rules for this workspace",
-		input: { hint: "[list | reload | decisions [n] | test [--cwd <dir>] [--env K=V] [--agent <sel>] [--platform <name>] <tool> <json-args>]" },
+		description: "list, reload, audit, dry-test, or inspect the network policy of the active permission rules for this workspace",
+		input: { hint: "[list | reload | network | decisions [n] | test [--cwd <dir>] [--env K=V] [--agent <sel>] [--platform <name>] <tool> <json-args>]" },
 		handler: (invocation) => runtime.command(invocation)
 	});
 }
 /**
 * Whether a `@deepseek-ai/dsh-session` version line predates the
-* `ignorable` envelope-marker surface: the `0.1.0-rc.6` line and earlier
-* silently drop the marker from `Session.append` options, so audit events
-* written by those builds land unmarked and break resume on stricter
-* hosts. Non-matching (post-rc.6, stable, or unresolvable) versions are
-* treated as possibly-marker-aware and verified by the append probe.
+* `ignorable` envelope-marker surface: every released rc line through
+* `0.1.0-rc.7` silently drops the marker from `Session.append` options
+* (the stamping fix exists on harness master only — no release carries it
+* yet), so audit events written by those builds land unmarked and break
+* resume on stricter hosts. Extend the bound when a new rc line ships that
+* still drops the marker. Non-matching (later rc, stable, or unresolvable)
+* versions are treated as possibly-marker-aware and verified by the
+* append probe.
 * @param version - the installed peer version string.
-* @returns true for the known-unmarked rc.1–rc.6 lines.
+* @returns true for the known-unmarked rc.1–rc.7 lines.
 */
 function isUnmarkedHostVersion(version) {
 	const match = /^0\.1\.0-rc\.(\d+)$/.exec(version.trim());
 	if (match === null) return false;
-	return Number(match[1]) <= 6;
+	return Number(match[1]) <= 7;
 }
 /**
 * Identity candidates for the `agents` match dimension, derived from the
@@ -2020,4 +3371,4 @@ function nextToken(text) {
 const name = "permission-rules";
 const inject = ["commands", "tools"];
 //#endregion
-export { Config, GlobError, PATH_CANDIDATE_KEYS, PLATFORMS, PermissionRulesRuntime, RULE_ACTIONS, RuleError, apply, compileGlob, compilePatternRegex, compileRules, compileRulesChain, describeRule, extractPathCandidates, findUnreachableRules, inject, isMarkedAuditEvent, isUnmarkedHostVersion, matchRules, name, normalizeWorkspacePath, parseRulesDocument, resolveConfig };
+export { Config, GlobError, NETWORK_MODES, NO_PROXY_ENV_NAMES, NetworkProxy, PATH_CANDIDATE_KEYS, PLATFORMS, PROXY_ENV_NAMES, PermissionRulesRuntime, RULE_ACTIONS, RuleError, SCHEMES, URL_CANDIDATE_KEYS, apply, blockMessage, compileGlob, compilePatternRegex, compileRules, compileRulesChain, decideNetworkTarget, defaultDecision, describeRule, extractPathCandidates, extractUrlCandidates, findUnreachableRules, inject, injectProxyEnv, isIpLiteral, isLoopbackTarget, isMarkedAuditEvent, isShellTool, isUnmarkedHostVersion, matchRules, matchTools, matchWhen, name, networkModeForSandbox, normalizeWorkspacePath, parseRulesDocument, parseUrlTarget, resolveConfig, targetMatchesNetwork };