dsh-permission-rules 0.6.21 → 0.7.0

package/lib/index.js

@@ -4,11 +4,11 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import chokidar from "chokidar";
 import z from "@deepseek-ai/schemastery";
-import { parse } from "yaml";
+import { isMap, isSeq, parse, parseDocument } from "yaml";
 import { fileURLToPath } from "node:url";
+import { connect, isIP } from "node:net";
 import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
-import { connect } from "node:net";
 import { lookup } from "node:dns/promises";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 //#region src/glob.ts
@@ -1223,7 +1223,16 @@ function tryParseHttpUrl(text) {
 		ips: literalIpOf(host)
 	};
 }
-/** Lowercase, strip IPv6 brackets, strip one trailing dot. */
+/**
+* Lowercase, strip IPv6 brackets, strip one trailing dot.
+*
+* Exported because the settings-page allow action must normalize a blocked
+* host EXACTLY the way target parsing does, or a rule generated from a block
+* record could name a different host than the connection that was blocked
+* (`Example.COM.` and `example.com` are the same target).
+* @param host - a host name or IP literal as it arrived on the wire.
+* @returns the canonical spelling.
+*/
 function normalizeHost(host) {
 	let out = host.toLowerCase().replace(/^\[|\]$/g, "");
 	while (out.endsWith(".")) out = out.slice(0, -1);
@@ -1669,7 +1678,9 @@ const Config = z.object({
 		proxyMaxRecent: z.number().default(100),
 		loopback: z.union(["allow", "policy"]).default("allow"),
 		injectEnv: z.boolean().default(true),
-		noProxy: z.union(["clear", "preserve"]).default("clear")
+		noProxy: z.union(["clear", "preserve"]).default("clear"),
+		upstreamProxy: z.string().default("off"),
+		allowHostAction: z.boolean().default(true)
 	}),
 	builtin: z.object({
 		enabled: z.boolean().default(true),
@@ -1758,12 +1769,15 @@ function resolveNetworkConfig(raw) {
 	assertEnum("network.noProxy", noProxy, ["clear", "preserve"]);
 	assertBoolean("network.enabled", raw?.enabled ?? true);
 	assertBoolean("network.injectEnv", raw?.injectEnv ?? true);
+	assertBoolean("network.allowHostAction", raw?.allowHostAction ?? true);
 	const proxyBind = raw?.proxyBind ?? "127.0.0.1";
 	if (typeof proxyBind !== "string" || proxyBind.trim().length === 0) throw new TypeError(`network.proxyBind must be a non-empty string, got ${typeof proxyBind}`);
 	const proxyPort = raw?.proxyPort ?? 0;
 	if (!Number.isSafeInteger(proxyPort) || proxyPort < 0 || proxyPort > 65535) throw new TypeError(`network.proxyPort must be an integer 0-65535, got ${String(raw?.proxyPort)}`);
 	const proxyMaxRecent = raw?.proxyMaxRecent ?? 100;
 	if (!Number.isSafeInteger(proxyMaxRecent) || proxyMaxRecent <= 0) throw new TypeError(`network.proxyMaxRecent must be a positive safe integer, got ${String(raw?.proxyMaxRecent)}`);
+	const upstreamProxy = raw?.upstreamProxy ?? "off";
+	assertUpstreamProxy(upstreamProxy);
 	return {
 		enabled: raw?.enabled ?? true,
 		mode,
@@ -1774,9 +1788,33 @@ function resolveNetworkConfig(raw) {
 		proxyMaxRecent,
 		loopback,
 		injectEnv: raw?.injectEnv ?? true,
-		noProxy
+		noProxy,
+		upstreamProxy,
+		allowHostAction: raw?.allowHostAction ?? true
 	};
 }
+/**
+* Throw unless `value` is `off`, `inherit`, or a usable http(s) proxy URL.
+*
+* Node has no SOCKS client, and the harness's own policy refuses a proxy URL it
+* cannot express for a scheme, so a SOCKS value is rejected at the mount with an
+* actionable message instead of failing at connect time. `''` is rejected too:
+* an empty string reads as "no upstream" but silently disables chaining.
+*/
+function assertUpstreamProxy(value) {
+	const invalid = (detail) => /* @__PURE__ */ new TypeError(`network.upstreamProxy must be "off" | "inherit" | an http(s) proxy URL, got ${JSON.stringify(value)}${detail}`);
+	if (value === "off" || value === "inherit") return;
+	if (typeof value !== "string" || value.trim().length === 0) throw invalid("");
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		parsed = void 0;
+	}
+	if (parsed === void 0) throw invalid("");
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw invalid(` (${parsed.protocol}// is not supported: Node has no SOCKS client, so give an http:// or https:// proxy)`);
+	if (parsed.hostname.length === 0) throw invalid(" (it must name a host)");
+}
 /** Throw unless `key` is one of `allowed` (TypeScript's closed enums are not runtime checks). */
 function assertEnum(key, value, allowed) {
 	if (!allowed.includes(value)) throw new TypeError(`${key} must be one of ${allowed.map((item) => JSON.stringify(item)).join(" | ")}, got ${JSON.stringify(value)}`);
@@ -1786,6 +1824,210 @@ function assertBoolean(key, value) {
 	if (typeof value !== "boolean") throw new TypeError(`${key} must be a boolean, got ${typeof value}`);
 }
 //#endregion
+//#region src/allow-host.ts
+/**
+* The settings-page "allow this host" action, as pure pieces: normalizing
+* and validating a blocked host, inserting ONE minimal
+* `match.network.domains` allow rule at the HEAD of a rule document, choosing
+* which rule file the rule belongs in, and mapping the action's result onto
+* the notice the page renders.
+*
+* Three invariants hold here and are asserted by `test/allow-host.spec.ts`:
+*
+* 1. the rule is inserted at index 0 — rules are first-match-wins, so a rule
+*    appended after an existing `deny` would be dead text;
+* 2. a document the yaml parser reports an error for, or whose `rules` is not
+*    a list, is REFUSED (a {@link RuleError}) — the caller never overwrites a
+*    file it could not read; and
+* 3. the insertion goes through the yaml Document API (`parseDocument` +
+*    `createNode` + `items.unshift` + `String(doc)`), so comments and the
+*    existing formatting of the untouched rules survive.
+*
+* Nothing here reads the filesystem or the process cwd: the runtime injects
+* `exists`, `processCwd`, and the source lists it already computed, which is
+* what makes the target choice testable without touching a real host.
+* @module dsh-permission-rules/allow-host
+*/
+/**
+* Why a generated rule may legitimately live in a rule file the parser would
+* reject: it is not one — every write goes back through the same
+* `parseRulesDocument` + `compileRules` gate as a hand edit.
+*/
+const RULE_REASON_SUFFIX = "(added from the settings page)";
+/**
+* A DNS-ish host: dot-separated labels of ASCII letters/digits/`-`/`_`, each
+* starting and ending with an alphanumeric. Deliberately narrow — the action
+* writes an EXACT host, so glob metacharacters (`*`), whitespace, `#`, `:`,
+* `[`, quotes and anything else that could make the generated scalar mean
+* something other than "this one host" are refused instead of escaped.
+*/
+const HOSTNAME_SHAPE = /^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?)*$/;
+/** Longest a host name (or an IP literal) may be; also bounds the generated rule. */
+const MAX_HOST_LENGTH = 253;
+/**
+* Canonical spelling of a host for the allow action, matching target parsing
+* exactly (see `normalizeHost`): lowercase, IPv6 brackets stripped, one
+* trailing dot stripped.
+* @param host - the host as the block record reported it.
+* @returns the canonical spelling.
+*/
+function normalizeAllowHost(host) {
+	return normalizeHost(host);
+}
+/**
+* Whether a normalized host may be written into a rule: a host name or an IP
+* literal, nothing else. This is the syntactic half of the action's safety —
+* a newline, a `rules:` fragment, a glob, a URL, or a `host:port` authority is
+* refused here rather than relying on the YAML emitter to quote it. The IP
+* check is `node:net`'s `isIP`, so a `host:port` string (which merely contains
+* a colon) is not mistaken for an IPv6 literal.
+* @param host - the normalized host.
+* @returns true when the host may be allowed.
+*/
+function isWritableHost(host) {
+	if (host.length === 0 || host.length > MAX_HOST_LENGTH) return false;
+	if (isIP(host) !== 0) return true;
+	return HOSTNAME_SHAPE.test(host);
+}
+/**
+* The `reason` carried by every generated rule. English on purpose: rule
+* `reason`s are never translated (they are quoted verbatim in denial messages
+* and in the session audit), so a localized reason would make one rule read
+* differently per UI language.
+* @param host - the allowed host.
+* @returns the reason line.
+*/
+function allowHostReason(host) {
+	return `Allow ${host} ${RULE_REASON_SUFFIX}`;
+}
+/**
+* Insert the minimal allow rule for `host` at the HEAD of a rule document.
+*
+* `inserted: false` (with the input text returned unchanged) means the first
+* rule of the file is ALREADY this exact allow — first-match semantics make a
+* second copy do nothing, so the caller must not rewrite the file (repeated
+* clicks would otherwise pile up duplicate lines in the user's git diff).
+*
+* @param text - the current file text (empty for a file to be created).
+* @param host - the normalized, validated host.
+* @returns the text to write plus whether anything was added.
+* @throws RuleError when the document cannot be parsed or has no `rules` list.
+*/
+function insertAllowRule(text, host) {
+	const normalized = normalizeAllowHost(host);
+	const doc = parseDocument(text);
+	if (doc.errors.length > 0) throw new RuleError(`cannot edit the rule file: ${doc.errors[0]?.message ?? "invalid YAML"}`);
+	const rule = {
+		match: { network: { domains: [normalized] } },
+		action: "allow",
+		reason: allowHostReason(normalized)
+	};
+	if (doc.contents === null) {
+		doc.set("rules", doc.createNode([rule]));
+		return {
+			text: String(doc),
+			inserted: true
+		};
+	}
+	if (!isMap(doc.contents)) throw new RuleError("cannot edit the rule file: the document root must be a mapping with a \"rules\" list");
+	if (!doc.has("rules")) throw new RuleError("cannot edit the rule file: the document has no \"rules\" list");
+	const rules = doc.get("rules");
+	if (!isSeq(rules)) throw new RuleError("cannot edit the rule file: \"rules\" must be a list");
+	if (headAllowHost(rules) === normalized) return {
+		text,
+		inserted: false
+	};
+	rules.items.unshift(doc.createNode(rule));
+	return {
+		text: String(doc),
+		inserted: true
+	};
+}
+/**
+* The host of the first rule, when that rule is exactly the allow rule this
+* action generates: `action: allow`, enabled, and a `match` whose only
+* dimension is a single `network.domains` entry. Anything else — a different
+* action, a disabled rule, or a rule narrowed by ports/schemes/tools/agents —
+* returns undefined, so an existing narrower rule can never make the action
+* skip the write that would actually unblock the connection.
+* @param rules - the parsed `rules` sequence.
+* @returns the normalized head host, or undefined.
+*/
+function headAllowHost(rules) {
+	const first = rules.items[0];
+	if (!isMap(first)) return void 0;
+	const record = first.toJSON();
+	if (typeof record !== "object" || record === null || Array.isArray(record)) return void 0;
+	const rule = record;
+	if (rule["action"] !== "allow" || rule["enabled"] === false) return void 0;
+	const match = rule["match"];
+	if (typeof match !== "object" || match === null || Array.isArray(match)) return void 0;
+	const dimensions = Object.keys(match);
+	if (dimensions.length !== 1 || dimensions[0] !== "network") return void 0;
+	const network = match["network"];
+	if (typeof network !== "object" || network === null || Array.isArray(network)) return void 0;
+	const scopes = Object.keys(network);
+	if (scopes.length !== 1 || scopes[0] !== "domains") return void 0;
+	const domains = network["domains"];
+	if (!Array.isArray(domains) || domains.length !== 1) return void 0;
+	const only = domains[0];
+	return typeof only === "string" ? normalizeAllowHost(only) : void 0;
+}
+/**
+* The one rule file this action may write for a request: the nearest file of
+* the chain that will actually judge the connection.
+*
+* With a workspace cwd the target is that workspace's project file (the
+* absolute `rulesFile` when one is configured), and the cwd must be a
+* workspace whose chain is loaded — an unknown cwd is refused instead of being
+* turned into a path.
+*
+* Without one, the order mirrors `resolveUserSources(process.cwd())` exactly,
+* so the file written is the file the host chain reads: the absolute
+* `rulesFile`, else `<processCwd>/<rulesFile>` when it already exists, else
+* the configured fallback, else `<processCwd>/<rulesFile>` (created — the
+* host chain picks it up on the next load).
+*
+* The result must be a known rule source and must never be the built-in
+* baseline.
+*
+* @param input - the injected config, cwd, and source state.
+* @returns the absolute path to write.
+* @throws RuleError when the request names an unknown workspace or resolves to
+*   a path outside the writable set.
+*/
+function resolveAllowHostTarget(input) {
+	const target = input.cwd === null ? hostTarget(input) : workspaceTarget(input, input.cwd);
+	if (input.builtinPath !== void 0 && samePath(target, input.builtinPath)) throw new RuleError(`refusing to write ${target}: the built-in ruleset is read-only`);
+	if (!input.knownSources.some((source) => samePath(source, target))) throw new RuleError(`refusing to write ${target}: not a known rule source`);
+	return target;
+}
+/** The project file of one workspace (the absolute `rulesFile` when one is configured). */
+function projectFile(rulesFile, cwd) {
+	return isAbsolute(rulesFile) ? rulesFile : join(cwd, rulesFile);
+}
+/** The target for a request that named a workspace. */
+function workspaceTarget(input, cwd) {
+	const owner = input.loadedCwds.find((loaded) => samePath(loaded, cwd));
+	if (owner === void 0) throw new RuleError(`refusing to allow for ${JSON.stringify(cwd)}: not a workspace whose rules are loaded`);
+	return projectFile(input.rulesFile, owner);
+}
+/** The target for a host-level (session-less) request — the same order the host chain resolves in. */
+function hostTarget(input) {
+	if (isAbsolute(input.rulesFile)) return input.rulesFile;
+	const project = join(input.processCwd, input.rulesFile);
+	if (input.exists(project)) return project;
+	const fallback = input.fallbackPath;
+	if (fallback === void 0) return project;
+	return isAbsolute(fallback) ? fallback : resolve(fallback);
+}
+/** Path equality as the per-workspace cache key treats it: resolved, and case-folded on Windows. */
+function samePath(a, b) {
+	const left = resolve(a);
+	const right = resolve(b);
+	return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+//#endregion
 //#region src/prose.ts
 /** Truncate long reasons/descriptions in one-line displays. */
 function short(text, limit = 120) {
@@ -1820,6 +2062,7 @@ const EN = {
 	networkDisabled: "Network policy disabled (network.enabled: false): no proxy, no web-tool mode defaults.",
 	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Network policy: mode ${mode}${sandboxMode === void 0 ? "" : ` (sandbox preset ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configured ${configuredMode})`}; proxy ${proxyActive ? `active on 127.0.0.1:${proxyPort}` : "INACTIVE (bind failed — shell network policy is not enforced)"}.`,
 	networkCounters: (denied, askBlocked) => `Blocks: ${denied} denied, ${askBlocked} ask-blocked.`,
+	networkUpstream: (mode, http, https, active, chained) => `Upstream: ${mode}${http === null ? "" : ` http ${http}`}${https === null ? "" : ` https ${https}`}${active ? "" : " (inactive)"}, ${chained} chained.`,
 	noNetworkBlocks: "No network blocks recorded yet.",
 	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
 		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (unattributed)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (rule ${ruleIndex + 1})` : " (mode default)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
@@ -1854,6 +2097,7 @@ const ZH = {
 	networkDisabled: "网络策略已停用（network.enabled: false）：无代理、无 web 工具模式默认裁决。",
 	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `网络策略：模式 ${mode}${sandboxMode === void 0 ? "" : `（沙箱预设 ${sandboxMode}）`}${configuredMode === "auto" ? "" : `（显式配置 ${configuredMode}）`}；代理${proxyActive ? `运行于 127.0.0.1:${proxyPort}` : "未激活（绑定失败——shell 网络策略未生效）"}。`,
 	networkCounters: (denied, askBlocked) => `拦截：拒绝 ${denied} 次，待审批阻断 ${askBlocked} 次。`,
+	networkUpstream: (mode, http, https, active, chained) => `上游：${mode}${http === null ? "" : ` http ${http}`}${https === null ? "" : ` https ${https}`}${active ? "" : "（未生效）"}，已链式 ${chained} 条。`,
 	noNetworkBlocks: "尚未记录任何网络拦截。",
 	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
 		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : "（未归属）"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : `（规则 ${ruleIndex + 1}）` : "（模式默认）"}${reason === void 0 ? "" : `：${short(reason)}`}`;
@@ -1888,6 +2132,7 @@ const ES = {
 	networkDisabled: "Política de red desactivada (network.enabled: false): sin proxy, sin valores predeterminados de modo para herramientas web.",
 	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Política de red: modo ${mode}${sandboxMode === void 0 ? "" : ` (preset sandbox ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configurado ${configuredMode})`}; proxy ${proxyActive ? `activo en 127.0.0.1:${proxyPort}` : "INACTIVO (fallo de bind — la política de red de shell no se aplica)"}.`,
 	networkCounters: (denied, askBlocked) => `Bloqueos: ${denied} denegados, ${askBlocked} bloqueados por aprobación.`,
+	networkUpstream: (mode, http, https, active, chained) => `Upstream: ${mode}${http === null ? "" : ` http ${http}`}${https === null ? "" : ` https ${https}`}${active ? "" : " (inactivo)"}, ${chained} encadenadas.`,
 	noNetworkBlocks: "Aún no se han registrado bloqueos de red.",
 	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
 		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (sin atribuir)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (regla ${ruleIndex + 1})` : " (modo predeterminado)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
@@ -1922,6 +2167,7 @@ const PT = {
 	networkDisabled: "Política de rede desativada (network.enabled: false): sem proxy, sem padrões de modo para ferramentas web.",
 	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `Política de rede: modo ${mode}${sandboxMode === void 0 ? "" : ` (preset sandbox ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (configurado ${configuredMode})`}; proxy ${proxyActive ? `ativo em 127.0.0.1:${proxyPort}` : "INATIVO (falha de bind — a política de rede do shell não está ativa)"}.`,
 	networkCounters: (denied, askBlocked) => `Bloqueios: ${denied} negados, ${askBlocked} bloqueados por aprovação.`,
+	networkUpstream: (mode, http, https, active, chained) => `Upstream: ${mode}${http === null ? "" : ` http ${http}`}${https === null ? "" : ` https ${https}`}${active ? "" : " (inativo)"}, ${chained} encadeadas.`,
 	noNetworkBlocks: "Nenhum bloqueio de rede registrado ainda.",
 	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
 		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (não atribuído)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (regra ${ruleIndex + 1})` : " (modo padrão)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
@@ -1956,6 +2202,7 @@ const HI = {
 	networkDisabled: "नेटवर्क नीति अक्षम (network.enabled: false): कोई प्रॉक्सी नहीं, कोई वेब-टूल मोड डिफ़ॉल्ट नहीं।",
 	networkHeader: (mode, sandboxMode, configuredMode, proxyActive, proxyPort) => `नेटवर्क नीति: मोड ${mode}${sandboxMode === void 0 ? "" : ` (सैंडबॉक्स प्रीसेट ${sandboxMode})`}${configuredMode === "auto" ? "" : ` (कॉन्फ़िगर किया ${configuredMode})`}; प्रॉक्सी ${proxyActive ? `सक्रिय 127.0.0.1:${proxyPort} पर` : "निष्क्रिय (बाइंड विफल — शेल नेटवर्क नीति लागू नहीं)"}।`,
 	networkCounters: (denied, askBlocked) => `ब्लॉक: ${denied} अस्वीकृत, ${askBlocked} अनुमोदन-ब्लॉक।`,
+	networkUpstream: (mode, http, https, active, chained) => `Upstream: ${mode}${http === null ? "" : ` http ${http}`}${https === null ? "" : ` https ${https}`}${active ? "" : " (निष्क्रिय)"}, ${chained} श्रृंखलित।`,
 	noNetworkBlocks: "अभी तक कोई नेटवर्क ब्लॉक दर्ज नहीं हुआ।",
 	networkBlockLine: (time, tool, attributed, domain, scheme, port, action, matched, ruleIndex, reason) => {
 		return `- ${new Date(time).toISOString()} ${action} ${`${tool}${attributed ? "" : " (असाइन नहीं)"}`} → ${`${scheme ?? "?"}://${domain}${port === void 0 ? "" : `:${port}`}`}${matched ? ruleIndex === void 0 ? "" : ` (नियम ${ruleIndex + 1})` : " (मोड डिफ़ॉल्ट)"}${reason === void 0 ? "" : `: ${short(reason)}`}`;
@@ -2096,6 +2343,65 @@ const PROXY_ENV_NAMES = [
 ];
 /** NO_PROXY names cleared (or preserved) by the injector. */
 const NO_PROXY_ENV_NAMES = ["NO_PROXY", "no_proxy"];
+/** How long a chained CONNECT waits for the upstream to answer before it gives up. */
+const UPSTREAM_CONNECT_TIMEOUT_MS = 1e4;
+/**
+* Resolve ambient upstream candidates the way the harness's own proxy policy
+* does: the scheme-specific name (lowercase first, blank treated as unset),
+* then `ALL_PROXY`, then — for https only — the http name. A value that is not
+* a parseable `http(s)://` URL is dropped here; the runtime reports those once.
+* @param lookup - reads one environment name (the launch snapshot, or `process.env`).
+* @returns the usable candidates, each absent when it is unusable.
+*/
+function readAmbientProxy(lookup) {
+	const pick = (names) => {
+		for (const name of names) {
+			const value = lookup(name);
+			if (value !== void 0 && value.trim().length > 0) return value.trim();
+		}
+	};
+	const usable = (value) => {
+		if (value === void 0) return void 0;
+		try {
+			const parsed = new URL(value);
+			return parsed.protocol === "http:" || parsed.protocol === "https:" ? value : void 0;
+		} catch {
+			return;
+		}
+	};
+	const all = usable(pick(["ALL_PROXY", "all_proxy"]));
+	const http = usable(pick(["http_proxy", "HTTP_PROXY"])) ?? all;
+	const https = usable(pick(["https_proxy", "HTTPS_PROXY"])) ?? all ?? http;
+	return {
+		...http === void 0 ? {} : { http },
+		...https === void 0 ? {} : { https }
+	};
+}
+/**
+* The loggable form of a proxy URL: the password is replaced, everything else
+* is kept verbatim. An upstream URL may carry credentials, and a proxy URL is
+* printed in warnings, `/rules network` and the settings snapshot, so it must
+* never be emitted raw.
+* @param value - the configured upstream URL.
+* @returns the same URL with its password masked, or the input when unparseable.
+*/
+function redactProxyUrl(value) {
+	try {
+		const parsed = new URL(value);
+		if (parsed.username === "" && parsed.password === "") return value;
+		const user = parsed.username;
+		const auth = parsed.password === "" ? `${user}@` : `${user}:***@`;
+		return `${parsed.protocol}//${auth}${parsed.host}`;
+	} catch {
+		return value;
+	}
+}
+/** The `Proxy-Authorization` value for an upstream URL carrying userinfo. */
+function proxyAuthorization(url) {
+	if (url.username === "" && url.password === "") return void 0;
+	const credentials = `${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`;
+	return `Basic ${Buffer.from(credentials).toString("base64")}`;
+}
 /**
 * The local HTTP/CONNECT policy proxy. Binds on demand (the plugin calls
 * {@link start} inside an effect and {@link close} from its disposer);
@@ -2112,9 +2418,14 @@ var NetworkProxy = class {
 		askBlocked: 0
 	};
 	actualPort = 0;
+	chained = 0;
 	constructor(options) {
 		this.options = options;
 	}
+	/** Connections dispatched through the configured upstream since mount. */
+	chainedConnections() {
+		return this.chained;
+	}
 	/** The bound port (valid after {@link start} resolves). */
 	get port() {
 		return this.actualPort;
@@ -2166,6 +2477,75 @@ var NetworkProxy = class {
 			server.close(() => resolve());
 		});
 	}
+	/**
+	* The upstream one ALLOWED connection may be chained through, or undefined to
+	* dial directly. Three vetoes, in order:
+	*
+	* 1. a loopback target never chains — a proxy outside this host cannot route
+	*    its loopback, and the harness's own policy bypasses loopback for the same
+	*    reason;
+	* 2. an `ips`-scoped decision never chains — chaining hands the hostname to
+	*    the upstream, so "the connection lands on an address the rules saw"
+	*    (the issue #21 invariant) would stop holding exactly where the rules
+	*    cared about the address;
+	* 3. no usable upstream for the target's scheme.
+	*
+	* A blocked connection never reaches this method: it is called only on the
+	* `allow` branch, after the decision is final.
+	* @param target - the adjudicated target.
+	* @param decision - the decision that allowed it.
+	* @returns the upstream URL to chain through, or undefined.
+	*/
+	upstreamRouteFor(target, decision) {
+		const ambient = this.options.upstream?.();
+		if (ambient === void 0) return void 0;
+		if (isLoopbackTarget(target)) return void 0;
+		const ipsScope = decision.rule?.source.match.network?.ips;
+		if (ipsScope !== void 0 && ipsScope.length > 0) return void 0;
+		return (target.scheme ?? "http") === "https" ? ambient.https : ambient.http;
+	}
+	/**
+	* Open a tunnel by asking the upstream for one, and hand back the socket it
+	* established. The upstream's own hostname is resolved by the system: it is
+	* operator configuration, not agent input, so it takes no part in rule
+	* adjudication and is outside the adjudicated-address invariant.
+	* @param upstream - the upstream proxy URL.
+	* @param authority - the `host:port` to ask for (IPv6 already bracketed).
+	* @returns the established tunnel socket.
+	*/
+	connectViaUpstream(upstream, authority) {
+		return new Promise((resolve, reject) => {
+			const via = new URL(upstream);
+			const send = via.protocol === "https:" ? request$1 : request;
+			const headers = { host: authority };
+			const auth = proxyAuthorization(via);
+			if (auth !== void 0) headers["proxy-authorization"] = auth;
+			const req = send({
+				host: via.hostname,
+				port: via.port === "" ? via.protocol === "https:" ? 443 : 80 : Number(via.port),
+				method: "CONNECT",
+				path: authority,
+				headers
+			});
+			req.setTimeout(UPSTREAM_CONNECT_TIMEOUT_MS, () => {
+				req.destroy(/* @__PURE__ */ new Error("upstream CONNECT timed out"));
+			});
+			req.on("connect", (response, socket) => {
+				const status = response.statusCode ?? 0;
+				if (status >= 200 && status < 300) resolve(socket);
+				else {
+					socket.destroy();
+					reject(/* @__PURE__ */ new Error(`upstream answered ${String(status)}`));
+				}
+			});
+			req.on("response", (response) => {
+				response.resume();
+				reject(/* @__PURE__ */ new Error(`upstream answered ${String(response.statusCode ?? 0)}`));
+			});
+			req.on("error", reject);
+			req.end();
+		});
+	}
 	/** Plain-HTTP proxying: absolute-form requests are adjudicated and forwarded (or blocked with a structured 403). */
 	async handleRequest(req, res) {
 		const target = parseUrlTarget(req.url ?? "");
@@ -2186,16 +2566,34 @@ var NetworkProxy = class {
 			return;
 		}
 		const upstream = new URL(req.url);
-		const send = upstream.protocol === "https:" ? request$1 : request;
-		const pinned = pinnedAddresses(adjudicated);
-		const proxyReq = send(upstream, {
-			method: req.method,
-			headers: req.headers,
-			...pinned.length === 0 ? {} : { lookup: pinnedLookup(pinned) }
-		}, (proxyRes) => {
+		const onResponse = (proxyRes) => {
 			res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
 			proxyRes.pipe(res);
-		});
+		};
+		const chained = this.upstreamRouteFor(adjudicated, decision);
+		let proxyReq;
+		if (chained === void 0) {
+			const pinned = pinnedAddresses(adjudicated);
+			const options = {
+				method: req.method,
+				headers: req.headers,
+				...pinned.length === 0 ? {} : { lookup: pinnedLookup(pinned) }
+			};
+			proxyReq = (upstream.protocol === "https:" ? request$1 : request)(upstream, options, onResponse);
+		} else {
+			const via = new URL(chained);
+			const headers = { ...req.headers };
+			const auth = proxyAuthorization(via);
+			if (auth !== void 0) headers["proxy-authorization"] = auth;
+			proxyReq = (via.protocol === "https:" ? request$1 : request)({
+				host: via.hostname,
+				port: via.port === "" ? via.protocol === "https:" ? 443 : 80 : Number(via.port),
+				method: req.method,
+				path: req.url,
+				headers
+			}, onResponse);
+			this.chained += 1;
+		}
 		proxyReq.on("error", (error) => {
 			if (!res.headersSent) {
 				res.writeHead(502, { "content-type": "text/plain" });
@@ -2258,10 +2656,12 @@ var NetworkProxy = class {
 			return;
 		}
 		let tunnel;
+		const chained = this.upstreamRouteFor(adjudicated, decision);
 		try {
-			tunnel = await this.connectUpstream(adjudicated, target.port ?? 443);
+			tunnel = chained === void 0 ? await this.connectUpstream(adjudicated, target.port ?? 443) : await this.connectViaUpstream(chained, target.host.includes(":") ? `[${target.host}]:${String(target.port ?? 443)}` : `${target.host}:${String(target.port ?? 443)}`);
+			if (chained !== void 0) this.chained += 1;
 		} catch (error) {
-			this.options.logger.warn(`permission-rules: upstream connect failed for ${target.host}: ${String(error)}`);
+			this.options.logger.warn(`permission-rules: upstream connect failed for ${target.host}: ${String(error)}${chained === void 0 ? "" : ` (via ${redactProxyUrl(chained)})`}`);
 			socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
 			return;
 		}
@@ -2306,6 +2706,7 @@ var NetworkProxy = class {
 	/** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */
 	recordBlock(decision, target) {
 		const attribution = this.options.attribution?.();
+		const cwd = attribution?.agent?.session.header.cwd;
 		const record = {
 			time: Date.now(),
 			tool: attribution?.tool ?? "subprocess",
@@ -2319,7 +2720,8 @@ var NetworkProxy = class {
 			matched: decision.matched,
 			source: decision.source ?? "",
 			...decision.ruleIndex !== void 0 ? { ruleIndex: decision.ruleIndex } : {},
-			...decision.rule !== void 0 ? { reason: decision.rule.reason } : {}
+			...decision.rule !== void 0 ? { reason: decision.rule.reason } : {},
+			...cwd !== void 0 ? { cwd } : {}
 		};
 		if (record.action === "deny") this.stats.denied += 1;
 		else this.stats.askBlocked += 1;
@@ -2466,9 +2868,18 @@ var PermissionRulesRemoteService = class extends TypertRemoteService {
 				matched: block.matched,
 				source: block.source,
 				ruleIndex: block.ruleIndex ?? null,
-				reason: block.reason ?? null
+				reason: block.reason ?? null,
+				cwd: block.cwd ?? null
 			})),
-			sources
+			sources,
+			allowHostAction: snapshot.allowHostAction,
+			upstream: {
+				mode: snapshot.upstream.mode,
+				http: snapshot.upstream.http,
+				https: snapshot.upstream.https,
+				active: snapshot.upstream.active,
+				chained: snapshot.upstream.chained
+			}
 		};
 	}
 	/** Read one known rule file for the editor. */
@@ -2505,6 +2916,28 @@ var PermissionRulesRemoteService = class extends TypertRemoteService {
 			};
 		}
 	}
+	/**
+	* Write one minimal allow rule for a blocked host into the nearest
+	* effective rule file (the settings page's per-block action). The runtime
+	* owns the whole decision — which file, index 0, the validation gate, the
+	* reload — and never throws; the try/catch is the same containment
+	* `reload()` uses so the page always receives a well-formed result.
+	*/
+	allowHost(request) {
+		try {
+			return this.config.runtime.allowHost(request);
+		} catch (error) {
+			return {
+				ok: false,
+				path: null,
+				created: false,
+				reloaded: 0,
+				outcome: null,
+				alreadyAllowed: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
 };
 //#endregion
 //#region src/settings.ts
@@ -2625,6 +3058,22 @@ const POLLING_WATCH_OPTIONS = {
 * State and behavior. One instance per plugin mount; disposals are owned by
 * the watcher/timer/proxy effects registered in {@link apply}.
 */
+/**
+* Whether a configured upstream addresses this proxy's own bind address and
+* port, which would make every chained connection recurse into this proxy.
+*/
+function isSelfUpstream(value, bind, port) {
+	try {
+		const parsed = new URL(value);
+		const bindIsLocal = bind === "127.0.0.1" || bind === "localhost" || bind === "::1" || bind === "0.0.0.0";
+		const host = parsed.hostname;
+		const valueIsLocal = host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+		const valuePort = parsed.port === "" ? parsed.protocol === "https:" ? 443 : 80 : Number(parsed.port);
+		return bindIsLocal && valueIsLocal && valuePort === port;
+	} catch {
+		return false;
+	}
+}
 var PermissionRulesRuntime = class {
 	ctx;
 	/** Loaded (or failed) rules per workspace cwd, least-recently-used first for eviction. */
@@ -2645,6 +3094,11 @@ var PermissionRulesRuntime = class {
 	inFlight = /* @__PURE__ */ new Map();
 	/** The network proxy, when the policy is enabled and mounted. */
 	networkProxy;
+	/** Ambient upstream candidates, captured ONCE before this plugin injects its own (see {@link captureAmbientUpstream}). */
+	ambientUpstream;
+	ambientCaptured = false;
+	upstreamWarned = false;
+	selfLoopWarned = false;
 	/** Restores the injected proxy environment (set after a successful bind). */
 	envRestore;
 	/** The authoritative config source: the composition entry, replaced by the settings scope while attached. */
@@ -3229,6 +3683,7 @@ var PermissionRulesRuntime = class {
 	*/
 	async attachNetworkProxy() {
 		const cfg = this.config.network;
+		this.captureAmbientUpstream();
 		const proxy = new NetworkProxy({
 			bind: cfg.proxyBind,
 			port: cfg.proxyPort,
@@ -3236,7 +3691,8 @@ var PermissionRulesRuntime = class {
 			decide: (target) => this.decideProxyTarget(target),
 			attribution: () => this.proxyAttribution(),
 			onBlock: (record, attribution) => this.auditNetworkBlock(record, attribution),
-			logger: this.ctx.logger
+			logger: this.ctx.logger,
+			upstream: () => this.upstreamFor()
 		});
 		this.networkProxy = proxy;
 		this.ctx.effect(() => () => {
@@ -3273,6 +3729,78 @@ var PermissionRulesRuntime = class {
 		this.envRestore = void 0;
 		await this.attachNetworkProxy();
 	}
+	/**
+	* Capture the launch environment's proxy names exactly ONCE, before this
+	* plugin injects its own. `onNetworkConfigChanged()` closes the old proxy and
+	* restores the environment around a rebind, so a second capture could read
+	* this plugin's own address back as if the operator had exported it — hence
+	* the memo. The launch snapshot is immutable and preferred; `process.env` is
+	* the fallback for hosts that expose no snapshot.
+	*/
+	captureAmbientUpstream() {
+		if (this.ambientCaptured) return;
+		this.ambientCaptured = true;
+		const launch = this.ctx.get("launchEnvironment");
+		const lookup = (name) => launch?.get(name)?.value ?? process.env[name];
+		this.ambientUpstream = readAmbientProxy(lookup);
+		this.warnAboutUpstream();
+	}
+	/** The one-shot upstream diagnostics: a discarded ambient proxy, or an `inherit` with nothing to inherit. */
+	warnAboutUpstream() {
+		if (this.upstreamWarned) return;
+		this.upstreamWarned = true;
+		const cfg = this.config.network;
+		const ambient = this.ambientUpstream;
+		const has = ambient !== void 0 && (ambient.http !== void 0 || ambient.https !== void 0);
+		if (cfg.upstreamProxy === "off" && cfg.injectEnv && has) this.ctx.logger.warn(`permission-rules: an ambient proxy (${redactProxyUrl(ambient.https ?? ambient.http ?? "")}) is discarded for traffic through this proxy; set network.upstreamProxy to "inherit" to chain through it, or leave it to subprocesses only`);
+		if (cfg.upstreamProxy === "inherit" && !cfg.injectEnv) this.ctx.logger.warn("permission-rules: network.upstreamProxy is only consulted for connections that reach this proxy; with injectEnv false, subprocess traffic keeps its own route");
+		if (cfg.upstreamProxy === "inherit" && !has) this.ctx.logger.warn("permission-rules: network.upstreamProxy is \"inherit\" but the launch environment named no usable http(s) proxy (a SOCKS or malformed value is ignored; Node has no SOCKS client)");
+	}
+	/**
+	* The upstream getter the proxy consults per connection. Undefined when the
+	* setting is `off`, when no candidate is usable, or when the candidate points
+	* back into this very proxy — a self-loop would recurse forever, so chaining
+	* is disabled for it and warned about once.
+	*/
+	upstreamFor() {
+		if (this.config.network.upstreamProxy === "off") return void 0;
+		const ambient = this.ambientUpstream;
+		if (ambient === void 0) return void 0;
+		const selfPort = this.networkProxy?.port ?? 0;
+		const selfHost = this.config.network.proxyBind;
+		const usable = (value) => {
+			if (value === void 0) return void 0;
+			if (selfPort > 0 && isSelfUpstream(value, selfHost, selfPort)) {
+				if (!this.selfLoopWarned) {
+					this.selfLoopWarned = true;
+					this.ctx.logger.warn(`permission-rules: network.upstreamProxy points at this proxy itself (${redactProxyUrl(value)}); chaining is disabled for it`);
+				}
+				return;
+			}
+			return value;
+		};
+		const http = usable(ambient.http);
+		const https = usable(ambient.https);
+		if (http === void 0 && https === void 0) return void 0;
+		return {
+			...http === void 0 ? {} : { http },
+			...https === void 0 ? {} : { https }
+		};
+	}
+	/** The upstream block of the network snapshot, already redacted. */
+	upstreamSnapshot() {
+		const setting = this.config.network.upstreamProxy;
+		const mode = setting === "off" ? "off" : setting === "inherit" ? "inherit" : "url";
+		const http = mode === "off" ? void 0 : mode === "url" ? setting : this.ambientUpstream?.http;
+		const https = mode === "off" ? void 0 : mode === "url" ? setting : this.ambientUpstream?.https;
+		return {
+			mode,
+			http: http === void 0 ? null : redactProxyUrl(http),
+			https: https === void 0 ? null : redactProxyUrl(https),
+			active: mode !== "off" && this.upstreamFor() !== void 0,
+			chained: this.networkProxy?.chainedConnections() ?? 0
+		};
+	}
 	/** The network snapshot the settings page and `/rules network` render. */
 	networkSnapshot() {
 		const cfg = this.config.network;
@@ -3291,16 +3819,18 @@ var PermissionRulesRuntime = class {
 			proxyActive: proxy !== void 0 && proxy.port > 0,
 			denied: stats.denied,
 			askBlocked: stats.askBlocked,
-			recent: proxy?.recentBlocks() ?? []
+			recent: proxy?.recentBlocks() ?? [],
+			upstream: this.upstreamSnapshot(),
+			allowHostAction: cfg.allowHostAction
 		};
 	}
-	/**
-	* The rule-file paths the settings-page editor may read or write: every
-	* currently loaded source plus the per-workspace project files and the
-	* configured fallback (so a not-yet-existing project file can be
-	* created). The editor never touches arbitrary paths — and the built-in
-	* baseline is excluded entirely (it is a shipped, read-only baseline,
-	* shown via `/rules` attribution instead).
+	/** The rule-file paths the settings-page editor may read or write: every
+	* currently loaded source plus the per-workspace project files, the
+	* configured fallback, and the host-level project file the session-less
+	* chain resolves (so a not-yet-existing project file can be created). The
+	* editor never touches arbitrary paths — and the built-in baseline is
+	* excluded entirely (it is a shipped, read-only baseline, shown via
+	* `/rules` attribution instead).
 	*/
 	knownRuleSources() {
 		const cfg = this.config;
@@ -3315,6 +3845,7 @@ var PermissionRulesRuntime = class {
 		}
 		if (cfg.fallbackPath !== void 0) set.add(isAbsolute(cfg.fallbackPath) ? cfg.fallbackPath : resolve(cfg.fallbackPath));
 		if (isAbsolute(cfg.rulesFile)) set.add(cfg.rulesFile);
+		else set.add(join(process.cwd(), cfg.rulesFile));
 		return [...set];
 	}
 	/** Read one known rule file for the editor: `{ exists, text, error }`. */
@@ -3404,6 +3935,117 @@ var PermissionRulesRuntime = class {
 			reloaded
 		};
 	}
+	/**
+	* The settings-page "allow this host" action (issue #19 item 3): write ONE
+	* minimal `match.network.domains` allow rule for a blocked target into the
+	* nearest effective rule file, at index 0, then report the decision the
+	* runtime makes for that target afterwards.
+	*
+	* Why index 0: rules are first-match-wins, so appending the rule after an
+	* existing `deny` would leave the connection blocked — the rule would be
+	* dead text the operator cannot see the reason for.
+	*
+	* Why `domains` only: that dimension is subdomain-inclusive and
+	* port/scheme-agnostic; narrowing the generated rule to the blocked port
+	* would re-block the same host on its next connection from another port.
+	* The rule can never widen TOOL permissions either — an allow hit on
+	* `tools/pre-execute` is delegated downstream, never claimed.
+	*
+	* Failure modes are fail-closed and leave the disk untouched: the action is
+	* disabled, the host is not a host name/IP literal, the request names an
+	* unknown workspace, the target resolves outside the known rule sources or
+	* onto the built-in baseline, the file cannot be read, the document does
+	* not parse / has no `rules` list, or the written text fails the same
+	* `parseRulesDocument` + `compileRules` gate every hand edit passes.
+	*
+	* The write goes through {@link saveRuleFile}, so the per-workspace chains
+	* AND the session-less host chain are re-read — no restart, no
+	* `/rules reload` — and the returned `outcome` is the REAL decision
+	* recomputed after the write (with the target as given, no DNS: an
+	* `ips`-scoped allow rule cannot be seen here). Cross-process concurrent
+	* writes to one rule file are out of scope: last writer wins.
+	*
+	* @param request - the blocked target plus the workspace it belongs to.
+	* @returns the action result, never a throw.
+	*/
+	allowHost(request) {
+		const fail = (error, path = null) => ({
+			ok: false,
+			path,
+			created: false,
+			reloaded: 0,
+			outcome: null,
+			alreadyAllowed: false,
+			error
+		});
+		if (!this.config.network.allowHostAction) return fail("the allow-host action is disabled by network.allowHostAction");
+		const host = normalizeAllowHost(request.host);
+		if (!isWritableHost(host)) return fail(`refusing to allow ${JSON.stringify(request.host)}: not a host name or IP literal`);
+		const target = {
+			scheme: request.scheme ?? void 0,
+			host,
+			port: request.port ?? void 0,
+			ips: []
+		};
+		if (this.decideProxyTarget(target).action === "allow") return {
+			ok: true,
+			path: null,
+			created: false,
+			reloaded: 0,
+			outcome: "allow",
+			alreadyAllowed: true,
+			error: null
+		};
+		let path;
+		try {
+			path = resolveAllowHostTarget({
+				cwd: request.cwd,
+				loadedCwds: [...this.byCwd.values()].map((loaded) => loaded.cwd),
+				knownSources: this.knownRuleSources(),
+				rulesFile: this.config.rulesFile,
+				fallbackPath: this.config.fallbackPath,
+				processCwd: process.cwd(),
+				builtinPath: this.builtinSource(),
+				exists: existsSync
+			});
+		} catch (error) {
+			return fail(error instanceof Error ? error.message : String(error));
+		}
+		const existed = existsSync(path);
+		let existing = "";
+		if (existed) try {
+			existing = readFileSync(path, "utf8");
+		} catch (error) {
+			return fail(`cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`, path);
+		}
+		let edit;
+		try {
+			edit = insertAllowRule(existing, host);
+		} catch (error) {
+			return fail(error instanceof Error ? error.message : String(error), path);
+		}
+		if (!edit.inserted) return {
+			ok: true,
+			path,
+			created: false,
+			reloaded: 0,
+			outcome: this.decideProxyTarget(target).action,
+			alreadyAllowed: true,
+			error: null
+		};
+		const hadHostChain = this.hostLoaded !== void 0;
+		const saved = this.saveRuleFile(path, edit.text);
+		if (!saved.ok) return fail(saved.error ?? `refusing to write ${path}`, path);
+		return {
+			ok: true,
+			path,
+			created: !existed,
+			reloaded: (saved.reloaded ?? 0) + (hadHostChain ? 1 : 0),
+			outcome: this.decideProxyTarget(target).action,
+			alreadyAllowed: false,
+			error: null
+		};
+	}
 	/** The installed `@deepseek-ai/dsh-session` version, or `null` when unresolvable (falls back to the append probe). */
 	peerVersion() {
 		try {
@@ -3638,6 +4280,7 @@ var PermissionRulesRuntime = class {
 		}
 		lines.push(prose.networkHeader(snapshot.mode, snapshot.sandboxMode, snapshot.configuredMode, snapshot.proxyActive, snapshot.proxyPort));
 		lines.push(prose.networkCounters(snapshot.denied, snapshot.askBlocked));
+		lines.push(prose.networkUpstream(snapshot.upstream.mode, snapshot.upstream.http, snapshot.upstream.https, snapshot.upstream.active, snapshot.upstream.chained));
 		if (snapshot.recent.length === 0) lines.push(prose.noNetworkBlocks);
 		else for (const block of snapshot.recent.slice(0, 10)) lines.push(prose.networkBlockLine(block.time, block.tool, block.attributed, block.domain, block.scheme, block.port, block.action, block.matched, block.ruleIndex, block.reason));
 		return {
@@ -4088,4 +4731,4 @@ const name = "permission-rules";
 /** Consumer — the /rules command handler and the tools/pre-execute waterfall listener consume the injected commands/tools services. */
 const inject = ["commands", "tools"];
 //#endregion
-export { BUILTIN_RULES_FILE, Config, GlobError, NETWORK_MODES, NO_PROXY_ENV_NAMES, NetworkProxy, PATH_CANDIDATE_KEYS, PLATFORMS, PROXY_ENV_NAMES, PermissionRulesRuntime, RULE_ACTIONS, RuleError, SCHEMES, SHIPPED_BUILTIN_RULES, URL_CANDIDATE_KEYS, apply, blockMessage, compileGlob, compilePatternRegex, compileRules, compileRulesChain, compileSourceRules, decideNetworkTarget, decomposeShellCommand, defaultDecision, describeRule, extractPathCandidates, extractUrlCandidates, findUnreachableRules, inject, injectProxyEnv, isIpLiteral, isLoopbackTarget, isMarkedAuditEvent, isShellTool, isUnmarkedHostVersion, matchRules, matchTools, matchWhen, mergeCompiledRules, name, networkModeForSandbox, normalizeWorkspacePath, parseRulesDocument, parseUrlTarget, resolveBuiltinRulesPath, resolveConfig, targetMatchesNetwork };
+export { BUILTIN_RULES_FILE, Config, GlobError, NETWORK_MODES, NO_PROXY_ENV_NAMES, NetworkProxy, PATH_CANDIDATE_KEYS, PLATFORMS, PROXY_ENV_NAMES, PermissionRulesRuntime, RULE_ACTIONS, RuleError, SCHEMES, SHIPPED_BUILTIN_RULES, URL_CANDIDATE_KEYS, apply, blockMessage, compileGlob, compilePatternRegex, compileRules, compileRulesChain, compileSourceRules, decideNetworkTarget, decomposeShellCommand, defaultDecision, describeRule, extractPathCandidates, extractUrlCandidates, findUnreachableRules, inject, injectProxyEnv, isIpLiteral, isLoopbackTarget, isMarkedAuditEvent, isShellTool, isUnmarkedHostVersion, matchRules, matchTools, matchWhen, mergeCompiledRules, name, networkModeForSandbox, normalizeHost, normalizeWorkspacePath, parseRulesDocument, parseUrlTarget, readAmbientProxy, redactProxyUrl, resolveBuiltinRulesPath, resolveConfig, targetMatchesNetwork };