dsh-permission-rules 0.6.21 → 0.7.0

package/src/allow-host.ts

@@ -0,0 +1,307 @@
+/**
+ * The settings-page "allow this host" action, as pure pieces: normalizing
+ * and validating a blocked host, inserting ONE minimal
+ * `match.network.domains` allow rule at the HEAD of a rule document, choosing
+ * which rule file the rule belongs in, and mapping the action's result onto
+ * the notice the page renders.
+ *
+ * Three invariants hold here and are asserted by `test/allow-host.spec.ts`:
+ *
+ * 1. the rule is inserted at index 0 — rules are first-match-wins, so a rule
+ *    appended after an existing `deny` would be dead text;
+ * 2. a document the yaml parser reports an error for, or whose `rules` is not
+ *    a list, is REFUSED (a {@link RuleError}) — the caller never overwrites a
+ *    file it could not read; and
+ * 3. the insertion goes through the yaml Document API (`parseDocument` +
+ *    `createNode` + `items.unshift` + `String(doc)`), so comments and the
+ *    existing formatting of the untouched rules survive.
+ *
+ * Nothing here reads the filesystem or the process cwd: the runtime injects
+ * `exists`, `processCwd`, and the source lists it already computed, which is
+ * what makes the target choice testable without touching a real host.
+ * @module dsh-permission-rules/allow-host
+ */
+
+import { isAbsolute, join, resolve } from 'node:path'
+import { isIP } from 'node:net'
+import { isMap, isSeq, parseDocument } from 'yaml'
+import type { YAMLSeq } from 'yaml'
+import { RuleError, normalizeHost } from './rules.ts'
+import type { AllowHostResult, RuleSourceView } from './wire.ts'
+
+/**
+ * Why a generated rule may legitimately live in a rule file the parser would
+ * reject: it is not one — every write goes back through the same
+ * `parseRulesDocument` + `compileRules` gate as a hand edit.
+ */
+const RULE_REASON_SUFFIX = '(added from the settings page)'
+
+/**
+ * A DNS-ish host: dot-separated labels of ASCII letters/digits/`-`/`_`, each
+ * starting and ending with an alphanumeric. Deliberately narrow — the action
+ * writes an EXACT host, so glob metacharacters (`*`), whitespace, `#`, `:`,
+ * `[`, quotes and anything else that could make the generated scalar mean
+ * something other than "this one host" are refused instead of escaped.
+ */
+const HOSTNAME_SHAPE = /^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?)*$/
+
+/** Longest a host name (or an IP literal) may be; also bounds the generated rule. */
+const MAX_HOST_LENGTH = 253
+
+/**
+ * Canonical spelling of a host for the allow action, matching target parsing
+ * exactly (see `normalizeHost`): lowercase, IPv6 brackets stripped, one
+ * trailing dot stripped.
+ * @param host - the host as the block record reported it.
+ * @returns the canonical spelling.
+ */
+export function normalizeAllowHost(host: string): string {
+  return normalizeHost(host)
+}
+
+/**
+ * Whether a normalized host may be written into a rule: a host name or an IP
+ * literal, nothing else. This is the syntactic half of the action's safety —
+ * a newline, a `rules:` fragment, a glob, a URL, or a `host:port` authority is
+ * refused here rather than relying on the YAML emitter to quote it. The IP
+ * check is `node:net`'s `isIP`, so a `host:port` string (which merely contains
+ * a colon) is not mistaken for an IPv6 literal.
+ * @param host - the normalized host.
+ * @returns true when the host may be allowed.
+ */
+export function isWritableHost(host: string): boolean {
+  if (host.length === 0 || host.length > MAX_HOST_LENGTH) return false
+  if (isIP(host) !== 0) return true
+  return HOSTNAME_SHAPE.test(host)
+}
+
+/**
+ * The `reason` carried by every generated rule. English on purpose: rule
+ * `reason`s are never translated (they are quoted verbatim in denial messages
+ * and in the session audit), so a localized reason would make one rule read
+ * differently per UI language.
+ * @param host - the allowed host.
+ * @returns the reason line.
+ */
+export function allowHostReason(host: string): string {
+  return `Allow ${host} ${RULE_REASON_SUFFIX}`
+}
+
+/** The outcome of one insertion attempt. */
+export interface AllowHostInsertion {
+  /** The document text to write; identical to the input when `inserted` is false. */
+  readonly text: string
+  /** Whether the rule was added (false = the file already leads with this exact allow). */
+  readonly inserted: boolean
+}
+
+/**
+ * Insert the minimal allow rule for `host` at the HEAD of a rule document.
+ *
+ * `inserted: false` (with the input text returned unchanged) means the first
+ * rule of the file is ALREADY this exact allow — first-match semantics make a
+ * second copy do nothing, so the caller must not rewrite the file (repeated
+ * clicks would otherwise pile up duplicate lines in the user's git diff).
+ *
+ * @param text - the current file text (empty for a file to be created).
+ * @param host - the normalized, validated host.
+ * @returns the text to write plus whether anything was added.
+ * @throws RuleError when the document cannot be parsed or has no `rules` list.
+ */
+export function insertAllowRule(text: string, host: string): AllowHostInsertion {
+  // Normalizing here as well as at the call site keeps the idempotence check
+  // (and the generated rule) independent of the caller's spelling.
+  const normalized = normalizeAllowHost(host)
+  const doc = parseDocument(text)
+  // `parseDocument` collects syntax errors instead of throwing, and `String(doc)`
+  // would happily re-emit a partially-understood document — refusing here is what
+  // keeps "unparseable file" from ever meaning "overwritten file".
+  if (doc.errors.length > 0) {
+    throw new RuleError(`cannot edit the rule file: ${doc.errors[0]?.message ?? 'invalid YAML'}`)
+  }
+  const rule = { match: { network: { domains: [normalized] } }, action: 'allow', reason: allowHostReason(normalized) }
+  if (doc.contents === null) {
+    // An empty or comment-only file: the comments stay ahead of the new key.
+    doc.set('rules', doc.createNode([rule]))
+    return { text: String(doc), inserted: true }
+  }
+  if (!isMap(doc.contents)) {
+    throw new RuleError('cannot edit the rule file: the document root must be a mapping with a "rules" list')
+  }
+  if (!doc.has('rules')) throw new RuleError('cannot edit the rule file: the document has no "rules" list')
+  const rules = doc.get('rules')
+  if (!isSeq(rules)) throw new RuleError('cannot edit the rule file: "rules" must be a list')
+  if (headAllowHost(rules) === normalized) return { text, inserted: false }
+  rules.items.unshift(doc.createNode(rule))
+  return { text: String(doc), inserted: true }
+}
+
+/**
+ * The host of the first rule, when that rule is exactly the allow rule this
+ * action generates: `action: allow`, enabled, and a `match` whose only
+ * dimension is a single `network.domains` entry. Anything else — a different
+ * action, a disabled rule, or a rule narrowed by ports/schemes/tools/agents —
+ * returns undefined, so an existing narrower rule can never make the action
+ * skip the write that would actually unblock the connection.
+ * @param rules - the parsed `rules` sequence.
+ * @returns the normalized head host, or undefined.
+ */
+function headAllowHost(rules: YAMLSeq): string | undefined {
+  const first = rules.items[0]
+  if (!isMap(first)) return undefined
+  const record: unknown = first.toJSON()
+  if (typeof record !== 'object' || record === null || Array.isArray(record)) return undefined
+  const rule = record as Record<string, unknown>
+  if (rule['action'] !== 'allow' || rule['enabled'] === false) return undefined
+  const match = rule['match']
+  if (typeof match !== 'object' || match === null || Array.isArray(match)) return undefined
+  const dimensions = Object.keys(match)
+  if (dimensions.length !== 1 || dimensions[0] !== 'network') return undefined
+  const network = (match as Record<string, unknown>)['network']
+  if (typeof network !== 'object' || network === null || Array.isArray(network)) return undefined
+  const scopes = Object.keys(network)
+  if (scopes.length !== 1 || scopes[0] !== 'domains') return undefined
+  const domains = (network as Record<string, unknown>)['domains']
+  if (!Array.isArray(domains) || domains.length !== 1) return undefined
+  const only: unknown = domains[0]
+  return typeof only === 'string' ? normalizeAllowHost(only) : undefined
+}
+
+/** Everything {@link resolveAllowHostTarget} needs, injected so the choice is pure and testable. */
+export interface AllowHostTargetInput {
+  /** The workspace the request named, or null for a host-level (session-less) block. */
+  readonly cwd: string | null
+  /** The absolute workspace roots whose rule chains are currently loaded (the cwd whitelist). */
+  readonly loadedCwds: readonly string[]
+  /** The paths the editor/action may touch (`PermissionRulesRuntime.knownRuleSources()`). */
+  readonly knownSources: readonly string[]
+  /** The configured `rulesFile`: relative to a workspace, or absolute for every one. */
+  readonly rulesFile: string
+  /** The configured `fallbackPath`, or undefined when unset. */
+  readonly fallbackPath: string | undefined
+  /** The host process's working directory (the session-less workspace). */
+  readonly processCwd: string
+  /** The shipped baseline path when the baseline is enabled; never writable. */
+  readonly builtinPath: string | undefined
+  /** Existence probe for the host-level project file. */
+  readonly exists: (path: string) => boolean
+}
+
+/**
+ * The one rule file this action may write for a request: the nearest file of
+ * the chain that will actually judge the connection.
+ *
+ * With a workspace cwd the target is that workspace's project file (the
+ * absolute `rulesFile` when one is configured), and the cwd must be a
+ * workspace whose chain is loaded — an unknown cwd is refused instead of being
+ * turned into a path.
+ *
+ * Without one, the order mirrors `resolveUserSources(process.cwd())` exactly,
+ * so the file written is the file the host chain reads: the absolute
+ * `rulesFile`, else `<processCwd>/<rulesFile>` when it already exists, else
+ * the configured fallback, else `<processCwd>/<rulesFile>` (created — the
+ * host chain picks it up on the next load).
+ *
+ * The result must be a known rule source and must never be the built-in
+ * baseline.
+ *
+ * @param input - the injected config, cwd, and source state.
+ * @returns the absolute path to write.
+ * @throws RuleError when the request names an unknown workspace or resolves to
+ *   a path outside the writable set.
+ */
+export function resolveAllowHostTarget(input: AllowHostTargetInput): string {
+  const target = input.cwd === null ? hostTarget(input) : workspaceTarget(input, input.cwd)
+  if (input.builtinPath !== undefined && samePath(target, input.builtinPath)) {
+    throw new RuleError(`refusing to write ${target}: the built-in ruleset is read-only`)
+  }
+  if (!input.knownSources.some(source => samePath(source, target))) {
+    throw new RuleError(`refusing to write ${target}: not a known rule source`)
+  }
+  return target
+}
+
+/** The project file of one workspace (the absolute `rulesFile` when one is configured). */
+function projectFile(rulesFile: string, cwd: string): string {
+  return isAbsolute(rulesFile) ? rulesFile : join(cwd, rulesFile)
+}
+
+/** The target for a request that named a workspace. */
+function workspaceTarget(input: AllowHostTargetInput, cwd: string): string {
+  const owner = input.loadedCwds.find(loaded => samePath(loaded, cwd))
+  if (owner === undefined) {
+    throw new RuleError(`refusing to allow for ${JSON.stringify(cwd)}: not a workspace whose rules are loaded`)
+  }
+  return projectFile(input.rulesFile, owner)
+}
+
+/** The target for a host-level (session-less) request — the same order the host chain resolves in. */
+function hostTarget(input: AllowHostTargetInput): string {
+  if (isAbsolute(input.rulesFile)) return input.rulesFile
+  const project = join(input.processCwd, input.rulesFile)
+  if (input.exists(project)) return project
+  const fallback = input.fallbackPath
+  if (fallback === undefined) return project
+  return isAbsolute(fallback) ? fallback : resolve(fallback)
+}
+
+/** Path equality as the per-workspace cache key treats it: resolved, and case-folded on Windows. */
+function samePath(a: string, b: string): boolean {
+  const left = resolve(a)
+  const right = resolve(b)
+  return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right
+}
+
+/**
+ * The workspaces a host-level block may be allowed in: the distinct non-null
+ * `cwd`s of the loaded rule sources.
+ *
+ * A block with no cwd was judged by the proxy's session-less host chain, which
+ * any loaded workspace chain outranks the moment one exists — so writing the
+ * host file can leave the connection blocked while the rule sits in a file
+ * nothing consults. The settings page therefore offers these workspaces and
+ * sends the chosen one as the request's cwd; when there is exactly one (or
+ * none), there is nothing to choose between.
+ * @param sources - the snapshot's rule sources.
+ * @returns the distinct workspace roots, in source order.
+ */
+export function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[] {
+  const seen = new Set<string>()
+  const workspaces: string[] = []
+  for (const source of sources) {
+    if (source.cwd === null || seen.has(source.cwd)) continue
+    seen.add(source.cwd)
+    workspaces.push(source.cwd)
+  }
+  return workspaces
+}
+
+/** The locale keys the allow action reports through. */
+export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed'
+
+/** The notice one action result maps onto: a locale key plus its interpolation values. */
+export interface AllowHostNotice {
+  readonly ok: boolean
+  readonly key: AllowHostNoticeKey
+  readonly vars: Record<string, string | number>
+}
+
+/**
+ * Map an action result onto the page notice.
+ *
+ * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
+ * returning the RECOMPUTED decision is that the page can never say "allowed"
+ * while the connection is still blocked (a nearer chain with an earlier deny,
+ * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
+ * as success when the decision really is `allow`.
+ * @param result - the `permissionRules/allowHost` result.
+ * @returns the notice to render.
+ */
+export function allowHostNotice(result: AllowHostResult): AllowHostNotice {
+  if (!result.ok) return { ok: false, key: 'allowHostFailed', vars: { error: result.error ?? 'unknown error' } }
+  if (result.outcome !== 'allow') {
+    return { ok: false, key: 'allowHostStillBlocked', vars: { outcome: result.outcome ?? 'unknown' } }
+  }
+  if (result.alreadyAllowed) return { ok: true, key: 'allowHostAlready', vars: {} }
+  return { ok: true, key: 'allowHostSaved', vars: { path: result.path ?? '', reloaded: result.reloaded } }
+}

package/src/client/index.ts

@@ -19,7 +19,7 @@ import { PERMISSION_RULES_REMOTE } from './remote.ts'
 import { PermissionRulesSection } from './section.ts'
 import type { PermissionRulesSectionInjected } from './section.ts'
 import { en, zh, type PermissionRulesLocaleKey } from './locales.ts'
-import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
+import type { AllowHostRequest, AllowHostResult, PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
 
 /** Dictionary namespace owned by this plugin. */
 export const NS = 'settings.permissionRules'
@@ -74,6 +74,7 @@ export async function apply(ctx: Context): Promise<void> {
       rulesRead: (path: string) => Promise<RemoteResult<RulesReadResult>>
       rulesSave: (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
       reload: () => Promise<RemoteResult<RulesReloadResult>>
+      allowHost: (request: AllowHostRequest) => Promise<RemoteResult<AllowHostResult>>
     } | undefined
     if (bridge === undefined) return
     const injected = (): PermissionRulesSectionInjected => ({
@@ -97,6 +98,11 @@ export async function apply(ctx: Context): Promise<void> {
         if (!result.ok) throw new Error(`reload failed: ${result.error.code}: ${result.error.message}`)
         return result.value
       },
+      allowHost: async (request) => {
+        const result = await bridge.allowHost(request)
+        if (!result.ok) throw new Error(`allowHost failed: ${result.error.code}: ${result.error.message}`)
+        return result.value
+      },
       t,
     })
     slots.inject('settings.section', () => slots.register({

package/src/client/locales.ts

@@ -14,6 +14,11 @@ export type PermissionRulesLocaleKey =
   | 'proxyActive'
   | 'proxyInactive'
   | 'proxyDisabled'
+  | 'upstream'
+  | 'upstreamOff'
+  | 'upstreamInherit'
+  | 'upstreamInactive'
+  | 'upstreamChained'
   | 'counters'
   | 'denied'
   | 'askBlocked'
@@ -22,6 +27,13 @@ export type PermissionRulesLocaleKey =
   | 'blockBy'
   | 'blockDefault'
   | 'blockUnattributed'
+  | 'allowHost'
+  | 'allowHostPickWorkspace'
+  | 'allowHostSaved'
+  | 'allowHostAlready'
+  | 'allowHostStillBlocked'
+  | 'allowHostFailed'
+  | 'allowHostDisabled'
   | 'editorTitle'
   | 'editorPath'
   | 'editorLoad'
@@ -43,6 +55,11 @@ export const en: Record<PermissionRulesLocaleKey, string> = {
   proxyActive: 'active on 127.0.0.1:{port}',
   proxyInactive: 'INACTIVE (bind failed — shell network policy is not enforced)',
   proxyDisabled: 'network policy disabled',
+  upstream: 'Upstream',
+  upstreamOff: 'off — allowed connections dial directly',
+  upstreamInherit: 'inherit from the launch environment',
+  upstreamInactive: 'inactive',
+  upstreamChained: '{count} chained',
   counters: 'Blocks',
   denied: 'denied',
   askBlocked: 'ask-blocked',
@@ -51,6 +68,13 @@ export const en: Record<PermissionRulesLocaleKey, string> = {
   blockBy: 'rule {index}',
   blockDefault: 'mode default',
   blockUnattributed: 'unattributed',
+  allowHost: 'Allow',
+  allowHostPickWorkspace: 'Choose a workspace…',
+  allowHostSaved: 'Allowed — wrote {path} ({reloaded} chain(s) re-read).',
+  allowHostAlready: 'Already allowed — nothing was written.',
+  allowHostStillBlocked: 'Rule written, but the target is still "{outcome}" — a nearer chain or the mode default still blocks it.',
+  allowHostFailed: 'Allow failed: {error}',
+  allowHostDisabled: 'Allow action disabled (network.allowHostAction)',
   editorTitle: 'Rule editor',
   editorPath: 'Rule file',
   editorLoad: 'Load',
@@ -73,6 +97,11 @@ export const zh: Record<PermissionRulesLocaleKey, string> = {
   proxyActive: '运行于 127.0.0.1:{port}',
   proxyInactive: '未激活（绑定失败——shell 网络策略未生效）',
   proxyDisabled: '网络策略已停用',
+  upstream: '上游',
+  upstreamOff: '关闭 —— 已放行连接直连',
+  upstreamInherit: '继承启动环境',
+  upstreamInactive: '未生效',
+  upstreamChained: '已链式 {count} 条',
   counters: '拦截',
   denied: '拒绝',
   askBlocked: '待审批阻断',
@@ -81,6 +110,13 @@ export const zh: Record<PermissionRulesLocaleKey, string> = {
   blockBy: '规则 {index}',
   blockDefault: '模式默认',
   blockUnattributed: '未归属',
+  allowHost: '放行',
+  allowHostPickWorkspace: '选择工作区…',
+  allowHostSaved: '已放行——写入 {path}（重读 {reloaded} 条链）。',
+  allowHostAlready: '已放行——未写入任何文件。',
+  allowHostStillBlocked: '规则已写入，但目标仍为「{outcome}」——更靠前的规则链或模式默认仍在拦截。',
+  allowHostFailed: '放行失败：{error}',
+  allowHostDisabled: '放行动作已关闭（network.allowHostAction）',
   editorTitle: '规则编辑器',
   editorPath: '规则文件',
   editorLoad: '载入',

package/src/client/remote.ts

@@ -10,7 +10,7 @@
 
 import type { RemoteResult, TypertRemoteContribution } from '@deepseek-ai/dsh-typert-protocol'
 import { PERMISSION_RULES_INVOCATIONS } from '../wire.ts'
-import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
+import type { AllowHostRequest, AllowHostResult, PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
 
 declare module '@deepseek-ai/dsh-typert-protocol' {
   interface TypertRemoteNamespace$permissionRules {
@@ -22,12 +22,15 @@ declare module '@deepseek-ai/dsh-typert-protocol' {
     rulesSave: (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
     /** Re-read every cached workspace chain. */
     reload: () => Promise<RemoteResult<RulesReloadResult>>
+    /** Write one minimal allow rule for a blocked host into the nearest effective rule file. */
+    allowHost: (request: AllowHostRequest) => Promise<RemoteResult<AllowHostResult>>
   }
   interface TypertRemoteMap {
     'permissionRules/networkStatus': () => Promise<RemoteResult<PermissionRulesSnapshot>>
     'permissionRules/rulesRead': (path: string) => Promise<RemoteResult<RulesReadResult>>
     'permissionRules/rulesSave': (path: string, text: string) => Promise<RemoteResult<RulesSaveResult>>
     'permissionRules/reload': () => Promise<RemoteResult<RulesReloadResult>>
+    'permissionRules/allowHost': (request: AllowHostRequest) => Promise<RemoteResult<AllowHostResult>>
   }
   interface TypertRemoteNamespaceMap {
     permissionRules: TypertRemoteNamespace$permissionRules

package/src/client/section.ts

@@ -11,8 +11,9 @@
 
 import * as React from 'react'
 import type { ReactElement } from 'react'
+import { allowHostNotice, allowHostWorkspaces } from '../allow-host.ts'
 import type { PermissionRulesLocaleKey } from './locales.ts'
-import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
+import type { AllowHostRequest, AllowHostResult, NetworkBlockView, PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'
 
 /** Functions the registration injects (wired to the Remote namespace in `./index.ts`). */
 export interface PermissionRulesSectionInjected {
@@ -24,6 +25,8 @@ export interface PermissionRulesSectionInjected {
   rulesSave: (path: string, text: string) => Promise<RulesSaveResult>
   /** Re-read every cached workspace chain. */
   reload: () => Promise<RulesReloadResult>
+  /** Write one minimal allow rule for one blocked host. */
+  allowHost: (request: AllowHostRequest) => Promise<AllowHostResult>
   /** The locale-bound translator. */
   t: T
 }
@@ -53,6 +56,11 @@ const NOTICE_ERR: React.CSSProperties = { fontSize: 13, color: 'var(--dsh-color-
 const TABLE: React.CSSProperties = { width: '100%', borderCollapse: 'collapse', fontSize: 12 }
 const CELL: React.CSSProperties = { borderBottom: '1px solid var(--dsh-color-border, #ddd)', padding: '4px 6px', textAlign: 'left', verticalAlign: 'top' }
 
+/** The stable identity of one block row (the same key the table uses). */
+function blockKey(block: NetworkBlockView): string {
+  return `${block.time}-${block.domain}`
+}
+
 /** The settings section component. */
 export function PermissionRulesSection({ close, t, ...injected }: PermissionRulesSectionProps): ReactElement {
   void close
@@ -63,6 +71,10 @@ export function PermissionRulesSection({ close, t, ...injected }: PermissionRule
   const [text, setText] = React.useState('')
   const [dirty, setDirty] = React.useState(false)
   const [notice, setNotice] = React.useState<{ ok: boolean; text: string } | undefined>(undefined)
+  // The allow action renders its own notice next to the block list (the editor
+  // notice above is only visible once a rule file is selected).
+  const [allowNotice, setAllowNotice] = React.useState<{ ok: boolean; text: string } | undefined>(undefined)
+  const [allowPick, setAllowPick] = React.useState<Record<string, string>>({})
 
   const refresh = React.useCallback(() => {
     void injected.status().then(next => {
@@ -118,6 +130,24 @@ export function PermissionRulesSection({ close, t, ...injected }: PermissionRule
     })
   }, [injected, t, refresh])
 
+  /**
+   * Run the per-block allow action. The runtime recomputes the decision for
+   * the target before returning, so the notice reports the REAL outcome: a
+   * successful write whose target stays blocked reads as a failure, never as
+   * a success.
+   */
+  const allowHost = React.useCallback((block: NetworkBlockView, cwd: string | null) => {
+    setAllowNotice(undefined)
+    const request: AllowHostRequest = { host: block.domain, scheme: block.scheme, port: block.port, cwd }
+    void injected.allowHost(request).then(result => {
+      const mapped = allowHostNotice(result)
+      setAllowNotice({ ok: mapped.ok, text: t(mapped.key, mapped.vars) })
+      if (result.ok) refresh()
+    }).catch((error: unknown) => {
+      setAllowNotice({ ok: false, text: t('allowHostFailed', { error: error instanceof Error ? error.message : String(error) }) })
+    })
+  }, [injected, t, refresh])
+
   const picker = React.createElement('select', {
     style: { ...MONO, maxWidth: 420 },
     value: selected ?? '',
@@ -144,6 +174,12 @@ export function PermissionRulesSection({ close, t, ...injected }: PermissionRule
     children.push(React.createElement('div', { key: 'proxy', style: ROW },
       React.createElement('span', { style: LABEL }, t('proxy')),
       React.createElement('span', { style: VALUE }, proxyText)))
+    const upstreamHead = snapshot.upstream.mode === 'off'
+      ? t('upstreamOff')
+      : `${snapshot.upstream.mode === 'inherit' ? t('upstreamInherit') : (snapshot.upstream.https ?? snapshot.upstream.http ?? '')}${snapshot.upstream.active ? '' : ` (${t('upstreamInactive')})`}`
+    children.push(React.createElement('div', { key: 'upstream', style: ROW },
+      React.createElement('span', { style: LABEL }, t('upstream')),
+      React.createElement('span', { style: VALUE }, `${upstreamHead} · ${t('upstreamChained', { count: snapshot.upstream.chained })}`)))
     children.push(React.createElement('div', { key: 'counters', style: ROW },
       React.createElement('span', { style: LABEL }, t('counters')),
       React.createElement('span', { style: VALUE }, `${snapshot.denied} ${t('denied')} · ${snapshot.askBlocked} ${t('askBlocked')}`)))
@@ -154,17 +190,54 @@ export function PermissionRulesSection({ close, t, ...injected }: PermissionRule
   if (snapshot === undefined || snapshot.recent.length === 0) {
     children.push(React.createElement('div', { key: 'no-blocks', style: VALUE }, t('noBlocks')))
   } else {
-    const rows = snapshot.recent.map(block => React.createElement('tr', { key: `${block.time}-${block.domain}` },
-      React.createElement('td', { style: CELL }, new Date(block.time).toLocaleTimeString()),
-      React.createElement('td', { style: CELL }, block.tool + (block.attributed ? '' : ` (${t('blockUnattributed')})`)),
-      React.createElement('td', { style: CELL }, `${block.scheme ?? '?'}://${block.domain}${block.port === null ? '' : `:${block.port}`}`),
-      React.createElement('td', { style: CELL }, block.matched
-        ? t('blockBy', { index: (block.ruleIndex ?? 0) + 1 })
-        : t('blockDefault')),
-      React.createElement('td', { style: CELL }, block.action),
-      React.createElement('td', { style: CELL }, block.reason ?? '')))
+    const choices = allowHostWorkspaces(snapshot.sources)
+    const allowEnabled = snapshot.allowHostAction !== false
+    const rows = snapshot.recent.map(block => {
+      const key = blockKey(block)
+      const picked = allowPick[key] ?? ''
+      // A block with no cwd is judged by the session-less host chain, which any
+      // loaded workspace chain outranks; with several sources the operator must
+      // pick the workspace the rule belongs in before the action can run.
+      const needsPick = block.cwd === null && snapshot.sources.length > 1 && choices.length > 0
+      const cwd = block.cwd ?? (needsPick ? (picked === '' ? null : picked) : null)
+      const decide = (): void => allowHost(block, cwd)
+      const action: React.ReactNode = !allowEnabled
+        ? React.createElement('span', { style: LABEL }, t('allowHostDisabled'))
+        : React.createElement('span', { style: ROW },
+          needsPick
+            ? React.createElement('select', {
+              style: MONO,
+              value: picked,
+              onChange: (event: React.ChangeEvent<HTMLSelectElement>) => {
+                const value = event.target.value
+                setAllowPick(current => ({ ...current, [key]: value }))
+              },
+            }, [
+              React.createElement('option', { key: '', value: '' }, t('allowHostPickWorkspace')),
+              ...choices.map(choice => React.createElement('option', { key: choice, value: choice }, choice)),
+            ])
+            : null,
+          React.createElement('button', {
+            type: 'button',
+            disabled: needsPick && (picked === '' || cwd === null),
+            onClick: decide,
+          }, t('allowHost')))
+      return React.createElement('tr', { key },
+        React.createElement('td', { style: CELL }, new Date(block.time).toLocaleTimeString()),
+        React.createElement('td', { style: CELL }, block.tool + (block.attributed ? '' : ` (${t('blockUnattributed')})`)),
+        React.createElement('td', { style: CELL }, `${block.scheme ?? '?'}://${block.domain}${block.port === null ? '' : `:${block.port}`}`),
+        React.createElement('td', { style: CELL }, block.matched
+          ? t('blockBy', { index: (block.ruleIndex ?? 0) + 1 })
+          : t('blockDefault')),
+        React.createElement('td', { style: CELL }, block.action),
+        React.createElement('td', { style: CELL }, block.reason ?? ''),
+        React.createElement('td', { style: CELL }, action))
+    })
     children.push(React.createElement('table', { key: 'recent-table', style: TABLE },
       React.createElement('tbody', undefined, rows)))
+    if (allowNotice !== undefined) {
+      children.push(React.createElement('div', { key: 'allow-notice', style: allowNotice.ok ? NOTICE_OK : NOTICE_ERR }, allowNotice.text))
+    }
   }
 
   // Rule editor.