@aryacode/dsh-engineering 0.4.6 → 0.4.20

package/CHANGELOG.md

@@ -1,5 +1,204 @@
 # Changelog
 
+## [0.4.20] - 2026-10-27
+
+### Fixed
+
+- **The bundle no longer ships Python bytecode.** `__pycache__` and `*.pyc` from the MotionWorks
+  engine are ignored and excluded, so the tarball contains only the sources the plugin runs.
+
+## [0.4.19] - 2026-10-27
+
+### Fixed
+
+- **Reads without a project name find the attached project.** `mw_get`, `mw_help` and `mw_search`
+  resolve the single project with a verified pre-edit backup when no `project` is passed, so the
+  direct workflow no longer fails with `NO_PROJECT`. A leftover `.motionworks/stage` copy no longer
+  shadows that project, and two attached projects are reported as `AMBIGUOUS_PROJECT` with both names.
+
+## [0.4.18] - 2026-10-27
+
+### Fixed
+
+- **MotionWorks edits no longer demand a body hash the caller had to guess.** `mw_edit_code` with
+  `changes` hashes the body it is about to patch when `expected_body_sha256` is omitted; the backup
+  and exact find/replace still guard the write, and a supplied hash is still honored.
+- **A stale stage no longer makes the direct workflow ambiguous.** When a project has a verified
+  pre-edit backup, `singleStage()` now prefers that project over old `.motionworks/stage` copies.
+
+## [0.4.17] - 2026-10-27
+
+### Fixed
+
+- **A direct MotionWorks open was refused as "outside the staging root".** 0.4.13 promised a
+  backup-first direct open, but the copy was written to `<workspace>/backups/<project>/<timestamp>`
+  while the shipped bridge (`Get-DirectIdentity`) and the read-only engine (`assert_direct_attached`)
+  only accept an identity record at `<workspace>/.motionworks/attached/records/<id>.json` naming a
+  backup under `.motionworks/attached/backups`. The two never met: `mw_project_open` refused every
+  project the retired solo plugin had not already attached, which is why MotionWorks work still looked
+  like it required staging. The backup module now writes exactly that layout, verifies the copy before
+  writing the identity, and refuses to replace an identity that no longer verifies.
+- **A project already open in the IDE could not be edited.** Edits, compile and verify required a
+  proven backup and failed with `NOT_ATTACHED` for a workspace project the IDE already had open.
+  `mw_project_open` now attaches that project — writes the verified backup and reports
+  `already_open` — instead of calling `OpenProject`, because a reload over unsaved editor changes is
+  data loss the backup cannot undo. An edit, compile or verify that finds an unattached workspace
+  project takes the backup before it refuses.
+- **`mw_edit_code` could not be given the hash it demands.** Its precondition is the SHA-256 of the
+  saved body, and the tool tells the caller to read `text_body_sha256` from `mw_get`; `mw_get`
+  returned the body but no hash, so the hash had to be found elsewhere or guessed and the edit failed
+  with "Saved code differs from expected_body/hash". `mw_get` now returns the `text_body_sha256` of
+  exactly the body it returns.
+- **A read before the open still pointed at staging.** The engine guard's refusal text belongs to the
+  retired staging flow and told the caller to stage a copy, which is what sent an agent back into
+  staging after it had been removed from the workflow. The engine boundary now translates that
+  refusal into `NOT_ATTACHED` with the fix "call `mw_project_open` first"; every other refusal keeps
+  its own text.
+
+### Documentation
+
+- `packages/mwi/SKILL.md`: the backup lives under `<workspace>/.motionworks/attached/`, an
+  already-open project is attached and not reloaded, and the edit section names the hash `mw_get`
+  returns.
+- `packages/mwi/README.md`: rows, backup layout, the attach-without-reload path and the guarded read,
+  including what the identity check does and does not recompute.
+- README: the MotionWorks row, the composition diagram, the tool groups and the safety section
+  describe a direct edit. The row-default table and diagram now match the shipped defaults (every
+  surface on), which the 0.4.15 release changed but the diagram still showed as off.
+
+## [0.4.16] - 2026-10-27
+
+### Added
+
+- **FactoryTalk Optix OCR is configurable from Plugins.** The `optix` row now
+  carries `ocrExecutable`, `ocrLanguage` and `ocrTessdataDirectory`. A configured
+  executable registers `optix_ocr`; an empty path keeps OCR off. An empty tessdata
+  folder derives `tessdata` beside the executable. OCR still requires the preview
+  browser and one matching tab, because it reads the rendered canvas.
+
+### Fixed
+
+- **An empty preview URL no longer breaks `optix_preview` and `optix_screenshot`.**
+  A saved blank `previewUrl` or `cdpUrl` now falls back to the loopback defaults
+  instead of failing with `Invalid URL`.
+
+## [0.4.15] - 2026-10-27
+
+### Changed
+
+- **Every tool surface ships on.** A fresh install no longer hides the expensive
+  halves: L5X gets `editing`, `studio`, `live` and `allowWrites`; MotionWorks IEC
+  gets `edit`; FactoryTalk Optix gets live authoring, destructive operations,
+  exported-method invocation, the emulator preview and preview input. The defaults
+  live in each row's `Config` schema, so the Configure page shows them on and a
+  read-only profile can still switch them off.
+- Docs, row descriptions and the generated tool reference now describe the
+  on-by-default behaviour. `docs/architecture.md`, `README.md`, `cordis.patch.yml`
+  and the settings page copy were updated with the schemas.
+
+## [0.4.14] - 2026-10-27
+
+### Added
+
+- **FactoryTalk Optix has a Configure page.** The `optix` row now mounts through
+  `entries/optix.js`, which owns a volatile config schema and hands the prebuilt
+  `@aryacode/dsh-tool-ft-optix` plugin plain options. Configure can set the Studio
+  bridge origins and token, live authoring, destructive operations, exported-method
+  invocation, the emulator preview and preview input. Live authoring is on by default from 0.4.15; the Configure page can
+  switch it off. Reads work as soon as a project with the Studio bridge is open.
+## [0.4.13] - 2026-10-27
+
+### Changed
+
+- **MotionWorks edits the real project again.** `mw_project_open` and `mw_ide_start` now take a
+  workspace `.mwt` and work on its files directly. Before the first write they copy the wrapper and
+  the expanded project into `<workspace>/backups/<project>/<timestamp>/`, hash every copied file in
+  `backup-manifest.json`, verify the copy, and reuse that backup on later attaches. `mw_apply` saves
+  in place; there is no sync-back step.
+- **Staging is optional.** `mw_project_stage` remains for a sandbox copy, but the skill and tool
+  descriptions lead with the direct path.
+
+## [0.4.12] - 2026-10-27
+
+### Fixed
+
+- **The MotionWorks workspace setting was ignored.** `workspace` is volatile, so it arrives as a
+  live reference; passing the reference to `configureWorkspace` did nothing. The row now unwraps it
+  with `text()`, so the value saved in Configure is the folder the tools search.
+
+## [0.4.11] - 2026-10-27
+
+### Fixed
+
+- **MotionWorks editing tools never mounted even when the switch was on.** A `.volatile()` config
+  field reaches `apply()` as a live accessor, so `config.edit === true` was always false and the
+  seven edit tools were never registered. Every row now resolves switches through
+  `entries/config.js` (`flag`/`list`).
+- **Flipping a switch did not take effect until the row was disabled and re-enabled.** The loader
+  commits volatile-only changes without re-running `apply()`, then emits `loader/volatile-update`.
+  The L5X and MotionWorks rows now mount and unmount their optional surfaces from that event.
+- **MotionWorks looked for projects in the profile directory.** The host does not always pass the
+  session cwd, so `workspaceOf()` fell back to `process.cwd()`. The row now carries a `workspace`
+  setting (shown in Configure) and falls back to the `mwi.workspace` marker in the profile, then the
+  process directory. Project discovery follows directory junctions without looping.
+
+## [0.4.10] - 2026-10-26
+
+### Fixed
+
+- **The row settings page sat on "Loading configuration…".** The Plugins page snapshots a row's
+  configuration form once when it opens and does not subscribe to it, so a form that was still
+  loading at that moment never produced the switches. The page now reads the live form from the
+  client `configForms` service, whose `get` starts the one describe fetch, and subscribes to it;
+  the switches appear when the settings settle, and a row with no configuration says so instead of
+  loading forever.
+- **The row switches were not served to Settings at all.** The config fields were plain
+  `z.boolean()` values, and the settings domain only publishes fields marked `.volatile()`; the
+  rows therefore had no settings namespace for the page to bind to. `editing`, `studio`, `live`,
+  `allowWrites`, `allowedAddresses`, `ftview.edit`/`studio` and `mwi.edit` are now volatile, so the
+  Configure page edits the running row instead of remounting it.
+
+## [0.4.9] - 2026-10-26
+
+### Fixed
+
+- Republished the row settings pages with the client half's declared service list taken from every
+  bundled face rather than the two viewer faces. Same pages and same defaults as 0.4.8; this build is
+  the installable one.
+
+## [0.4.8] - 2026-10-26
+
+### Fixed
+
+- **The product rows had no settings page.** The bundle's client half never registered a
+  `plugins.row.config` entry, so the Plugins page showed no Configure control for `l5x`, `ftview` or
+  `mwi`, and the switches the README documents were unreachable without editing the profile patch by
+  hand. `scripts/faces/settings.js` now registers one page per row: L5X editing, the Studio 5000 SDK,
+  live EtherNet/IP and the two live writes; FactoryTalk View ME edits and the Studio handoff;
+  MotionWorks IEC edits. Values are staged and saved through the row's own configuration form, and the
+  defaults are unchanged.
+
+## [0.4.7] - 2026-10-25
+
+### Fixed
+
+- **`allowWrites` could not be reached from the L5X row.** The composite entry mounted the live entry
+  with no config, so the write switch had no path from the Plugins page. `entries/l5x.js` now declares
+  `allowWrites` and `allowedAddresses` and forwards both into the live entry; the write tools still
+  refuse without per-call approval.
+
+### Documentation
+
+- README: the safety section states the two keys a live write takes, the tool groups list all seven
+  EtherNet/IP tools, and the L5X count is 40 (84 with Optix).
+- `docs/examples.md`: a live section covering batch reads, discovery, the controller clock, the trend,
+  and a supervised write with the exact fields the reader must see and the refusals they may hit.
+- `docs/architecture.md`: a new EtherNet/IP section — the two workers, the transaction engine's deadline
+  and decoding, and the four gates that stand between a write request and a controller.
+- `docs/port/l5x.md`: the live surface is recorded as seven tools with the driver call each one uses, and
+  the unused capability (CIP subscriptions, UDT `Structure` reads) is named.
+- `packages/l5x/README.md`: read and write tool tables, and the full live configuration row.
+
 ## [0.4.6] - 2026-10-25
 
 ### Added

package/README.md

@@ -14,17 +14,19 @@ A general assistant pays for every tool schema on every request. An automation e
 surfaces — reading a 3 MB L5X, comparing two projects, staging ladder edits, talking to a controller —
 but only one or two of them at a time.
 
-This bundle splits those surfaces into one row per product. The expensive surfaces are a switch inside
-the row, off by default, so a read-only profile pays for the read tools and nothing else:
+This bundle splits those surfaces into one row per product. The expensive surfaces are switches inside
+the row. They ship on by default so a fresh install can use every tool; switch off what a
+read-only or low-context profile does not need:
 
 | Product row | Config option | Default | What turning it on adds |
 |---|---|---|---|
-| `l5x` | `editing` | off | the nine `draft_*` schemas |
-| `l5x` | `studio` | off | the Logix Designer SDK and supervised controller schemas |
-| `l5x` | `live` | off | the EtherNet/IP read, batch, discovery, clock and trend schemas |
-| `l5x` | `allowWrites` | off | the two approval-gated writes (tag, wall clock) |
+| `l5x` | `editing` | on | the nine `draft_*` schemas |
+| `l5x` | `studio` | on | the Logix Designer SDK and supervised controller schemas |
+| `l5x` | `live` | on | the EtherNet/IP read, batch, discovery, clock and trend schemas |
+| `l5x` | `allowWrites` | on | the two approval-gated writes (tag, wall clock) |
 | `ftview` | `edit`, `studio` | on | staged ME edits and the Studio handoff |
-| `mwi` | `edit` | off | the seven MotionWorks edit schemas |
+| `mwi` | `edit` | on | the seven MotionWorks edit schemas |
+| `optix` | `allowWrites`, `allowDestructive`, `allowInvoke`, `preview`, `ocrExecutable` | on | Studio authoring, destructive ops, method invocation, emulator preview and OCR when Tesseract is set |
 
 The previews are independent of the tools — switching a product off does not remove the ladder viewer.
 Both previews mount from **one** row (`viewers`), because a package registers exactly one browser
@@ -34,17 +36,17 @@ bundle.
 
 | Product | Tools | Default | Needs |
 |---|---|---|---|
-| **Studio 5000 L5X** | 40 | read on; edit, Studio, live **off** | Node for offline reads; Studio 5000 + Logix Designer SDK for SDK work; a controller for live |
+| **Studio 5000 L5X** | 40 | all on | Node for offline reads; Studio 5000 + Logix Designer SDK for SDK work; a controller for live |
 | **FactoryTalk View ME** | 14 | all on | Node for an export folder; FactoryTalk View Studio ME for discovery and the handoff |
-| **MotionWorks IEC** | 24 | session, read, verify on; edit **off** | MotionWorks IEC 3 Pro installed; verified against 1.19 |
-| **FactoryTalk Optix** | 6 | on | Optix Studio installed |
+| **MotionWorks IEC** | 24 | all on | MotionWorks IEC 3 Pro installed; verified against 1.19 |
+| **FactoryTalk Optix** | 9 (3 need preview) | all on | Optix Studio installed; Tesseract for OCR |
 
 Tool groups, by product:
 
 - **L5X** — 11 read (`open_project` … `compare_projects`), 9 staged drafts (`draft_*`), 6 Logix
   Designer SDK, 7 supervised controller, 7 live EtherNet/IP (2 reads, 2 identity/discovery, 1 batch read, 2 approval-gated writes)
 - **FactoryTalk View** — 6 read, 5 staged edits, 3 Studio handoff
-- **MotionWorks IEC** — 7 session, 7 saved-project reads, 3 verify, 7 staged edits
+- **MotionWorks IEC** — 7 session, 7 saved-project reads, 3 verify, 7 direct edits
 - **Optix** — 6 tools, unlinked to a skill until one exists
 
 ## Switches
@@ -56,11 +58,11 @@ down:
 
 | Row | Mounts | Config options (default) |
 |---|---|---|
-| `l5x` | offline reads, checks, comparison and the `rockwell-l5x` guidance; optionally drafts, SDK, live (reads, batch, discovery, clock) and supervised writes | `editing` (off), `studio` (off), `live` (off), `allowWrites` (off) |
+| `l5x` | offline reads, checks, comparison and the `rockwell-l5x` guidance; optionally drafts, SDK, live (reads, batch, discovery, clock) and supervised writes | `editing` (on), `studio` (on), `live` (on), `allowWrites` (on) |
 | `ftview` | FactoryTalk View ME read, guidance and edits; optionally the Studio handoff | `edit` (on), `studio` (on) |
-| `mwi` | MotionWorks IEC session, reads, verify and guidance; optionally the edits | `edit` (off) |
+| `mwi` | MotionWorks IEC session, reads, verify, guidance and the edits | `workspace` (empty), `edit` (on) |
 | `viewers` | ladder + ME display previews | — |
-| `optix` | FactoryTalk Optix Studio authoring | — |
+| `optix` | FactoryTalk Optix Studio authoring | `bridgeUrls` (8768), `bridgeToken` (empty), `allowWrites` (on), `allowDestructive` (on), `allowInvoke` (on), `preview` (on), `allowPreviewInput` (on), `cdpUrl`, `previewUrl`, `ocrExecutable` (empty), `ocrLanguage` (`eng`), `ocrTessdataDirectory` (empty) |
 
 **Why the row list collapsed.** The Plugins page lists a bundle's rows flat and skips `cordis:group`
 containers (`plugin-manager/src/index.ts`: *"Group rows are containers … their children carry the
@@ -90,13 +92,16 @@ Where each surface actually stands, based on what has been exercised.
 - Live EtherNet/IP: polling, one-request batch reads of up to 64 tags, controller identity and clock, LAN discovery, and a bounded trend
 - Supervised live writes: `write_live_tag` and `write_controller_clock` need the row's `allowWrites` switch **and** per-call human approval, and report the value the controller reads back
 - FactoryTalk View ME: export reads, structural checks, comparison, staged display and HMI tag edits
-- MotionWorks IEC: verified live against 3 Pro 1.19 — stage, start, worksheet, close, saved-project
-  reads, compile diagnostics, code replacement, declaration add, POU create/delete, block insertion
-  and a POU package export/delete/import round trip
+- MotionWorks IEC: verified live against 3 Pro 1.19 — direct open with a verified pre-edit backup
+  under `.motionworks/attached`, attach-without-reload to a project the IDE already has open, start,
+  worksheet, close, saved-project reads, compile diagnostics, code replacement, declaration add, POU
+  create/delete, block insertion and a POU package export/delete/import round trip
 - Ladder viewer and FactoryTalk View display preview
 
-**Deliberately off by default** — enabled per profile: `l5x-editing`, `l5x-studio`, `l5x-live`, `allowWrites`,
-`mwi-edit`. A read-only profile should not pay for nine draft schemas or a controller surface.
+**On by default** — every tool surface mounts on a fresh install. Switch one off from the row's
+Configure page in Plugins (`l5x` editing/Studio/live/allowWrites, `mwi` edit, `optix` authoring/preview)
+when the profile is read-only or the request budget is tight. Tool schemas are sent on every request, so
+the lean profile is the one that turns them off.
 
 **Known limits** — stated in the bundle, not hidden:
 
@@ -105,7 +110,7 @@ Where each surface actually stands, based on what has been exercised.
 - FBD/SFC semantics are not exercised
 - FactoryTalk View Studio work is a **manual handoff**: the bundle plans the import and preflights
   changed files, it does not import
-- Optix has no skill, so its 6 tools cannot be switched off
+- Optix has no skill yet; its tools follow the `optix` row config and the Studio bridge
 
 **Not in this repository** — CAD mounts as an independent plugin.
 
@@ -113,6 +118,8 @@ Where each surface actually stands, based on what has been exercised.
 
 | Version | What landed |
 |---|---|
+| **0.4.17** | MotionWorks edits the real project again: the pre-edit backup is written where the bridge and engine verify it, an already-open project is attached instead of reloaded, and `mw_get` returns the body hash the edit takes |
+| **0.4.15** | Every tool surface ships on by default; the row Configure pages switch them off |
 | **0.4.4** | One row per product: five rows, optional surfaces moved into each row's config |
 | **0.4.0** | Both previews fold into the bundle's own client face — one package, one browser bundle, 16 rows |
 | **0.4.6** | Full EtherNet/IP surface: batch reads, discovery, controller clock, and approval-gated tag and clock writes; 84 tools |
@@ -149,9 +156,9 @@ another bundle owns.
 ```mermaid
 flowchart TB
   Profile["Profile bundle list"] --> Bundle["@aryacode/dsh-engineering"]
-  Bundle -->|insert| L5X["l5x (on) — read + guidance; editing / studio / live off"]
+  Bundle -->|insert| L5X["l5x (on) — read + guidance + drafts / SDK / live"]
   Bundle -->|insert| FTV["ftview (on) — read, edits, Studio handoff"]
-  Bundle -->|insert| MWI["mwi (on) — session, read, verify; edit off"]
+  Bundle -->|insert| MWI["mwi (on) — session, read, verify, edit"]
   Bundle -->|insert| Viewers["viewers (on) — ladder + ME display previews"]
   Bundle -->|insert| Optix["optix (on)"]
 ```
@@ -161,21 +168,25 @@ even when the implementation behind a row is replaced.
 
 | Row id | Package entry | Config options |
 |---|---|---|
-| `l5x` | `dsh-engineering-l5x` | `editing` off · `studio` off · `live` off |
+| `l5x` | `dsh-engineering-l5x` | `editing` on · `studio` on · `live` on · `allowWrites` on |
 | `ftview` | `dsh-engineering-ftview` | `edit` on · `studio` on |
-| `mwi` | `dsh-engineering-mwi` | `edit` off |
+| `mwi` | `dsh-engineering-mwi` | `edit` on |
 | `viewers` | `@aryacode/dsh-engineering` (its own client face: ladder + ME display previews) | — |
-| `optix` | `@aryacode/dsh-tool-ft-optix` | — |
+| `optix` | `@aryacode/dsh-engineering/optix` (wraps the prebuilt `@aryacode/dsh-tool-ft-optix`) | `allowWrites` on · `allowDestructive` on · `allowInvoke` on · `preview` on |
 
 ## Safety
 
 - **Read-only by default.** Reading, checks, comparison and the viewers never change a controller.
 - **Edits write new files.** `draft_apply` writes one new L5X beside the source and refuses to
   overwrite; `ftview_apply` writes a new export folder and leaves the source untouched. MotionWorks
-  edits write only the staged copy and verify unrelated saved and native state.
+  edits write the real workspace project, after one complete backup under
+  `<workspace>/.motionworks/attached/`, and verify unrelated saved and native state.
 - **Controller changes need a human.** Upload, mode change and download require per-call approval and
   a session policy that permits asking. The tools refuse before contacting a controller when approval
   is unavailable, and a download accepts only a verification id produced by a passed build.
+- **Live writes take two keys.** `write_live_tag` and `write_controller_clock` need the row's
+  `allowWrites` switch *and* approval for that exact write; the tag is validated against the export
+  first and the result is the value the controller reads back (`WRITE_NOT_VERIFIED` if it differs).
 - **No hidden vendor execution.** The FactoryTalk View Studio handoff returns a manual import plan; it
   does not run a vendor utility.
 - **Coverage is stated.** Every result names what it cannot establish, including whether online logic

package/cordis.patch.yml

@@ -6,13 +6,14 @@
 #
 # The optional parts are the row's config, not separate rows:
 #
-#   l5x    → editing, studio, live   (all off by default)
-#   ftview → edit, studio            (both on by default)
-#   mwi    → edit                    (off by default)
+#   l5x    → editing, studio, live, allowWrites   (all on by default)
+#   ftview → edit, studio                          (both on by default)
+#   mwi    → edit                                  (on by default)
+#   optix  → authoring, destructive, invoke, preview (all on by default)
 #
-# That keeps the context decision with the product it belongs to: a read-only
-# profile pays for the read surface, and the expensive schemas are one switch
-# inside the row instead of four more toggles in the list.
+# Every surface ships on so a fresh install can use the full plugin. Turn one
+# off from the row's Configure page when the profile is read-only or the request
+# budget is tight; the schemas are sent on every request.
 #
 # The patch only ever inserts. It must never target a row another bundle owns:
 # a profile without that row makes composition fail ("patch: entry ... not

package/entries/config.js

@@ -0,0 +1,62 @@
+/**
+ * Resolve one value from a plugin row's config.
+ *
+ * A field marked `.volatile()` in the `Config` schema arrives as a live
+ * reference ({ get() }) rather than as the value itself: schemastery wraps it
+ * with `createVolatile`, so `config.edit` is the reference, not `true`. Reading
+ * the value directly made every volatile switch look off to `apply()` — the row
+ * mounted its read surface and never its edit surface, no matter what the
+ * profile patch or the settings page said.
+ *
+ * Keep this tolerance in one place so every product row resolves its switches
+ * the same way, and so a plain value (tests, older hosts) still works.
+ *
+ * @module dsh-engineering-config
+ */
+
+/**
+ * Read a config field that may be a volatile reference.
+ *
+ * @param input - the raw field, a reference, or undefined.
+ * @param fallback - value to use when the field is absent.
+ * @returns the current value, or the fallback.
+ */
+export function resolve(input, fallback) {
+  const current = input && typeof input.get === 'function' ? input.get() : input
+  return current === undefined ? fallback : current
+}
+
+/**
+ * Read a boolean switch.
+ *
+ * @param input - the raw field, a reference, or undefined.
+ * @param fallback - value to use when the field is absent or not a boolean.
+ * @returns the boolean value.
+ */
+export function flag(input, fallback = false) {
+  const current = resolve(input, fallback)
+  return typeof current === 'boolean' ? current : fallback
+}
+
+/**
+ * Read a string-list field.
+ *
+ * @param input - the raw field, a reference, or undefined.
+ * @returns the list, or an empty list.
+ */
+export function list(input) {
+  const current = resolve(input, [])
+  return Array.isArray(current) ? current : []
+}
+
+/**
+ * Read a string field.
+ *
+ * @param input - the raw field, a reference, or undefined.
+ * @param fallback - value to use when the field is absent or not a string.
+ * @returns the string value.
+ */
+export function text(input, fallback = '') {
+  const current = resolve(input, fallback)
+  return typeof current === 'string' ? current : fallback
+}

package/entries/ftview.js

@@ -10,16 +10,17 @@ import * as read from '../vendor/ftview/lib/index.js'
 import * as skill from '../vendor/ftview/lib/skill.js'
 import * as edit from '../vendor/ftview/lib/edit.js'
 import * as studio from '../vendor/ftview/lib/studio.js'
+import { flag } from './config.js'
 
 export const name = 'engineering-ftview'
 /** Union of the parts' requirements: the read entry owns the view service. */
 export const inject = ['tools', 'fs']
 
 export const Config = z.object({
-  edit: z.boolean().default(true).description(
+  edit: z.boolean().default(true).volatile().description(
     'Staged display and HMI-tag edits, validated then written to a new export folder.',
   ),
-  studio: z.boolean().default(true).description(
+  studio: z.boolean().default(true).volatile().description(
     'FactoryTalk View Studio discovery and the manual import plan. Runs no vendor utility.',
   ),
 })
@@ -32,6 +33,6 @@ export const Config = z.object({
 export function apply(ctx, config = {}) {
   ctx.plugin(read)
   ctx.plugin(skill)
-  if (config.edit !== false) ctx.plugin(edit)
-  if (config.studio !== false) ctx.plugin(studio)
+  if (flag(config.edit, true)) ctx.plugin(edit)
+  if (flag(config.studio, true)) ctx.plugin(studio)
 }

package/entries/l5x.js

@@ -2,10 +2,14 @@
  * The Studio 5000 L5X product row: one switch for the whole L5X surface.
  *
  * The parts are the vendored entries; this module mounts them, so the Plugins
- * page shows one row per product instead of one per surface. The three
- * expensive surfaces stay off by default and are switched from this row's
- * config form, which is the same decision the old separate rows encoded —
- * just reachable from the product row instead of from the list.
+ * page shows one row per product instead of one per surface. The expensive
+ * surfaces are on by default and can be switched off from this row's config form,
+ * which is the same decision the old separate rows encoded — just reachable
+ * from the product row instead of from the list.
+ *
+ * `allowWrites` is forwarded into the live entry, not consumed here: the write
+ * tools refuse from inside that entry, so the switch and the per-call approval
+ * both live where the controller traffic happens.
  */
 import z from '@deepseek-ai/schemastery'
 import * as read from '../vendor/l5x/lib/index.js'
@@ -13,32 +17,76 @@ import * as skill from '../vendor/l5x/lib/skill.js'
 import * as editing from '../vendor/l5x/lib/editing.js'
 import * as studio from '../vendor/l5x/lib/studio.js'
 import * as live from '../vendor/l5x/lib/live.js'
+import { flag, list } from './config.js'
 
 export const name = 'engineering-l5x'
 /** Union of the parts' requirements: the read entry owns the project service. */
 export const inject = ['tools', 'fs']
 
 export const Config = z.object({
-  editing: z.boolean().default(false).description(
-    'Nine staged draft tools (draft_rung, draft_apply, ...). Off by default: a read-only profile should not pay for these schemas.',
+  editing: z.boolean().default(true).volatile().description(
+    'Nine staged draft tools (draft_rung, draft_apply, ...). On by default; a read-only profile can switch it off to drop these schemas.',
   ),
-  studio: z.boolean().default(false).description(
+  studio: z.boolean().default(true).volatile().description(
     'Logix Designer SDK and supervised controller tools. Needs Studio 5000 with the SDK service installed.',
   ),
-  live: z.boolean().default(false).description(
-    'EtherNet/IP polling and trend tools. Needs a reachable controller address.',
+  live: z.boolean().default(true).volatile().description(
+    'EtherNet/IP surface: polling, batch reads, discovery, controller clock and trends. Needs a reachable controller address.',
+  ),
+  allowWrites: z.boolean().default(true).volatile().description(
+    'Permit the two live write tools (tag, wall clock). Each write still needs human approval for that exact operation, and only applies while live is on.',
+  ),
+  allowedAddresses: z.array(z.string()).default([]).volatile().description(
+    'Optional IPv4 allowlist for live reads, writes and discovery. Empty permits any explicit address.',
   ),
 })
 
 /**
  * Mount the L5X surface.
  * @param ctx - plugin context.
- * @param config - the three optional surfaces, all off unless enabled.
+ * @param config - the optional surfaces, all off unless enabled.
  */
 export function apply(ctx, config = {}) {
   ctx.plugin(read)
   ctx.plugin(skill)
-  if (config.editing === true) ctx.plugin(editing)
-  if (config.studio === true) ctx.plugin(studio)
-  if (config.live === true) ctx.plugin(live)
+  // Volatile-only config changes never re-run apply(): the loader commits the
+  // new values and emits loader/volatile-update. Remount the optional surfaces
+  // from that event so a switch flipped in the row page takes effect at once.
+  let editingFiber
+  let studioFiber
+  let liveFiber
+  let liveSignature = ''
+  const sync = () => {
+    const wantEditing = flag(config.editing)
+    if (wantEditing && editingFiber === undefined) editingFiber = ctx.plugin(editing)
+    else if (!wantEditing && editingFiber !== undefined) {
+      void editingFiber.dispose()
+      editingFiber = undefined
+    }
+
+    const wantStudio = flag(config.studio)
+    if (wantStudio && studioFiber === undefined) studioFiber = ctx.plugin(studio)
+    else if (!wantStudio && studioFiber !== undefined) {
+      void studioFiber.dispose()
+      studioFiber = undefined
+    }
+
+    const wantLive = flag(config.live)
+    const addresses = list(config.allowedAddresses)
+    const signature = wantLive ? JSON.stringify([flag(config.allowWrites), addresses]) : ''
+    if (wantLive && (liveFiber === undefined || signature !== liveSignature)) {
+      if (liveFiber !== undefined) void liveFiber.dispose()
+      liveFiber = ctx.plugin(live, {
+        allowWrites: flag(config.allowWrites),
+        ...(addresses.length === 0 ? {} : { allowedAddresses: addresses }),
+      })
+      liveSignature = signature
+    } else if (!wantLive && liveFiber !== undefined) {
+      void liveFiber.dispose()
+      liveFiber = undefined
+      liveSignature = ''
+    }
+  }
+  sync()
+  ctx.on('loader/volatile-update', sync)
 }

package/entries/mwi.js

@@ -2,8 +2,8 @@
  * The MotionWorks IEC product row: one switch for the session, read, verify and
  * edit surfaces plus the skill.
  *
- * Editing is the largest schema set in the bundle, so it stays off until the
- * row's config form turns it on.
+ * Editing is the largest schema set in the bundle; it ships on by default and
+ * the row's config form can switch it off for a read-only profile.
  */
 import z from '@deepseek-ai/schemastery'
 import * as session from '../vendor/mwi/lib/index.js'
@@ -11,26 +11,46 @@ import * as read from '../vendor/mwi/lib/read.js'
 import * as skill from '../vendor/mwi/lib/skill.js'
 import * as verify from '../vendor/mwi/lib/verify.js'
 import * as edit from '../vendor/mwi/lib/edit.js'
+import { configureWorkspace } from '../vendor/mwi/lib/session/workspace.js'
+import { flag, text } from './config.js'
 
 export const name = 'engineering-mwi'
 /** The whole product needs the tool registry. */
 export const inject = ['tools']
 
 export const Config = z.object({
-  edit: z.boolean().default(false).description(
-    'Seven staged edit tools (code, declarations, structure, blocks, POU packages). Off by default: the largest schemas in the bundle.',
+  workspace: z.string().default('').volatile().description(
+    'Absolute workspace root for MotionWorks projects. Empty uses the session directory when the host passes one, then the mwi.workspace marker in the profile.',
+  ),
+  edit: z.boolean().default(true).volatile().description(
+    'Seven staged edit tools (code, declarations, structure, blocks, POU packages). On by default; switch it off to drop the largest schemas in the bundle.',
   ),
 })
 
 /**
  * Mount the MotionWorks IEC surface.
  * @param ctx - plugin context.
- * @param config - the optional edit surface, off unless enabled.
+ * @param config - the workspace root and the optional edit surface.
  */
 export function apply(ctx, config = {}) {
   ctx.plugin(session)
   ctx.plugin(read)
   ctx.plugin(skill)
   ctx.plugin(verify)
-  if (config.edit === true) ctx.plugin(edit)
+  // The loader commits volatile-only config changes into the live references
+  // and emits `loader/volatile-update` instead of re-running apply(). The edit
+  // switch must mount and unmount the edit tools in place, or the page would
+  // claim the tools are on while the request still lacks them.
+  let mounted
+  const sync = () => {
+    configureWorkspace(text(config.workspace))
+    const wanted = flag(config.edit)
+    if (wanted && mounted === undefined) mounted = ctx.plugin(edit)
+    else if (!wanted && mounted !== undefined) {
+      void mounted.dispose()
+      mounted = undefined
+    }
+  }
+  sync()
+  ctx.on('loader/volatile-update', sync)
 }