@ddtcorex/dsh-maestro-config 0.1.1 → 0.1.2

package/lib/client.js

@@ -2117,7 +2117,8 @@ var require_browser = __commonJS({
 // src/client/index.tsx
 var index_exports = {};
 __export(index_exports, {
-  apply: () => apply
+  apply: () => apply,
+  inject: () => inject
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -2221,6 +2222,29 @@ var codeStyle = {
   color: "var(--dsw-alias-label-primary)",
   wordBreak: "break-all"
 };
+var textareaStyle = {
+  ...inputStyle,
+  height: 120,
+  padding: "8px 12px",
+  resize: "vertical"
+};
+var tabBarStyle = {
+  display: "flex",
+  gap: 8,
+  borderBottom: "1px solid var(--dsw-alias-border-l2)",
+  marginBottom: 16
+};
+var tabButtonStyle = (active) => ({
+  padding: "8px 14px",
+  border: "none",
+  borderBottom: active ? "2px solid var(--dsw-alias-button-primary-fill)" : "2px solid transparent",
+  background: "transparent",
+  color: active ? "var(--dsw-alias-label-primary)" : "var(--dsw-alias-label-secondary)",
+  font: "inherit",
+  fontSize: 13,
+  fontWeight: active ? 600 : 400,
+  cursor: "pointer"
+});
 function QrImage({ url, size = 104 }) {
   const [dataUrl, setDataUrl] = (0, import_react.useState)(null);
   (0, import_react.useEffect)(() => {
@@ -2596,31 +2620,6 @@ function ToggleField({ label, caption, checked, onChange }) {
     )
   );
 }
-function ReviewHistoryPanel({ rpcCall }) {
-  const [entries, setEntries] = (0, import_react.useState)(null);
-  (0, import_react.useEffect)(() => {
-    rpcCall(MAESTRO_ENDPOINTS.reviewsList, {}).then((res) => {
-      if (res?.ok) setEntries(res.value ?? []);
-    }).catch(() => setEntries([]));
-  }, []);
-  if (entries === null) return (0, import_react.createElement)("p", { style: captionStyle }, "Loading review history\u2026");
-  if (entries.length === 0) return (0, import_react.createElement)("p", { style: captionStyle }, "No reviews recorded yet.");
-  const icon = (entry) => entry.status === "completed" ? "\u2705" : entry.status === "failed" ? "\u26A0\uFE0F" : "\u{1F440}";
-  return (0, import_react.createElement)(
-    "ul",
-    { style: { listStyle: "none", margin: 0, padding: 0 } },
-    entries.map((entry) => (0, import_react.createElement)(
-      "li",
-      { key: entry.id, style: { padding: "6px 0", borderBottom: "1px solid var(--dsw-alias-separator-default, #333)", fontSize: 13 } },
-      (0, import_react.createElement)("span", null, `${icon(entry)} ${entry.projectPath} !${entry.mrIid} \xB7 ${entry.mode}${entry.trigger !== "mention" ? ` \xB7 ${entry.trigger}` : ""}`),
-      (0, import_react.createElement)(
-        "div",
-        { style: captionStyle },
-        `${new Date(entry.startedAt).toLocaleString()}${entry.summary ? ` \u2014 ${entry.summary}` : ""}${entry.error ? ` \u2014 ${entry.error}` : ""}`
-      )
-    ))
-  );
-}
 function LanAccess({ proxyStatus, lanPin }) {
   const urls = proxyStatus?.lanUrls ?? [];
   const [selected, setSelected] = (0, import_react.useState)(0);
@@ -2729,11 +2728,95 @@ function MaestroSettingsTab({ rpcCall, configRpcCall }) {
   const [lanPinEnabled, setLanPinEnabled] = (0, import_react.useState)(false);
   const [lanPin, setLanPin] = (0, import_react.useState)(null);
   const [showLanPin, setShowLanPin] = (0, import_react.useState)(false);
+  const [activeTab, setActiveTab] = (0, import_react.useState)("guard");
+  const [guard, setGuard] = (0, import_react.useState)({});
+  const [patternsText, setPatternsText] = (0, import_react.useState)("");
+  const [placeholdersText, setPlaceholdersText] = (0, import_react.useState)("");
+  const [supervisorCfg, setSupervisorCfg] = (0, import_react.useState)({});
+  const [notifierCfg, setNotifierCfg] = (0, import_react.useState)({});
   const call = async (endpoint, payload) => {
     const res = await rpcCall(endpoint, payload);
     if (!res?.ok) throw new Error(res?.error?.message ?? "RPC failed");
     return res.value;
   };
+  const unwrap = (res) => {
+    if (res && typeof res === "object" && "ok" in res) {
+      if (res.ok) return res.value;
+      throw new Error(res.error?.message ?? "RPC failed");
+    }
+    return res;
+  };
+  const cfgGet = async (domain) => {
+    if (!configRpcCall) throw new Error("config RPC not available");
+    const res = await configRpcCall("get", { domain });
+    return unwrap(res);
+  };
+  const cfgSet = async (domain, patch) => {
+    if (!configRpcCall) throw new Error("config RPC not available");
+    const res = await configRpcCall("set", { domain, patch });
+    return unwrap(res);
+  };
+  const saveGuard = async (patch) => {
+    setError(null);
+    const next = { ...guard, ...patch };
+    if (patch.gitProtection && guard.gitProtection) next.gitProtection = { ...guard.gitProtection, ...patch.gitProtection };
+    setGuard(next);
+    try {
+      await cfgSet("guard", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const commitBlacklistPatterns = async (text) => {
+    const patterns = text.split("\n").map((s) => s.trim()).filter(Boolean);
+    setError(null);
+    try {
+      await cfgSet("guardBlacklist", { patterns });
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const commitPlaceholders = async () => {
+    setError(null);
+    let obj = {};
+    try {
+      obj = placeholdersText.trim() ? JSON.parse(placeholdersText) : {};
+      if (typeof obj !== "object" || obj === null || Array.isArray(obj)) throw new Error("placeholders must be JSON object");
+    } catch (e) {
+      setError(`placeholders JSON invalid: ${e.message ?? String(e)}`);
+      return;
+    }
+    try {
+      await cfgSet("guardBlacklist", { placeholders: obj });
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const saveSupervisorCfg = async (patch) => {
+    setError(null);
+    setSupervisorCfg((prev) => ({ ...prev, ...patch }));
+    try {
+      await cfgSet("supervisor", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
+  const saveNotifierCfg = async (patch) => {
+    setError(null);
+    setNotifierCfg((prev) => {
+      const next = { ...prev };
+      for (const [k, v] of Object.entries(patch)) {
+        if (k === "telegram" && typeof v === "object" && v !== null) next.telegram = { ...prev.telegram ?? {}, ...v };
+        else next[k] = v;
+      }
+      return next;
+    });
+    try {
+      await cfgSet("notifier", patch);
+    } catch (e) {
+      setError(e.message ?? String(e));
+    }
+  };
   const refresh = async () => {
     try {
       setStatus(await call(MAESTRO_ENDPOINTS.status, {}));
@@ -2754,6 +2837,21 @@ function MaestroSettingsTab({ rpcCall, configRpcCall }) {
         }
       }).catch(() => {
       });
+      Promise.all([
+        cfgGet("guard").catch(() => ({})),
+        cfgGet("guardBlacklist").catch(() => ({ patterns: [], placeholders: {} })),
+        cfgGet("supervisor").catch(() => ({})),
+        cfgGet("notifier").catch(() => ({}))
+      ]).then(([g, bl, sup, not]) => {
+        setGuard(g ?? {});
+        const pats = Array.isArray(bl?.patterns) ? bl.patterns : [];
+        const ph = bl?.placeholders && typeof bl.placeholders === "object" ? bl.placeholders : {};
+        setPatternsText(pats.join("\n"));
+        setPlaceholdersText(JSON.stringify(ph, null, 2));
+        setSupervisorCfg(sup ?? {});
+        setNotifierCfg(not ?? {});
+      }).catch(() => {
+      });
     }
     call(MAESTRO_ENDPOINTS.lanPinStatus, {}).then((value) => {
       setLanPinEnabled(value.enabled);
@@ -2971,8 +3069,7 @@ function MaestroSettingsTab({ rpcCall, configRpcCall }) {
         caption: "After a completed review, further pushes to the same MR trigger an automatic quick re-review.",
         checked: config.autoRereviewOnPush,
         onChange: (checked) => saveField("autoRereviewOnPush", checked)
-      }),
-      (0, import_react.createElement)(ReviewHistoryPanel, { rpcCall })
+      })
     ),
     (0, import_react.createElement)(
       "div",
@@ -3008,6 +3105,149 @@ function MaestroSettingsTab({ rpcCall, configRpcCall }) {
       (0, import_react.createElement)("h4", { style: headingStyle }, "Projects"),
       (0, import_react.createElement)(ProjectMappingsEditor, { mappings: config.projectMappings ?? [], onChange: (mappings) => saveField("projectMappings", mappings), catalog, globalReviewModel: config.reviewModel ?? null })
     ),
+    // Task 3: Guard/Blacklist/Supervisor/Notifier tabs — data-driven over guard domains
+    (0, import_react.createElement)(
+      "div",
+      { style: sectionStyle },
+      (0, import_react.createElement)("h4", { style: headingStyle }, "Guard / Blacklist / Supervisor / Notifier"),
+      (0, import_react.createElement)(
+        "div",
+        { style: tabBarStyle },
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "guard"), onClick: () => setActiveTab("guard") }, "Guard"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "blacklist"), onClick: () => setActiveTab("blacklist") }, "Blacklist"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "supervisor"), onClick: () => setActiveTab("supervisor") }, "Supervisor"),
+        (0, import_react.createElement)("button", { type: "button", style: tabButtonStyle(activeTab === "notifier"), onClick: () => setActiveTab("notifier") }, "Notifier")
+      ),
+      activeTab === "guard" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "guard" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Enforce publish block, git protection and cwd containment."),
+        (0, import_react.createElement)(ToggleField, {
+          label: "publishBlocked",
+          caption: "Block publish-related commands when enabled.",
+          checked: guard.publishBlocked === true,
+          onChange: (v) => saveGuard({ publishBlocked: v })
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "gitProtection.enabled",
+          caption: "Protect pushes to protected branches.",
+          checked: guard.gitProtection?.enabled === true,
+          onChange: (v) => saveGuard({ gitProtection: { enabled: v, branches: guard.gitProtection?.branches ?? ["master", "main"] } })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "gitProtection.branches (comma separated)"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: (guard.gitProtection?.branches ?? ["master", "main"]).join(", "),
+          placeholder: "master, main",
+          onChange: (e) => {
+            const branches = e.target.value.split(",").map((s) => s.trim()).filter(Boolean);
+            saveGuard({ gitProtection: { enabled: guard.gitProtection?.enabled ?? true, branches } });
+          }
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "cwdContainment",
+          caption: "Contain file operations to the session cwd.",
+          checked: guard.cwdContainment === true,
+          onChange: (v) => saveGuard({ cwdContainment: v })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "credentialPaths (comma separated)"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: (guard.credentialPaths ?? []).join(", "),
+          placeholder: "~/.config/credentials.yaml, ~/.config/cloudflared",
+          onChange: (e) => {
+            const credentialPaths = e.target.value.split(",").map((s) => s.trim()).filter(Boolean);
+            saveGuard({ credentialPaths });
+          }
+        })
+      ),
+      activeTab === "blacklist" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "blacklist" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "One pattern per line. These are blocked from being committed or published."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "patterns (one per line)"),
+        (0, import_react.createElement)("textarea", {
+          style: textareaStyle,
+          value: patternsText,
+          placeholder: "example-project\nacme-shop",
+          onChange: (e) => setPatternsText(e.target.value),
+          onBlur: (e) => commitBlacklistPatterns(e.target.value)
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "placeholders JSON"),
+        (0, import_react.createElement)("textarea", {
+          style: { ...textareaStyle, height: 90 },
+          value: placeholdersText,
+          placeholder: '{"example-project":"my-project"}',
+          onChange: (e) => setPlaceholdersText(e.target.value),
+          onBlur: () => commitPlaceholders()
+        }),
+        (0, import_react.createElement)("p", { style: captionStyle }, "Map blocked patterns to their placeholder suggestions."),
+        (0, import_react.createElement)("button", { type: "button", style: { ...secondaryButtonStyle, marginTop: 8 }, onClick: () => {
+          commitBlacklistPatterns(patternsText);
+          commitPlaceholders();
+        } }, "Save Blacklist")
+      ),
+      activeTab === "supervisor" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "supervisor" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Background daemon that auto-resumes crashed sessions."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "intervalMs"),
+        (0, import_react.createElement)("input", {
+          type: "number",
+          style: inputStyle,
+          value: supervisorCfg.intervalMs ?? "",
+          placeholder: "5000",
+          onChange: (e) => {
+            const v = e.target.value === "" ? void 0 : Number(e.target.value);
+            saveSupervisorCfg({ intervalMs: v });
+          }
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "downThreshold"),
+        (0, import_react.createElement)("input", {
+          type: "number",
+          style: inputStyle,
+          value: supervisorCfg.downThreshold ?? "",
+          placeholder: "3",
+          onChange: (e) => {
+            const v = e.target.value === "" ? void 0 : Number(e.target.value);
+            saveSupervisorCfg({ downThreshold: v });
+          }
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "autoResumeEnabled",
+          caption: "Automatically resume down sessions.",
+          checked: supervisorCfg.autoResumeEnabled === true,
+          onChange: (v) => saveSupervisorCfg({ autoResumeEnabled: v })
+        })
+      ),
+      activeTab === "notifier" && (0, import_react.createElement)(
+        "div",
+        { "data-tab": "notifier" },
+        (0, import_react.createElement)("p", { style: captionStyle }, "Telegram notifications for Maestro events."),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "telegram.botToken"),
+        (0, import_react.createElement)("input", {
+          type: "password",
+          autoComplete: "off",
+          style: inputStyle,
+          value: notifierCfg.telegram?.botToken ?? "",
+          placeholder: "123456:ABC-DEF...",
+          onChange: (e) => saveNotifierCfg({ telegram: { botToken: e.target.value } })
+        }),
+        (0, import_react.createElement)("label", { style: fieldLabelStyle }, "telegram.chatId"),
+        (0, import_react.createElement)("input", {
+          style: inputStyle,
+          value: notifierCfg.telegram?.chatId ?? "",
+          placeholder: "-1001234567890",
+          onChange: (e) => saveNotifierCfg({ telegram: { chatId: e.target.value } })
+        }),
+        (0, import_react.createElement)(ToggleField, {
+          label: "telegram.reviewNotifications",
+          caption: "Also notify about finished reviews.",
+          checked: notifierCfg.telegram?.reviewNotifications === true || notifierCfg.policy?.reviewNotifications === true,
+          onChange: (v) => saveNotifierCfg({ telegram: { reviewNotifications: v } })
+        })
+      )
+    ),
     error && (0, import_react.createElement)("p", { style: errorStyle }, error)
   );
 }
@@ -3051,7 +3291,7 @@ function registerSettingsNavIcon(label, root) {
 // src/client/index.tsx
 var SETTINGS_NAV_CSS2 = `
 
-/* maestro: replace the settings-nav fallback gear with the maestro glyph */
+/* maestro: replace the settings-nav fallback gear with the Maestro M-logo glyph */
 [${SETTINGS_NAV_MARKER}] > svg:first-child {
   display: none;
 }
@@ -3062,10 +3302,11 @@ var SETTINGS_NAV_CSS2 = `
   width: 16px;
   height: 16px;
   background: currentColor;
-  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
-  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
+  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
 }
 `;
+var inject = ["slots", "connection"];
 function installNavIconStyle() {
   const tag = document.createElement("style");
   tag.dataset.plugin = "@ddtcorex/dsh-maestro-config";

package/lib/index.d.ts

@@ -1,12 +1,35 @@
 import type { Context } from '@deepseek-ai/cordis';
+type RpcResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+        details: object;
+    };
+};
 import { type MaestroConfigService } from './service.ts';
 export declare const name = "maestro-config";
 export declare const inject: string[];
 declare module '@deepseek-ai/cordis' {
     interface Context {
         maestroConfig: MaestroConfigService;
+        connection: {
+            rpc: {
+                handle: (channel: string, handler: (endpoint: string, payload: unknown) => Promise<RpcResult<unknown>>, opts?: unknown) => () => void;
+            };
+        };
     }
 }
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export declare function apply(ctx: Context): void;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEpF,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAiB,CAAA;AAIpC,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,oBAAoB,CAAA;KACpC;CACF;AAmBD,8EAA8E;AAC9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuBxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,KAAK,SAAS,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAErH,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEpF,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAiB,CAAA;AAIpC,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,oBAAoB,CAAA;QACnC,UAAU,EAAE;YAAE,GAAG,EAAE;gBAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM,IAAI,CAAA;aAAE,CAAA;SAAE,CAAA;KAC/J;CACF;AAmBD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwBxC"}

package/lib/index.js

@@ -17,7 +17,13 @@ function fail(message) {
         },
     };
 }
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export function apply(ctx) {
     const svc = createMaestroConfigService();
     ctx.provide('maestroConfig', svc);
@@ -29,6 +35,7 @@ export function apply(ctx) {
         if (endpoint === 'get') {
             if (typeof body.domain !== 'string')
                 return fail('domain (string) is required');
+            // guard / guardBlacklist / supervisor / notifier are all valid domains here
             return ok(await svc.get(body.domain));
         }
         if (endpoint === 'set') {

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAA6B,MAAM,cAAc,CAAA;AAEpF,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAQzC,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO;YACP,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAuC;SACxE;KACF,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAA;IACxC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACd,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,QAAgB,EAAE,OAAgB,EAA+B,EAAE;QAC/G,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAwC,CAAA;QACnE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC/E,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7F,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACtC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAA6B,MAAM,cAAc,CAAA;AAEpF,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AASzC,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO;YACP,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAuC;SACxE;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAA;IACxC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACd,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,QAAgB,EAAE,OAAgB,EAA+B,EAAE;QAC/G,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAwC,CAAA;QACnE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC/E,4EAA4E;YAC5E,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7F,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACtC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAC9B,CAAA;AACH,CAAC"}

package/lib/types/client/Settings.d.ts

@@ -0,0 +1,11 @@
+type RpcCall = (endpoint: string, payload?: unknown, signal?: AbortSignal) => Promise<unknown>;
+export declare function Settings({ configRpcCall }: {
+    configRpcCall: RpcCall;
+}): import("react").DetailedReactHTMLElement<{
+    'data-maestro-guard-settings': string;
+    style: {
+        maxWidth: number;
+    };
+}, HTMLElement>;
+export default Settings;
+//# sourceMappingURL=Settings.d.ts.map

package/lib/types/client/Settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Settings.d.ts","sourceRoot":"","sources":["../../../src/client/Settings.tsx"],"names":[],"mappings":"AAIA,KAAK,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAiF9F,wBAAgB,QAAQ,CAAC,EAAE,aAAa,EAAE,EAAE;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE;;;;;gBAiRrE;AAGD,eAAe,QAAQ,CAAA"}

package/lib/types/client/index.d.ts

@@ -2,6 +2,7 @@ interface ClientCtx {
     get?(name: string): unknown;
     effect(fn: () => () => void, label?: string): unknown;
 }
+export declare const inject: readonly ["slots", "connection"];
 export declare function apply(ctx: ClientCtx): void;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAuCA,UAAU,SAAS;IACjB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACtD;AAaD,wBAAgB,KAAK,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CA+B1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.tsx"],"names":[],"mappings":"AAwCA,UAAU,SAAS;IACjB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACtD;AAED,eAAO,MAAM,MAAM,kCAAmC,CAAA;AAatD,wBAAgB,KAAK,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CA+B1C"}

package/lib/types/client/maestro-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maestro-card.d.ts","sourceRoot":"","sources":["../../../src/client/maestro-card.jsx"],"names":[],"mappings":"AAkeA;;;;;;;;gBAoRC"}
+{"version":3,"file":"maestro-card.d.ts","sourceRoot":"","sources":["../../../src/client/maestro-card.jsx"],"names":[],"mappings":"AAweA;;;;;;;;gBA0dC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddtcorex/dsh-maestro-config",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": false,
   "description": "Maestro Config — shared settings service for the dsh-maestro-* suite over the single namespaced store (~/.dsh/maestro/settings.json)",
   "type": "module",
@@ -34,16 +34,14 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.8"
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2"
   },
   "dependencies": {
-    "@ddtcorex/dsh-maestro-config-lib": "^0.1.1"
+    "@ddtcorex/dsh-maestro-config-lib": "^0.1.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
     "@types/node": "^22.0.0",
     "@types/qrcode": "^1.5.6",
     "@types/react": "~18.3.1",

package/src/client/index.tsx

@@ -7,12 +7,13 @@ import { registerSettingsNavIcon, SETTINGS_NAV_MARKER } from './settings-nav-ico
  * DSH 0.1.x gives external settings sections a generic gear and exposes no
  * icon field in the settings.section contract (mirrors dsh-better-sidebar):
  * the marker only claims this plugin's localized row and this CSS paints the
- * Lucide "audio-lines" glyph as a currentColor mask so it follows native nav
- * hover/active colors at the shell's 16px icon rhythm.
+ * Maestro M-logo glyph as a currentColor mask so it follows native nav
+ * hover/active colors at the shell's 16px icon rhythm. The path matches the
+ * sidebar MaestroTrigger (trigger.tsx#MaestroLogo) — M2 11 L5 4 L8 9 L11 4 L14 11.
  */
 const SETTINGS_NAV_CSS = `
 
-/* maestro: replace the settings-nav fallback gear with the maestro glyph */
+/* maestro: replace the settings-nav fallback gear with the Maestro M-logo glyph */
 [${SETTINGS_NAV_MARKER}] > svg:first-child {
   display: none;
 }
@@ -23,8 +24,8 @@ const SETTINGS_NAV_CSS = `
   width: 16px;
   height: 16px;
   background: currentColor;
-  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
-  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 10v3'/%3E%3Cpath d='M6 4v16'/%3E%3Cpath d='M10 8v8'/%3E%3Cpath d='M14 4v16'/%3E%3Cpath d='M18 6v12'/%3E%3Cpath d='M22 10v3'/%3E%3C/svg%3E") center / contain no-repeat;
+  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
 }
 `
 
@@ -42,6 +43,8 @@ interface ClientCtx {
   effect(fn: () => () => void, label?: string): unknown
 }
 
+export const inject = ['slots', 'connection'] as const
+
 function installNavIconStyle(): () => void {
   const tag = document.createElement('style')
   tag.dataset.plugin = '@ddtcorex/dsh-maestro-config'

package/src/client/maestro-card.jsx

@@ -86,6 +86,32 @@ const codeStyle = {
   wordBreak: 'break-all',
 }
 
+const textareaStyle = {
+  ...inputStyle,
+  height: 120,
+  padding: '8px 12px',
+  resize: 'vertical',
+}
+
+const tabBarStyle = {
+  display: 'flex',
+  gap: 8,
+  borderBottom: '1px solid var(--dsw-alias-border-l2)',
+  marginBottom: 16,
+}
+
+const tabButtonStyle = (active) => ({
+  padding: '8px 14px',
+  border: 'none',
+  borderBottom: active ? '2px solid var(--dsw-alias-button-primary-fill)' : '2px solid transparent',
+  background: 'transparent',
+  color: active ? 'var(--dsw-alias-label-primary)' : 'var(--dsw-alias-label-secondary)',
+  font: 'inherit',
+  fontSize: 13,
+  fontWeight: active ? 600 : 400,
+  cursor: 'pointer',
+})
+
 /** QR code centered in a light tile with an even scanner-friendly quiet zone. */
 function QrImage({ url, size = 104 }) {
   const [dataUrl, setDataUrl] = useState(null)
@@ -373,26 +399,6 @@ function ToggleField({ label, caption, checked, onChange }) {
   )
 }
 
-/** Newest-first list of recorded review runs from the host's reviews.json. */
-function ReviewHistoryPanel({ rpcCall }) {
-  const [entries, setEntries] = useState(null)
-  useEffect(() => {
-    rpcCall(MAESTRO_ENDPOINTS.reviewsList, {})
-      .then(res => { if (res?.ok) setEntries(res.value ?? []) })
-      .catch(() => setEntries([]))
-  }, [])
-  if (entries === null) return h('p', { style: captionStyle }, 'Loading review history…')
-  if (entries.length === 0) return h('p', { style: captionStyle }, 'No reviews recorded yet.')
-  const icon = entry => entry.status === 'completed' ? '✅' : entry.status === 'failed' ? '⚠️' : '👀'
-  return h('ul', { style: { listStyle: 'none', margin: 0, padding: 0 } },
-    entries.map(entry => h('li', { key: entry.id, style: { padding: '6px 0', borderBottom: '1px solid var(--dsw-alias-separator-default, #333)', fontSize: 13 } },
-      h('span', null, `${icon(entry)} ${entry.projectPath} !${entry.mrIid} · ${entry.mode}${entry.trigger !== 'mention' ? ` · ${entry.trigger}` : ''}`),
-      h('div', { style: captionStyle },
-        `${new Date(entry.startedAt).toLocaleString()}${entry.summary ? ` — ${entry.summary}` : ''}${entry.error ? ` — ${entry.error}` : ''}`),
-    )),
-  )
-}
-
 /** One selectable LAN address chip + the QR of the currently selected URL. */
 function LanAccess({ proxyStatus, lanPin }) {
   const urls = proxyStatus?.lanUrls ?? []
@@ -492,6 +498,13 @@ export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
   const [lanPinEnabled, setLanPinEnabled] = useState(false)
   const [lanPin, setLanPin] = useState(null)
   const [showLanPin, setShowLanPin] = useState(false)
+  // Task 3: Guard/Blacklist/Supervisor/Notifier tabs state
+  const [activeTab, setActiveTab] = useState('guard')
+  const [guard, setGuard] = useState({})
+  const [patternsText, setPatternsText] = useState('')
+  const [placeholdersText, setPlaceholdersText] = useState('')
+  const [supervisorCfg, setSupervisorCfg] = useState({})
+  const [notifierCfg, setNotifierCfg] = useState({})
 
   const call = async (endpoint, payload) => {
     const res = await rpcCall(endpoint, payload)
@@ -499,6 +512,60 @@ export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
     return res.value
   }
 
+  // Helpers for guard/supervisor/notifier domains via generic config RPC (Task 3)
+  const unwrap = (res) => {
+    if (res && typeof res === 'object' && 'ok' in res) {
+      if (res.ok) return res.value
+      throw new Error(res.error?.message ?? 'RPC failed')
+    }
+    return res
+  }
+  const cfgGet = async (domain) => {
+    if (!configRpcCall) throw new Error('config RPC not available')
+    const res = await configRpcCall('get', { domain })
+    return unwrap(res)
+  }
+  const cfgSet = async (domain, patch) => {
+    if (!configRpcCall) throw new Error('config RPC not available')
+    const res = await configRpcCall('set', { domain, patch })
+    return unwrap(res)
+  }
+  const saveGuard = async (patch) => {
+    setError(null)
+    const next = { ...guard, ...patch }
+    if (patch.gitProtection && guard.gitProtection) next.gitProtection = { ...guard.gitProtection, ...patch.gitProtection }
+    setGuard(next)
+    try { await cfgSet('guard', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const commitBlacklistPatterns = async (text) => {
+    const patterns = text.split('\n').map(s => s.trim()).filter(Boolean)
+    setError(null)
+    try { await cfgSet('guardBlacklist', { patterns }) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const commitPlaceholders = async () => {
+    setError(null)
+    let obj = {}
+    try { obj = placeholdersText.trim() ? JSON.parse(placeholdersText) : {}; if (typeof obj !== 'object' || obj === null || Array.isArray(obj)) throw new Error('placeholders must be JSON object') } catch (e) { setError(`placeholders JSON invalid: ${e.message ?? String(e)}`); return }
+    try { await cfgSet('guardBlacklist', { placeholders: obj }) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const saveSupervisorCfg = async (patch) => {
+    setError(null)
+    setSupervisorCfg(prev => ({ ...prev, ...patch }))
+    try { await cfgSet('supervisor', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+  const saveNotifierCfg = async (patch) => {
+    setError(null)
+    setNotifierCfg(prev => {
+      const next = { ...prev }
+      for (const [k, v] of Object.entries(patch)) {
+        if (k === 'telegram' && typeof v === 'object' && v !== null) next.telegram = { ...(prev.telegram ?? {}), ...v }
+        else next[k] = v
+      }
+      return next
+    })
+    try { await cfgSet('notifier', patch) } catch (e) { setError(e.message ?? String(e)) }
+  }
+
   const refresh = async () => {
     try { setStatus(await call(MAESTRO_ENDPOINTS.status, {})) } catch { /* transient failure, ignore */ }
     try { setProxyStatus(await call(MAESTRO_ENDPOINTS.proxyStatus, {})) } catch { /* proxy row may be starting */ }
@@ -520,6 +587,21 @@ export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
           }
         })
         .catch(() => { /* supervisor domain not yet set or config service unavailable */ })
+      // Task 3: load Guard/Blacklist/Supervisor/Notifier domains
+      Promise.all([
+        cfgGet('guard').catch(() => ({})),
+        cfgGet('guardBlacklist').catch(() => ({ patterns: [], placeholders: {} })),
+        cfgGet('supervisor').catch(() => ({})),
+        cfgGet('notifier').catch(() => ({})),
+      ]).then(([g, bl, sup, not]) => {
+        setGuard(g ?? {})
+        const pats = Array.isArray(bl?.patterns) ? bl.patterns : []
+        const ph = bl?.placeholders && typeof bl.placeholders === 'object' ? bl.placeholders : {}
+        setPatternsText(pats.join('\n'))
+        setPlaceholdersText(JSON.stringify(ph, null, 2))
+        setSupervisorCfg(sup ?? {})
+        setNotifierCfg(not ?? {})
+      }).catch(() => {})
     }
     call(MAESTRO_ENDPOINTS.lanPinStatus, {})
       .then(value => { setLanPinEnabled(value.enabled); if (value.enabled) setLanPin(value.pin ?? null) })
@@ -720,7 +802,6 @@ export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
         checked: config.autoRereviewOnPush,
         onChange: checked => saveField('autoRereviewOnPush', checked),
       }),
-      h(ReviewHistoryPanel, { rpcCall }),
     ),
 
     h('div', { style: sectionStyle },
@@ -754,6 +835,129 @@ export function MaestroSettingsTab({ rpcCall, configRpcCall }) {
       h(ProjectMappingsEditor, { mappings: config.projectMappings ?? [], onChange: mappings => saveField('projectMappings', mappings), catalog, globalReviewModel: config.reviewModel ?? null }),
     ),
 
+    // Task 3: Guard/Blacklist/Supervisor/Notifier tabs — data-driven over guard domains
+    h('div', { style: sectionStyle },
+      h('h4', { style: headingStyle }, 'Guard / Blacklist / Supervisor / Notifier'),
+      h('div', { style: tabBarStyle },
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'guard'), onClick: () => setActiveTab('guard') }, 'Guard'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'blacklist'), onClick: () => setActiveTab('blacklist') }, 'Blacklist'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'supervisor'), onClick: () => setActiveTab('supervisor') }, 'Supervisor'),
+        h('button', { type: 'button', style: tabButtonStyle(activeTab === 'notifier'), onClick: () => setActiveTab('notifier') }, 'Notifier'),
+      ),
+      activeTab === 'guard' && h('div', { 'data-tab': 'guard' },
+        h('p', { style: captionStyle }, 'Enforce publish block, git protection and cwd containment.'),
+        h(ToggleField, {
+          label: 'publishBlocked',
+          caption: 'Block publish-related commands when enabled.',
+          checked: guard.publishBlocked === true,
+          onChange: v => saveGuard({ publishBlocked: v }),
+        }),
+        h(ToggleField, {
+          label: 'gitProtection.enabled',
+          caption: 'Protect pushes to protected branches.',
+          checked: guard.gitProtection?.enabled === true,
+          onChange: v => saveGuard({ gitProtection: { enabled: v, branches: guard.gitProtection?.branches ?? ['master', 'main'] } }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'gitProtection.branches (comma separated)'),
+        h('input', {
+          style: inputStyle,
+          value: (guard.gitProtection?.branches ?? ['master', 'main']).join(', '),
+          placeholder: 'master, main',
+          onChange: e => {
+            const branches = e.target.value.split(',').map(s => s.trim()).filter(Boolean)
+            saveGuard({ gitProtection: { enabled: guard.gitProtection?.enabled ?? true, branches } })
+          },
+        }),
+        h(ToggleField, {
+          label: 'cwdContainment',
+          caption: 'Contain file operations to the session cwd.',
+          checked: guard.cwdContainment === true,
+          onChange: v => saveGuard({ cwdContainment: v }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'credentialPaths (comma separated)'),
+        h('input', {
+          style: inputStyle,
+          value: (guard.credentialPaths ?? []).join(', '),
+          placeholder: '~/.config/credentials.yaml, ~/.config/cloudflared',
+          onChange: e => {
+            const credentialPaths = e.target.value.split(',').map(s => s.trim()).filter(Boolean)
+            saveGuard({ credentialPaths })
+          },
+        }),
+      ),
+      activeTab === 'blacklist' && h('div', { 'data-tab': 'blacklist' },
+        h('p', { style: captionStyle }, 'One pattern per line. These are blocked from being committed or published.'),
+        h('label', { style: fieldLabelStyle }, 'patterns (one per line)'),
+        h('textarea', {
+          style: textareaStyle,
+          value: patternsText,
+          placeholder: 'example-project\nacme-shop',
+          onChange: e => setPatternsText(e.target.value),
+          onBlur: e => commitBlacklistPatterns(e.target.value),
+        }),
+        h('label', { style: fieldLabelStyle }, 'placeholders JSON'),
+        h('textarea', {
+          style: { ...textareaStyle, height: 90 },
+          value: placeholdersText,
+          placeholder: '{"example-project":"my-project"}',
+          onChange: e => setPlaceholdersText(e.target.value),
+          onBlur: () => commitPlaceholders(),
+        }),
+        h('p', { style: captionStyle }, 'Map blocked patterns to their placeholder suggestions.'),
+        h('button', { type: 'button', style: { ...secondaryButtonStyle, marginTop: 8 }, onClick: () => { commitBlacklistPatterns(patternsText); commitPlaceholders() } }, 'Save Blacklist'),
+      ),
+      activeTab === 'supervisor' && h('div', { 'data-tab': 'supervisor' },
+        h('p', { style: captionStyle }, 'Background daemon that auto-resumes crashed sessions.'),
+        h('label', { style: fieldLabelStyle }, 'intervalMs'),
+        h('input', {
+          type: 'number',
+          style: inputStyle,
+          value: supervisorCfg.intervalMs ?? '',
+          placeholder: '5000',
+          onChange: e => { const v = e.target.value === '' ? undefined : Number(e.target.value); saveSupervisorCfg({ intervalMs: v }) },
+        }),
+        h('label', { style: fieldLabelStyle }, 'downThreshold'),
+        h('input', {
+          type: 'number',
+          style: inputStyle,
+          value: supervisorCfg.downThreshold ?? '',
+          placeholder: '3',
+          onChange: e => { const v = e.target.value === '' ? undefined : Number(e.target.value); saveSupervisorCfg({ downThreshold: v }) },
+        }),
+        h(ToggleField, {
+          label: 'autoResumeEnabled',
+          caption: 'Automatically resume down sessions.',
+          checked: supervisorCfg.autoResumeEnabled === true,
+          onChange: v => saveSupervisorCfg({ autoResumeEnabled: v }),
+        }),
+      ),
+      activeTab === 'notifier' && h('div', { 'data-tab': 'notifier' },
+        h('p', { style: captionStyle }, 'Telegram notifications for Maestro events.'),
+        h('label', { style: fieldLabelStyle }, 'telegram.botToken'),
+        h('input', {
+          type: 'password',
+          autoComplete: 'off',
+          style: inputStyle,
+          value: notifierCfg.telegram?.botToken ?? '',
+          placeholder: '123456:ABC-DEF...',
+          onChange: e => saveNotifierCfg({ telegram: { botToken: e.target.value } }),
+        }),
+        h('label', { style: fieldLabelStyle }, 'telegram.chatId'),
+        h('input', {
+          style: inputStyle,
+          value: notifierCfg.telegram?.chatId ?? '',
+          placeholder: '-1001234567890',
+          onChange: e => saveNotifierCfg({ telegram: { chatId: e.target.value } }),
+        }),
+        h(ToggleField, {
+          label: 'telegram.reviewNotifications',
+          caption: 'Also notify about finished reviews.',
+          checked: notifierCfg.telegram?.reviewNotifications === true || notifierCfg.policy?.reviewNotifications === true,
+          onChange: v => saveNotifierCfg({ telegram: { reviewNotifications: v } }),
+        }),
+      ),
+    ),
+
     error && h('p', { style: errorStyle }, error),
   )
 }

package/src/host/index.ts

@@ -1,6 +1,7 @@
-import type {} from '@deepseek-ai/dsh-client-connection'
 import type { Context } from '@deepseek-ai/cordis'
-import type { RpcErrorDetailsMap, RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api'
+
+type RpcResult<T> = { ok: true; value: T } | { ok: false; error: { code: string; message: string; details: object } }
+type RpcErrorDetailsMap = { 'bad-request': { issues: object[] } }
 import { createMaestroConfigService, type MaestroConfigService } from './service.ts'
 
 export const name = 'maestro-config'
@@ -11,6 +12,7 @@ const RPC_CHANNEL = '/dsh-maestro-config'
 declare module '@deepseek-ai/cordis' {
   interface Context {
     maestroConfig: MaestroConfigService
+    connection: { rpc: { handle: (channel: string, handler: (endpoint: string, payload: unknown) => Promise<RpcResult<unknown>>, opts?: unknown) => () => void } }
   }
 }
 
@@ -31,7 +33,13 @@ function fail(message: string): RpcResult<never> {
   }
 }
 
-/** Publish maestroConfig over the shared store + loopback RPC for clients. */
+/**
+ * Publish maestroConfig over the shared store + loopback RPC for clients.
+ * Exposes guard/guardBlacklist/supervisor/notifier domains (Task 1 validators)
+ * via generic get/set — validation is delegated to the lib's domain validators.
+ * Host also handles '/dsh-maestro-config/get' and '/dsh-maestro-config/set'
+ * style calls through the single channel with endpoint dispatch.
+ */
 export function apply(ctx: Context): void {
   const svc = createMaestroConfigService()
   ctx.provide('maestroConfig', svc)
@@ -43,6 +51,7 @@ export function apply(ctx: Context): void {
       }
       if (endpoint === 'get') {
         if (typeof body.domain !== 'string') return fail('domain (string) is required')
+        // guard / guardBlacklist / supervisor / notifier are all valid domains here
         return ok(await svc.get(body.domain))
       }
       if (endpoint === 'set') {