@t4r71/dsh-dual-axis 0.1.0

package/lib/index.js

@@ -0,0 +1,2591 @@
+import z from "@deepseek-ai/schemastery";
+import { dirname, sep } from "node:path";
+import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
+import { setSandboxMode } from "@deepseek-ai/dsh-sandbox-policy";
+import { CommandDefinitionId } from "@deepseek-ai/dsh-commands/brand";
+import { SandboxedFileSystem } from "@deepseek-ai/dsh-fs-sandbox";
+import { FsError } from "@deepseek-ai/dsh-fs";
+import { stat } from "node:fs/promises";
+//#region lib/types/axis.js
+/**
+* The read/write ACCESS AXES of the file sandbox: the per-axis vocabulary a
+* session selects and the lossless mapping onto the legacy single `mode`.
+*
+* This is the 0.1.7 port of the algebra upstream deleted. 0.1.6 shipped it as
+* `@deepseek-ai/dsh-sandbox/access` (152 lines) and
+* `@deepseek-ai/dsh-sandbox/scope` (152 lines); 0.1.7 has neither symbol nor
+* file, so the package carries its own copy and keeps the 0.1.6 semantics
+* verbatim: four kinds, `custom` = base + allow - deny with deny winning.
+*
+* One axis answers "which absolute paths may this execution touch". `deny`
+* permits nothing, `workspace` permits the calling session's workspace root
+* plus the platform temp areas, `all` is the whole host filesystem, and
+* `custom` names a BASE kind plus absolute path ADDITIONS and REMOVALS —
+* path lists, not patterns.
+*
+* `mode` REMAINS the write axis's persistence spelling. The session-format
+* whitelist pins its literal values, so this module keeps `mode` derivable
+* from the write scope in both directions instead of replacing it:
+* {@link scopeOfMode} and {@link modeOfScope} are the two halves of that
+* bijection, and `custom` maps onto the mode implied by its own base.
+*
+* @module @t4r71/dsh-dual-axis/axis
+*/
+/** Every {@link AxisScopeKind}, for option advertisement and untrusted-value validation. */
+const AXIS_KINDS = [
+	"deny",
+	"workspace",
+	"all",
+	"custom"
+];
+/** Every {@link AxisBase}, for option advertisement and untrusted-value validation. */
+const AXIS_BASES = [
+	"deny",
+	"workspace",
+	"all"
+];
+/** The default READ axis: every mode permitted reading before the axes existed, so the whole host. */
+const DEFAULT_READ_SCOPE = { kind: "all" };
+/** The default WRITE axis: the session workspace plus the platform temp areas. */
+const DEFAULT_WRITE_SCOPE = { kind: "workspace" };
+/**
+* Whether an untrusted runtime value names one of the three `SandboxMode` members.
+*
+* The TYPE says `SandboxMode`; the session LOG says whatever a past writer put
+* there. A replayed or foreign log can carry a mode this build never wrote, and
+* a fold that trusts it would take the whole projected axis cell down with it.
+* This guard is the boundary that turns 'the log claims a mode' into 'the log
+* claims a mode this build understands': callers read a false answer as 'names
+* no mode' and keep the axis value they already had.
+* @param value - the untrusted value from a session-log payload.
+* @returns true when the value is a `SandboxMode`.
+*/
+function isSandboxMode(value) {
+	return value === "read-only" || value === "workspace-write" || value === "danger-full-access";
+}
+/**
+* The write scope a legacy `mode` means.
+* @param mode - the sandbox mode.
+* @returns the equivalent write scope.
+*/
+function scopeOfMode(mode) {
+	switch (mode) {
+		case "read-only": return { kind: "deny" };
+		case "workspace-write": return { kind: "workspace" };
+		case "danger-full-access": return { kind: "all" };
+	}
+}
+/**
+* The mode an axis BASE implies — the shared half of {@link modeOfScope}. The
+* three-value mode set is closed, so every base spells exactly one mode.
+* @param base - the axis base to spell.
+* @returns the mode that base has always been persisted as.
+*/
+function modeOfAxisBase(base) {
+	switch (base) {
+		case "deny": return "read-only";
+		case "workspace": return "workspace-write";
+		case "all": return "danger-full-access";
+	}
+}
+/**
+* The legacy `mode` a write scope is spelled as. `custom` resolves through its
+* own base: the mode names the containment the fence must not exceed, while the
+* scope's additions and removals ride beside it.
+* @param scope - the write axis value.
+* @returns the mode that spells this scope's base.
+*/
+function modeOfScope(scope) {
+	return scope.kind === "custom" ? modeOfAxisBase(scope.base) : modeOfAxisBase(scope.kind);
+}
+/**
+* Read the axis pair a resolved policy carries, falling back to the defaults.
+* The policy's `mode` is authoritative for the write axis's BASE: a policy
+* that carries no write axes writes exactly what its mode always meant, so
+* every pre-existing policy keeps its exact behavior.
+*
+* 0.1.7's `SandboxExecutionPolicy` has no `readScope` / `writeScope`
+* members (only `mode`, `workspaceRoot`, `sessionId?`), so the axes arrive
+* through the extra argument this package's own fence passes. The
+* `mode`-derived fallback keeps the function total for the upstream type.
+* @param policy - the resolved policy (supplies `mode`).
+* @param axes - the session's axis pair, when the caller holds one.
+* @returns both axes in force.
+*/
+function effectiveScopes(policy, axes) {
+	return {
+		read: axes?.read ?? DEFAULT_READ_SCOPE,
+		write: axes?.write ?? scopeOfMode(policy.mode)
+	};
+}
+/**
+* Whether a policy's `mode` still spells its write scope's base — the
+* invariant every construction site must preserve. A custom write scope whose
+* base disagrees with `mode` would enforce containment the session never chose.
+* @param policy - the policy to check.
+* @param axes - the session's axis pair, when the caller holds one.
+* @returns true when the two agree.
+*/
+function isModeConsistent(policy, axes) {
+	return policy.mode === modeOfScope(effectiveScopes(policy, axes).write);
+}
+//#endregion
+//#region lib/types/scope.js
+/**
+* The shared path-range ALGEBRA behind both access axes: one pure evaluation
+* from an {@link AxisScope} to the canonical allow and deny root sets the
+* fence consumes.
+*
+* This is the 0.1.7 port of 0.1.6's `@deepseek-ai/dsh-sandbox/scope`
+* (152 lines), reduced to what a fence needs and made source-agnostic:
+*
+* - `workspace` derives its roots from 0.1.7's own
+*   `writableRoots(policy)` (`@deepseek-ai/dsh-sandbox`, re-exported from
+*   `packages/sandbox/sandbox/src/roots.ts:52`), so the fence agrees with
+*   the Seatbelt profile and the write fence by construction.
+* - Containment itself is NOT evaluated here. 0.1.6 took the enforcement
+*   layer's `contains` predicate as a parameter; this port keeps that shape
+*   but narrows it to the SYNCHRONOUS lexical predicate the pure tests use,
+*   and the filesystem-identity fallback lives in the fence
+*   (`fs-fence.ts`), which is where the canonical target key exists.
+*
+* `resolveScope` returns the sets; the fence applies them with deny-wins
+* precedence through {@link scopeContains}.
+*
+* @module @t4r71/dsh-dual-axis/scope
+*/
+/** Thrown when a configured `custom` scope entry cannot name an absolute path. */
+var ScopeConfigError = class extends Error {
+	entry;
+	value;
+	constructor(entry, value) {
+		super(`sandbox scope: \`${entry}\` entry ${JSON.stringify(value)} must be a non-empty absolute path`);
+		this.entry = entry;
+		this.value = value;
+		this.name = "ScopeConfigError";
+	}
+};
+/** Canonicalize one configured custom entry, failing closed on anything that cannot name an absolute host path. */
+function canonicalEntry(value, entry) {
+	if (value.trim().length === 0 || !isAbsoluteSpelling(value)) throw new ScopeConfigError(entry, value);
+	return canonicalPath(value);
+}
+/**
+* Whether a configured path is spelled absolutely on this host. Both POSIX
+* (`/x`) and Windows (`C:\\x`, `\\\\server\\share`) spellings are accepted
+* because a policy may be authored for one world and resolved in another; the
+* canonical resolution that follows is what actually binds it to this host.
+* @param path - the configured path spelling.
+* @returns whether the spelling is absolute.
+*/
+function isAbsoluteSpelling(path) {
+	return path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path) || path.startsWith("\\\\");
+}
+/**
+* Evaluate one axis against a workspace root. `deny` permits nothing;
+* `workspace` yields the shared writable roots; `all` is unbounded;
+* `custom` yields its base plus its own additions, with its removals listed
+* separately so the fence can apply them with precedence.
+*
+* A `custom` scope whose base is `all` stays unbounded: "everything except
+* these directories" is still everything-except, so its removals must survive
+* into {@link ResolvedScope.deny} rather than being flattened into an allow
+* list that could not express them.
+* @param scope - the axis value.
+* @param policy - the workspace root `workspace` and `custom` scopes resolve against.
+* @returns the evaluated range.
+* @throws {ScopeConfigError} when a `custom` entry is not a non-empty absolute path.
+*/
+function resolveScope(scope, policy) {
+	if (scope.kind !== "custom") return resolveBase(scope.kind, policy);
+	const base = resolveBase(scope.base, policy);
+	const allow = [...base.allow, ...scope.allow.map((entry) => canonicalEntry(entry, "allow"))];
+	const deny = scope.deny.map((entry) => canonicalEntry(entry, "deny"));
+	return {
+		unbounded: base.unbounded,
+		allow: dedupe(allow),
+		deny: dedupe(deny)
+	};
+}
+/** Evaluate a base (or closed) kind — the shared half of {@link resolveScope}. */
+function resolveBase(base, policy) {
+	switch (base) {
+		case "deny": return {
+			unbounded: false,
+			allow: [],
+			deny: []
+		};
+		case "workspace": return {
+			unbounded: false,
+			allow: dedupe(writableRoots({
+				mode: "workspace-write",
+				workspaceRoot: policy.workspaceRoot
+			})),
+			deny: []
+		};
+		case "all": return {
+			unbounded: true,
+			allow: [],
+			deny: []
+		};
+	}
+}
+/** Stable-order dedupe: keeps the first spelling of each value. */
+function dedupe(values) {
+	return [...new Set(values)];
+}
+/**
+* Whether `target` is the root itself or lies beneath it, by canonical
+* spelling. Case-insensitive on Windows, matching that filesystem's
+* convention.
+* @param target - canonical target path.
+* @param root - canonical root path.
+* @param caseSensitive - whether lexical comparison preserves case; defaults to the host convention.
+* @returns whether the target is the root or a descendant of it.
+*/
+function isLexicallyUnder(target, root, caseSensitive = process.platform !== "win32") {
+	const comparableTarget = caseSensitive ? target : target.toLowerCase();
+	const comparableRoot = caseSensitive ? root : root.toLowerCase();
+	if (comparableTarget === comparableRoot) return true;
+	const prefix = comparableRoot.endsWith(sep) ? comparableRoot : comparableRoot + sep;
+	return comparableTarget.startsWith(prefix);
+}
+/**
+* Whether `targetKey` is permitted by an evaluated scope. Removal wins over
+* addition: a deny root containing the target refuses it even when an allow
+* root — or an unbounded axis — would otherwise permit it.
+* @param scope - the evaluated scope.
+* @param targetKey - the target's canonical identity key (the resolved path).
+* @param contains - the containment predicate; defaults to {@link isLexicallyUnder}.
+* @returns whether the scope permits the target.
+*/
+function scopeContains(scope, targetKey, contains = isLexicallyUnder) {
+	for (const root of scope.deny) if (contains(targetKey, root)) return false;
+	if (scope.unbounded) return true;
+	for (const root of scope.allow) if (contains(targetKey, root)) return true;
+	return false;
+}
+//#endregion
+//#region lib/types/config.js
+/**
+* The dual-axis settings surface: the 0.1.7 spelling of the section 0.1.6
+* registered through `ctx.settings.installSection`.
+*
+* 0.1.7 removed both `installSection` and `settings.register(ns, schema)`:
+* `SettingsForms.describe()` projects exactly the Config schemas of LOADED
+* Loader entries (`packages/settings/settings/src/index.ts:302-340`) and
+* `write()` refuses a namespace with no matching entry
+* (`:382-384`, `No configurable plugin entry`). The namespace IS the entry
+* id, so this package's own row id in `cordis.patch.yml` — `dual-axis` — is
+* the settings namespace. 0.1.6's separate `sandbox-axis` namespace name is
+* therefore retired.
+*
+* 0.1.7 also added the volatile gate: a field that is not beneath a
+* `.volatile()` node is neither projected into the form
+* (`packages/settings/settings/src/schema.ts:37-47`) nor writable
+* (`:74-78`), and an entry with no volatile field at all is refused outright
+* (`index.ts:385-386`). Both axes are marked volatile here.
+*
+* The schema is deliberately `z.any()` per axis, exactly as in 0.1.6:
+* schemastery's union types strip the `custom` branch's `base/allow/deny`
+* payload, which would silently degrade a configured custom axis into an axis
+* carrying no paths. Shape validation is {@link normalizeScope}'s job.
+*
+* @module @t4r71/dsh-dual-axis/config
+*/
+/**
+* This package's row id in `cordis.patch.yml`. It doubles as the 0.1.7
+* settings namespace (the Loader entry id) and, prefixed with the package
+* name, as the `plugins.row.config` slot entry key the client half uses.
+*/
+const DUAL_AXIS_ROW_ID = "dual-axis";
+/**
+* The 0.1.6 settings namespace name, kept only so a migration can recognize
+* the retired spelling. Nothing registers under it in 0.1.7.
+*/
+const RETIRED_SETTINGS_NAMESPACE = "sandbox-axis";
+/**
+* The composition config's schema. Both axes are `.volatile()` and
+* `z.any()` — see the module docstring for why each is required.
+*
+* Not annotated `z<Config>`: `.volatile()` widens the field's inferred type
+* to schemastery's `Volatile<>` accessor, which the plain `Config` interface
+* does not describe. The repo's own volatile Configs
+* (`packages/core/agent-default-model/src/index.ts:51-55`) are inferred the
+* same way, and {@link axesOf} re-establishes the declared shape.
+*/
+const Config = z.object({
+	read: z.any().volatile(),
+	write: z.any().volatile(),
+	groups: z.array(z.any()).default([]).volatile(),
+	defaultGroups: z.array(z.string()).default([]).volatile()
+});
+/**
+* Collect one `custom` axis's path list: every entry must be a non-empty
+* absolute path.
+* @param label - the axis name used in the error message.
+* @param entry - the list name used in the error message (`allow` or `deny`).
+* @param value - the untrusted list value.
+* @returns the validated path list.
+* @throws When the value is not a string array, or holds a non-absolute path.
+*/
+function pathList(label, entry, value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new Error(`dual-axis: ${label} ${entry} must be an array of absolute path strings`);
+	for (const item of value) if (item.length === 0 || !isAbsoluteSpelling(item)) throw new Error(`dual-axis: ${label} ${entry} entry ${JSON.stringify(item)} must be an absolute path`);
+	return [...value];
+}
+/**
+* Coerce one axis value from a config document (which a human may have edited)
+* into a legal {@link AxisScope}, throwing rather than guessing.
+*
+* An unreadable axis must not become some other, wider or narrower grant:
+* throwing fails the row's mount or the settings write on the spot instead of
+* proceeding under an invented boundary. This is 0.1.6's `normalizeScope`,
+* unchanged.
+* @param label - the axis name used in error messages (`read` or `write`).
+* @param value - the untrusted axis value.
+* @returns the validated axis value.
+* @throws When the value is not one of the four kinds, or a custom entry is not absolute.
+*/
+function normalizeScope(label, value) {
+	if (typeof value !== "object" || value === null) throw new Error(`dual-axis: ${label} must be an access-axis object, received ${JSON.stringify(value)}`);
+	const candidate = value;
+	if (typeof candidate.kind !== "string" || !AXIS_KINDS.includes(candidate.kind)) throw new Error(`dual-axis: ${label} carries unknown kind ${JSON.stringify(candidate.kind)} (expected: ${AXIS_KINDS.join(", ")})`);
+	if (candidate.kind !== "custom") return { kind: candidate.kind };
+	if (typeof candidate.base !== "string" || !AXIS_BASES.includes(candidate.base)) throw new Error(`dual-axis: ${label} custom base must be ${AXIS_BASES.join(", ")}, received ${JSON.stringify(candidate.base)}`);
+	return {
+		kind: "custom",
+		base: candidate.base,
+		groups: groupIds(label, candidate.groups),
+		allow: pathList(label, "allow", candidate.allow),
+		deny: pathList(label, "deny", candidate.deny)
+	};
+}
+/**
+* Collect one `custom` axis's rule-group references. Only the speaker matters
+* here — an id is a name the settings page resolves, so this checks that the
+* list is a list of non-empty names and nothing more; whether the name exists is
+* decided at the moment of use ({@link resolveEffectiveAxes}), where a missing
+* one can be refused instead of quietly dropped.
+* @param label - the axis name used in the error message.
+* @param value - the untrusted `groups` value.
+* @returns the validated id list.
+* @throws When the value is not an array of non-empty strings.
+*/
+function groupIds(label, value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0)) throw new Error(`dual-axis: ${label} groups must be an array of non-empty rule-group ids`);
+	return [...new Set(value)];
+}
+/**
+* Whether two axes describe the same boundary. Compared member by member
+* rather than by reference: every re-parse builds fresh axis objects, and a
+* custom axis's two path lists carry order as part of their value.
+* @param left - one axis.
+* @param right - another axis.
+* @returns whether both describe the same axis.
+*/
+function sameScope(left, right) {
+	if (left.kind !== right.kind) return false;
+	if (left.kind !== "custom" || right.kind !== "custom") return true;
+	const sameList = (a, b) => a.length === b.length && a.every((value, index) => value === b[index]);
+	return left.base === right.base && sameList(left.groups ?? [], right.groups ?? []) && sameList(left.allow, right.allow) && sameList(left.deny, right.deny);
+}
+/**
+* Read both axes out of one settings/config value.
+*
+* The parameter is UNTRUSTED on purpose: the same function serves the
+* composition layer's parsed Config, the settings service's projected
+* descriptor (an `unknown` on the wire between two packages), and a
+* hand-edited document, and none of those three is guaranteed to carry the
+* declared shape. Both axes therefore pass through {@link normalizeScope},
+* which is where an illegal value becomes a throw instead of an invented
+* boundary; a missing side falls back to the built-in default axis.
+* @param section - the section's current resolved value, whatever carries it.
+* @returns both axes.
+* @throws When either axis's shape is illegal.
+*/
+function axesOf(section) {
+	const declared = section === null || typeof section !== "object" ? {} : section;
+	return {
+		read: normalizeScope("read", unwrapVolatile(declared.read) ?? DEFAULT_READ_SCOPE),
+		write: normalizeScope("write", unwrapVolatile(declared.write) ?? DEFAULT_WRITE_SCOPE)
+	};
+}
+/**
+* Unwrap one config field's value.
+*
+* A `.volatile()` field is handed to the plugin as a cordis `Volatile<T>`
+* **accessor**, not as `T`: the schema's `get()` re-reads the stored value on
+* every call so an edit applies without remounting the entry. Reading the
+* property directly therefore yields the accessor object, whose `kind` is
+* `undefined` — which {@link normalizeScope} correctly refuses, failing the
+* whole row at mount. The upstream volatile Config
+* (`packages/core/agent-default-model/src/index.ts:68-71`) unwraps the same way.
+*
+* A hand-written config document may also carry the plain value, so both
+* spellings are accepted.
+* @param value - the configured field, as the accessor, as a plain value, or as
+*   whatever an untrusted document put under the key.
+* @returns the underlying value, or `undefined` when this field is unset.
+*/
+function unwrapVolatile(value) {
+	if (value === void 0) return void 0;
+	if (typeof value.get === "function") return value.get();
+	return value;
+}
+/**
+* This row's current value on the settings page, or `undefined` when no
+* settings service is mounted.
+*
+* This is the ONE read path to that row. It goes through `describe()` rather
+* than the config the plugin instance captured at mount because the loader does
+* not commit a later save back to that instance
+* (`vendor/loader/src/config/entry.ts:162-195`); `describe()` re-projects
+* `entry.fiber.config` and unwraps the volatile accessors on every call
+* (`packages/settings/settings/src/index.ts:319-323` +
+* `packages/settings/settings/src/schema.ts:11`), which is the same path the
+* settings page renders from. A save therefore applies without a restart.
+* @param ctx - host context; the service is looked up, never injected.
+* @returns the row's current value, or `undefined` when unavailable.
+*/
+function declaredSection(ctx) {
+	return ctx.get("settings")?.describe().find((row) => row.ns === DUAL_AXIS_ROW_ID)?.value;
+}
+/**
+* The group library a decision path may read, and the ONLY part of the settings
+* row one may read for a decision.
+*
+* The row's `read`, `write` and `defaultGroups` fields are seeds for
+* NEWLY CREATED sessions and carry no authority over an existing one; a
+* decision path that read them would let the settings page silently re-scope a
+* running session, which is the drift this package exists to prevent.
+* @param section - the row's current value, as {@link declaredSection} returns it.
+* @returns the untrusted `groups` value, for {@link resolveEffectiveAxes}.
+*/
+function groupLibraryValue(section) {
+	return section === null || typeof section !== "object" ? void 0 : unwrapVolatile(section.groups);
+}
+/**
+* The group ids a newly created session starts out referencing.
+* @param section - the row's current value, as {@link declaredSection} returns it.
+* @returns the ids, deduplicated; empty when the row declares none.
+* @throws When a declared id is not a non-empty string.
+*/
+function defaultGroupIds(section) {
+	return groupIds("defaultGroups", section === null || typeof section !== "object" ? void 0 : unwrapVolatile(section.defaultGroups));
+}
+//#endregion
+//#region lib/types/groups.js
+/**
+* RULE GROUPS and THE ONE resolution from a session's axis preset to the ranges
+* actually in force.
+*
+* A rule group is a named fragment of path rules owned by the settings page
+* (`dual-axis`'s `groups` Config field). A session references groups BY ID and
+* never stores their content: ten sessions selecting one group must not become
+* ten copies of it, because copies drift. Resolving an id against the CURRENT
+* library is therefore the only place a group's rules enter a decision, and
+* editing a group takes effect on every session referencing it without a
+* restart.
+*
+* This module is that place, for both axes and for both invariants that ride on
+* them:
+*
+* - **deny wins over allow**, with session-level entries and every selected
+*   group merged into ONE allow list and ONE deny list first
+*   ({@link resolveEffectiveAxes}), so a group's removal cannot be overridden by
+*   a session-level addition.
+* - **write never exceeds read**: the effective write range is the write axis's
+*   range INTERSECTED with the read axis's range. A write outside the read range
+*   would let an agent overwrite a file it cannot read back, so the intersection
+*   is computed here — in the resolution — and never in a user interface.
+*
+* Both the fence and the model-facing prompt call {@link resolveEffectiveAxes},
+* so the range the model is told about and the range it is held to are the same
+* computation over the same inputs: the session's own preset (read and write
+* axes, their own additions and removals, and the group ids they selected) plus
+* the current definitions of those ids. The settings page's `read` / `write`
+* defaults and its `defaultGroups` seed are NOT among those inputs: they are
+* read once, when a session is created.
+*
+* A reference to an id the library does not define is refused, never treated as
+* an empty group: "I excluded it and nothing happened" is the worst failure this
+* surface can have.
+*
+* @module @t4r71/dsh-dual-axis/groups
+*/
+/** The narrowing that removed nothing. Exported: it is the stored record's absent value. */
+const NO_NARROWING = {
+	narrowed: false,
+	droppedRoots: [],
+	lostUnbounded: false
+};
+/**
+* Read one stored narrowing report, or throw naming the member that is
+* unreadable.
+*
+* An absent member is the legal "nothing was ever published for this record"
+* state and yields {@link NO_NARROWING}: that is exactly what the fence enforced
+* before this member existed, so the surface shows no narrowing rather than
+* inventing one. Anything PRESENT must be well formed — a report whose root list
+* cannot be read would otherwise be displayed as "nothing was removed".
+* @param value - the untrusted `narrowing` member of a stored record.
+* @returns the validated report.
+* @throws When the member is present and not a well-formed report.
+*/
+function parseNarrowing(value) {
+	if (value === void 0) return NO_NARROWING;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("dual-axis: a stored narrowing report must be an object");
+	const candidate = value;
+	if (typeof candidate.narrowed !== "boolean" || typeof candidate.lostUnbounded !== "boolean") throw new Error("dual-axis: a stored narrowing report needs boolean narrowed and lostUnbounded");
+	return {
+		narrowed: candidate.narrowed,
+		droppedRoots: pathList("stored narrowing", "droppedRoots", candidate.droppedRoots),
+		lostUnbounded: candidate.lostUnbounded
+	};
+}
+/**
+* Parse one group's rules for one axis.
+* @param label - the group and axis, as the error message should name them.
+* @param value - the untrusted `read` or `write` member.
+* @returns the validated rules, or `undefined` when the member is absent.
+* @throws When the member is neither absent nor an object of absolute path lists.
+*/
+function axisRules(label, value) {
+	if (value === void 0) return void 0;
+	if (value === null || typeof value !== "object") throw new Error(`dual-axis: ${label} must be an object carrying allow and/or deny`);
+	const candidate = value;
+	return {
+		allow: pathList(label, "allow", candidate.allow),
+		deny: pathList(label, "deny", candidate.deny)
+	};
+}
+/**
+* Read one group entry out of the library.
+* @param index - the entry's position, used in error messages.
+* @param value - the untrusted entry.
+* @returns the validated group.
+* @throws When the entry carries no usable id.
+*/
+function groupAt(index, value) {
+	if (value === null || typeof value !== "object") throw new Error(`dual-axis: rule group #${String(index)} must be an object`);
+	const candidate = value;
+	if (typeof candidate.id !== "string" || candidate.id.length === 0) throw new Error(`dual-axis: rule group #${String(index)} needs a non-empty string id`);
+	const label = "rule group " + JSON.stringify(candidate.id);
+	const read = candidate.read === void 0 ? void 0 : axisRules(label + " read", candidate.read);
+	const write = candidate.write === void 0 ? void 0 : axisRules(label + " write", candidate.write);
+	return {
+		id: candidate.id,
+		name: typeof candidate.name === "string" && candidate.name.length > 0 ? candidate.name : candidate.id,
+		...read === void 0 ? {} : { read },
+		...write === void 0 ? {} : { write }
+	};
+}
+/**
+* Parse the settings page's group library. An unset or null library is the
+* legal "no groups configured" state; anything else must be a well-formed
+* library, because a half-read library would silently drop a removal.
+* @param value - the untrusted `groups` Config value.
+* @returns the parsed library by id, or the sentence explaining why it is unusable.
+*/
+function parseLibrary(value) {
+	if (value === void 0 || value === null) return {
+		ok: true,
+		byId: /* @__PURE__ */ new Map()
+	};
+	if (!Array.isArray(value)) return {
+		ok: false,
+		problem: "the rule-group library must be an array of groups"
+	};
+	const byId = /* @__PURE__ */ new Map();
+	try {
+		for (let index = 0; index < value.length; index += 1) {
+			const group = groupAt(index, value[index]);
+			if (byId.has(group.id)) return {
+				ok: false,
+				problem: "the rule-group library defines " + JSON.stringify(group.id) + " more than once"
+			};
+			byId.set(group.id, group);
+		}
+	} catch (error) {
+		return {
+			ok: false,
+			problem: error instanceof Error ? error.message : String(error)
+		};
+	}
+	return {
+		ok: true,
+		byId
+	};
+}
+/**
+* The group ids a preset references, in first-seen order and without repeats.
+* Callers use this to skip reading the settings page at all for the sessions
+* that reference no groups.
+* @param preset - the session's own axis preset.
+* @returns the referenced ids.
+*/
+function referencedGroupIds(preset) {
+	const ids = [];
+	for (const axis of [preset.read, preset.write]) {
+		if (axis.kind !== "custom") continue;
+		for (const id of axis.groups ?? []) if (!ids.includes(id)) ids.push(id);
+	}
+	return ids;
+}
+/**
+* The ids the settings page's library defines, for validating one command entry
+* before it is recorded.
+*
+* An unusable library yields no ids: every `groups` entry is then refused by
+* name, which is the same fail-closed answer the decision path gives.
+* @param library - the settings page's current `groups` value, untrusted.
+* @returns the defined ids.
+*/
+function ruleGroupIds(library) {
+	const parsed = parseLibrary(library);
+	return parsed.ok ? new Set(parsed.byId.keys()) : /* @__PURE__ */ new Set();
+}
+/**
+* Expand one axis: its own additions and removals first, then those of every
+* group it references, merged into one allow list and one deny list. The result
+* carries no group ids — expansion is the resolution, and a resolved value that
+* still referenced groups could be expanded a second time.
+* @param axis - the axis preset.
+* @param side - which of a group's two rule sets applies.
+* @param byId - the parsed library.
+* @returns the expanded axis.
+*/
+function expandAxis(axis, side, byId) {
+	if (axis.kind !== "custom") return axis;
+	const ids = axis.groups ?? [];
+	if (ids.length === 0) return axis;
+	const allow = [...axis.allow];
+	const deny = [...axis.deny];
+	for (const id of ids) {
+		const rules = byId.get(id)?.[side];
+		if (rules === void 0) continue;
+		allow.push(...rules.allow ?? []);
+		deny.push(...rules.deny ?? []);
+	}
+	return {
+		kind: "custom",
+		base: axis.base,
+		allow: [...new Set(allow)],
+		deny: [...new Set(deny)]
+	};
+}
+/**
+* Attach the group ids a NEW session starts out referencing to the axes that are
+* `custom`, leaving every other axis exactly as declared.
+*
+* The rule is judged per axis, and only an axis whose OWN kind is `custom` can
+* carry a reference: checking the settings row instead (a tick that is not
+* tied to an axis) promoted `read: all` to `read: { kind: 'custom', base: 'all' }`
+* even though no axis was ever set to custom. An axis of one of the three closed
+* kinds has nowhere to put an id and is seeded verbatim — promoting it would
+* report a custom scope the settings page never showed.
+*
+* A group may carry rules for either axis or both, and the session selected it
+* once, so the same list goes on both `custom` axes; the group's `read` rules
+* then apply where they exist and its `write` rules where they exist. Two axes
+* are therefore independent: one may take the references while the other keeps
+* its closed kind.
+* @param axes - the pair a new session is seeded with.
+* @param ids - the settings page's `defaultGroups`.
+* @returns the pair carrying those references.
+*/
+function seedGroupReferences(axes, ids) {
+	if (ids.length === 0) return axes;
+	const attach = (axis) => axis.kind === "custom" ? {
+		...axis,
+		groups: [.../* @__PURE__ */ new Set([...axis.groups ?? [], ...ids])]
+	} : axis;
+	return {
+		read: attach(axes.read),
+		write: attach(axes.write)
+	};
+}
+/**
+* The intersection of two evaluated ranges, as an evaluated range. Exact for
+* canonical directory roots: two roots are either nested — the deeper one is
+* their intersection — or disjoint, and a union of directories intersected with
+* a union of directories is the union of those pairwise intersections.
+* @param left - one evaluated range.
+* @param right - the other evaluated range.
+* @returns the range permitting exactly what both permit.
+*/
+function intersectResolved(left, right) {
+	const deny = [.../* @__PURE__ */ new Set([...left.deny, ...right.deny])];
+	if (left.unbounded && right.unbounded) return {
+		unbounded: true,
+		allow: [],
+		deny
+	};
+	if (left.unbounded) return {
+		unbounded: false,
+		allow: [...right.allow],
+		deny
+	};
+	if (right.unbounded) return {
+		unbounded: false,
+		allow: [...left.allow],
+		deny
+	};
+	const allow = [];
+	for (const one of left.allow) for (const other of right.allow) if (isLexicallyUnder(one, other) && !allow.includes(one)) allow.push(one);
+	else if (isLexicallyUnder(other, one) && !allow.includes(other)) allow.push(other);
+	return {
+		unbounded: false,
+		allow,
+		deny
+	};
+}
+/**
+* Spell an evaluated range as an axis value that evaluates back to it. The
+* `deny` base plus the roots themselves is the exact spelling: a `workspace`
+* base would re-add the platform temp areas this range may never have had.
+* @param resolved - the evaluated range.
+* @returns the equivalent axis value.
+*/
+function scopeOfResolved(resolved) {
+	return resolved.unbounded ? {
+		kind: "custom",
+		base: "all",
+		allow: [],
+		deny: [...resolved.deny]
+	} : {
+		kind: "custom",
+		base: "deny",
+		allow: [...resolved.allow],
+		deny: [...resolved.deny]
+	};
+}
+/**
+* The removals in a range that remove something, so two ranges that differ only
+* in irrelevant removals compare equal.
+* @param scope - the evaluated range.
+* @returns the deny roots that would otherwise be permitted.
+*/
+function relevantDenies(scope) {
+	const permitAll = {
+		unbounded: scope.unbounded,
+		allow: scope.allow,
+		deny: []
+	};
+	return scope.deny.filter((root) => scopeContains(permitAll, root, isLexicallyUnder));
+}
+/** Whether two evaluated ranges permit exactly the same paths. */
+function sameRange(left, right) {
+	const sameSet = (one, other) => one.length === other.length && one.every((value) => other.includes(value));
+	if (left.unbounded !== right.unbounded) return false;
+	if (left.unbounded) return sameSet(relevantDenies(left), relevantDenies(right));
+	return sameSet(left.allow, right.allow) && sameSet(relevantDenies(left), relevantDenies(right));
+}
+/**
+* What the intersection removed: every root the write axis permitted that the
+* effective range does not, counting both roots dropped from the allow list and
+* roots the read axis newly denies.
+* @param before - the write axis's own range.
+* @param after - the effective write range.
+* @returns the narrowing report.
+*/
+function narrowingOf(before, after) {
+	const lostUnbounded = before.unbounded && !after.unbounded;
+	const droppedRoots = [...before.allow.filter((root) => !scopeContains(after, root, isLexicallyUnder)), ...after.deny.filter((root) => !before.deny.includes(root) && scopeContains(before, root, isLexicallyUnder))];
+	const unique = [...new Set(droppedRoots)];
+	return {
+		narrowed: lostUnbounded || unique.length > 0,
+		droppedRoots: unique,
+		lostUnbounded
+	};
+}
+/**
+* Expand one axis against the library, reporting the ids it references and the
+* library does not define.
+* @param axis - the axis preset.
+* @param side - which of a group's two rule sets applies.
+* @param byId - the parsed library.
+* @param missing - collects the undefined ids, in reference order.
+* @returns the expanded axis.
+*/
+function expandChecked(axis, side, byId, missing) {
+	if (axis.kind === "custom") {
+		for (const id of axis.groups ?? []) if (!byId.has(id) && !missing.includes(id)) missing.push(id);
+	}
+	return expandAxis(axis, side, byId);
+}
+/** The sentence naming the ids a preset references and the library does not define. */
+function missingGroupsProblem(ids) {
+	return "this session references rule group(s) " + ids.map((id) => JSON.stringify(id)).join(", ") + " that the rule-group library does not define";
+}
+/**
+* THE resolution: one session's axis preset plus the current group library into
+* the read and write ranges actually in force.
+*
+* The write member of the result is the intersection of the write axis's range
+* with the read axis's. The write axis keeps its own spelling whenever the
+* intersection changed nothing, so a session that references no groups and needs
+* no narrowing is described and enforced exactly as before groups existed.
+*
+* An unresolvable reference or an unusable library returns `ok: false` and no
+* axes: the caller refuses, because resolving a missing id to an empty group
+* would silently drop rules the user configured.
+* @param preset - the session's own axis preset, group ids included.
+* @param library - the settings page's current `groups` value, untrusted.
+* @param policy - the workspace root a `workspace` base resolves against.
+* @returns the effective pair, or the sentence explaining why there is none.
+*/
+function resolveEffectiveAxes(preset, library, policy) {
+	const parsed = parseLibrary(library);
+	if (!parsed.ok) return {
+		ok: false,
+		problem: parsed.problem
+	};
+	const missing = [];
+	const read = expandChecked(preset.read, "read", parsed.byId, missing);
+	const write = expandChecked(preset.write, "write", parsed.byId, missing);
+	if (missing.length > 0) return {
+		ok: false,
+		problem: missingGroupsProblem(missing)
+	};
+	let readRange;
+	let writeRange;
+	try {
+		readRange = resolveScope(read, policy);
+		writeRange = resolveScope(write, policy);
+	} catch (error) {
+		return {
+			ok: false,
+			problem: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const intersected = intersectResolved(writeRange, readRange);
+	if (sameRange(writeRange, intersected)) return {
+		ok: true,
+		axes: {
+			read,
+			write,
+			narrowing: NO_NARROWING
+		}
+	};
+	return {
+		ok: true,
+		axes: {
+			read,
+			write: scopeOfResolved(intersected),
+			narrowing: narrowingOf(writeRange, intersected)
+		}
+	};
+}
+/**
+* The narrower of two bases, in the containment order `deny` ⊂ `workspace` ⊂
+* `all`.
+*
+* This is the tier the write-never-exceeds-read invariant can express to the
+* layer BELOW the tool layer. That layer is a single closed sandbox mode
+* mirrored from the write axis onto the session's `sandbox/mode`, and it cannot
+* spell a path list; the narrower base is the largest tier both axes contain, so
+* mirroring it keeps the operating-system confinement inside the intersection
+* instead of leaving it at the write axis's own, wider base.
+* @param left - one axis.
+* @param right - the other axis.
+* @returns the narrower base.
+*/
+function narrowerBase(left, right) {
+	const rank = (scope) => scope.kind === "custom" ? [
+		"deny",
+		"workspace",
+		"all"
+	].indexOf(scope.base) : [
+		"deny",
+		"workspace",
+		"all"
+	].indexOf(scope.kind);
+	return rank(left) <= rank(right) ? left.kind === "custom" ? left.base : left.kind : right.kind === "custom" ? right.base : right.kind;
+}
+//#endregion
+//#region lib/types/content.js
+/**
+* Whether a session has been USED yet — the one predicate that decides when its
+* axis pair freezes.
+*
+* A session the workspace picker reopens in the same workspace is the same
+* session id with the same stored record, so the axes it was seeded with at
+* creation are what its two dropdowns show for the rest of its life. That is
+* correct for a session someone has actually worked in; for one nobody has ever
+* exchanged a turn with it is wrong, because the settings row is a live default
+* and the person changing it expects the next conversation to follow.
+*
+* So the record is written when the session is used, not when it is created:
+*
+* - nothing appended beyond the loop's runtime-context snapshot → no record; the
+*   seed recomputed from the CURRENT settings row answers every read, so the
+*   dropdown follows the settings page in real time;
+* - one real user turn, or an assistant reply → the record is written and the
+*   pair freezes;
+* - `/axis` → {@link SessionAxesStore.set} writes unconditionally, so a manual
+*   pick always freezes, on an empty session too.
+*
+* ## What counts as "content"
+*
+* Everything except a message whose source is the loop's own runtime-context
+* snapshot. That snapshot is appended by the agent loop on EVERY turn
+* (`packages/core/agent-loop/src/runtime-context.ts`), including the very first
+* one, and it is present before any human input exists — the four events a
+* freshly created session carries are the header, the preset, the mode, and the
+* approval policy. Counting it would make every session look used the moment
+* anything rendered its prompt, which is exactly the state this predicate has to
+* tell apart.
+*
+* The snapshot is identified by its `source.kind`, the discriminant the loop
+* writes and reads back (`isOwned` in that module requires `kind === 'plugin'`;
+* the system-prompt renderer stamps `kind: 'runtime-context'`). Matching on the
+* kind is cheaper and more robust than matching the rendered text, which is
+* localized prose that changes with every contribution.
+*
+* Every other message counts, the skill catalogue and the compaction markers
+* included: each of them means the session has entered a turn, and a session
+* that has entered a turn is one somebody is using.
+*
+* @module @t4r71/dsh-dual-axis/content
+*/
+/**
+* The `source.kind` of the loop's per-turn runtime-context snapshot.
+*
+* @see `packages/core/agent-loop/src/runtime-context.ts` — `RuntimeContextProjection.project`
+*   builds the message, and the renderer in
+*   `packages/core/system-prompt/src/index.ts` stamps this kind on it.
+*/
+const RUNTIME_CONTEXT_KIND = "runtime-context";
+/**
+* The event types that can carry content, so a listener can skip the rest without
+* building the session's whole event list.
+*
+* A `system/message` is in here because it only exists once a turn has started,
+* and a started turn is a used session. The prompt is assembled and that event
+* appended BEFORE the human message reaches the log (measured: `system/message`
+* at seq 7, the user turn at seq 8), so a rule that waited for the user message
+* alone would let a tool-less turn finish without freezing anything.
+*/
+const CONTENT_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"user/message",
+	"assistant/message",
+	"system/message"
+]);
+/**
+* Whether a session has content beyond the loop's own runtime-context snapshots.
+*
+* Cheap by construction: it walks the session's existing event array, which is
+* already materialized and cached, without copying, parsing, or allocating per
+* event. It is called on every `ensure` for a session that has no record, and
+* that set is exactly the sessions nobody has used — so the scan is short.
+* @param session - the session to judge.
+* @returns whether this session has been used.
+*/
+function hasContent(session) {
+	for (const event of session.snapshotEvents()) {
+		if (event.type === "user/message") {
+			if (event.data.source?.kind === RUNTIME_CONTEXT_KIND) continue;
+			return true;
+		}
+		if (event.type === "assistant/message" || event.type === "system/message") return true;
+	}
+	return false;
+}
+//#endregion
+//#region lib/types/session-axes.js
+/**
+* The write axis's landing place in a session's LOG, and the reason it is the
+* only one.
+*
+* 0.1.6 carried both axes on the \`sandbox/mode\` event (\`readScope\` /
+* \`writeScope\` members) and wrote them through \`setSandboxScopes\`. 0.1.7's
+* \`sandbox/mode\` payload is locked to \`{ mode, source }\` in three independent
+* places — the \`SessionEventMap\` declaration
+* (\`packages/sandbox/sandbox-policy/src/session-mode.ts:33-38\`), the session-format
+* validator
+* (\`packages/session/session-format-v0-to-v1/src/payload-validation.ts:165-168\`),
+* and the generated schema (\`docs/persistence-schema.json:11132-11147\`) — so the
+* path-level axis pair cannot ride on it.
+*
+* A package-declared event type is not an alternative: \`Session.append\`
+* (\`packages/core/session/src/index.ts:722-750\`) builds the envelope as exactly
+* \`{ type, seq, time, data, surfaceOp?, sourceEventSeqs? }\` and takes no envelope
+* option, so a type outside \`KNOWN_SESSION_EVENT_TYPES\` cannot be marked
+* \`ignorable\` (the marker exists only on the READ side,
+* \`packages/session/session-persistence/src/storage-contract.ts:75\`) and a log
+* carrying it is refused whole. That refusal is why the pair now lives in
+* \`./session-store.ts\` instead.
+*
+* What REMAINS here is the write base's mirror onto \`sandbox/mode\`: a known type,
+* carrying the closed three-value mode the operating-system layer enforces. The
+* mirror is the NARROWER of the two axes' bases, never the write axis's own —
+* the effective write range is the write axis intersected with the read axis, so
+* mirroring the wider base would leave the layer below the tool fence granting
+* writes the intersection forbids.
+*
+* @module @t4r71/dsh-dual-axis/session-axes
+*/
+/**
+* Mirror one session's write base onto 0.1.7's own \`sandbox/mode\` event, so the
+* inherited write fence and the system-prompt policy section agree with the axis
+* pair this package stores.
+*
+* The mirrored TIER is derived from the two axes' bases only, never from a rule
+* group's contents, so editing a group cannot leave this event stale. Path-level
+* narrowing is enforced live, where the group definitions are read.
+*
+* The event is appended even when it repeats the standing mode: \`sandbox/mode\`
+* carries no idempotence contract, and a session that gained axes without a
+* matching mode record would have its write fence read a stale mode.
+* @param session - the session the axes belong to.
+* @param axes - the axis pair in force from this event onward.
+*/
+function mirrorWriteMode(session, axes) {
+	setSandboxMode(session, modeOfAxisBase(narrowerBase(axes.write, axes.read)));
+}
+//#endregion
+//#region lib/types/session-store.js
+/**
+* THE per-session axis store, outside the session log.
+*
+* The axes cannot live in a session's own log: this package's own event type is
+* not in 0.1.7's `KNOWN_SESSION_EVENT_TYPES`, and `Session.append` takes no
+* envelope option, so the event cannot be marked `ignorable` and a log carrying
+* it is refused WHOLE by `validateStoredEvents`
+* (`packages/session/session-persistence/src/storage-contract.ts:75-77`).
+* A session this package had written to could therefore not be opened at all
+* after a restart.
+*
+* The axes live instead in this package's OWN settings namespace,
+* `dual-axis-sessions`, partitioned by session id. That namespace is a
+* separate Loader entry from `dual-axis` because the row's namespace carries the
+* settings page's read/write/defaultGroups form: an undeclared field inside that
+* row would be projected into the row's form. This namespace declares exactly one
+* field and the settings page never renders it.
+*
+* `sandbox/mode` REMAINS the write axis's legal landing place in the log — see
+* `./session-axes.ts`, which mirrors the write base onto it. The log therefore
+* still records the containment the operating-system layer enforces; what it no
+* longer records is the path-level axis pair, which is this module's.
+*
+* A session with NO record is neither an error state nor a reason to hide a
+* control: every live decision path reads through {@link SessionAxesStore.ensure},
+* which answers {@link seedAxesFor} — the deployment seed a newly created session
+* is pinned with — and hands that SAME value to the ONE repair write it
+* schedules. Such a session therefore runs under the deployment's seed from its
+* first read, not under {@link DEFAULT_AXES} until the record lands, and the pair
+* a picker shows before the record exists is the pair the fence and the prompt
+* are already enforcing (the client half recomputes that seed from the same row —
+* see `sessionAxesSeed` in `@t4r71/dsh-dual-axis-ui`).
+* {@link DEFAULT_AXES} is now only the answer {@link SessionAxesStore.getOr} gives
+* a caller that holds no session to build a seed from.
+*
+* A session with no record that has ALSO never been used is a different case, and
+* it is the one the workspace picker creates every time: reopening the same
+* workspace reopens the same session id, so freezing it at creation would pin the
+* axes of a conversation nobody has had to whatever the settings row said that
+* day. Its record is therefore written when it is USED ({@link hasContent}), not
+* when it is created: until then every read recomputes the seed from the row as
+* it stands NOW, and the dropdown follows the settings page in real time.
+*
+* @module @t4r71/dsh-dual-axis/session-store
+*/
+/**
+* The settings namespace holding every session's axis pair. It is a Loader entry
+* id (`cordis.patch.yml`), which is what `SettingsForms.write` looks up.
+*/
+const SESSION_AXES_NAMESPACE = "dual-axis-sessions";
+/** The single Config field: session id -> axis pair. */
+const SESSION_AXES_FIELD = "axes";
+/**
+* This entry's composition config. The field is `.volatile()` because 0.1.7
+* refuses an entry with no volatile field outright
+* (`packages/settings/settings/src/index.ts:385-386`) and because path writes
+* are refused for every non-volatile path (`:387-389`).
+*
+* `z.dict(z.any())` rather than a per-session object schema: the keys are session
+* ids, which no schema can enumerate, and the VALUES are validated by
+* {@link parseSessionAxesField}, where an unreadable axis becomes a throw rather
+* than an invented boundary — the same rule the row's own axes follow.
+*
+* Annotated rather than inferred: `z.dict`'s output names `Dict` from
+* `@deepseek-ai/cosmokit`, and declaration emit refuses a type it can only reach
+* through a nested `node_modules` path (TS2883). The annotation states the same
+* type through that package's own entry.
+*/
+const Config$1 = z.object({ axes: z.dict(z.any()).default({}).volatile() });
+/**
+* The pair {@link SessionAxesStore.getOr} answers for a session with no stored
+* record, and nothing else.
+*
+* It is deliberately NOT what a session with no record is held to any more:
+* every live read goes through {@link SessionAxesStore.ensure}, which answers the
+* deployment's seed ({@link seedAxesFor}), so the pair in force is the pair the
+* session was created with rather than the built-in one. Reaching for this
+* constant on a decision path would hold a session to a boundary the settings
+* page never chose — narrower than an `all` default, wider than a `deny` one.
+* @see SessionAxesStore.getOr
+*/
+const DEFAULT_AXES = {
+	read: DEFAULT_READ_SCOPE,
+	write: DEFAULT_WRITE_SCOPE
+};
+/**
+* The axis pair a session with no stored record is REPAIRED to — the same seed a
+* newly created session is pinned with.
+*
+* Repairing to the standing pair instead (`DEFAULT_AXES`) would be narrower but wrong: a
+* session whose creation-time write was lost would keep the built-in defaults
+* for the rest of its life, and the settings page's seed would never reach it.
+* Repairing to the seed keeps `pin`'s retry semantics intact — the retry just
+* happens on the next touch of the session instead of only at creation.
+*
+* The seed is computed from two synchronous reads: the settings row's
+* `read`/`write`/`defaultGroups` (seeds for a session that has none of its own)
+* and, for a subagent child, the parent's pair AS IT STANDS NOW. A parent with
+* no record of its own yields `undefined` from {@link inheritedAxes}, which is
+* the same answer `pin` gets, so parent and child agree in that case too.
+* @param ctx - host context; carries the settings service the seed is read from.
+* @param session - the session to seed.
+* @param fallback - the composing plugin's own config, used only when no settings
+*   service is mounted (where the namespace cannot be written anyway).
+* @returns the pair a newly created session would have been pinned with.
+*/
+function seedAxesFor(ctx, session, fallback) {
+	const section = declaredSection(ctx);
+	const inherited = inheritedAxes(ctx, session);
+	if (section === void 0) return seedGroupReferences(inherited ?? fallback?.axes ?? DEFAULT_AXES, fallback?.groups ?? []);
+	return seedPair(section, inherited);
+}
+/**
+* The pure core of {@link seedAxesFor}: one settings row value, plus the pair a
+* subagent child inherits, into the pair a session with no record is seeded with.
+*
+* It is TOTAL on purpose, and the client half mirrors it step for step
+* (`sessionAxesSeed` in `@t4r71/dsh-dual-axis-ui`, pinned by
+* `tests/seed-parity.spec.ts`): an unreadable row, and an unreadable inherited
+* pair, answer {@link DEFAULT_AXES}. That is also what a live read answers — see
+* {@link SessionAxesStore.ensure} — so the pair a picker shows for a session with
+* no record and the pair the host enforces are one value rather than two.
+* @param row - the settings row's value, untrusted: a human may have edited it.
+* @param inherited - the parent's pair for a subagent child, or `undefined`.
+* @returns the seed pair.
+*/
+function seedPair(row, inherited) {
+	try {
+		return seedGroupReferences(inherited === void 0 ? axesOf(row) : pairOf(inherited), defaultGroupIds(row));
+	} catch {
+		return DEFAULT_AXES;
+	}
+}
+/**
+* Re-normalize a pair another reader produced.
+*
+* A pair this package stored is already normalized; a hand-edited document's is
+* not, and the inherited pair the client half reads comes straight off the wire.
+* Running both through the same validation is what makes the two halves agree on
+* the bytes, not merely on the kinds.
+* @param pair - the untrusted pair.
+* @returns the normalized pair.
+* @throws When either member is not a legal axis value.
+*/
+function pairOf(pair) {
+	return {
+		read: normalizeScope("read", pair.read),
+		write: normalizeScope("write", pair.write)
+	};
+}
+/**
+* The pair a **subagent child session** inherits, or `undefined` when this is not
+* a child or its parent holds no record.
+*
+* A child does not read the settings page: 0.1.7 deliberately seeds a child with
+* its parent's explicit per-session override, and the parent's STORED pair is the
+* only copy of that override this package has. Returning `undefined` (rather than
+* inventing one) leaves the caller on the settings seed, which is what the child
+* would have received had the parent never overridden anything — and is exactly
+* the pair an un-recorded parent is itself held to.
+*
+* The record is looked up by the id the child's header names. The parent's own
+* Session object is NOT required: requiring it made the answer depend on whether
+* the parent happened to be resident in this process, and the client half — which
+* reads the same document by the same id — cannot observe residency, so the two
+* would disagree for a child whose parent is not materialized.
+* @param ctx - host context carrying the axis store.
+* @param session - the session whose parent to read.
+* @returns the parent's pair, or `undefined`.
+*/
+function inheritedAxes(ctx, session) {
+	if (session.header.origin !== "subagent") return void 0;
+	const parentId = session.header.parentSession;
+	if (parentId === void 0) return void 0;
+	return sessionAxesStore(ctx).get(String(parentId));
+}
+/** How many times one write re-reads the revision after a conflict. */
+const AXES_WRITE_ATTEMPTS = 4;
+/** Milliseconds before attempt N is issued, N counted from zero. */
+const AXES_WRITE_BACKOFF_MS = [
+	0,
+	25,
+	75,
+	200
+];
+/**
+* A whole-document write was refused because another writer moved the settings
+* document between this writer's read and its write.
+*
+* It is thrown, never swallowed: the axis a person just picked is not in force
+* unless it was stored, and reporting success for a lost write would leave the
+* fence enforcing a range the picker does not show.
+*/
+var SessionAxesConflictError = class extends Error {
+	/** Stable machine code for callers that map failures to their own taxonomy. */
+	code = "DUAL_AXIS_AXES_CONFLICT";
+	/** The namespace whose write was refused. */
+	ns = SESSION_AXES_NAMESPACE;
+	/** Attempts made before giving up. */
+	attempts;
+	/**
+	* @param cause - the last conflict the settings service raised.
+	* @param attempts - attempts made before giving up.
+	*/
+	constructor(cause, attempts) {
+		super("dual-axis: the settings document changed under this writer " + String(attempts) + " times while storing a session axis pair; nothing was written", { cause });
+		this.name = "SessionAxesConflictError";
+		this.attempts = attempts;
+	}
+};
+/**
+* Whether two narrowing reports say the same thing, so a republish that changes
+* nothing does not write the document.
+* @param left - one report, absent when nothing was ever published.
+* @param right - the other, absent under the same condition.
+* @returns whether both report the same removal.
+*/
+function sameNarrowing(left, right) {
+	if (left === void 0 || right === void 0) return false;
+	return left.narrowed === right.narrowed && left.lostUnbounded === right.lostUnbounded && left.droppedRoots.length === right.droppedRoots.length && left.droppedRoots.every((root) => right.droppedRoots.includes(root));
+}
+/**
+* Whether a value is a plain data object.
+* @param value - the candidate.
+* @returns whether it is an object that is not null and not an array.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read one stored record into an axis pair, or throw naming the member that is
+* unreadable.
+* @param id - the session id the record belongs to, for the error message.
+* @param value - the untrusted record.
+* @returns the validated pair.
+* @throws When either member is not a legal axis value.
+*/
+function parseSessionAxesRecord(id, value) {
+	if (!isRecord(value)) throw new Error("dual-axis: the stored axes of session " + JSON.stringify(id) + " must be an object");
+	const narrowing = parseNarrowing(value.narrowing);
+	return {
+		read: normalizeScope("read", value.read ?? DEFAULT_READ_SCOPE),
+		write: normalizeScope("write", value.write ?? DEFAULT_WRITE_SCOPE),
+		...narrowing.narrowed ? { narrowing } : {}
+	};
+}
+/**
+* Read the whole stored field. A human may have edited the settings document, so
+* an unreadable entry throws instead of being dropped: dropping it would silently
+* widen that session back to the deployment defaults.
+* @param value - the untrusted `axes` field.
+* @returns every stored pair, by session id.
+* @throws When the field is not an object of readable records.
+*/
+function parseSessionAxesField(value) {
+	if (value === void 0 || value === null) return {};
+	if (!isRecord(value)) throw new Error("dual-axis: the stored session axes field must be an object");
+	const parsed = {};
+	for (const [id, record] of Object.entries(value)) parsed[id] = parseSessionAxesRecord(id, record);
+	return parsed;
+}
+/**
+* The stored pair as this package spells it everywhere else. The stored record is
+* already a pair; this exists so the store's return type is the shared one and a
+* caller cannot start depending on the record's identity.
+* @param record - the stored pair.
+* @returns the same pair.
+*/
+function scopesOf(record) {
+	return {
+		read: record.read,
+		write: record.write
+	};
+}
+/**
+* The read and write face of {@link SESSION_AXES_NAMESPACE}, plus the sweep that
+* keeps it from growing with the sessions that no longer exist.
+*
+* Reads go through `settings.describe()`, the same projection the settings page
+* renders from, and are memoized on the namespace's `revision` — which 0.1.7 bumps
+* exactly when that entry's stored profile override changes
+* (`packages/settings/settings/src/index.ts:311-317`). A decision path therefore
+* pays one `describe()` per document change, not one per tool dispatch.
+*/
+var SessionAxesStore = class {
+	ctx;
+	options;
+	cachedRevision;
+	cachedRecords = {};
+	/** Parsed records by the JSON spelling that produced them. */
+	bySpelling = /* @__PURE__ */ new Map();
+	/**
+	* Session ids with a repair write outstanding (or already landed) since the
+	* record was found missing. Prevents one repair per tool dispatch while the
+	* whole-document write is in flight; cleared when a write FAILS so the next
+	* touch retries instead of leaving the session on the defaults forever.
+	*/
+	repairing = /* @__PURE__ */ new Set();
+	/**
+	* The last narrowing report this store handed to a write, by session id. A
+	* decision path re-resolves on every touch, so this is what keeps it from
+	* queueing the same document write over and over; it is cleared when a write
+	* lands (or fails), never on a read.
+	*/
+	narrowingMemo = /* @__PURE__ */ new Map();
+	/** Sessions with a narrowing write outstanding right now. */
+	narrowingWriting = /* @__PURE__ */ new Set();
+	/**
+	* @param ctx - host context; the settings service is looked up, never injected,
+	*   so a composition without settings still loads this package's fence.
+	* @param options - retry policy and the sleep used between attempts.
+	*/
+	constructor(ctx, options = {}) {
+		this.ctx = ctx;
+		this.options = {
+			attempts: options.attempts ?? 4,
+			backoffMs: options.backoffMs ?? AXES_WRITE_BACKOFF_MS,
+			sleep: options.sleep ?? ((ms) => new Promise((resolve) => {
+				setTimeout(resolve, ms);
+			}))
+		};
+	}
+	/**
+	* This namespace's current settings row, or `undefined` when no settings
+	* service is mounted or the entry is not composed.
+	* @returns the descriptor carrying the value and the revision.
+	*/
+	descriptor() {
+		const settings = this.ctx.get("settings");
+		if (settings === void 0) return void 0;
+		return settings.describe().find((row) => row.ns === SESSION_AXES_NAMESPACE);
+	}
+	/**
+	* Every stored pair, by session id.
+	* @returns the parsed field.
+	* @throws When the document carries an unreadable record.
+	*/
+	records() {
+		const descriptor = this.descriptor();
+		if (descriptor === void 0) return {};
+		if (descriptor.revision === this.cachedRevision) return this.cachedRecords;
+		const value = isRecord(descriptor.value) ? descriptor.value[SESSION_AXES_FIELD] : void 0;
+		const spelling = JSON.stringify(value ?? null);
+		let records = this.bySpelling.get(spelling);
+		if (records === void 0) {
+			records = parseSessionAxesField(value);
+			this.bySpelling.set(spelling, records);
+		}
+		this.cachedRevision = descriptor.revision;
+		this.cachedRecords = records;
+		return records;
+	}
+	/**
+	* One session's stored pair.
+	* @param sessionId - the session whose axes to read.
+	* @returns the pair, or `undefined` when this session has no record yet.
+	*/
+	get(sessionId) {
+		const record = this.records()[sessionId];
+		return record === void 0 ? void 0 : scopesOf(record);
+	}
+	/**
+	* One session's stored pair, or the built-in defaults.
+	*
+	* The answer for a caller that has no session to build a seed from, and the only
+	* remaining reader of {@link DEFAULT_AXES}. Every live path reads {@link ensure}
+	* instead, whose un-recorded answer is the session's own seed.
+	* @param sessionId - the session whose axes to read.
+	* @returns the pair in force.
+	*/
+	getOr(sessionId) {
+		return this.get(sessionId) ?? DEFAULT_AXES;
+	}
+	/**
+	* One session's pair, with an un-recorded session scheduled for repair.
+	*
+	* This is the read every LIVE touch point uses (the model-facing prompt, the
+	* read fence, and `/axis`). A session that has a record answers it; a session
+	* that has none answers {@link seedAxesFor} — the pair `pin` writes for a newly
+	* created session — and that ONE value is both this read's answer and what the
+	* scheduled repair stores. The answer and the write therefore cannot disagree,
+	* and a session created under a saved default runs under that default from its
+	* FIRST turn instead of waiting for the record to land. The record is what
+	* answers from the moment it lands.
+	*
+	* An un-recorded session is only REPAIRED when it has been used
+	* ({@link hasContent}). Until then the seed is recomputed on every read, so the
+	* settings row stays live: a session the workspace picker reopens before anyone
+	* has sent anything follows the settings page, which is the whole point of not
+	* having a record yet. The moment a turn lands, the next read repairs the
+	* session and it freezes — the same seed it answered with, computed from the row
+	* as it then stood.
+	*
+	* The seed is a thunk because only the caller can build it (it needs the
+	* session, and the composing plugin's config for a settings-less host). It is
+	* evaluated exactly once per un-recorded read — those reads are a prompt
+	* assembly, a tool dispatch and a pick, never a hot loop — and it must have no
+	* side effect, because its value IS this read's answer.
+	* @param sessionId - the session whose axes to read.
+	* @param seed - builds the pair a repair persists AND this read answers; never
+	*   called when a record exists.
+	* @param frozen - whether the session has been used, so its pair must be
+	*   written rather than recomputed. Defaults to `true`: a caller that cannot
+	*   judge the session's content keeps the pre-existing freeze-on-first-touch
+	*   behaviour, which is the safe direction — it never widens a live session's
+	*   axes behind the person's back.
+	* @returns the pair in force right now.
+	*/
+	ensure(sessionId, seed, frozen = true) {
+		const standing = this.get(sessionId);
+		if (standing !== void 0) return standing;
+		let seeded;
+		try {
+			seeded = seed();
+		} catch {
+			if (frozen) this.scheduleRepair(sessionId, seed);
+			return DEFAULT_AXES;
+		}
+		if (frozen) this.scheduleRepair(sessionId, () => seeded);
+		return seeded;
+	}
+	/**
+	* Publish the narrowing a live read just resolved, when the record does not
+	* already carry it.
+	*
+	* This is how the client half learns what the read axis removed from the write
+	* range without re-implementing the path algebra: it reads this member out of
+	* the same document its two dropdowns already read. The value comes from the
+	* very resolution the prompt and the fence used, so the surfaced narrowing and
+	* the enforced one are one computation rather than two that must agree.
+	*
+	* Called on every touch of a session that references groups, so an edit to a
+	* group's rules is republished by the next touch instead of waiting for the
+	* record to be rewritten for another reason. A session with no record is left
+	* alone: its axes are recomputed from the settings row on every read, and a
+	* store of its own would freeze that. Writes are fire-and-forget — a caller is
+	* a synchronous decision path and its answer must not depend on a document
+	* write.
+	* @param sessionId - the session whose narrowing to publish.
+	* @param narrowing - the value {@link resolveEffectiveAxes} returned for it.
+	*/
+	refreshNarrowing(sessionId, narrowing) {
+		const record = this.records()[sessionId];
+		if (record === void 0) return;
+		const stored = record.narrowing;
+		if (stored === void 0 && !narrowing.narrowed) return;
+		if (sameNarrowing(stored, narrowing)) {
+			this.narrowingMemo.delete(sessionId);
+			return;
+		}
+		if (sameNarrowing(this.narrowingMemo.get(sessionId), narrowing)) return;
+		this.narrowingMemo.set(sessionId, narrowing);
+		this.writeNarrowing(sessionId, narrowing);
+	}
+	/**
+	* Store one narrowing report for a session that already has a record, at most
+	* once per value.
+	*
+	* A failed write only forgets what was attempted: the next touch republishes
+	* the same report, and the dropdowns keep showing the last stored one instead
+	* of nothing. It never touches the axes, so a refresh that loses its race
+	* cannot revert a pick.
+	* @param sessionId - the session to update.
+	* @param narrowing - the report to store.
+	*/
+	writeNarrowing(sessionId, narrowing) {
+		if (this.narrowingWriting.has(sessionId)) return;
+		this.narrowingWriting.add(sessionId);
+		Promise.resolve().then(async () => {
+			const record = this.records()[sessionId];
+			if (record === void 0) return;
+			const stored = record.narrowing;
+			if (stored === void 0 && !narrowing.narrowed) return;
+			if (sameNarrowing(stored, narrowing)) return;
+			const { narrowing: _retired, ...axes } = record;
+			await this.replaceRecords({
+				...this.records(),
+				[sessionId]: {
+					...axes,
+					...narrowing.narrowed ? { narrowing } : {}
+				}
+			});
+		}).catch((error) => {
+			this.ctx.logger?.warn("dual-axis: could not store the narrowing of session \"%s\"; the dropdowns keep the last stored report", sessionId);
+			this.ctx.logger?.warn(error);
+		}).finally(() => {
+			this.narrowingWriting.delete(sessionId);
+			this.narrowingMemo.delete(sessionId);
+		});
+	}
+	/**
+	* Store one session's pair, whole-document, and report a lost write loudly.
+	*
+	* A single `replace` of the field: removal needs the whole map anyway, and a
+	* per-id path write cannot prune. Every attempt re-reads the revision, so an
+	* edit that landed between the read and the write is retried against the value
+	* it produced instead of being overwritten from a stale snapshot.
+	* @param sessionId - the session the pair belongs to.
+	* @param axes - the pair to store.
+	* @throws {SessionAxesConflictError} when every attempt lost the revision race.
+	* @throws When no settings service serves this namespace.
+	*/
+	async set(sessionId, axes, narrowing) {
+		await this.replaceRecords({
+			...this.records(),
+			[sessionId]: {
+				read: axes.read,
+				write: axes.write,
+				...narrowing === void 0 || !narrowing.narrowed ? {} : { narrowing }
+			}
+		});
+		if (narrowing !== void 0) this.narrowingMemo.set(sessionId, narrowing);
+	}
+	/**
+	* Persist one un-recorded session's seed, at most once until it lands.
+	*
+	* Fire-and-forget on purpose: every caller is a synchronous decision path
+	* (a tool dispatch, a prompt assembly) that cannot await a whole-document
+	* write, and none of them may fail because the repair could not be stored —
+	* the answer that read already gave stands either way. A failed repair is
+	* logged and re-armed.
+	* @param sessionId - the session to repair.
+	* @param seed - builds the pair to persist; may throw on an unreadable document.
+	*/
+	scheduleRepair(sessionId, seed) {
+		if (this.repairing.has(sessionId)) return;
+		this.repairing.add(sessionId);
+		Promise.resolve().then(async () => {
+			if (this.get(sessionId) !== void 0) return;
+			await this.set(sessionId, seed());
+			this.repairing.delete(sessionId);
+		}).catch((error) => {
+			this.repairing.delete(sessionId);
+			this.ctx.logger?.warn("dual-axis: could not store the axes of session \"%s\"; it stays on the default pair", sessionId);
+			this.ctx.logger?.warn(error);
+		});
+	}
+	/**
+	* Prune records whose session no longer exists.
+	*
+	* The deletion signal is the persistence layer itself: a session whose id is
+	* absent from `sessionPersistence.list()` has no stored log. `session/disposed`
+	* is NOT that signal — residency churn disposes a session whose file is still on
+	* disk, and dropping its axes there would silently reset a session that is about
+	* to be resumed.
+	* @returns the ids dropped, or `undefined` when the sweep cannot judge (no
+	*   persistence service mounted, or a listing failed): an unjudgeable sweep
+	*   removes nothing.
+	*/
+	async sweep() {
+		const records = this.records();
+		const ids = Object.keys(records);
+		if (ids.length === 0) return {
+			removed: [],
+			before: 0
+		};
+		const persistence = this.ctx.get("sessionPersistence");
+		if (persistence === void 0) return void 0;
+		let live;
+		try {
+			const listed = await persistence.list();
+			live = new Set(listed.map((snapshot) => String(snapshot.header.id)));
+		} catch (error) {
+			this.ctx.logger?.warn("dual-axis: could not list stored sessions, keeping every axis record");
+			this.ctx.logger?.warn(error);
+			return;
+		}
+		const kept = {};
+		const removed = [];
+		for (const id of ids) {
+			const record = records[id];
+			if (record === void 0) continue;
+			if (live.has(id)) kept[id] = record;
+			else removed.push(id);
+		}
+		if (removed.length === 0) return {
+			removed: [],
+			before: ids.length
+		};
+		await this.replaceRecords(kept);
+		return {
+			removed,
+			before: ids.length
+		};
+	}
+	/**
+	* Replace the whole field, retrying while the revision fence refuses it.
+	* @param records - the complete next field.
+	* @throws {SessionAxesConflictError} when every attempt was refused.
+	*/
+	async replaceRecords(records) {
+		const settings = this.ctx.get("settings");
+		const entryExists = this.descriptor() !== void 0;
+		if (settings === void 0 || !entryExists) throw new Error("dual-axis: no configurable plugin entry \"dual-axis-sessions\"; the session axis store cannot be written");
+		let conflict;
+		for (let attempt = 0; attempt < this.options.attempts; attempt += 1) {
+			const backoff = this.options.backoffMs[attempt] ?? this.options.backoffMs[this.options.backoffMs.length - 1] ?? 0;
+			if (backoff > 0) await this.options.sleep(backoff);
+			const revision = this.descriptor()?.revision;
+			try {
+				await settings.replace(SESSION_AXES_NAMESPACE, { [SESSION_AXES_FIELD]: records }, revision);
+				return;
+			} catch (error) {
+				conflict = error;
+			}
+		}
+		throw new SessionAxesConflictError(conflict, this.options.attempts);
+	}
+};
+/** Stores by host context, so every consumer of one process shares one cache. */
+const stores = /* @__PURE__ */ new WeakMap();
+/**
+* The store of one host context. Consumers hold no service of their own: the
+* fence and the prompt must keep working in a composition that never mounted the
+* settings service, where the store simply has nothing to read.
+* @param ctx - host context.
+* @returns the shared store.
+*/
+function sessionAxesStore(ctx) {
+	const existing = stores.get(ctx);
+	if (existing !== void 0) return existing;
+	const created = new SessionAxesStore(ctx);
+	stores.set(ctx, created);
+	return created;
+}
+/**
+* This entry's plugin body.
+*
+* The entry exists for its Config: `SettingsForms.describe` projects the schemas
+* of LOADED entries, so the session axis store has no namespace to live in until
+* a Loader row activates with this plugin. The body itself does nothing — every
+* read and write goes through {@link SessionAxesStore}, which the composing
+* plugin owns.
+* @returns nothing.
+*/
+async function apply() {}
+Object.assign(apply, { Config: Config$1 });
+Object.defineProperty(apply, "name", {
+	value: "dual-axis-sessions",
+	configurable: true
+});
+//#endregion
+//#region lib/types/axis-entry.js
+/**
+* The dual-axis command's argument grammar: one client-composed entry string
+* into one access axis.
+*
+* The grammar is owned by the browser half's pickers, which emit exactly two
+* forms — <axis>:<deny|workspace|all> for the three closed values, and
+* <axis>:custom:base=<deny|workspace|all>[,groups=<id>|<id>][,allow=<absolute path>][,deny=<absolute path>]
+* from the path editor, where a repeated key carries several entries.
+*
+* A `groups` entry records the IDS ONLY, checked against the ids the settings
+* page currently defines and then stored verbatim. The group's rules are never
+* expanded into the entry: expansion happens at the moment of use, so editing a
+* group reaches every session that references it without a restart.
+*
+* The caller supplies the session's standing pair so a one-axis entry returns
+* the complete new pair; the axis the entry does not name keeps its value.
+*
+* @module @t4r71/dsh-dual-axis/axis-entry
+*/
+/** The two axis names an entry string may start with. */
+const AXIS_ENTRY_NAMES = ["read", "write"];
+/**
+* Whether a spelling names an access axis.
+* @param value - the text before the first colon.
+* @returns whether it is read or write.
+*/
+function isAxisName(value) {
+	return AXIS_ENTRY_NAMES.includes(value);
+}
+/**
+* Whether a spelling names a custom base.
+* @param value - the candidate base.
+* @returns whether it is one of the three bases.
+*/
+function isAxisBase(value) {
+	return value === "deny" || value === "workspace" || value === "all";
+}
+/**
+* Parse the base=…,groups=…,allow=…,deny=… fragment that follows <axis>:custom:.
+* @param fragment - everything after the second colon.
+* @param knownGroups - the rule-group ids the settings page currently defines.
+* @returns the custom scope, or the sentence explaining which entry failed.
+*/
+function parseCustomFragment(fragment, knownGroups) {
+	const entries = fragment.split(",");
+	const head = entries[0];
+	if (head === void 0 || !head.startsWith("base=")) return {
+		ok: false,
+		problem: "a custom axis must begin with base=<deny|workspace|all>"
+	};
+	const base = head.slice(5);
+	if (!isAxisBase(base)) return {
+		ok: false,
+		problem: "\"" + base + "\" is not a custom base; expected deny, workspace, or all"
+	};
+	const groups = [];
+	const allow = [];
+	const deny = [];
+	for (let index = 1; index < entries.length; index += 1) {
+		const entry = entries[index];
+		if (entry === void 0) continue;
+		const separator = entry.indexOf("=");
+		if (separator < 0) return {
+			ok: false,
+			problem: "\"" + entry + "\" is not a key=value entry; expected groups=<id>|<id>, allow=<absolute path>, or deny=<absolute path>"
+		};
+		const key = entry.slice(0, separator);
+		const value = entry.slice(separator + 1);
+		if (key !== "groups" && key !== "allow" && key !== "deny") return {
+			ok: false,
+			problem: "\"" + key + "\" is not a custom key; expected groups, allow, or deny"
+		};
+		if (key === "groups") {
+			for (const id of value.split("|")) {
+				if (id.length === 0) return {
+					ok: false,
+					problem: "groups entry " + JSON.stringify(value) + " carries an empty rule-group id"
+				};
+				if (!knownGroups.has(id)) return {
+					ok: false,
+					problem: "\"" + id + "\" is not a rule group the settings page defines"
+				};
+				if (!groups.includes(id)) groups.push(id);
+			}
+			continue;
+		}
+		if (!isAbsoluteSpelling(value)) return {
+			ok: false,
+			problem: key + " entry " + JSON.stringify(value) + " must be a non-empty absolute path"
+		};
+		if (key === "allow") allow.push(value);
+		else deny.push(value);
+	}
+	return {
+		ok: true,
+		scope: {
+			kind: "custom",
+			base,
+			groups: Object.freeze(groups),
+			allow: Object.freeze(allow),
+			deny: Object.freeze(deny)
+		}
+	};
+}
+/**
+* Read one client-composed axis entry into the complete axis pair it selects.
+* @param rawInput - the command invocation's verbatim input; the commands
+*   registry passes the text after the command name including the separating
+*   space, so this trims first.
+* @param current - the session's standing pair; the axis the entry does not
+*   name keeps its value from here.
+* @param knownGroups - the rule-group ids the settings page currently defines;
+*   a `groups` entry naming anything else is refused.
+* @returns the new pair, or the sentence explaining why the entry was refused.
+*/
+function parseAxisEntry(rawInput, current, knownGroups = /* @__PURE__ */ new Set()) {
+	const input = rawInput.trim();
+	if (input === "") return {
+		ok: false,
+		problem: "an axis switch requires <read|write>:<deny|workspace|all|custom:base=…,groups=…,allow=…,deny=…>"
+	};
+	const headEnd = input.indexOf(":");
+	if (headEnd < 0) return {
+		ok: false,
+		problem: "\"" + input + "\" names no axis; expected <read|write>:<value>"
+	};
+	const axisName = input.slice(0, headEnd);
+	if (!isAxisName(axisName)) return {
+		ok: false,
+		problem: "\"" + axisName + "\" is not an axis; expected read or write"
+	};
+	const tail = input.slice(headEnd + 1);
+	const kindEnd = tail.indexOf(":");
+	const kind = kindEnd < 0 ? tail : tail.slice(0, kindEnd);
+	const rest = kindEnd < 0 ? "" : tail.slice(kindEnd + 1);
+	let scope;
+	if (kind === "custom") {
+		if (rest === "") return {
+			ok: false,
+			problem: "custom needs its base and path lists: custom:base=<deny|workspace|all>[,groups=<id>|<id>][,allow=<absolute path>][,deny=<absolute path>]"
+		};
+		const parsed = parseCustomFragment(rest, knownGroups);
+		if (!parsed.ok) return parsed;
+		scope = parsed.scope;
+	} else if (isAxisBase(kind)) {
+		if (rest !== "") return {
+			ok: false,
+			problem: "\"" + kind + "\" takes no further arguments"
+		};
+		scope = { kind };
+	} else return {
+		ok: false,
+		problem: "\"" + kind + "\" is not an axis value; expected deny, workspace, all, or custom"
+	};
+	return {
+		ok: true,
+		axes: axisName === "read" ? {
+			read: scope,
+			write: current.write
+		} : {
+			read: current.read,
+			write: scope
+		}
+	};
+}
+//#endregion
+//#region lib/types/axis-command.js
+/**
+* The dual-axis bundle's command registration: the one write path the two
+* composer dropdowns reach the host through.
+*
+* The name is NOT permission. @deepseek-ai/dsh-permission-presets registers
+* /permission on the global command layer, and the registry's NamedEntries
+* throws on a duplicate global name, so reusing it would fail this plugin's
+* load. The preset picker keeps /permission; this command owns the axes.
+*
+* Registration rides ctx.inject(['commands'], …) rather than the plugin's
+* static inject: a profile without a command registry composes this bundle
+* for its fence and prompt, and an unconditional ctx.commands access would fail
+* that load.
+*
+* The write is a WHOLE-DOCUMENT settings write and therefore asynchronous, so
+* the handler is too. A lost revision race settles as an ordinary command
+* error carrying the conflict's own sentence: the dispatching surface renders
+* it beside the picker, and nothing is reported as applied that was not stored.
+*
+* @module @t4r71/dsh-dual-axis/axis-command
+*/
+/** The registered command name, without its leading slash. */
+const AXIS_COMMAND_NAME = "axis";
+/**
+* Render one axis value for the settlement sentence.
+* @param scope - the axis value.
+* @returns its kind, with a custom value's base and list sizes.
+*/
+function describeScope(scope) {
+	if (scope.kind !== "custom") return scope.kind;
+	return "custom(base=" + scope.base + ", +" + String(scope.allow.length) + ", -" + String(scope.deny.length) + ")";
+}
+/**
+* Register the axis command for every composed command adapter.
+* @param ctx - host context; the registration is owned by this context's fiber.
+* @param options - the standing-pair reader, the group-id reader, and the write path.
+*/
+function registerAxisCommand(ctx, options) {
+	ctx.inject(["commands"], (commandCtx) => {
+		commandCtx.commands.register({
+			definitionId: CommandDefinitionId("@t4r71/dsh-dual-axis"),
+			name: AXIS_COMMAND_NAME,
+			description: "Switch one file-sandbox access axis (read or write)",
+			input: { hint: "<read|write>:<deny|workspace|all|custom:base=…,groups=…,allow=…,deny=…>" },
+			handler: async ({ agent, rawInput }) => {
+				const parsed = parseAxisEntry(rawInput, options.current(agent.session), options.knownGroups());
+				if (!parsed.ok) return {
+					kind: "error",
+					text: parsed.problem + ". Usage: /axis <read|write>:<deny|workspace|all|custom:base=…,groups=…,allow=…,deny=…>"
+				};
+				try {
+					await options.write(agent.session, parsed.axes);
+				} catch (error) {
+					return {
+						kind: "error",
+						text: (error instanceof SessionAxesConflictError ? error.message : "the axis was not stored: " + (error instanceof Error ? error.message : String(error))) + ". Usage: /axis <read|write>:<deny|workspace|all|custom:base=…,groups=…,allow=…,deny=…>"
+					};
+				}
+				return {
+					kind: "success",
+					text: "read " + describeScope(parsed.axes.read) + " | write " + describeScope(parsed.axes.write)
+				};
+			}
+		});
+	});
+}
+//#endregion
+//#region lib/types/scope-prompt.js
+/**
+* The model-facing text of the two access axes: ONE source for both the
+* runtime-context paragraph the model reads before it acts and the refusal a
+* fence returns when it acts anyway.
+*
+* Why one module: the paragraph and the refusal must state the same range. Two
+* hand-written copies drift, and the drift is invisible — the model would plan
+* against one boundary in its context and be denied by a different one. Both
+* callers therefore call {@link renderAxisRange} for the range sentence and
+* share {@link NO_BYPASS} and {@link WIDENING_EXIT} verbatim; neither string is
+* spelled anywhere else in this package.
+*
+* Both callers feed it only session-log facts plus the group definitions the
+* log's ids resolve against: the axis preset is the `dual-axis/scopes` fold (the
+* projection unit), the workspace root is the session header's `cwd`, and the
+* group library is the settings row's `groups` field. Nothing here reads ambient
+* state of its own, so the rendered text is reconstructable from the log and
+* that library.
+*
+* @module @t4r71/dsh-dual-axis/scope-prompt
+*/
+/**
+* The sentence naming what is NOT a way around a refusal. Three facts, all of
+* which the model otherwise has to guess: the denial is the session's rule
+* rather than the calling tool's limitation; where each axis is enforced; and
+* that the two axes are layered differently.
+*
+* The layering is stated per axis because asserting it for the whole fence
+* would be false. `read-guard.ts` enforces the read axis and the allow/deny
+* path entries of the effective write range at the tool-dispatch layer, and the
+* write BASE tier a second time below it: `session-axes.ts` mirrors the
+* narrower of the two bases onto the session `sandbox/mode`, which the command
+* tools themselves run under. An effective write range based on `all` mirrors
+* to `danger-full-access`, so for that base there is no layer below the tool
+* layer at all.
+*/
+const NO_BYPASS = "This is not a limitation of the tool you called: switching to another tool, spawning a child process, writing a script, or calling a command tool does not make the path allowed — reaching it by any other route is still a violation of the session rule. The fence is also not one layer, but the layers differ per axis: the read axis, and the allow/deny PATH entries of the effective write range, are enforced at the tool layer, and bind only the tools that layer sees. The BASE tier of the effective write range — the narrower of the two axes' bases — is enforced a second time below the tool layer: it is mirrored onto the session sandbox mode that the command tools themselves run under, so a \"workspace\" or \"deny\" base keeps holding for a shell command. An effective write range based on \"all\" mirrors to no sandbox restriction at all, so nothing below the tool layer holds it.";
+/**
+* The sentence naming the only two compliant moves. Both are user-facing, so it
+* names where the user acts: the settings page row and the two composer
+* dropdowns are the two surfaces that write the same session axes.
+*/
+const WIDENING_EXIT = "The only compliant moves are: (1) complete the task inside the allowed range above, or (2) ask the user to widen that axis for this session — the settings page lists the dual-axis row, and the two dropdowns above the composer switch the same two axes.";
+/** Render one path list for the model; an empty list is stated, never left blank. */
+function renderRoots(roots) {
+	return roots.length === 0 ? "(none)" : JSON.stringify(roots);
+}
+/**
+* Render one axis as the concrete places it permits and forbids, with the
+* configured entries already resolved to canonical absolute roots.
+*
+* A model plans against directories, not at mode names: `workspace` alone
+* leaves it guessing whether the platform temp areas count, and `custom`
+* leaves it guessing which paths were added or removed. {@link resolveScope}
+* answers both, so this prints its result instead of the axis value.
+*
+* A `custom` axis whose entries cannot be resolved (a foreign or hand-edited
+* log carrying a relative path, which `ScopeConfigError` refuses) is stated as
+* permitting nothing rather than throwing: the paragraph must not fail the
+* whole assembly, and a range that cannot be evaluated must never read as a
+* wider one.
+* @param axis - the axis value in force.
+* @param workspaceRoot - the session workspace root a `workspace` and `custom` axis resolve against.
+* @returns the range sentence, e.g. `kind custom; allowed roots: ["C:\\ws"]; denied roots: ["C:\\ws\\secret"] (a denied path always wins)`.
+*/
+function renderAxisRange(axis, workspaceRoot) {
+	let resolved;
+	try {
+		resolved = resolveScope(axis, { workspaceRoot });
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		return `kind ${axis.kind}; the configured entries could not be resolved (${reason}), so no path is known to be allowed`;
+	}
+	const allowed = resolved.unbounded ? "every path on this host except the denied roots below" : renderRoots(resolved.allow);
+	const denied = resolved.deny.length === 0 ? renderRoots(resolved.deny) : `${renderRoots(resolved.deny)} (a denied path always wins)`;
+	return `kind ${axis.kind}; allowed roots: ${allowed}; denied roots: ${denied}`;
+}
+/**
+* The sentence reporting what the write-never-exceeds-read invariant removed.
+*
+* Stated because the removal is otherwise invisible: a rule group that grants
+* write access to a directory the read axis does not cover grants nothing, and a
+* user who cannot see that concludes the rule was ignored. Empty when the
+* intersection removed nothing, so a session that narrowed nothing is not
+* warned about a narrowing that did not happen.
+* @param narrowing - what the resolution removed from the write axis.
+* @returns the sentence, or the empty string when nothing was removed.
+*/
+function renderNarrowing(narrowing) {
+	if (!narrowing.narrowed) return "";
+	const parts = [];
+	if (narrowing.droppedRoots.length > 0) parts.push(`the read axis removed ${renderRoots(narrowing.droppedRoots)} from it`);
+	if (narrowing.lostUnbounded) parts.push("it was unbounded, and the read range is now its entire bound");
+	return "The read axis narrowed this write range: " + parts.join(", and ") + ". A write axis or rule group naming a path outside the read range grants nothing there — the write is refused, not silently allowed.";
+}
+/**
+* The runtime-context paragraph naming both axes as they stand for one session.
+*
+* The write member is the EFFECTIVE write range: the write axis with every
+* referenced group expanded, intersected with the read axis, and the intersection
+* is stated rather than left for the model to infer. A model that assumed the
+* write axis stood alone would plan writes the session refuses; one that assumed
+* the intersection without being told would refuse work the axes permit.
+* @param axes - the effective axis pair for the session.
+* @param workspaceRoot - the session's workspace root.
+* @returns the paragraph, ready to be contributed as one runtime-context entry.
+*/
+function renderScopePrompt(axes, workspaceRoot) {
+	const narrowing = renderNarrowing(axes.narrowing);
+	return `Current DSH file access axes for this session: read — ${renderAxisRange(axes.read, workspaceRoot)}; write — ${renderAxisRange(axes.write, workspaceRoot)}. A read outside the read axis is refused, and a modification outside the write axis is refused. The write range above is the write axis INTERSECTED with the read axis: a write is never permitted outside the read range, so a directory the read axis does not cover stays unwritable even when the write axis or one of its rule groups names it. ` + (narrowing === "" ? "" : narrowing + " ") + "This is not a limitation of the tool you called: switching to another tool, spawning a child process, writing a script, or calling a command tool does not make the path allowed — reaching it by any other route is still a violation of the session rule. The fence is also not one layer, but the layers differ per axis: the read axis, and the allow/deny PATH entries of the effective write range, are enforced at the tool layer, and bind only the tools that layer sees. The BASE tier of the effective write range — the narrower of the two axes' bases — is enforced a second time below the tool layer: it is mirrored onto the session sandbox mode that the command tools themselves run under, so a \"workspace\" or \"deny\" base keeps holding for a shell command. An effective write range based on \"all\" mirrors to no sandbox restriction at all, so nothing below the tool layer holds it. The only compliant moves are: (1) complete the task inside the allowed range above, or (2) ask the user to widen that axis for this session — the settings page lists the dual-axis row, and the two dropdowns above the composer switch the same two axes.";
+}
+/**
+* The notice stating that a session's axis preset could not be resolved, so no
+* path is known to be allowed.
+*
+* Rendered both into the prompt and into a refusal, from this one source: an
+* unresolvable reference — a rule group deleted while a session still references
+* it — must fail closed everywhere it is met, and must say which id is missing
+* rather than behaving like a group that allows nothing in particular.
+* @param problem - the resolution failure, naming the offending id.
+* @returns the model-facing notice.
+*/
+function unresolvedAxesNotice(problem) {
+	return "This session's file access axes could not be resolved, so no path is known to be allowed: " + problem + ". The reference is refused rather than read as an empty rule group, because a rule that silently does nothing is worse than a refusal. The only compliant moves are: (1) complete the task inside the allowed range above, or (2) ask the user to widen that axis for this session — the settings page lists the dual-axis row, and the two dropdowns above the composer switch the same two axes.";
+}
+/**
+* The refusal a fence returns for one path, built from the same range sentence
+* the prompt uses.
+* @param input - the refused path, the axis that refused it, and the root it resolves against.
+* @returns the model-facing refusal text.
+*/
+function scopeRefusal(input) {
+	const narrowing = input.axis === "write" && input.narrowing !== void 0 ? renderNarrowing(input.narrowing) : "";
+	return `Access denied: ${JSON.stringify(input.displayPath)} is outside this session's ${input.axis} axis. ${input.axis} axis in force — ${renderAxisRange(input.scope, input.workspaceRoot)}. ` + (narrowing === "" ? "" : narrowing + " ") + "This is not a limitation of the tool you called: switching to another tool, spawning a child process, writing a script, or calling a command tool does not make the path allowed — reaching it by any other route is still a violation of the session rule. The fence is also not one layer, but the layers differ per axis: the read axis, and the allow/deny PATH entries of the effective write range, are enforced at the tool layer, and bind only the tools that layer sees. The BASE tier of the effective write range — the narrower of the two axes' bases — is enforced a second time below the tool layer: it is mirrored onto the session sandbox mode that the command tools themselves run under, so a \"workspace\" or \"deny\" base keeps holding for a shell command. An effective write range based on \"all\" mirrors to no sandbox restriction at all, so nothing below the tool layer holds it. The only compliant moves are: (1) complete the task inside the allowed range above, or (2) ask the user to widen that axis for this session — the settings page lists the dual-axis row, and the two dropdowns above the composer switch the same two axes.";
+}
+//#endregion
+//#region lib/types/containment.js
+/**
+* 目标路径包含判定：把上游 `@deepseek-ai/dsh-fs-sandbox/containment` 的
+* `isPathUnder` 原样内联到本包。
+*
+* 为什么必须内联：fs-sandbox@0.1.7-rc.2 的**发布包** exports 只开出
+* `.`、`./src/*` 与 `./package.json` 三条，**没有 `./containment`**；
+* 而源码工作区里该文件存在，靠路径解析能直接命中。于是同一个 import 在
+* 工作区里编译通过、装成 tgz 后运行期必然抛
+* `Package subpath './containment' is not defined by "exports"`，
+* 使 dual-axis 这个 entry 永远无法激活（fiberPhase 恒为 null）。
+* 自有副本消除这个 install-shape 依赖。
+* @module @t4r71/dsh-dual-axis/containment
+*/
+const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+function isMissing(error) {
+	const code = error.code;
+	return MISSING_CODES.has(code);
+}
+function comparablePath(path, caseSensitive) {
+	return caseSensitive ? path : path.toLowerCase();
+}
+function isLexicallyUnder$1(path, root, caseSensitive) {
+	const comparableTarget = comparablePath(path, caseSensitive);
+	const comparableRoot = comparablePath(root, caseSensitive);
+	if (comparableTarget === comparableRoot) return true;
+	const prefix = comparableRoot.endsWith(sep) ? comparableRoot : comparableRoot + sep;
+	return comparableTarget.startsWith(prefix);
+}
+async function statIfPresent(path) {
+	try {
+		return await stat(path, { bigint: true });
+	} catch (error) {
+		if (isMissing(error)) return void 0;
+		throw error;
+	}
+}
+function sameIdentity(left, right) {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+/**
+* Determine whether a canonical target is a writable root or lies beneath it.
+* The lexical fast path handles normal canonical spellings. When spellings
+* differ, walk the target's existing ancestors and compare filesystem identity
+* with the root; this recognizes Windows long-name/8.3 aliases and casing
+* without weakening containment to a textual approximation.
+* @param path - canonical target key, which may end in a missing suffix.
+* @param root - canonical writable root.
+* @param caseSensitive - whether lexical comparison preserves case; defaults
+*   to the host filesystem convention used by supported platforms.
+* @returns whether the target is the root or a descendant of it.
+*/
+async function isPathUnder(path, root, caseSensitive = process.platform !== "win32") {
+	if (isLexicallyUnder$1(path, root, caseSensitive)) return true;
+	const rootInfo = await statIfPresent(root);
+	if (!rootInfo) return false;
+	let ancestor = path;
+	while (true) {
+		const ancestorInfo = await statIfPresent(ancestor);
+		if (ancestorInfo && sameIdentity(ancestorInfo, rootInfo)) return true;
+		const parent = dirname(ancestor);
+		if (parent === ancestor) return false;
+		ancestor = parent;
+	}
+}
+//#endregion
+//#region lib/types/fs-fence.js
+/**
+* Decide whether one read axis permits one canonical target key. This is the
+* fence's entire decision, as a pure function: it takes the evaluated range and
+* the containment predicate, so a test can exercise every branch with no
+* filesystem, no session, and no service.
+*
+* The error message names the READ axis's kind, never the mode that would
+* spell it: a read axis of `workspace` would otherwise be reported as
+* "workspace-write", a WRITE mode name this axis has no concept of.
+* @param read - the read axis in force.
+* @param policy - the workspace root a `workspace` read axis derives from.
+* @param targetKey - the target's canonical identity key.
+* @param contains - the containment predicate.
+* @returns `undefined` when permitted, or the refusal message.
+*/
+function readAxisRefusal(read, policy, targetKey, contains) {
+	if (scopeContains(resolveScope(read, policy), targetKey, contains)) return void 0;
+	return refuse(read);
+}
+/**
+* The async twin of {@link readAxisRefusal}: production containment
+* (`isPathUnder`) walks the filesystem identity chain for alias-equivalent
+* roots, so the fence cannot use the lexical predicate alone.
+* @param read - the read axis in force.
+* @param policy - the workspace root a `workspace` read axis derives from.
+* @param targetKey - the target's canonical identity key.
+* @param contains - the async containment predicate.
+* @returns `undefined` when permitted, or the refusal message.
+*/
+async function readAxisRefusalAsync(read, policy, targetKey, contains) {
+	const scope = resolveScope(read, policy);
+	for (const root of scope.deny) if (await contains(targetKey, root)) return refuse(read);
+	if (scope.unbounded) return void 0;
+	for (const root of scope.allow) if (await contains(targetKey, root)) return void 0;
+	return refuse(read);
+}
+/**
+* The single refusal message both predicates return, naming the READ axis's
+* kind rather than the write mode that would spell it.
+* @param read - the refused read axis.
+* @returns the refusal message.
+*/
+function refuse(read) {
+	return `file access denied under the ${read.kind} read axis`;
+}
+/**
+* The read-axis-enforcing filesystem backend. Mount it in place of
+* `@deepseek-ai/dsh-fs-sandbox`: it registers the same `fs` service and
+* inherits that backend's write fence verbatim.
+*/
+var DualAxisFileSystem = class extends SandboxedFileSystem {
+	constructor(ctx, config) {
+		super(ctx, config);
+	}
+	/**
+	* The read axis pair of the session a read belongs to. Reads carry no
+	* session, so the fence resolves the DEPLOYMENT default axes here; a caller
+	* that knows the calling session passes them per call instead.
+	* @returns the deployment default axis pair.
+	*/
+	defaultAxes() {
+		return effectiveScopes(this.ctx.sandboxPolicy.resolve());
+	}
+	/**
+	* Fence the caller's read path against the READ axis, then return the target
+	* for the inherited read. The check happens BEFORE any disk access.
+	* @param target - the target the caller already resolved.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the same target, once the read axis permits it.
+	* @throws {FsError} `FS_SANDBOX_DENIED` when the read axis refuses the target.
+	*/
+	async checkedRead(target, axes) {
+		const policy = this.ctx.sandboxPolicy.resolve();
+		const refusal = await readAxisRefusalAsync(axes?.read ?? this.defaultAxes().read, policy, target.targetKey, isPathUnder);
+		if (refusal !== void 0) throw new FsError(`cannot read "${target.displayPath}": ${refusal}`, "FS_SANDBOX_DENIED");
+		return target;
+	}
+	/**
+	* Fence `lstat`'s string path by resolving the same target the inherited
+	* implementation will inspect, then applying the read axis. The resolution
+	* happens BEFORE the metadata read, so a refusal never touches the disk, and
+	* the inherited call still receives the original arguments verbatim.
+	* @param path - the requested path, relative to `opts.cwd` or the backend cwd.
+	* @param opts - optional cwd for the resolution.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the target the inherited `lstat` will inspect.
+	*/
+	async checkedReadPath(path, opts, axes) {
+		return this.checkedRead(await this.resolve(path, opts), axes);
+	}
+	/**
+	* Fence the read by the per-call read axis, then delegate to the inherited
+	* UTF-8 read.
+	* @param target - the resolved target to read.
+	* @param signal - aborts the read.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the file content from the inherited backend.
+	*/
+	async readText(target, signal, axes) {
+		return super.readText(await this.checkedRead(target, axes), signal);
+	}
+	/**
+	* Fence the read by the per-call read axis, then delegate to the inherited
+	* streaming read. The fence runs BEFORE the iterable is handed out: a refused
+	* stream never produces a chunk.
+	* @param target - the resolved target to stream.
+	* @param signal - aborts the read.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the inherited chunk iterable.
+	*/
+	async streamText(target, signal, axes) {
+		return super.streamText(await this.checkedRead(target, axes), signal);
+	}
+	/**
+	* Fence the read by the per-call read axis, then delegate to the inherited
+	* bounded byte read.
+	* @param target - the resolved target to read.
+	* @param signal - aborts the read.
+	* @param maxBytes - inclusive byte cap on the complete content.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the file bytes from the inherited backend.
+	*/
+	async readBytes(target, signal, maxBytes, axes) {
+		return super.readBytes(await this.checkedRead(target, axes), signal, maxBytes);
+	}
+	/**
+	* Fence the read by the per-call read axis, then delegate to the inherited
+	* byte-window read.
+	* @param target - the resolved target to read.
+	* @param range - `offset` and `length` of the window.
+	* @param signal - aborts the read.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the byte window from the inherited backend.
+	*/
+	async readByteRange(target, range, signal, axes) {
+		return super.readByteRange(await this.checkedRead(target, axes), range, signal);
+	}
+	/**
+	* Fence the listing by the per-call read axis, then delegate to the inherited
+	* directory listing.
+	* @param target - the resolved directory to list.
+	* @param signal - aborts the listing.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the directory entries from the inherited backend.
+	*/
+	async listDir(target, signal, axes) {
+		return super.listDir(await this.checkedRead(target, axes), signal);
+	}
+	/**
+	* Fence the metadata read by the per-call read axis, then delegate to the
+	* inherited stat.
+	* @param target - the resolved target to inspect.
+	* @param signal - aborts the metadata read.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the metadata, or `undefined` when the target is absent.
+	*/
+	async stat(target, signal, axes) {
+		return super.stat(await this.checkedRead(target, axes), signal);
+	}
+	/**
+	* Fence the no-follow metadata read by the per-call read axis, then delegate
+	* to the inherited lstat with the caller's arguments unchanged.
+	* @param path - the requested path, relative to `opts.cwd` or the backend cwd.
+	* @param opts - optional cwd for the resolution.
+	* @param signal - aborts the metadata read.
+	* @param axes - the calling session's axis pair; omit for the deployment default.
+	* @returns the path-entry metadata, or `undefined` when the entry is absent.
+	*/
+	async lstat(path, opts, signal, axes) {
+		await this.checkedReadPath(path, opts, axes);
+		return super.lstat(path, opts, signal);
+	}
+};
+//#endregion
+//#region lib/types/index.js
+/**
+* 双轴访问模式组合包（宿主半边）：把文件沙箱的两条访问轴 —— 读轴与写轴，
+* 每条都取 deny | workspace | all | custom，custom 形如
+* `{ kind: 'custom', base, allow[], deny[] }`，语义是 allow = base ∪ allow − deny
+* 且 deny 优先 —— 作为一份可安装、可配置的组合层暴露出去。
+*
+* 这一层持有两件事：新会话从哪两条轴开始（本行的 Loader entry Config，见
+* `./config.ts`），以及这两条轴在一条会话里怎么存、怎么读
+* （`./session-store.ts`，本包自有的设置命名空间 `dual-axis-sessions`，按会话 id
+* 分区）。它把前者下发到后者的时机是 `ctx.on('session/created')`：0.1.7 里
+* `packages/interaction/permission-presets/src/index.ts:245` 用同一个钩子钉
+* 权限预设，本包在它之后注册，因此新会话先拿到预设的 mode，再被本包写上一对轴。
+* 那一对轴按会话来源分两种：顶层会话取设置页那一行当刻的值，子代理子会话取
+* **父会话当刻生效的那一对**（见 `./session-store.ts` 的 `inheritedAxes`）。
+* 同一个种子也是**记录缺席时那条会话被修复成的取值**（`seedAxesFor`），修复由
+* 三处活读路径上的 `store.ensure` 触发，见该方法的说明。
+*
+* 为什么轴不在会话日志里（0.1.7 上游删改所致，逐条依据见 README）：
+* - 轴代数由 `./axis.ts` 与 `./scope.ts` 自带（0.1.7 全删）。
+* - 会话内的载体由本包自己声明的事件类型承担在 0.1.7 里**不成立**：该类型不在
+*   `KNOWN_SESSION_EVENT_TYPES` 里，而 `Session.append` 的信封硬编码、不接
+*   `ignorable`，于是写过的会话会被 `validateStoredEvents` 整份拒收、冷启动后
+*   打不开。轴因此搬到 `./session-store.ts`；日志里只保留写轴基准档经
+*   `sandbox/mode` 的那一次镜像（`./session-axes.ts`）。
+* - 读路径围栏由 `./fs-fence.ts` 自己实现（0.1.7 的 fs-sandbox 只围栏写）。
+* - 设置节由本行的 Config + `.volatile()` 承载（0.1.7 删了 `installSection`
+*   与任意命名空间注册，ns 就是 entry id）。
+*
+* 客户端半边在 `@t4r71/dsh-dual-axis-ui`：本包不声明 `dsh.client`。
+*
+* @module @t4r71/dsh-dual-axis
+*/
+/**
+* {@link DualAxis.inject} 声明的依赖清单。
+*
+* `sessions` 是构造期就要用的：挂载时补齐挂载前就已存在的会话。cordis 里访问
+* 未声明的服务会直接抛 `cannot get property "..." without inject`，挂载当场失败。
+* 会话投影不再需要 —— 轴不再由会话事件喂（`./session-store.ts`）。
+*/
+const INJECT = ["sessions"];
+/**
+* 双轴访问模式组合层。
+*
+* 挂载时做四件事：自检行里声明的轴形状、在会话创建钩子上给新会话钉一对轴、
+* 按需回收已经消失的会话的记录、把写轴基准档镜像进日志。改完配置只管之后的
+* 会话；已经在跑的会话保持它存储里那一对轴。子代理子会话不取设置页的值，
+* 取它的父会话当刻那一对。
+*/
+var DualAxis = class {
+	/**
+	* 这一行需要的能力：会话表（补齐挂载前的会话）。依赖是静态字段，Cordis 的
+	* loader 只从插件的 `inject` 属性读它 —— 函数形态导出同名常量不会被采用。
+	*/
+	static inject = INJECT;
+	/** 本行的组合配置 schema，由 loader 在挂载前校验。 */
+	static Config = Config;
+	/**
+	* 本行的组合配置，挂载那一刻的那一份。
+	*
+	* 两条轴都是 `.volatile()` 字段，取值是 schema 的 accessor；但这份 accessor
+	* 是**构造期**解析出来的，0.1.7 的 loader 不把后来的设置改动提交回来，所以它
+	* 只作 {@link declaredAxes} 取不到设置服务时的兜底，不再是新会话的取值来源。
+	*/
+	config;
+	/** 轴的权威存储：本包自有的设置命名空间，按会话 id 分区。 */
+	store;
+	/**
+	* @param ctx - 宿主上下文，本层读会话表、注册会话钩子、写轴存储都经它。
+	* @param config - 本行的组合配置（挂载那一刻的值）。
+	*/
+	constructor(ctx, config) {
+		this.config = config;
+		axesOf(config);
+		this.store = sessionAxesStore(ctx);
+		ctx.inject(["systemPrompt"], (scope) => {
+			scope.systemPrompt.context({
+				name: "sandbox:dual-axis",
+				order: scope.systemPrompt.getContextOrder("SANDBOX_POLICY") + 1,
+				text: (context) => {
+					const session = context.agent?.session;
+					if (session === void 0) return "";
+					const workspaceRoot = session.header.cwd;
+					if (workspaceRoot === void 0) return "";
+					const resolved = this.resolveFor(ctx, session, workspaceRoot);
+					return resolved.ok ? renderScopePrompt(resolved.axes, workspaceRoot) : unresolvedAxesNotice(resolved.problem);
+				}
+			});
+		});
+		ctx.inject(["settings"], (scope) => {
+			scope.effect(() => scope.settings.configure({ auto: false }, ctx.fiber));
+		});
+		const pin = (session) => {
+			this.pin(ctx, session);
+		};
+		ctx.on("session/created", pin);
+		for (const session of ctx.sessions.list()) pin(session);
+		ctx.on("session/event", (session, event) => {
+			if (!CONTENT_EVENT_TYPES.has(event.type)) return;
+			const header = session.header;
+			if (header === void 0) return;
+			if (this.store.get(String(header.id)) !== void 0) return;
+			pin(session);
+		});
+		this.sweepSchedule(ctx);
+		registerAxisCommand(ctx, {
+			current: (session) => this.store.ensure(String(session.header.id), () => this.seedFor(ctx, session), hasContent(session)),
+			knownGroups: () => ruleGroupIds(groupLibraryValue(declaredSection(ctx))),
+			write: async (session, axes) => {
+				await this.store.set(String(session.header.id), axes);
+				mirrorWriteMode(session, axes);
+				const workspaceRoot = session.header.cwd;
+				if (workspaceRoot !== void 0) this.resolveFor(ctx, session, workspaceRoot);
+			}
+		});
+	}
+	/**
+	* 给一条会话钉上它该有的两条轴。
+	*
+	* 取值来源按会话来源分叉：子代理子会话继承父会话当刻那一对，其余会话取设置页
+	* 那一行当刻的值。这条会话在存储里已经有记录时**一律不写**：那条记录就是这条会话
+	* 自己的轴，设置页此后再改与它无关，而每一次重钉都会把用户在下拉里选过的值按设置页
+	* 覆盖回去。
+	*
+	* **没有内容**的会话同样**不写**：不是「已经有记录」，而是「还不该有记录」。
+	* 工作区选择器在同一个工作区里开新对话时复用同一条会话 id（`docs` 与 README 里
+	* 记着这条实测），所以创建即冻结等于把一条还没人用过的会话按当天的设置页钉死；
+	* 这条会话此后每次读取都由 `ensure` 现算种子，设置页改一行它就跟着改，直到它真的
+	* 被用过。落记录的两个时机因此是：**这一条会话被用过**（`hasContent`），或者
+	* **用户经 `/axis` 手动改过它的轴**（那条写路径无条件落，见 `registerAxisCommand`）。
+	* @param ctx - 宿主上下文，用于读这条会话与它父会话的轴。
+	* @param session - 目标会话。
+	*/
+	pin(ctx, session) {
+		const header = session.header;
+		if (header === void 0) return;
+		const id = String(header.id);
+		const standing = this.store.get(id);
+		if (standing !== void 0) {
+			mirrorWriteMode(session, standing);
+			return;
+		}
+		if (!hasContent(session)) return;
+		this.store.set(id, this.seedFor(ctx, session)).catch((error) => {
+			ctx.logger?.error("dual-axis: could not store the axes of session \"%s\"", id);
+			ctx.logger?.error(error);
+		});
+	}
+	/**
+	* 一条会话该有的那一对轴 —— 新会话的种子，也是记录缺席时被修复成的取值。
+	*
+	* `pin` 与三处活读路径上的 `store.ensure` 走的是这同一个方法，所以「新建时写下的」
+	* 与「后来补写的」不可能算出两个答案；没有设置服务的组合里用本行自己的 Config 兜底。
+	* @param ctx - 宿主上下文。
+	* @param session - 目标会话。
+	* @returns 这一对轴。
+	*/
+	seedFor(ctx, session) {
+		return seedAxesFor(ctx, session, {
+			axes: this.declaredAxes(ctx),
+			groups: this.declaredDefaultGroups(ctx)
+		});
+	}
+	/**
+	* 这条会话当刻生效的那一对轴 —— 记录缺席时现算种子，有记录时读记录；两条轴都按
+	* 引用的 id **当刻**取组定义，再求写轴 ∩ 读轴。
+	*
+	* 提示词、围栏与客户端显示走的是这**同一处**：解算结果里的 `narrowing` 被原样发布进
+	* 这条会话的记录（{@link SessionAxesStore.refreshNarrowing}），于是界面上说「被削掉了
+	* 这些根」与实际执行的围栏不会有第二个答案 —— 浏览器半边既算不出 `workspace` 底座
+	* （要 `os.tmpdir()`），也算不出根路径的规范拼写（要 `realpath`）。
+	* @param ctx - 宿主上下文。
+	* @param session - 目标会话。
+	* @param workspaceRoot - 这条会话的工作区根，`workspace` 与 `custom` 底座对它的解析。
+	* @returns 生效的一对轴，或解算不出来的原因。
+	*/
+	resolveFor(ctx, session, workspaceRoot) {
+		const id = String(session.header.id);
+		const preset = this.store.ensure(id, () => this.seedFor(ctx, session), hasContent(session));
+		const resolved = resolveEffectiveAxes(preset, referencedGroupIds(preset).length === 0 ? void 0 : groupLibraryValue(declaredSection(ctx)), { workspaceRoot });
+		if (resolved.ok) this.store.refreshNarrowing(id, resolved.axes.narrowing);
+		return resolved;
+	}
+	/**
+	* 按需回收：存储里那些 id 已经不在持久化会话表里的记录。
+	*
+	* 起停各扫一次、此后每 {@link SWEEP_INTERVAL_MS} 一次，都是后台任务：清扫失败只记
+	* 日志，绝不影响会话创建或判定路径。判据（为什么不是 `session/disposed`）见
+	* {@link SessionAxesStore.sweep}。
+	* @param ctx - 宿主上下文。
+	*/
+	/**
+	* 把每一条在册会话的收窄结论重新解算并发一次。
+	*
+	* 为什么需要这一步：收窄结论是解算的产物，而解算的输入里就有**组定义**，改一个组的
+	* 规则只改设置文档、不碰任何一条会话。少了这一次重发，界面上那句「读轴削掉了这些根」
+	* 就要等到这条会话下一次被触达（下一轮提示词、下一次工具调用、下一次改轴）才跟上，
+	* 而人在设置页改完组之后回到对话里看下拉时，两者都还没发生。
+	*
+	* 判定路径不受影响：围栏与提示词一直是按 id **现取**组定义的，这里重发的只是那份
+	* 已经解算出来的结论。没有记录的会话跳过 —— 它的轴本来就每次现算，落一份反而会冻住。
+	* @param ctx - 宿主上下文。
+	*/
+	republishNarrowing(ctx) {
+		for (const session of ctx.sessions.list()) {
+			const header = session.header;
+			if (header === void 0 || header.cwd === void 0) continue;
+			if (this.store.get(String(header.id)) === void 0) continue;
+			this.resolveFor(ctx, session, header.cwd);
+		}
+	}
+	sweepSchedule(ctx) {
+		const sweep = () => {
+			this.store.sweep().then((result) => {
+				if (result !== void 0 && result.removed.length > 0) ctx.logger?.info("dual-axis: dropped the axis records of %s deleted session(s)", String(result.removed.length));
+			}).catch((error) => {
+				ctx.logger?.warn("dual-axis: the session axis sweep failed; every record is kept");
+				ctx.logger?.warn(error);
+			});
+		};
+		const republish = () => {
+			this.republishNarrowing(ctx);
+		};
+		ctx.effect(() => {
+			const first = setTimeout(sweep, SWEEP_FIRST_DELAY_MS);
+			const repeating = setInterval(sweep, SWEEP_INTERVAL_MS);
+			const firstRepublish = setTimeout(republish, NARROWING_REFRESH_MS);
+			const republishing = setInterval(republish, NARROWING_REFRESH_MS);
+			return () => {
+				clearTimeout(first);
+				clearInterval(repeating);
+				clearTimeout(firstRepublish);
+				clearInterval(republishing);
+			};
+		}, "dual-axis: session axis sweep");
+	}
+	/**
+	* 设置页那一行当刻声明的两条轴。
+	*
+	* 走 `ctx.settings.describe()` 而不是构造期捕获的 `this.config`：设置页保存写的
+	* 是 Loader entry 的 config 文档，而 `this.config` 是挂载那一刻解析出来的
+	* volatile accessor 快照。0.1.7 的 loader 不把新值提交回插件实例持有的那一份
+	* （`vendor/loader/src/config/entry.ts:162-195`），所以同一进程内保存后，读
+	* `this.config` 拿到的仍是旧值，必须重启才生效。`describe()` 每次都从
+	* `entry.fiber.config` 重新投影并解 volatile
+	* （`packages/settings/settings/src/index.ts:319-323` +
+	* `packages/settings/settings/src/schema.ts:10-17`），与设置页摘要显示用的是
+	* 同一条读路径，因此这里读到的就是文件里那份值。
+	*
+	* `settings` 不在场的组合（本包可在没有设置服务的宿主里单独装载）退回构造期
+	* 那一份，也就是没有设置页可保存时的唯一取值。
+	* @param ctx - 宿主上下文。
+	* @returns 两条轴。
+	*/
+	declaredAxes(ctx) {
+		const value = declaredSection(ctx);
+		return axesOf(value === void 0 ? this.config : value);
+	}
+	/**
+	* 设置页声明「新会话默认加载」的组 id。
+	*
+	* 只被 {@link pin} 用来播种新会话，判定路径一概不读它 —— 与 read/write 两个默认值同理，
+	* 它描述的是一条**将要建立**的会话，不是任何已经有记录的会话。
+	* @param ctx - 宿主上下文。
+	* @returns 声明的组 id；没有设置服务时为空。
+	*/
+	declaredDefaultGroups(ctx) {
+		const value = declaredSection(ctx);
+		return value === void 0 ? defaultGroupIds(this.config) : defaultGroupIds(value);
+	}
+};
+/** 首次清扫的延迟：等 loader 把每个入口都激活、持久化后端也装好。 */
+const SWEEP_FIRST_DELAY_MS = 15e3;
+/** 之后每次清扫的间隔。 */
+const SWEEP_INTERVAL_MS = 3e4;
+/**
+* 两次重发收窄结论之间的毫秒数 —— 界面上那句「读轴削掉了这些根」跟随组定义的最坏延迟。
+*
+* 比回收记录的间隔短：回收只是清理，而这句话是给人读的判断，而它唯一的其他更新时机是
+* 这条会话被触达（下一轮提示词、下一次工具调用、下一次改轴）—— 人在设置页改完组之后回到
+* 对话里看下拉时，这三件事都还没发生。重发本身只在结论真的变了时才写文档。
+*/
+const NARROWING_REFRESH_MS = 1e4;
+//#endregion
+export { AXES_WRITE_ATTEMPTS, AXES_WRITE_BACKOFF_MS, AXIS_BASES, AXIS_COMMAND_NAME, AXIS_KINDS, Config, DEFAULT_AXES, DEFAULT_READ_SCOPE, DEFAULT_WRITE_SCOPE, DUAL_AXIS_ROW_ID, DualAxis, DualAxis as default, DualAxisFileSystem, NARROWING_REFRESH_MS, NO_BYPASS, RETIRED_SETTINGS_NAMESPACE, SESSION_AXES_FIELD, SESSION_AXES_NAMESPACE, SWEEP_FIRST_DELAY_MS, SWEEP_INTERVAL_MS, ScopeConfigError, Config$1 as SessionAxesConfig, SessionAxesConflictError, SessionAxesStore, WIDENING_EXIT, axesOf, declaredSection, defaultGroupIds, effectiveScopes, groupLibraryValue, inheritedAxes, intersectResolved, isAbsoluteSpelling, isLexicallyUnder, isModeConsistent, isSandboxMode, mirrorWriteMode, modeOfAxisBase, modeOfScope, narrowerBase, normalizeScope, parseAxisEntry, parseSessionAxesField, parseSessionAxesRecord, readAxisRefusal, referencedGroupIds, registerAxisCommand, renderAxisRange, renderScopePrompt, resolveEffectiveAxes, resolveScope, ruleGroupIds, sameScope, scopeContains, scopeOfMode, scopeOfResolved, scopeRefusal, seedAxesFor, seedGroupReferences, seedPair, sessionAxesStore };