dsh-patch-edit-plus 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.1.2] — 2026-09-19
+
+### Fixed
+
+- **The settings section never registered.** The settings namespace `patch_edit_plus` contains an underscore, which `dsh-settings`' namespace pattern (`^[a-z][a-z0-9-]*$`) rejects, so `register()` threw before anything persisted — no settings entry appeared in the panel or in `~/.dsh/settings.yaml`. Renamed to `patch-edit-plus` (no migration needed: the old section could never exist).
+- **Config changes from the settings layer never reached the tool.** The `setSource`/`onChange` hooks were no-ops and the resolved config was memoized once at load. The plugin now consumes the resolved source: every committed settings change (or legacy `register` watch) re-resolves the config and re-registers the tool — disposing the old registration first, since re-registering over a live name silently renames it. `allowCodexPatch` and every other field can now be toggled from the DSH settings panel and take effect immediately, with the tool description (the list of accepted patch styles) staying in sync; no process restart required. Detaching the settings service falls back to the composition entry, and re-judging is idempotent (the whole resolved config is compared, not just one field).
+
+## [0.1.1] — 2026-09-17
+
+### Fixed
+
+- **Every write was denied under `workspace-write`.** The tool passed no per-call `sandboxPolicy`, so the enforcing filesystem fell back to `ctx.sandboxPolicy.resolve()` with no scope — the DEPLOYMENT workspace root (the server's launch directory) instead of the session cwd. A path plainly inside the session workspace therefore failed containment and returned `file access denied under workspace-write mode`, even in a `danger-full-access` session, where the mode was not even read. The policy is now resolved per call with the calling session in scope (`resolve({ session })`) and stamped on every write and every Delete/Move shell request, exactly as the native `write`/`edit` tools do. Both halves of the mode are honored now: the session's `sandbox/mode` override and its cwd as the workspace root.
+- Path resolution and the fence now share one root: the plan resolves every target against the policy's `workspaceRoot` (falling back to the session cwd), so the path the engine writes is the path the fence measures.
+
 ## Unreleased
 
 ### Added

package/CHANGELOG.zh.md

@@ -1,5 +1,19 @@
 # 更新日志
 
+## [0.1.2] — 2026-09-19
+
+### 修复
+
+- **设置区从未注册成功。** settings 命名空间 `patch_edit_plus` 含下划线，不满足 `dsh-settings` 的命名空间校验（`^[a-z][a-z0-9-]*$`），`register()` 在校验处即抛错——面板与 `~/.dsh/settings.yaml` 中都不会出现该插件的设置段。现改名为 `patch-edit-plus`（无需迁移：旧段不可能存在过）。
+- **设置层的配置改动从未传导到工具。** `setSource`/`onChange` 两个钩子是空实现，且解析后的配置在加载时被一次固化。插件现在真正消费解析来源：设置层的每次提交变更（或旧版 `register` 的 watch）都会重新解析配置并重新注册工具——先注销旧注册再注册，避免重名时被静默改名。`allowCodexPatch` 等全部字段现在都可以在 DSH 设置面板中修改并立即生效，工具描述（可用补丁语法列表）同步更新，无需重启进程。settings 服务卸载时回落到组合条目，且重新判定是幂等的（比对整份 resolved config，而非单个字段）。
+
+## [0.1.1] — 2026-09-17
+
+### 修复
+
+- **所有写入在 `workspace-write` 下被拒绝。** 工具没有传递 per-call `sandboxPolicy`，强制执行的文件系统于是回退到无作用域的 `ctx.sandboxPolicy.resolve()`——拿到的是**部署级**工作区根（服务进程的启动目录）而非会话 cwd。因此明明位于会话工作区内的路径未通过围栏检查，返回 `file access denied under workspace-write mode`；连 `danger-full-access` 会话也一样，该模式下这个 mode 甚至根本没被读取。现在改为每次调用都带上调用会话作用域解析策略（`resolve({ session })`），并同时盖在每一次写入与每一次 Delete/Move 的 shell 请求上，与官方 `write`/`edit` 完全一致。mode 的两半都生效了：会话的 `sandbox/mode` 覆盖，以及以会话 cwd 作为工作区根。
+- 路径解析与围栏现在共用同一个根：计划阶段以策略的 `workspaceRoot`（缺省回退到会话 cwd）解析每个目标，写入引擎实际写的路径就是围栏实际度量的路径。
+
 ## Unreleased
 
 ### 新增

package/README.ja.md

@@ -87,7 +87,7 @@ dsh web --dump-config   # verify the plugin row appears
 | `conflictPolicy` | `rename` | ツール名が使用済みの場合の `rename` / `skip` / `fail`。 |
 | `renameSuffix` | `_1` | リネーム回避で使用される接尾辞。 |
 | `allowUnifiedDiff` | `true` | git/unified diff を受け付けます。 |
-| `allowCodexPatch` | `false` | Codex `apply_patch` 構文を受け付けます。 |
+| `allowCodexPatch` | `false` | Codex `apply_patch` 構文を受け付けます。DSH 設定パネルからも変更でき、変更は即座に反映されます(再起動不要)。 |
 | `deleteBackend` | `shell` | `shell` または `none`（削除/移動は構造化エラーを返します）。 |
 | `shellDialect` | `auto` | `auto`（win32 では pwsh）/ `posix` / `pwsh`。 |
 | `deleteCommand` / `moveCommand` | 組み込み | カスタムコマンドテンプレート。パスは依然として **env 経由のみ**（`DSH_PATCH_TARGET` / `DSH_PATCH_SOURCE`）で渡され、コマンド文字列に補間されることはありません。 |
@@ -100,6 +100,7 @@ dsh web --dump-config   # verify the plugin row appears
 ## 制限事項（開示）
 
 - **削除/移動は `ctx.shell` を通じて実行されます。** サンドボックスの強度は、ロードされたシェルエグゼキュータが強制する内容（`bash-sandbox` は境界を設け、`bash-local` は設けません）と同じであり、ネイティブ bash ツールと同じリスク態勢です。すべてのリクエストは `sandboxPolicy` を伴い、サンドボックスの事実を報告するため、「ポリシーによる拒否」と「コマンド失敗」を区別できます。
+- **すべての書き込みとすべての削除/移動がセッションスコープのポリシーを伴います。** `apply_patch` は呼び出しごとに `ctx.sandboxPolicy.resolve({ session })` を解決し(セッションのモードオーバーライドと、ワークスペースルートとしてのセッション cwd)、ネイティブの `write`/`edit` ツールとまったく同じにし、パスの計画も同じルートに対して行います。これがないと、強制実行するファイルシステムはデプロイメントルートにフォールバックし、`danger-full-access` セッションであってもワークスペース内の書き込みが `workspace-write` 拒否として失敗します。`workspace-write` での拒否はバックエンドの文言を含む `PatchError` として表面化します(構造化された `[sandbox: …]` マーカーと同じターン内のエスカレーションフィールドは未実装です。エスカレーションが必要な場合はネイティブの `write`/`edit` を使用してください)。
 - **追加は親ディレクトリを作成しません。** これはネイティブ `write` ツールと同じです（`ctx.fs` に mkdir はありません）。エラーには不足しているディレクトリ名が示されます。
 - ファジー/オフセットマッチングはありません。ハンクの位置は正確一致 → `trimEnd` → `trim` で、これは意図的なものです（ファジーマッチングは破壊的操作に対して安全ではありません。ロードマップに含まれています）。
 - バイナリパッチは明確なエラーで拒否されます。
@@ -110,7 +111,7 @@ dsh web --dump-config   # verify the plugin row appears
 npm install
 npm run typecheck        # against 0.1.2-rc.1 peers (devDependencies)
 npm run typecheck:0.1.5  # against 0.1.5-rc.2 peers (static dual-version proof)
-npm test                 # vitest, 84 tests
+npm test                 # vitest, 90 tests
 npm run lint
 npm run build            # lib/
 npm run verify:source    # static safety assertions (intent dance, no node:fs, …)

package/README.ko.md

@@ -87,7 +87,7 @@ dsh web --dump-config   # verify the plugin row appears
 | `conflictPolicy` | `rename` | 도구 이름이 이미 사용 중일 때의 동작으로, `rename` / `skip` / `fail` 중 하나입니다. |
 | `renameSuffix` | `_1` | 이름 회피에 사용되는 접미사입니다. |
 | `allowUnifiedDiff` | `true` | git/unified diff를 허용합니다. |
-| `allowCodexPatch` | `false` | Codex `apply_patch` 문법을 허용합니다. |
+| `allowCodexPatch` | `false` | Codex `apply_patch` 문법을 허용합니다. DSH 설정 패널에서도 변경할 수 있으며, 변경은 즉시 적용됩니다(재시작 불필요). |
 | `deleteBackend` | `shell` | `shell` 또는 `none`(`none`이면 삭제/이동이 구조화된 오류를 반환합니다). |
 | `shellDialect` | `auto` | `auto`(win32에서는 pwsh) / `posix` / `pwsh` 중 하나입니다. |
 | `deleteCommand` / `moveCommand` | 내장 | 사용자 지정 명령 템플릿입니다. 경로는 여전히 **환경 변수로만**(`DSH_PATCH_TARGET` / `DSH_PATCH_SOURCE`) 전달되며, 명령 문자열에 끼워 넣어서는 안 됩니다. |
@@ -100,6 +100,7 @@ dsh web --dump-config   # verify the plugin row appears
 ## 한계 (공개)
 
 - **삭제/이동은 `ctx.shell`을 통해 실행됩니다.** 샌드박스 강도는 로드된 셸 실행기가 실제로 강제하는 수준을 따릅니다(`bash-sandbox`는 격리하고, `bash-local`은 격리하지 않습니다) — 네이티브 bash 도구와 동일한 위험 구도입니다. 모든 요청은 `sandboxPolicy`를 함께 전달하고 샌드박스 관련 사실을 보고하므로, "정책 거부"와 "명령 실패"를 구별할 수 있습니다.
+- **모든 쓰기와 모든 삭제/이동이 세션 범위 정책을 함께 전달합니다.** `apply_patch`는 호출마다 `ctx.sandboxPolicy.resolve({ session })`을 해석하며(세션의 모드 재정의와 워크스페이스 루트로서의 세션 cwd), 네이티브 `write`/`edit` 도구와 완전히 동일하게 동작하고 경로 계획도 같은 루트를 사용합니다. 이것이 없으면 강제 적용하는 파일 시스템이 배포 루트로 폴백하여, `danger-full-access` 세션에서도 워크스페이스 내부 쓰기가 `workspace-write` 거부로 실패합니다. `workspace-write` 거부는 백엔드 문구를 담은 `PatchError`로 표면화됩니다(구조화된 `[sandbox: …]` 마커와 같은 턴의 에스컬레이션 필드는 구현되지 않았습니다. 에스컬레이션이 필요하면 네이티브 `write`/`edit`를 사용하십시오).
 - **추가(Add)는 상위 디렉터리를 생성하지 않습니다.** 이는 네이티브 `write` 도구와 동일한 동작이며(`ctx.fs`에는 mkdir이 없습니다), 오류 메시지에 누락된 디렉터리 이름이 표시됩니다.
 - 퍼지/오프셋 매칭은 지원하지 않습니다. hunk 위치 탐색은 정확 일치 → `trimEnd` → `trim` 순으로 의도적으로 수행합니다(퍼지 매칭은 파괴적 연산에 안전하지 않으며, 로드맵에 올라 있습니다).
 - 바이너리 패치는 명확한 오류와 함께 거부됩니다.
@@ -110,7 +111,7 @@ dsh web --dump-config   # verify the plugin row appears
 npm install
 npm run typecheck        # against 0.1.2-rc.1 peers (devDependencies)
 npm run typecheck:0.1.5  # against 0.1.5-rc.2 peers (static dual-version proof)
-npm test                 # vitest, 84 tests
+npm test                 # vitest, 90 tests
 npm run lint
 npm run build            # lib/
 npm run verify:source    # static safety assertions (intent dance, no node:fs, …)

package/README.md

@@ -6,11 +6,10 @@ Patch-style file editing for [DeepSeek Harness (DSH)](https://github.com/deepsee
 
 | DSH version | Status | Notes |
 |---|---|---|
-| `0.1.2-rc.1` | ✅ supported | Tool authoring contract (`defineTool` DSL, presentation intents) is byte-identical across 0.1.2–0.1.5; one code path serves both. |
-| `0.1.3-alpha.x` | ✅ supported | Same as above. |
-| `0.1.5-rc.2` | ✅ statically verified | `npm run typecheck:0.1.5` typechecks `src/` against the real `0.1.5-rc.2` peer packages. No `readByteRange` usage, no 0.1.5-only PTC identifiers. |
+| `0.1.7-rc.1+` | ✅ supported (this line, v0.2.0+) | Declarative settings: `allowCodexPatch` is marked `.volatile()` — the settings form renders automatically and `loader/volatile-update` re-registers the tool without a remount. No registration call. |
+| `0.1.2-rc.1` ~ `0.1.5-rc.2` | ↗ maintenance line | Served by the pre-0.1.7 branch / `dsh-0.1.5` dist-tag. 0.1.7 removed the imperative settings APIs the dual-API fallback relied on, so one codebase cannot serve both. |
 
-Settings registration uses the dual-API fallback (`settings.installSection` on 0.1.2+, `settings.register` on older hosts).
+Settings are declarative on this line: fields marked `.volatile()` in `Config` become the settings form; the plugin subscribes to `loader/volatile-update` instead of receiving registration hooks.
 
 ## Why patch at all? (tool routing guide)
 
@@ -87,7 +86,7 @@ Enable with `allowCodexPatch: true`. When a Codex patch arrives while disabled,
 | `conflictPolicy` | `rename` | `rename` / `skip` / `fail` when the tool name is taken. |
 | `renameSuffix` | `_1` | Suffix used by rename avoidance. |
 | `allowUnifiedDiff` | `true` | Accept git/unified diffs. |
-| `allowCodexPatch` | `false` | Accept Codex `apply_patch` syntax. |
+| `allowCodexPatch` | `false` | Accept Codex `apply_patch` syntax. Also editable in the DSH settings panel; changes take effect immediately, no restart needed. |
 | `deleteBackend` | `shell` | `shell` or `none` (Delete/Move return a structured error). |
 | `shellDialect` | `auto` | `auto` (pwsh on win32) / `posix` / `pwsh`. |
 | `deleteCommand` / `moveCommand` | built-in | Custom command templates. Paths still arrive **only via env** (`DSH_PATCH_TARGET` / `DSH_PATCH_SOURCE`); never interpolate them into the command string. |
@@ -100,6 +99,7 @@ Enable with `allowCodexPatch: true`. When a Codex patch arrives while disabled,
 ## Limitations (disclosed)
 
 - **Delete/Move run through `ctx.shell`.** The sandbox strength is whatever the loaded shell executor enforces (`bash-sandbox` fences; `bash-local` does not) — the same risk posture as the native bash tool. Every request carries a `sandboxPolicy` and reports sandbox facts so "policy denied" is distinguishable from "command failed".
+- **Every write and every Delete/Move carries the session-scoped policy.** `apply_patch` resolves `ctx.sandboxPolicy.resolve({ session })` per call — the session's mode override plus its cwd as the workspace root — exactly like the native `write`/`edit` tools, and resolves plan paths against that same root. Without it the enforcing filesystem falls back to the deployment root, which makes in-workspace writes fail as `workspace-write` denials even in a `danger-full-access` session. A `workspace-write` denial surfaces as a `PatchError` whose message carries the backend text (the structured `[sandbox: …]` marker and the same-turn escalation fields are not implemented; use the native `write`/`edit` tools when you need to escalate).
 - **Add does not create parent directories.** This matches the native `write` tool (`ctx.fs` has no mkdir); the error names the missing directory.
 - No fuzzy/offset matching: hunk location is exact → `trimEnd` → `trim`, deliberately (fuzzy matching is unsafe for destructive ops; it is on the roadmap).
 - Binary patches are rejected with a clear error.
@@ -110,7 +110,7 @@ Enable with `allowCodexPatch: true`. When a Codex patch arrives while disabled,
 npm install
 npm run typecheck        # against 0.1.2-rc.1 peers (devDependencies)
 npm run typecheck:0.1.5  # against 0.1.5-rc.2 peers (static dual-version proof)
-npm test                 # vitest, 84 tests
+npm test                 # vitest, 90 tests
 npm run lint
 npm run build            # lib/
 npm run verify:source    # static safety assertions (intent dance, no node:fs, …)

package/README.zh.md

@@ -6,11 +6,10 @@
 
 | DSH 版本 | 状态 | 说明 |
 |---|---|---|
-| `0.1.2-rc.1` | ✅ 支持 | 工具编写契约（`defineTool` DSL、presentation 视图）在 0.1.2–0.1.5 间逐字节未变，单一代码路径服务两个版本。 |
-| `0.1.3-alpha.x` | ✅ 支持 | 同上。 |
-| `0.1.5-rc.2` | ✅ 静态核验 | `npm run typecheck:0.1.5` 用真实 `0.1.5-rc.2` peer 包对 `src/` 做类型核验；不调用 `readByteRange`，不含 0.1.5-only PTC 字符串。 |
+| `0.1.7-rc.1+` | ✅ 支持（本线，v0.2.0+） | 声明式设置：`allowCodexPatch` 标记 `.volatile()`——设置表单自动生成，`loader/volatile-update` 驱动工具原位重注册（不 remount），无任何注册调用。 |
+| `0.1.2-rc.1` ~ `0.1.5-rc.2` | ↗ 维护线 | 由 0.1.7 前的分支 / `dsh-0.1.5` dist-tag 服务。0.1.7 删除了双 API 回退所依赖的命令式注册 API，一份代码无法同时兼容两代。 |
 
-settings 注册走双 API 回退：0.1.2+ 的 `settings.installSection` 优先，旧版回退 `settings.register`。
+本线的 settings 是声明式的：`Config` 中标记 `.volatile()` 的字段即设置表单；插件订阅 `loader/volatile-update`，不再接收注册 hooks。
 
 ## 工具路由指引（为什么该用谁）
 
@@ -86,7 +85,7 @@ dsh web --dump-config   # 确认插件行出现
 | `conflictPolicy` | `rename` | 重名时 `rename` / `skip` / `fail`。 |
 | `renameSuffix` | `_1` | 改名避让使用的后缀。 |
 | `allowUnifiedDiff` | `true` | 接受 git/unified diff。 |
-| `allowCodexPatch` | `false` | 接受 Codex `apply_patch` 语法。 |
+| `allowCodexPatch` | `false` | 接受 Codex `apply_patch` 语法。也可在 DSH 设置面板中修改，改动立即生效、无需重启。 |
 | `deleteBackend` | `shell` | `shell` 或 `none`（Delete/Move 返回结构化错误）。 |
 | `shellDialect` | `auto` | `auto`（win32 上 pwsh）/ `posix` / `pwsh`。 |
 | `deleteCommand` / `moveCommand` | 内置 | 自定义命令模板。路径仍然**只经 env** 传入（`DSH_PATCH_TARGET` / `DSH_PATCH_SOURCE`），请勿把路径插值进命令串。 |
@@ -99,6 +98,7 @@ dsh web --dump-config   # 确认插件行出现
 ## 限制（明确披露）
 
 - **Delete/Move 走 `ctx.shell`**：沙箱强度取决于装载的 shell 执行器（`bash-sandbox` 有围栏；`bash-local` 没有）—— 与原生 bash 工具的风险姿态一致。每次请求都携带 `sandboxPolicy` 并回传沙箱事实，"策略拒绝"与"命令失败"可区分。
+- **每次写入、每次 Delete/Move 都携带会话作用域策略**：`apply_patch` 每次调用都解析 `ctx.sandboxPolicy.resolve({ session })` —— 会话的 mode 覆盖，加上以会话 cwd 作为工作区根 —— 与官方 `write`/`edit` 完全一致，且路径规划用同一个根。缺了它，强制执行的文件系统会回退到部署级根，导致工作区内的写入以 `workspace-write` 拒绝告终，连 `danger-full-access` 会话也不例外。`workspace-write` 下的拒绝以 `PatchError` 呈现，消息里带后端原文（结构化的 `[sandbox: …]` 标记与同轮提权字段未实现；需要提权时请改用官方 `write`/`edit`）。
 - **Add 不创建父目录**：与原生 `write` 工具一致（`ctx.fs` 无 mkdir）；错误信息会指出缺失的目录。
 - 不做模糊/偏移匹配：定位容错为精确 → `trimEnd` → `trim` 三级，刻意保守（模糊匹配对删除类操作不安全，已列入路线图）。
 - 二进制补丁被拒绝并给出明确错误。
@@ -109,7 +109,7 @@ dsh web --dump-config   # 确认插件行出现
 npm install
 npm run typecheck        # 针对 0.1.2-rc.1 peer 包（devDependencies）
 npm run typecheck:0.1.5  # 针对 0.1.5-rc.2 peer 包（双版本静态核验）
-npm test                 # vitest，84 个用例
+npm test                 # vitest，90 个用例
 npm run lint
 npm run build            # lib/
 npm run verify:source    # 静态安全断言（intent 舞蹈、无 node:fs 等）

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-patch-edit-plus",
   "name": "dsh-patch-edit-plus",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": {
     "en": "Patch-style file editing: one apply_patch tool for git/unified diff (default) and Codex apply_patch syntax (opt-in), with all-or-nothing application and sandbox-aware delete/move.",
     "zh": "补丁风格文件编辑：单个 apply_patch 工具，接受 git/unified diff（默认）与 Codex apply_patch 语法（可选开启），全量验证后原子应用，删除/移动走沙箱感知 shell。"

package/lib/apply/plan.js

@@ -7,15 +7,19 @@
 import { duplicatePathError, limitError, missingParentError, pathEscapeError, symlinkRejectedError, } from '../errors.js';
 /**
  * Plan a parsed patch against the filesystem backend.
+ * @param sandboxPolicy - the per-call policy the mutations will carry; its
+ *   workspace root, when set, is the resolution cwd AND the containment root, so
+ *   the path the engine writes is exactly the path the fence will measure.
  * @throws {@link PatchError} on limits, path escapes, symlinks, missing parents or duplicate targets.
  */
-export async function buildPlan(ctx, exec, parsed, cfg) {
+export async function buildPlan(ctx, exec, parsed, cfg, sandboxPolicy) {
     if (parsed.ops.length > cfg.maxFiles)
         throw limitError('file section count', parsed.ops.length, cfg.maxFiles);
     const fs = ctx.fs;
-    const cwd = exec.agent?.session.header.cwd;
+    const cwd = sandboxPolicy?.workspaceRoot ?? exec.agent?.session.header.cwd;
     const resolveOpts = { cwd, signal: exec.signal };
-    // Containment root: the session workspace, when the call carries one.
+    // Containment root: the fencing root when the call carries a policy, else the
+    // session workspace. Mirrors the native write/edit tools' resolve options.
     const rootTarget = cwd === undefined ? undefined : await fs.resolve(cwd, resolveOpts);
     const seen = new Map();
     const entries = [];

package/lib/config.js

@@ -12,7 +12,7 @@ export const Config = z.object({
     conflictPolicy: z.union(['rename', 'skip', 'fail']).default('rename'),
     renameSuffix: z.string().default('_1'),
     allowUnifiedDiff: z.boolean().default(true),
-    allowCodexPatch: z.boolean().default(false),
+    allowCodexPatch: z.boolean().default(false).volatile(),
     deleteBackend: z.union(['shell', 'none']).default('shell'),
     shellDialect: z.union(['auto', 'posix', 'pwsh']).default('auto'),
     deleteCommand: z.string(),
@@ -23,6 +23,14 @@ export const Config = z.object({
     maxPatchBytes: z.number().step(1).min(1024).default(512 * 1024),
     maxDiffBytes: z.number().step(1).min(256).default(16 * 1024),
 });
+/** Read a `.volatile()` field: a live ref on 0.1.7+, a plain boolean otherwise. */
+export function readVolatileBoolean(value, fallback) {
+    if (typeof value === 'boolean')
+        return value;
+    if (value && typeof value.get === 'function')
+        return Boolean(value.get());
+    return fallback;
+}
 /** Fill user config with defaults; `undefined`/null entries fall back too. */
 export function resolveConfig(config) {
     const c = config ?? {};
@@ -31,7 +39,7 @@ export function resolveConfig(config) {
         conflictPolicy: c.conflictPolicy ?? 'rename',
         renameSuffix: typeof c.renameSuffix === 'string' ? c.renameSuffix : '_1',
         allowUnifiedDiff: c.allowUnifiedDiff ?? true,
-        allowCodexPatch: c.allowCodexPatch ?? false,
+        allowCodexPatch: readVolatileBoolean(c.allowCodexPatch, false),
         deleteBackend: c.deleteBackend ?? 'shell',
         shellDialect: c.shellDialect ?? 'auto',
         deleteCommand: typeof c.deleteCommand === 'string' && c.deleteCommand !== '' ? c.deleteCommand : undefined,

package/lib/index.js

@@ -4,36 +4,67 @@
  * One `apply_patch` tool accepting git/unified diff (default) and Codex
  * `apply_patch` syntax (opt-in). All-or-nothing application through the
  * official fs write-intent dance; delete/move through the sandbox-aware
- * shell. Compatible with DSH 0.1.2-rc.1 through 0.1.5-rc.2: the tool
- * authoring contract is byte-identical across those versions, so a single
- * code path serves both; only settings registration needs the dual-API
- * fallback (`installSection` first, `register` second).
+ * shell. Targets DSH 0.1.7+: settings are declarative — the fields marked
+ * `.volatile()` in `Config` render the settings form automatically (no
+ * registration call), and `loader/volatile-update` drives re-registration
+ * without a plugin remount. This line drops the pre-0.1.7 hosts; the
+ * 0.1.2-rc.1 ~ 0.1.5-rc.2 line stays on its maintenance branch.
  *
  * @module dsh-patch-edit-plus
  */
-import { Config, resolveConfig } from './config.js';
+import { resolveConfig } from './config.js';
 import { registerApplyPatchTool } from './register.js';
 /** Cordis plugin name used by Loader diagnostics. */
 export const name = 'dsh-patch-edit-plus';
-/** Settings namespace (a plain string literal: valid on every target version). */
-export const SETTINGS_NAMESPACE = 'patch_edit_plus';
-export { Config };
-/** Register the tool and the settings namespace. Every registration is scoped to this plugin. */
+/**
+ * Services this plugin reads, declared for the loader BEFORE `apply` runs.
+ *
+ * Cordis resolves `ctx.<service>` through a proxy that throws
+ * `cannot get property "<name>" without inject` for anything not declared
+ * here, and the loader surfaces that as a fatal `plugin tree failed to load`.
+ * Both entries below are read unconditionally on the load path:
+ * - `tools` — `registerApplyPatchTool` probes and registers (`ctx.tools`).
+ * - `fs` — reads plus the official write-intent dance (`ctx.fs`).
+ *
+ * `shell` is deliberately NOT declared. Delete/Move is the only consumer and
+ * `resolveShell` probes it inside a `try/catch`, returning `undefined` when no
+ * executor is mounted; declaring it would instead refuse to load the plugin
+ * in every profile that has no shell capability.
+ */
+export const inject = ['tools', 'fs'];
+export { Config } from './config.js';
+/**
+ * Register the tool from the current config snapshot.
+ *
+ * 登记级 key。工具「描述」把可用语法固化进去了（tool.ts 拼 `Accepts ${styles}`），
+ * 所以判定必须覆盖整份 resolved config，而不是只看 allowCodexPatch。
+ */
 export function apply(ctx, config) {
-    const cfg = resolveConfig(config);
+    // 组合条目（0.1.7 起 volatile 字段在其中是 live 引用）：rejudge 每次整体
+    // 重解析一次，一次调用内是同一份快照；跨调用的最新值由事件驱动重取。
+    const compositionEntry = config ?? {};
+    let disposer = null;
+    let registeredKey = null;
+    const rejudge = () => {
+        const next = resolveConfig(compositionEntry);
+        const key = JSON.stringify(next);
+        if (key === registeredKey)
+            return;
+        disposer?.();
+        disposer = registerApplyPatchTool(ctx, next) ?? null;
+        registeredKey = key;
+    };
     ctx.effect(() => {
-        const disposer = registerApplyPatchTool(ctx, cfg);
-        return disposer ?? (() => { });
+        rejudge();
+        return () => {
+            disposer?.();
+            disposer = null;
+            registeredKey = null;
+        };
     });
-    ctx.inject(['settings'], (settingsCtx) => {
-        const settings = settingsCtx.settings
-            ?? settingsCtx;
-        const base = config ?? {};
-        if (typeof settings?.installSection === 'function') {
-            settings.installSection(ctx, SETTINGS_NAMESPACE, Config, base, { setSource: () => { }, onChange: () => { } });
-        }
-        else if (typeof settings?.register === 'function') {
-            settings.register(SETTINGS_NAMESPACE, Config, { base });
-        }
+    // 0.1.7+: 只有 volatile 字段变更才走这里（不 remount）；普通字段变更会整体
+    // remount 插件，新一次 `apply` 自然读到全部新值。等值变更宿主不通知。
+    ctx.on('loader/volatile-update', () => {
+        rejudge();
     });
 }

package/lib/policy.js

@@ -0,0 +1,63 @@
+/**
+ * Sandbox-policy seam: the per-call policy every mutation must carry.
+ *
+ * `ctx.fs.writeText` and a shell run both take an OPTIONAL `sandboxPolicy`, and
+ * omitting it is not "no policy" — the enforcing backends fall back to
+ * `ctx.sandboxPolicy.resolve()` with NO scope, which resolves the DEPLOYMENT
+ * defaults: the configured fallback workspace root (the server's launch
+ * directory) rather than this call's session cwd, plus the deployment default
+ * mode rather than the session's `sandbox/mode` override.
+ *
+ * That fallback is what made every `apply_patch` write fail with
+ * `file access denied under workspace-write mode` in a `danger-full-access`
+ * session: the fenced path was inside the session workspace, but containment
+ * was measured against the launch directory. The error text names the wrong
+ * party, so the failure reads like a bad path rather than a lost policy.
+ *
+ * The official `write`/`edit` tools avoid it by resolving the policy PER CALL
+ * with the calling session in scope, which stamps both the session's mode
+ * override and `session.header.cwd` as the workspace root. This module does the
+ * same, so `apply_patch` is fenced exactly like the native tools: a wider
+ * session mode is honored and a narrower one is enforced against the real
+ * workspace instead of the launch directory.
+ *
+ * @module dsh-patch-edit-plus/policy
+ */
+function isPolicyFace(value) {
+    return typeof value === 'object' && value !== null && typeof value.resolve === 'function';
+}
+/**
+ * Structurally resolve `ctx.sandboxPolicy`, the way {@link resolveShell} resolves
+ * `ctx.shell`: `ctx.get` is the optional-service accessor, so a profile without a
+ * policy owner yields `undefined` instead of a load failure.
+ * @param ctx - the plugin context.
+ * @returns the policy service, or `undefined` when none is mounted.
+ */
+export function resolveSandboxPolicyService(ctx) {
+    try {
+        const get = ctx.get;
+        if (typeof get !== 'function')
+            return undefined;
+        const service = get.call(ctx, 'sandboxPolicy');
+        return isPolicyFace(service) ? service : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The policy to stamp onto every mutation of one tool call: the calling
+ * session's standing policy (its mode override, its cwd as the workspace root).
+ * An agentless call resolves the unscoped deployment policy, which is the correct
+ * fence when there is no session to name.
+ * @param ctx - the plugin context.
+ * @param exec - the tool-execution context supplying the calling session.
+ * @returns the policy to pass to the mutation, or `undefined` when the mounted
+ *   filesystem is not sandboxed (the argument is then ignored by the backend).
+ */
+export function resolveSandboxPolicy(ctx, exec) {
+    const service = resolveSandboxPolicyService(ctx);
+    if (service === undefined)
+        return undefined;
+    return exec.agent === undefined ? service.resolve() : service.resolve({ session: exec.agent.session });
+}

package/lib/tool.js

@@ -10,6 +10,7 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { PatchError, codexDisabledError, limitError, unifiedDisabledError } from './errors.js';
 import { detectFormat } from './detect.js';
+import { resolveSandboxPolicy } from './policy.js';
 import { parseCodexPatch } from './parse/codex.js';
 import { parseUnifiedDiff } from './parse/unified.js';
 import { buildPlan } from './apply/plan.js';
@@ -108,10 +109,13 @@ export function buildApplyPatchTool(toolName, ctx, cfg) {
             const dryRun = typeof args.dryRun === 'boolean'
                 ? args.dryRun
                 : cfg.dryRunByDefault;
-            const plan = await buildPlan(ctx, exec, parsed, cfg);
+            // Resolve the sandbox policy BEFORE planning: the plan resolves every path
+            // against the policy's workspace root, and the same policy is stamped on
+            // every mutation below, so planned paths and fenced paths share one root.
+            const sandboxPolicy = resolveSandboxPolicy(ctx, exec);
+            const plan = await buildPlan(ctx, exec, parsed, cfg, sandboxPolicy);
             const changes = await verifyPatch(ctx, exec, plan, cfg);
             if (!dryRun) {
-                const sandboxPolicy = undefined;
                 await applyPatch(ctx, exec, changes, cfg, sandboxPolicy);
             }
             return buildResult(format, !dryRun, changes, cfg, Date.now() - start);

package/lib/types/apply/plan.d.ts

@@ -7,6 +7,7 @@
 import type { Context } from '@deepseek-ai/cordis';
 import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
 import type { FsTarget } from '@deepseek-ai/dsh-fs';
+import type { SandboxExecutionPolicy } from '@deepseek-ai/dsh-sandbox';
 import type { ResolvedConfig } from '../config.js';
 import type { ParsedPatch, PatchOp } from '../parse/types.js';
 /** One planned, fully-resolved operation. */
@@ -24,8 +25,11 @@ export interface PlannedPatch {
 }
 /**
  * Plan a parsed patch against the filesystem backend.
+ * @param sandboxPolicy - the per-call policy the mutations will carry; its
+ *   workspace root, when set, is the resolution cwd AND the containment root, so
+ *   the path the engine writes is exactly the path the fence will measure.
  * @throws {@link PatchError} on limits, path escapes, symlinks, missing parents or duplicate targets.
  */
-export declare function buildPlan(ctx: Context, exec: ToolRunContext, parsed: ParsedPatch, cfg: ResolvedConfig): Promise<PlannedPatch>;
+export declare function buildPlan(ctx: Context, exec: ToolRunContext, parsed: ParsedPatch, cfg: ResolvedConfig, sandboxPolicy?: SandboxExecutionPolicy): Promise<PlannedPatch>;
 /** True when the operation needs the shell backend (delete or move). */
 export declare function needsShell(op: PatchOp): boolean;

package/lib/types/config.d.ts

@@ -6,6 +6,7 @@
  * @module dsh-patch-edit-plus/config
  */
 import z from '@deepseek-ai/schemastery';
+import type { Volatile } from '@deepseek-ai/cosmokit';
 /** What to do when the configured tool name is already taken at registration. */
 export type ConflictPolicy = 'rename' | 'skip' | 'fail';
 /** Backend used for Delete/Move operations (`ctx.fs` has no delete/move). */
@@ -22,8 +23,10 @@ export interface Config {
     renameSuffix?: string;
     /** Accept git/unified diff patches. Defaults to true. */
     allowUnifiedDiff?: boolean;
-    /** Accept Codex `apply_patch` syntax. Defaults to false. */
-    allowCodexPatch?: boolean;
+    /** Accept Codex `apply_patch` syntax. Defaults to false.
+     * 0.1.7 `.volatile()`: the loader hands `apply` a live `Volatile` ref for this
+     * field — always read it through `readVolatileBoolean`, never cache the ref. */
+    allowCodexPatch?: boolean | Volatile<boolean>;
     /** Delete/Move backend. Defaults to `shell`. `none` rejects Delete/Move with a structured error. */
     deleteBackend?: DeleteBackend;
     /** Shell dialect for the constant delete/move templates. Defaults to `auto` (pwsh on win32). */
@@ -44,7 +47,37 @@ export interface Config {
     maxDiffBytes?: number;
 }
 /** Schemastery schema for Loader defaults and generated configuration docs. */
-export declare const Config: z<Config>;
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    toolName: z<string, string, "defined">;
+    conflictPolicy: z<"rename" | "skip" | "fail", "rename" | "skip" | "fail", "defined">;
+    renameSuffix: z<string, string, "defined">;
+    allowUnifiedDiff: z<boolean, boolean, "defined">;
+    allowCodexPatch: z<boolean, boolean, "volatile-defined">;
+    deleteBackend: z<"shell" | "none", "shell" | "none", "defined">;
+    shellDialect: z<"auto" | "posix" | "pwsh", "auto" | "posix" | "pwsh", "defined">;
+    deleteCommand: z<string, string, "plain">;
+    moveCommand: z<string, string, "plain">;
+    dryRunByDefault: z<boolean, boolean, "defined">;
+    followSymlinks: z<boolean, boolean, "defined">;
+    maxFiles: z<number, number, "defined">;
+    maxPatchBytes: z<number, number, "defined">;
+    maxDiffBytes: z<number, number, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    toolName: z<string, string, "defined">;
+    conflictPolicy: z<"rename" | "skip" | "fail", "rename" | "skip" | "fail", "defined">;
+    renameSuffix: z<string, string, "defined">;
+    allowUnifiedDiff: z<boolean, boolean, "defined">;
+    allowCodexPatch: z<boolean, boolean, "volatile-defined">;
+    deleteBackend: z<"shell" | "none", "shell" | "none", "defined">;
+    shellDialect: z<"auto" | "posix" | "pwsh", "auto" | "posix" | "pwsh", "defined">;
+    deleteCommand: z<string, string, "plain">;
+    moveCommand: z<string, string, "plain">;
+    dryRunByDefault: z<boolean, boolean, "defined">;
+    followSymlinks: z<boolean, boolean, "defined">;
+    maxFiles: z<number, number, "defined">;
+    maxPatchBytes: z<number, number, "defined">;
+    maxDiffBytes: z<number, number, "defined">;
+}>>, "plain">;
 /** Fully-resolved configuration used by the tool body. */
 export interface ResolvedConfig {
     toolName: string;
@@ -62,5 +95,7 @@ export interface ResolvedConfig {
     maxPatchBytes: number;
     maxDiffBytes: number;
 }
+/** Read a `.volatile()` field: a live ref on 0.1.7+, a plain boolean otherwise. */
+export declare function readVolatileBoolean(value: boolean | Volatile<boolean> | undefined, fallback: boolean): boolean;
 /** Fill user config with defaults; `undefined`/null entries fall back too. */
 export declare function resolveConfig(config: Config | undefined): ResolvedConfig;

package/lib/types/index.d.ts

@@ -4,20 +4,44 @@
  * One `apply_patch` tool accepting git/unified diff (default) and Codex
  * `apply_patch` syntax (opt-in). All-or-nothing application through the
  * official fs write-intent dance; delete/move through the sandbox-aware
- * shell. Compatible with DSH 0.1.2-rc.1 through 0.1.5-rc.2: the tool
- * authoring contract is byte-identical across those versions, so a single
- * code path serves both; only settings registration needs the dual-API
- * fallback (`installSection` first, `register` second).
+ * shell. Targets DSH 0.1.7+: settings are declarative — the fields marked
+ * `.volatile()` in `Config` render the settings form automatically (no
+ * registration call), and `loader/volatile-update` drives re-registration
+ * without a plugin remount. This line drops the pre-0.1.7 hosts; the
+ * 0.1.2-rc.1 ~ 0.1.5-rc.2 line stays on its maintenance branch.
  *
  * @module dsh-patch-edit-plus
  */
 import type { Context } from '@deepseek-ai/cordis';
-import { Config } from './config.js';
 import type { Config as PluginConfig } from './config.js';
+declare module '@deepseek-ai/cordis' {
+    interface Events {
+        'loader/volatile-update': (paths: string[]) => void;
+    }
+}
 /** Cordis plugin name used by Loader diagnostics. */
 export declare const name = "dsh-patch-edit-plus";
-/** Settings namespace (a plain string literal: valid on every target version). */
-export declare const SETTINGS_NAMESPACE = "patch_edit_plus";
-export { Config };
-/** Register the tool and the settings namespace. Every registration is scoped to this plugin. */
+/**
+ * Services this plugin reads, declared for the loader BEFORE `apply` runs.
+ *
+ * Cordis resolves `ctx.<service>` through a proxy that throws
+ * `cannot get property "<name>" without inject` for anything not declared
+ * here, and the loader surfaces that as a fatal `plugin tree failed to load`.
+ * Both entries below are read unconditionally on the load path:
+ * - `tools` — `registerApplyPatchTool` probes and registers (`ctx.tools`).
+ * - `fs` — reads plus the official write-intent dance (`ctx.fs`).
+ *
+ * `shell` is deliberately NOT declared. Delete/Move is the only consumer and
+ * `resolveShell` probes it inside a `try/catch`, returning `undefined` when no
+ * executor is mounted; declaring it would instead refuse to load the plugin
+ * in every profile that has no shell capability.
+ */
+export declare const inject: string[];
+export { Config } from './config.js';
+/**
+ * Register the tool from the current config snapshot.
+ *
+ * 登记级 key。工具「描述」把可用语法固化进去了（tool.ts 拼 `Accepts ${styles}`），
+ * 所以判定必须覆盖整份 resolved config，而不是只看 allowCodexPatch。
+ */
 export declare function apply(ctx: Context, config?: PluginConfig): void;

package/lib/types/policy.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Sandbox-policy seam: the per-call policy every mutation must carry.
+ *
+ * `ctx.fs.writeText` and a shell run both take an OPTIONAL `sandboxPolicy`, and
+ * omitting it is not "no policy" — the enforcing backends fall back to
+ * `ctx.sandboxPolicy.resolve()` with NO scope, which resolves the DEPLOYMENT
+ * defaults: the configured fallback workspace root (the server's launch
+ * directory) rather than this call's session cwd, plus the deployment default
+ * mode rather than the session's `sandbox/mode` override.
+ *
+ * That fallback is what made every `apply_patch` write fail with
+ * `file access denied under workspace-write mode` in a `danger-full-access`
+ * session: the fenced path was inside the session workspace, but containment
+ * was measured against the launch directory. The error text names the wrong
+ * party, so the failure reads like a bad path rather than a lost policy.
+ *
+ * The official `write`/`edit` tools avoid it by resolving the policy PER CALL
+ * with the calling session in scope, which stamps both the session's mode
+ * override and `session.header.cwd` as the workspace root. This module does the
+ * same, so `apply_patch` is fenced exactly like the native tools: a wider
+ * session mode is honored and a narrower one is enforced against the real
+ * workspace instead of the launch directory.
+ *
+ * @module dsh-patch-edit-plus/policy
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
+import type { SandboxExecutionPolicy } from '@deepseek-ai/dsh-sandbox';
+/** The `ctx.sandboxPolicy` face this plugin reads (structurally — never a runtime import). */
+export interface SandboxPolicyFace {
+    /** Resolve the complete policy for one call; with a session it stamps that session's mode and cwd. */
+    resolve(request?: {
+        session?: unknown;
+    }): SandboxExecutionPolicy;
+}
+/**
+ * Structurally resolve `ctx.sandboxPolicy`, the way {@link resolveShell} resolves
+ * `ctx.shell`: `ctx.get` is the optional-service accessor, so a profile without a
+ * policy owner yields `undefined` instead of a load failure.
+ * @param ctx - the plugin context.
+ * @returns the policy service, or `undefined` when none is mounted.
+ */
+export declare function resolveSandboxPolicyService(ctx: Context): SandboxPolicyFace | undefined;
+/**
+ * The policy to stamp onto every mutation of one tool call: the calling
+ * session's standing policy (its mode override, its cwd as the workspace root).
+ * An agentless call resolves the unscoped deployment policy, which is the correct
+ * fence when there is no session to name.
+ * @param ctx - the plugin context.
+ * @param exec - the tool-execution context supplying the calling session.
+ * @returns the policy to pass to the mutation, or `undefined` when the mounted
+ *   filesystem is not sandboxed (the argument is then ignored by the backend).
+ */
+export declare function resolveSandboxPolicy(ctx: Context, exec: ToolRunContext): SandboxExecutionPolicy | undefined;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "dsh-patch-edit-plus",
-  "version": "0.1.0",
-  "description": "Patch-style file editing for DeepSeek Harness: one apply_patch tool accepting git/unified diff (default) and Codex apply_patch syntax (opt-in), with all-or-nothing application, read-before-write intent dance, sandbox-aware delete/move, and 0.1.2-rc.1 ~ 0.1.5-rc.2 compatibility.",
+  "version": "0.2.0",
+  "description": "Patch-style file editing for DeepSeek Harness: one apply_patch tool accepting git/unified diff (default) and Codex apply_patch syntax (opt-in), with all-or-nothing application, read-before-write intent dance, sandbox-aware delete/move, with a DSH 0.1.7+ line (declarative volatile settings).",
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "https://github.com/drscrewdriver/dsh-patch-edit-plus.git"
+    "url": "git+https://github.com/drscrewdriver/dsh-patch-edit-plus.git"
   },
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -47,7 +47,7 @@
   },
   "engines": {
     "node": ">=20",
-    "dsh": ">=0.1.2-rc.1 <0.2.0-0"
+    "dsh": ">=0.1.7-rc.1 <0.2.0-0"
   },
   "license": "MIT",
   "keywords": [
@@ -62,10 +62,10 @@
   ],
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-fs": ">=0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox": ">=0.1.2-rc.1",
-    "@deepseek-ai/dsh-shell": ">=0.1.2-rc.1",
-    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1"
+    "@deepseek-ai/dsh-fs": ">=0.1.7-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-sandbox": ">=0.1.7-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-shell": ">=0.1.7-rc.1 <0.2.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.1 <0.2.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -85,7 +85,7 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.2"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
@@ -98,6 +98,10 @@
     "eslint": "^9.0.0",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@deepseek-ai/schemastery": "^3.18.4"
+  },
+  "publishConfig": {
+    "tag": "dsh-0.1.7"
   }
 }