dsh-permission-rules 0.6.18 → 0.6.19

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## v0.6.19 - 2026-09-10
+
+### Security
+
+- A CONNECT tunnel refuses to dial a hostname when the adjudication resolved no address: `connectUpstream` now fails closed (logged, 502 to the client) instead of falling back to `connect(port, target.host)` — a second DNS resolution whose answer the rules never saw, and the one remaining path governed by Node's 250 ms `autoSelectFamilyAttemptTimeout`. The reported path itself was already fixed in 0.6.17 (`connect` dials the addresses `decideWithResolution` returned, and an IP literal skips the family race entirely); this closes the residual (issue #21).
+
+### Fixed
+
+- Session-less host-level traffic is judged against the CONFIGURED chain instead of an empty map. `proxyChains()` consulted only `byCwd`, which `rulesFor(cwd)` populates from a session or tool call, so at boot the harness's own host-level fetches met the whitelist default and were blocked as `[network: blocked pending approval]` even with a matching allow rule already configured. `hostChain()` loads the chain for the host process's own working directory (project file → absolute `rulesFile` → configured fallback → shipped baseline) while no per-cwd chain is loaded; it never becomes a `byCwd` member, so a session workspace chain always outranks it, and an unusable configured chain warns once and degrades to the mode default (issue #18).
+- Rule files are normalized before parsing: CRLF maps onto LF, a stray CR inside a line is dropped, and every CR is a line separator in a CR-only file. A lone CR is not a line break to the YAML parser in every position — it survived into the scalar it terminated (`domains: [registry.npmjs.org\r]`, or a final line ending in a bare CR), compiling a pattern that silently never matched its target (issue #19 item 4).
+- Rule-file watches poll on WSL drvfs mounts: `watchPollingFor` switches a watch to `usePolling` (300 ms interval) when the watched rule file is under `/mnt/<drive>` or `/proc/version` reports a Microsoft kernel, because chokidar's native change events are unreliable on drvfs/9p and a rule edit otherwise stopped hot-reloading silently with no error. Detection is per watch, so every other host keeps the native watcher, and `/rules reload` stays the manual fallback (issue #19 item 1).
+
+### Added
+
+- A failing model call now names the policy. The injected proxy environment is process-wide, so the harness's own LLM transport is adjudicated by this policy too, and a blocked provider endpoint surfaced as a bare `Connection error. / TRANSPORT`. A transparent `llm/stream` listener appends the `[network: …]` marker — blocked target, mode/rule, remediation — to the ORIGINAL error object (its class, code and retry facts stay intact) and logs it, so a turn can be attributed to the policy rather than reading as a provider outage. It registers only when `network.enabled`. It does NOT auto-allow provider endpoints: the two other resolutions the issue offers are not reachable from a plugin (`ctx.llm.listProviders()` exposes provider ids/names only, configured base URLs are adapter-owned, and there is no per-spawn environment seam for shell children), which the five READMEs record as a known limitation (issue #22).
+
+### Tests
+
+- Gate chain green: 23 files / 302 tests, coverage 92.27% statements / 87.29% branches / 93.62% functions.
+
 ## v0.6.18 - 2026-09-10
 
 ### Docs

package/README.es.md

@@ -45,7 +45,7 @@ Cada acierto **y** cada paso directo se registra como un evento de sesión `perm
 - **Línea base de alto riesgo integrada** — un conjunto deny/ask embarcado (comandos destructivos, escalada de privilegios, descarga-y-ejecución, rutas sensibles) habilitado por defecto y añadido después de las reglas de usuario (una regla de usuario más cercana puede sobrescribirlo); se alterna con `builtin.enabled`.
 - **Archivos de reglas jerárquicos** — `searchUp` opcional fusiona cada `.dsh/rules.yaml` desde el cwd de la sesión hasta la raíz del sistema de archivos, el más cercano primero.
 - **Despliegue en dry-run** — `enforce: false` audita lo que la política *haría* mientras deja pasar cada llamada.
-- **Recarga en caliente** — vigilancia Chokidar con debounce; una edición rota conserva las reglas anteriores, nunca falla.
+- **Recarga en caliente** — vigilancia Chokidar con debounce; una edición rota conserva las reglas anteriores, nunca falla. En un host WSL, o para un archivo de reglas bajo `/mnt/<unidad>`, la vigilancia pasa a sondeo (polling) porque allí los eventos nativos de cambio no son fiables.
 - **Fallo ruidoso** — YAML inválido, acciones/campos desconocidos, globs/regexes malos, patrones propensos a backtracking o más de `maxRules` reglas fallan la carga.
 
 ## Rule syntax
@@ -78,6 +78,7 @@ Una **política de red a nivel de proceso** estilo Codex: el tráfico de subproc
 
 - **Emparejamiento** — `match.network` con `domains` / `ips` / `ports` / `schemes` (globs, comodines, CIDR, rangos de puertos; se aceptan puertos YAML numéricos). La extracción de candidatos URL en la ruta caliente `tools/pre-execute` se dispara sobre argumentos de herramientas web y URLs embebidas en texto de comandos bash/pwsh; los destinos de loopback pueden cortocircuitar reglas según la política `loopback`. Los literales IPv6 mapeados a IPv4 se normalizan a su forma IPv4 antes de comparar, y el proxy se conecta a las direcciones con las que se tomó la decisión, sin una segunda resolución DNS.
 - **Auditoría** — las conexiones denegadas anexan `permissionRules/network` a la sesión propietaria (la misma puerta adaptativa `ignorable`), con contadores de bloqueo e intercepciones recientes en `/rules network` y la página de settings.
+- **Diagnóstico** — las conexiones bloqueadas llevan un mensaje `[network: …]`, y una llamada al modelo que falla mientras el proxy bloqueó un destino (el entorno de proxy inyectado también alcanza al transporte LLM del host) nombra ese destino y la solución en el texto del fallo, en lugar de quedar como un error de transporte desnudo.
 
 ## Quick start
 
@@ -174,6 +175,7 @@ Todos los parámetros son campos Schemastery `Config` (modificables desde cordis
 - **Los candidatos de ruta son heurísticos.** Solo las claves de argumento documentadas alimentan el emparejamiento de rutas, y el emparejamiento relativo al workspace es insensible a mayúsculas ASCII solo con `caseInsensitivePaths` activado.
 - **Los globs son un subconjunto conservador.** Sin expansión de llaves — escribe dos patrones, o usa modo regex.
 - **La guardia de backtracking de regex es estructural, no exhaustiva.** Prefiere el modo glob para archivos no confiables.
+- **Los endpoints del proveedor LLM necesitan una regla allow.** El entorno de proxy inyectado es de proceso completo, así que en modo whitelist el propio transporte del modelo del host se adjudica como cualquier otra conexión, y el plugin no puede enumerar los endpoints que llamará un adaptador (las rutas de proveedor exponen ids, y las base URL configuradas viven en los settings de cada adaptador). Añade una regla allow para el endpoint del proveedor, o pon `network.injectEnv: false` para dejar el proceso del host fuera del proxy.
 
 ## Collaborating with dsh-auto-review
 

package/README.hi.md

@@ -45,7 +45,7 @@
 - **अंतर्निहित उच्च-जोखिम आधाररेखा** — एक साथ भेजा गया deny/ask नियम-समूह (विनाशकारी कमांड, विशेषाधिकार वृद्धि, डाउनलोड-और-निष्पादन, संवेदनशील पथ) डिफ़ॉल्ट रूप से सक्षम और उपयोगकर्ता नियमों के बाद जोड़ा गया (निकटतम उपयोगकर्ता नियम इसे अधिरोहित कर सकता है); `builtin.enabled` से टॉगल करें।
 - **पदानुक्रमित नियम फ़ाइलें** — वैकल्पिक `searchUp` सत्र cwd से फ़ाइल-सिस्टम रूट तक हर `.dsh/rules.yaml` को मर्ज करता है, निकटतम पहले।
 - **dry-run रोलआउट** — `enforce: false` ऑडिट करता है कि नीति *क्या* करती, हर कॉल को पास करते हुए।
-- **हॉट रीलोड** — debounce सहित Chokidar निगरानी; टूटा संपादन पिछले नियम रखता है, कभी क्रैश नहीं।
+- **हॉट रीलोड** — debounce सहित Chokidar निगरानी; टूटा संपादन पिछले नियम रखता है, कभी क्रैश नहीं। WSL होस्ट पर, या `/mnt/<drive>` के नीचे रखी नियम फ़ाइल के लिए, निगरानी polling पर चली जाती है क्योंकि वहाँ मूल परिवर्तन इवेंट भरोसेमंद नहीं होते।
 - **ज़ोर से विफल** — अमान्य YAML, अज्ञात action/फ़ील्ड, ख़राब globs/regex, बैकट्रैकिंग-प्रवण पैटर्न या `maxRules` से अधिक नियम लोड को विफल करते हैं।
 
 ## Rule syntax
@@ -78,6 +78,7 @@ Codex-शैली की **प्रक्रिया-स्तरीय न
 
 - **मिलान** — `match.network` `domains` / `ips` / `ports` / `schemes` के साथ (globs, वाइल्डकार्ड, CIDR, पोर्ट श्रेणियाँ; संख्यात्मक YAML पोर्ट स्वीकृत)। `tools/pre-execute` हॉट पथ पर URL-उम्मीदवार निष्कर्षण वेब-टूल तर्कों और bash/pwsh कमांड टेक्स्ट में एम्बेडेड URLs पर चलता है; लूपबैक लक्ष्य `loopback` नीति के अनुसार नियमों को शॉर्ट-सर्किट कर सकते हैं। IPv4-मैप्ड IPv6 लिटरल तुलना से पहले IPv4 रूप में सामान्यीकृत होते हैं, और प्रॉक्सी उन्हीं पतों पर कनेक्ट करता है जिन पर निर्णय लिया गया — दूसरा DNS रिज़ॉल्यूशन नहीं।
 - **ऑडिट** — अस्वीकृत कनेक्शन स्वामी सत्र में `permissionRules/network` जोड़ते हैं (वही अनुकूली `ignorable` द्वार), `/rules network` और settings पृष्ठ में ब्लॉक काउंटर व हाल की अवरोधन के साथ।
+- **निदान** — अवरुद्ध कनेक्शन `[network: …]` संदेश लेकर आते हैं, और यदि मॉडल कॉल विफल होते समय प्रॉक्सी ने कोई लक्ष्य अवरुद्ध किया हो (इंजेक्ट किया गया प्रॉक्सी वातावरण होस्ट के LLM ट्रांसपोर्ट तक भी पहुँचता है), तो विफलता संदेश उस लक्ष्य और समाधान का नाम लेता है — केवल कच्चा ट्रांसपोर्ट त्रुटि नहीं दिखाता।
 
 ## Quick start
 
@@ -174,6 +175,7 @@ dsh --profile web --dump-config | grep -A4 'id: permission-rules'
 - **पथ उम्मीदवार अनुमानी हैं।** केवल दस्तावेज़ित तर्क कुंजियाँ पथ मिलान को खिलाती हैं, और कार्यक्षेत्र-सापेक्ष मिलान केवल `caseInsensitivePaths` चालू होने पर ASCII-केस-असंवेदी है।
 - **globs एक रूढ़िवादी उपसमुच्चय हैं।** कोई ब्रेस विस्तार नहीं — दो पैटर्न लिखें, या regex मोड उपयोग करें।
 - **regex बैकट्रैकिंग गार्ड संरचनात्मक है, संपूर्ण नहीं।** अविश्वसनीय फ़ाइलों के लिए glob मोड पसंद करें।
+- **LLM प्रदाता endpoints के लिए allow नियम चाहिए।** इंजेक्ट किया गया प्रॉक्सी वातावरण पूरे प्रोसेस का है, इसलिए whitelist मोड में होस्ट का अपना मॉडल ट्रांसपोर्ट भी किसी अन्य कनेक्शन की तरह adjudicate होता है, और प्लगइन यह गिन नहीं सकता कि कोई adapter किन endpoints को कॉल करेगा (provider routes केवल ids देते हैं, और configured base URLs हर adapter की अपनी settings में रहते हैं)। प्रदाता endpoint के लिए allow नियम जोड़ें, या होस्ट प्रोसेस को प्रॉक्सी से बाहर रखने के लिए `network.injectEnv: false` सेट करें।
 
 ## Collaborating with dsh-auto-review
 

package/README.md

@@ -46,7 +46,7 @@ Every hit **and** every passthrough is audit-logged as a `permissionRules/decisi
 - **Built-in high-risk baseline** — a shipped deny/ask ruleset (destructive commands, privilege escalation, download-and-execute, sensitive paths) enabled by default and appended after user rules so a nearer user rule can override it; toggle with `builtin.enabled`.
 - **Hierarchical rule files** — optional `searchUp` merges every `.dsh/rules.yaml` from the session cwd to the filesystem root, nearest first.
 - **Dry-run rollout** — `enforce: false` audits what the policy *would* do while passing every call through.
-- **Hot reload** — Chokidar watch with debounce; a broken edit keeps the previous rules, never crashes.
+- **Hot reload** — Chokidar watch with debounce; a broken edit keeps the previous rules, never crashes. On a WSL host, or for a rule file under `/mnt/<drive>`, the watch switches to polling because native change events are unreliable there.
 - **Fail loud** — invalid YAML, unknown actions/fields, bad globs/regexes, backtracking-prone patterns, or more than `maxRules` rules fail the load.
 
 ## Rule syntax
@@ -79,6 +79,7 @@ A Codex-style **process-level network policy**: shell subprocess traffic flows t
 
 - **Matching** — `match.network` with `domains` / `ips` / `ports` / `schemes` (globs, wildcards, CIDRs, port ranges; numeric YAML ports are accepted). URL-candidate extraction on the `tools/pre-execute` hot path fires on web-tool arguments and URLs embedded in bash/pwsh command text; loopback targets can short-circuit rules per `loopback` policy. IPv4-mapped IPv6 literals are normalized to their IPv4 form before matching, and the proxy connects on the addresses the decision was made on — never a second DNS resolution.
 - **Audit** — denied connections append `permissionRules/network` to the owning session (same adaptive `ignorable` gate), with block counters and recent interceptions in `/rules network` and the settings page.
+- **Diagnosis** — blocked connections carry a `[network: …]` message, and a model call that fails while the proxy blocked a target (the injected proxy environment also reaches the host's LLM transport) names that target and the remediation in its failure text instead of failing as a bare transport error.
 
 ## Quick start
 
@@ -175,6 +176,7 @@ All tunables are Schemastery `Config` fields (changeable from cordis.yml). An id
 - **Path candidates are heuristic.** Only the documented argument keys feed path matching, and workspace-relative matching is ASCII-case-insensitive only when `caseInsensitivePaths` is on.
 - **Globs are a conservative subset.** No brace expansion — write two patterns, or use regex mode.
 - **The regex backtracking guard is structural, not exhaustive.** Prefer glob mode for untrusted files.
+- **LLM provider endpoints need an allow rule.** The injected proxy environment is process-wide, so in whitelist mode the host's own model transport is adjudicated like any other connection, and the plugin cannot enumerate the endpoints an adapter will call (provider routes expose ids, and configured base URLs live in adapter-owned settings). Add an allow rule for the provider endpoint, or set `network.injectEnv: false` to keep the host process out of the proxy.
 
 ## Collaborating with dsh-auto-review
 

package/README.pt.md

@@ -45,7 +45,7 @@ Cada acerto **e** cada passagem direta é registrada como um evento de sessão `
 - **Linha de base de alto risco integrada** — um conjunto deny/ask embarcado (comandos destrutivos, escalada de privilégios, baixar-e-executar, caminhos sensíveis) habilitado por padrão e anexado após as regras de usuário (uma regra de usuário mais próxima pode sobrescrevê-lo); alterna com `builtin.enabled`.
 - **Arquivos de regras hierárquicos** — `searchUp` opcional mescla cada `.dsh/rules.yaml` do cwd da sessão até a raiz do sistema de arquivos, o mais próximo primeiro.
 - **Implantação em dry-run** — `enforce: false` audita o que a política *faria* enquanto deixa cada chamada passar.
-- **Recarga a quente** — vigilância Chokidar com debounce; uma edição quebrada mantém as regras anteriores, nunca falha.
+- **Recarga a quente** — vigilância Chokidar com debounce; uma edição quebrada mantém as regras anteriores, nunca falha. Num host WSL, ou para um arquivo de regras sob `/mnt/<unidade>`, a vigilância passa a polling porque os eventos nativos de mudança não são confiáveis ali.
 - **Falha ruidosa** — YAML inválido, ações/campos desconhecidos, globs/regexes ruins, padrões propensos a backtracking ou mais de `maxRules` regras falham a carga.
 
 ## Rule syntax
@@ -78,6 +78,7 @@ Uma **política de rede em nível de processo** estilo Codex: o tráfego de subp
 
 - **Correspondência** — `match.network` com `domains` / `ips` / `ports` / `schemes` (globs, curingas, CIDR, faixas de porta; portas YAML numéricas são aceitas). A extração de candidatos URL na rota quente `tools/pre-execute` dispara sobre argumentos de ferramentas web e URLs embutidas em texto de comando bash/pwsh; destinos de loopback podem curto-circuitar regras conforme a política `loopback`. Literais IPv6 mapeados em IPv4 são normalizados para a forma IPv4 antes da comparação, e o proxy conecta nos endereços usados na decisão, sem uma segunda resolução DNS.
 - **Auditoria** — conexões negadas anexam `permissionRules/network` à sessão proprietária (a mesma porta adaptativa `ignorable`), com contadores de bloqueio e intercepções recentes em `/rules network` e na página de settings.
+- **Diagnóstico** — conexões bloqueadas trazem uma mensagem `[network: …]`, e uma chamada ao modelo que falha enquanto o proxy bloqueou um destino (o ambiente de proxy injetado também alcança o transporte LLM do host) nomeia esse destino e a solução no texto da falha, em vez de ficar como um erro de transporte cru.
 
 ## Quick start
 
@@ -174,6 +175,7 @@ Todos os parâmetros são campos Schemastery `Config` (alteráveis pelo cordis.y
 - **Candidatos de caminho são heurísticos.** Somente as chaves de argumento documentadas alimentam a correspondência de caminho, e a correspondência relativa ao workspace é insensível a maiúsculas ASCII apenas com `caseInsensitivePaths` ativado.
 - **Globs são um subconjunto conservador.** Sem expansão de chaves — escreva dois padrões, ou use o modo regex.
 - **A guarda de backtracking de regex é estrutural, não exaustiva.** Prefira o modo glob para arquivos não confiáveis.
+- **Os endpoints do provedor LLM precisam de uma regra allow.** O ambiente de proxy injetado é do processo inteiro, então no modo whitelist o próprio transporte do modelo do host é adjudicado como qualquer outra conexão, e o plugin não consegue enumerar os endpoints que um adaptador vai chamar (as rotas de provedor expõem apenas ids, e as base URLs configuradas ficam nos settings de cada adaptador). Adicione uma regra allow para o endpoint do provedor, ou defina `network.injectEnv: false` para manter o processo do host fora do proxy.
 
 ## Collaborating with dsh-auto-review
 

package/README.zh.md

@@ -45,7 +45,7 @@
 - **内置高危基线** —— 随附的 deny/ask 规则集（破坏性命令、权限提升、下载即执行、敏感路径），默认开启并追加在用户规则之后（更近的用户规则可覆盖）；用 `builtin.enabled` 开关。
 - **分层规则文件** —— 可选 `searchUp` 从会话 cwd 到文件系统根合并每个 `.dsh/rules.yaml`，就近优先。
 - **试运行上线** —— `enforce: false` 审计策略*会*做什么，同时放行每个调用。
-- **热重载** —— Chokidar 监听带去抖；损坏的编辑保留旧规则、绝不崩溃。
+- **热重载** —— Chokidar 监听带去抖；损坏的编辑保留旧规则、绝不崩溃。在 WSL 主机上（或规则文件位于 `/mnt/<盘符>` 下时）监听切换为轮询，因为该处的原生变更事件不可靠。
 - **失败大声** —— 非法 YAML、未知 action/字段、坏 glob/正则、易回溯模式或超过 `maxRules` 的规则在加载期失败。
 
 ## Rule syntax
@@ -78,6 +78,7 @@ Codex 风格的**进程级网络策略**：shell 子进程流量经内置本地
 
 - **匹配** —— `match.network` 用 `domains` / `ips` / `ports` / `schemes`（glob、通配符、CIDR、端口范围；数值型 YAML 端口可接受）。`tools/pre-execute` 热路径上的 URL 候选抽取作用于 web 工具参数与嵌入 bash/pwsh 命令文本的 URL；回环目标可按 `loopback` 策略短路规则。IPv4 映射的 IPv6 字面量在匹配前归一化为 IPv4 形式；代理按裁决到的地址建连，不做二次 DNS 解析。
 - **审计** —— 被拒连接向所属会话追加 `permissionRules/network`（同样的自适应 `ignorable` 门），块计数器与近期拦截在 `/rules network` 与设置页展示。
+- **诊断** —— 被拦截的连接带 `[network: …]` 消息；若模型调用失败时代理恰好拦截了某个目标（注入的代理环境同样作用于宿主的 LLM 传输），失败文本会点名该目标与处置办法，而不再只是一个裸的传输错误。
 
 ## Quick start
 
@@ -174,6 +175,7 @@ dsh --profile web --dump-config | grep -A4 'id: permission-rules'
 - **路径候选是启发式的。** 只有文档化的参数键参与路径匹配，且工作区相对匹配仅在 `caseInsensitivePaths` 开启时忽略 ASCII 大小写。
 - **glob 是保守子集。** 无花括号展开——写两个模式，或用正则模式。
 - **正则回溯守卫是结构性的、非穷尽的。** 对不可信文件优先用 glob 模式。
+- **LLM 供应商端点需要显式允许规则。** 注入的代理环境是进程级的，因此白名单模式下宿主自身的模型传输与其他连接一样被裁决，而插件无法枚举某个适配器将要调用的端点（供应商路由只暴露 id，配置的 base URL 存在各适配器自己的设置里）。请为供应商端点添加 allow 规则，或设 `network.injectEnv: false` 让宿主进程不经过该代理。
 
 ## Collaborating with dsh-auto-review
 

package/lib/index.js

@@ -516,7 +516,7 @@ var RuleError = class extends Error {
 * @returns the validated document.
 */
 function parseRulesDocument(text) {
-	const parsed = parseYaml(text);
+	const parsed = parseYaml(normalizeLineEndings(text));
 	if (parsed === null || parsed === void 0) return { rules: [] };
 	const root = asRecord(parsed, "rules document root");
 	const unknownRoot = Object.keys(root).filter((key) => key !== "rules");
@@ -875,6 +875,25 @@ function compileParamPatterns(key, patterns, options) {
 		negative
 	};
 }
+/**
+* Normalize the line endings of one rule-file body before parsing. A file
+* authored or checked out on the Windows side arrives with CRLF, and a lone
+* CR — one not paired with an LF — is NOT a line break to the YAML parser in
+* every position: it survives into the scalar it terminates, so a pattern
+* spelled `domains: [registry.npmjs.org<CR>]`, or a final line ending in a
+* bare CR, compiled a pattern that could never match its target (issue #19
+* item 4). CRLF becomes LF; a stray CR inside a line is dropped (it is junk
+* there — a deliberate CR is written as the YAML escape `\r` and never
+* reaches this text); and a CR-only file (classic Mac line endings, no LF
+* anywhere) treats every CR as its line separator. Every line-ending style
+* therefore parses to the same document.
+* @param text - the raw rule-file text.
+* @returns the same text with LF line breaks and no stray CR.
+*/
+function normalizeLineEndings(text) {
+	if (!text.includes("\n")) return text.replace(/\r/g, "\n");
+	return text.replace(/\r\n/g, "\n").replace(/\r/g, "");
+}
 /** Parse YAML through the `yaml` dependency, mapping parse failures onto {@link RuleError}. */
 function parseYaml(text) {
 	try {
@@ -2187,13 +2206,22 @@ var NetworkProxy = class {
 	}
 	/**
 	* Connect to the first adjudicated address that accepts, so the tunnel lands
-	* on an address the decision approved; a hostname target with no resolution
-	* keeps the historical hostname connect. Each candidate is tried in order so
-	* a multi-address host does not lose its fallback.
+	* on an address the decision approved. Each candidate is tried in order so a
+	* multi-address host does not lose its fallback.
+	*
+	* A target whose adjudication resolved no address FAILS here instead of
+	* dialing the hostname (issue #21): dialing the name would be a second DNS
+	* resolution — the answer could differ from the one the rules were evaluated
+	* against — and it is the one remaining path where Node's happy-eyeballs
+	* race applies, with its 250 ms `autoSelectFamilyAttemptTimeout` default
+	* that kills any endpoint further away than that. Dialing an already-
+	* resolved literal skips that algorithm entirely (net.js connects an IP
+	* without a lookup), so the tunnel only ever reaches an adjudicated
+	* address; the client's retry resolves and adjudicates again.
 	*/
 	async connectUpstream(target, port) {
 		const pinned = pinnedAddresses(target);
-		if (pinned.length === 0) return connect(port, target.host);
+		if (pinned.length === 0) throw new Error(`no adjudicated address for ${target.host}`);
 		let lastError;
 		for (const address of pinned) try {
 			return await new Promise((resolve, reject) => {
@@ -2547,6 +2575,60 @@ const WEB_TOOLS = ["web_fetch", "web_search"];
 /** Stale in-flight entries are dropped after this many milliseconds (attribution is best-effort). */
 const IN_FLIGHT_TTL_MS = 6e5;
 /**
+* Clock slack for attributing a proxy block to a model call: a block recorded
+* within this window before the call started still counts, so millisecond
+* granularity or a listener ordering between the retry middleware and this
+* waterfall cannot hide the block that caused the failure.
+*/
+const LLM_BLOCK_SKEW_MS = 1e3;
+/**
+* Chokidar polling interval used when the watched path lives on a filesystem
+* whose change events are unreliable (WSL drvfs/9p mounts): polling costs a
+* stat per interval, which is negligible for a rule file and far cheaper than
+* a rule edit that silently never hot-reloads.
+*/
+const POLLING_WATCH_INTERVAL_MS = 300;
+/**
+* Whether one watched path lies under a WSL drvfs mount (`/mnt/<drive>/…`),
+* where inotify-style change events are known to be unreliable — chokidar
+* then has to poll (issue #19 item 1). The separator is normalized first so
+* the check also recognizes the path as the Windows side spells it; a
+* Windows drive path (`D:\…`) never matches.
+* @param path - the watched file or directory path.
+* @returns true when the path addresses a drvfs mount.
+*/
+function isDvrfsPath(path) {
+	return /^\/mnt\/[a-z](?:\/|$)/i.test(path.replace(/\\/g, "/"));
+}
+/**
+* Whether the running kernel is WSL's, as `/proc/version` reports it. Every
+* WSL kernel string carries `microsoft` (`…-microsoft-standard-WSL2`), which
+* is what the issue asks the detection to key on; a non-WSL Linux kernel
+* never does, and hosts without `/proc/version` (Windows, macOS) answer
+* false.
+* @param procVersion - the `/proc/version` text, or an empty string when it cannot be read.
+* @returns true when the kernel is Microsoft's.
+*/
+function isWslKernel(procVersion) {
+	return procVersion.toLowerCase().includes("microsoft");
+}
+/** `/proc/version` is immutable for the process lifetime: read it at most once. */
+let procVersionText;
+/** Read `/proc/version`, or an empty string wherever the file is absent (Windows, macOS). */
+function readProcVersion() {
+	if (procVersionText === void 0) try {
+		procVersionText = readFileSync("/proc/version", "utf8");
+	} catch {
+		procVersionText = "";
+	}
+	return procVersionText;
+}
+/** Chokidar options that switch one watch to polling (drvfs mount or WSL host). */
+const POLLING_WATCH_OPTIONS = {
+	usePolling: true,
+	interval: POLLING_WATCH_INTERVAL_MS
+};
+/**
 * State and behavior. One instance per plugin mount; disposals are owned by
 * the watcher/timer/proxy effects registered in {@link apply}.
 */
@@ -2558,6 +2640,10 @@ var PermissionRulesRuntime = class {
 	compileCache = /* @__PURE__ */ new Map();
 	/** Live watchers per watched path (rule file or candidate ancestor directory), with the cwds each serves. */
 	watchers = /* @__PURE__ */ new Map();
+	/** The configured chain session-less proxy connections are judged against (see {@link hostChain}); never a `byCwd` member. */
+	hostLoaded;
+	/** Whether the one-time "configured chain unusable" warning was already logged. */
+	hostChainWarned = false;
 	/** Debounce timers per rule-file path. */
 	timers = /* @__PURE__ */ new Map();
 	/** Whether the host honors the audit envelope's `ignorable` marker: unknown until the first decision (or peer-version check). */
@@ -3015,8 +3101,91 @@ var PermissionRulesRuntime = class {
 			ruleset: loaded.compiled,
 			sources: loaded.sources
 		});
+		if (chains.length === 0) {
+			const host = this.hostChain();
+			if (host !== void 0) chains.push(host);
+		}
 		return chains;
 	}
+	/**
+	* The CONFIGURED chain a session-less connection is judged against: the
+	* chain for the host process's own working directory (project rule file →
+	* an absolute `rulesFile` → the configured fallback → the shipped
+	* baseline), loaded on first use. Proxy traffic that carries no session —
+	* the harness's own plugin-market catalog/update/npm lookups at boot — used
+	* to be judged against an empty chain and therefore always hit the mode
+	* default, so a target an already-configured allow rule permits stayed
+	* blocked until some session had run a tool call (issue #18). The chain is
+	* kept OUT of `byCwd` on purpose: it must never outrank a session workspace
+	* chain, and it stops being consulted as soon as one is loaded (a host-level
+	* connection is then judged exactly as before, against the loaded workspace
+	* chains). It is not watched either: the session-less window is the boot
+	* window, and the first tool call of any session takes over with the normal
+	* per-workspace chain, which is watched.
+	* @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
+	*/
+	hostChain() {
+		if (this.hostLoaded === void 0) try {
+			this.hostLoaded = this.load(process.cwd());
+		} catch (error) {
+			if (!this.hostChainWarned) {
+				this.hostChainWarned = true;
+				this.ctx.logger.warn(`permission-rules: cannot load the configured rules for session-less connections at ${process.cwd()}: ${String(error)} (the network mode default applies)`);
+			}
+			return;
+		}
+		return {
+			ruleset: this.hostLoaded.compiled,
+			sources: this.hostLoaded.sources
+		};
+	}
+	/**
+	* The `llm/stream` waterfall listener (issue #22). The proxy environment
+	* this plugin injects for shell subprocesses is process-wide, so it is also
+	* visible to the harness's own LLM transport; a provider endpoint that the
+	* policy blocks then surfaces as a bare transport failure ("Connection
+	* error. / TRANSPORT" after the retry budget) with nothing pointing at the
+	* policy. This wrapper is transparent for every call: it only ENRICHES a
+	* failure whose window contains a proxy block, so no turn fails silently on
+	* a policy decision the user cannot see.
+	* @param next - the downstream chain (the resolved adapter's stream).
+	* @returns the same chunks, with any failure carrying the policy diagnosis.
+	*/
+	llmStream(next) {
+		return this.diagnosedLlmStream(next);
+	}
+	/** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
+	async *diagnosedLlmStream(next) {
+		const startedAt = Date.now();
+		try {
+			yield* next();
+		} catch (error) {
+			const diagnosis = this.llmFailureDiagnosis(startedAt);
+			if (diagnosis !== void 0) {
+				this.ctx.logger.warn(`permission-rules: ${diagnosis}`);
+				if (error instanceof Error && !error.message.includes("[network:")) error.message = `${error.message} — ${diagnosis}`;
+			}
+			throw error;
+		}
+	}
+	/**
+	* The policy diagnosis for one failed model call, or undefined when the
+	* proxy blocked nothing while it ran. The newest block in the window names
+	* the target and the mode, and the remediation is the honest one: allow the
+	* endpoint or stop injecting the policy environment into the host process.
+	*/
+	llmFailureDiagnosis(since) {
+		const proxy = this.networkProxy;
+		if (proxy === void 0) return void 0;
+		const blocks = proxy.recentBlocks().filter((record) => record.time >= since - LLM_BLOCK_SKEW_MS);
+		const newest = blocks[0];
+		if (newest === void 0) return void 0;
+		const target = `${newest.scheme ?? "https"}://${newest.domain}${newest.port !== void 0 ? `:${newest.port}` : ""}`;
+		const marker = newest.action === "ask" ? "[network: blocked pending approval]" : "[network: denied]";
+		const rule = newest.matched ? `, rule ${(newest.ruleIndex ?? 0) + 1}${newest.source !== "" ? ` (${newest.source})` : ""}` : ", no matching allow rule";
+		const more = blocks.length > 1 ? ` (and ${blocks.length - 1} more block${blocks.length > 2 ? "s" : ""} in the same window)` : "";
+		return `${marker} the local policy proxy blocked ${target} during this model call (mode ${newest.mode}${rule})${more} — the host process inherits the policy proxy environment (network.injectEnv), so the model transport is adjudicated like any other connection; add an allow rule for the provider endpoint or set network.injectEnv: false`;
+	}
 	/** Mark one delegated shell execution as in-flight (newest attribution wins). */
 	markShell(exec) {
 		this.inFlight.set(String(exec.callId), {
@@ -3534,6 +3703,19 @@ var PermissionRulesRuntime = class {
 			throw error instanceof RuleError ? error : new RuleError(`permission-rules: cannot load ${filePath}: ${message}`);
 		}
 	}
+	/**
+	* Whether one watched path must be polled instead of trusting the platform's
+	* change events. WSL is the case issue #19 item 1 reports: a rule file under
+	* `/mnt/<drive>` (drvfs/9p) or any file on a WSL host can stop delivering
+	* chokidar change events with no error at all, so the watcher edits would
+	* silently stop hot-reloading. Polling is the documented chokidar remedy;
+	* everywhere else the native watcher stays in place.
+	* @param path - the watched rule file or candidate directory.
+	* @returns true when the watch should run in polling mode.
+	*/
+	watchPollingFor(path) {
+		return isDvrfsPath(path) || isWslKernel(readProcVersion());
+	}
 	/** Attach (once per file path) the Chokidar watcher feeding {@link reload}. */
 	attachWatch(cwd, source) {
 		if (!this.config.watch || source === "" || this.config.builtin.enabled && source === this.config.builtin.path) return;
@@ -3543,9 +3725,11 @@ var PermissionRulesRuntime = class {
 			return;
 		}
 		const cwds = /* @__PURE__ */ new Set([cwd]);
+		const polling = this.watchPollingFor(source);
 		const watcher = chokidar.watch(source, {
 			persistent: true,
-			ignoreInitial: true
+			ignoreInitial: true,
+			...polling ? POLLING_WATCH_OPTIONS : {}
 		});
 		const onEvent = () => this.scheduleReload(source);
 		watcher.on("add", onEvent);
@@ -3641,6 +3825,7 @@ var PermissionRulesRuntime = class {
 		const watchOptions = {
 			persistent: true,
 			ignoreInitial: true,
+			...this.watchPollingFor(candidate) ? POLLING_WATCH_OPTIONS : {},
 			ignored: (path) => path.split(sep).includes("node_modules") || path.split(sep).includes(".git")
 		};
 		const watcher = dir === parent ? chokidar.watch(dir, watchOptions) : chokidar.watch(dir, {
@@ -3784,7 +3969,10 @@ async function apply(ctx, config) {
 		return next();
 	});
 	attachSettingsSection(ctx, runtime, config);
-	if (resolved.network.enabled) await runtime.attachNetworkProxy();
+	if (resolved.network.enabled) {
+		await runtime.attachNetworkProxy();
+		ctx.on("llm/stream", (_options, next) => runtime.llmStream(next));
+	}
 	ctx.inject(["systemPrompt"], (scope) => {
 		const systemPrompt = scope.get("systemPrompt");
 		if (systemPrompt?.context === void 0) return;

package/lib/types/proxy.d.ts

@@ -101,9 +101,18 @@ export declare class NetworkProxy {
     private handleRequest;
     /**
      * Connect to the first adjudicated address that accepts, so the tunnel lands
-     * on an address the decision approved; a hostname target with no resolution
-     * keeps the historical hostname connect. Each candidate is tried in order so
-     * a multi-address host does not lose its fallback.
+     * on an address the decision approved. Each candidate is tried in order so a
+     * multi-address host does not lose its fallback.
+     *
+     * A target whose adjudication resolved no address FAILS here instead of
+     * dialing the hostname (issue #21): dialing the name would be a second DNS
+     * resolution — the answer could differ from the one the rules were evaluated
+     * against — and it is the one remaining path where Node's happy-eyeballs
+     * race applies, with its 250 ms `autoSelectFamilyAttemptTimeout` default
+     * that kills any endpoint further away than that. Dialing an already-
+     * resolved literal skips that algorithm entirely (net.js connects an IP
+     * without a lookup), so the tunnel only ever reaches an adjudicated
+     * address; the client's retry resolves and adjudicates again.
      */
     private connectUpstream;
     /** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */

package/lib/types/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE3D,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAyF,CAAA;AAEtI,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE7E,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,IAAI,CAAA;aAAE,GAAG,OAAO,CAAA;SAAE,CAAA;KACtH,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,eAAe,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAA;IACzD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAA;IAClG,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,UAAU,CAAI;gBAEO,OAAO,EAAE,mBAAmB;IAEzD,2DAA2D;IAC3D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IAC/E,YAAY,IAAI,SAAS,kBAAkB,EAAE;IAI7C,iCAAiC;IACjC,UAAU,IAAI,YAAY;IAI1B,kDAAkD;IAClD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BxB,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,oHAAoH;YACtG,aAAa;IAyC3B;;;;;OAKG;YACW,eAAe;IAqB7B,uGAAuG;YACzF,aAAa;IAiD3B,yFAAyF;YAC3E,oBAAoB;IAgBlC,4FAA4F;IAC5F,OAAO,CAAC,WAAW;CA4BpB;AAsCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI,CAyBtF"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE3D,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAyF,CAAA;AAEtI,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE7E,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,IAAI,CAAA;aAAE,GAAG,OAAO,CAAA;SAAE,CAAA;KACtH,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,eAAe,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAA;IACzD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAA;IAClG,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,UAAU,CAAI;gBAEO,OAAO,EAAE,mBAAmB;IAEzD,2DAA2D;IAC3D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IAC/E,YAAY,IAAI,SAAS,kBAAkB,EAAE;IAI7C,iCAAiC;IACjC,UAAU,IAAI,YAAY;IAI1B,kDAAkD;IAClD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BxB,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,oHAAoH;YACtG,aAAa;IAyC3B;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAqB7B,uGAAuG;YACzF,aAAa;IAiD3B,yFAAyF;YAC3E,oBAAoB;IAgBlC,4FAA4F;IAC5F,OAAO,CAAC,WAAW;CA4BpB;AAsCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI,CAyBtF"}

package/lib/types/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AAEzC,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAsB,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAA;AAKD,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kHAAkH;IAClH,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wHAAwH;IACxH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,0JAA0J;IAC1J,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC7F,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/F,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAKxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,YAAY,EAAE,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAW/G;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAI/I;AA+CD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAerB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAsChG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAOD,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxE;AAoFD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAW5E;AA4PD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAID,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CA0B5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYrE;AA6DD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAgB7F;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AAEzC,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAsB,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAA;AAKD,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kHAAkH;IAClH,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wHAAwH;IACxH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,0JAA0J;IAC1J,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC7F,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/F,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAKxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,YAAY,EAAE,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAW/G;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAI/I;AA+CD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAerB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAsChG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAOD,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxE;AAoFD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAW5E;AAgRD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAID,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CA0B5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYrE;AA6DD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAgB7F;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}

package/lib/types/runtime.d.ts

@@ -12,6 +12,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
+import type { StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools';
 import type { Config, ResolvedConfig } from './config.js';
 import type { CompiledRuleset, RuleHit } from './rules.js';
@@ -33,6 +34,26 @@ interface LoadedRules {
     /** `true` when the last initial load threw under `badFilePolicy: 'fail'`. */
     readonly failed?: true;
 }
+/**
+ * Whether one watched path lies under a WSL drvfs mount (`/mnt/<drive>/…`),
+ * where inotify-style change events are known to be unreliable — chokidar
+ * then has to poll (issue #19 item 1). The separator is normalized first so
+ * the check also recognizes the path as the Windows side spells it; a
+ * Windows drive path (`D:\…`) never matches.
+ * @param path - the watched file or directory path.
+ * @returns true when the path addresses a drvfs mount.
+ */
+export declare function isDvrfsPath(path: string): boolean;
+/**
+ * Whether the running kernel is WSL's, as `/proc/version` reports it. Every
+ * WSL kernel string carries `microsoft` (`…-microsoft-standard-WSL2`), which
+ * is what the issue asks the detection to key on; a non-WSL Linux kernel
+ * never does, and hosts without `/proc/version` (Windows, macOS) answer
+ * false.
+ * @param procVersion - the `/proc/version` text, or an empty string when it cannot be read.
+ * @returns true when the kernel is Microsoft's.
+ */
+export declare function isWslKernel(procVersion: string): boolean;
 /**
  * State and behavior. One instance per plugin mount; disposals are owned by
  * the watcher/timer/proxy effects registered in {@link apply}.
@@ -45,6 +66,10 @@ export declare class PermissionRulesRuntime {
     private readonly compileCache;
     /** Live watchers per watched path (rule file or candidate ancestor directory), with the cwds each serves. */
     private readonly watchers;
+    /** The configured chain session-less proxy connections are judged against (see {@link hostChain}); never a `byCwd` member. */
+    private hostLoaded;
+    /** Whether the one-time "configured chain unusable" warning was already logged. */
+    private hostChainWarned;
     /** Debounce timers per rule-file path. */
     private readonly timers;
     /** Whether the host honors the audit envelope's `ignorable` marker: unknown until the first decision (or peer-version check). */
@@ -222,6 +247,46 @@ export declare class PermissionRulesRuntime {
     private decideProxyTarget;
     /** The loaded rule chains in cache order, nearest workspace first. */
     private proxyChains;
+    /**
+     * The CONFIGURED chain a session-less connection is judged against: the
+     * chain for the host process's own working directory (project rule file →
+     * an absolute `rulesFile` → the configured fallback → the shipped
+     * baseline), loaded on first use. Proxy traffic that carries no session —
+     * the harness's own plugin-market catalog/update/npm lookups at boot — used
+     * to be judged against an empty chain and therefore always hit the mode
+     * default, so a target an already-configured allow rule permits stayed
+     * blocked until some session had run a tool call (issue #18). The chain is
+     * kept OUT of `byCwd` on purpose: it must never outrank a session workspace
+     * chain, and it stops being consulted as soon as one is loaded (a host-level
+     * connection is then judged exactly as before, against the loaded workspace
+     * chains). It is not watched either: the session-less window is the boot
+     * window, and the first tool call of any session takes over with the normal
+     * per-workspace chain, which is watched.
+     * @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
+     */
+    private hostChain;
+    /**
+     * The `llm/stream` waterfall listener (issue #22). The proxy environment
+     * this plugin injects for shell subprocesses is process-wide, so it is also
+     * visible to the harness's own LLM transport; a provider endpoint that the
+     * policy blocks then surfaces as a bare transport failure ("Connection
+     * error. / TRANSPORT" after the retry budget) with nothing pointing at the
+     * policy. This wrapper is transparent for every call: it only ENRICHES a
+     * failure whose window contains a proxy block, so no turn fails silently on
+     * a policy decision the user cannot see.
+     * @param next - the downstream chain (the resolved adapter's stream).
+     * @returns the same chunks, with any failure carrying the policy diagnosis.
+     */
+    llmStream(next: () => AsyncIterable<StreamChunk>): AsyncIterable<StreamChunk>;
+    /** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
+    private diagnosedLlmStream;
+    /**
+     * The policy diagnosis for one failed model call, or undefined when the
+     * proxy blocked nothing while it ran. The newest block in the window names
+     * the target and the mode, and the remediation is the honest one: allow the
+     * endpoint or stop injecting the policy environment into the host process.
+     */
+    private llmFailureDiagnosis;
     /** Mark one delegated shell execution as in-flight (newest attribution wins). */
     private markShell;
     /** Drop one shell execution when it settles. */
@@ -344,6 +409,17 @@ export declare class PermissionRulesRuntime {
     validateDeploymentFiles(): void;
     /** Parse and compile one mandated file, rethrowing as a mount failure. */
     private loadForValidation;
+    /**
+     * Whether one watched path must be polled instead of trusting the platform's
+     * change events. WSL is the case issue #19 item 1 reports: a rule file under
+     * `/mnt/<drive>` (drvfs/9p) or any file on a WSL host can stop delivering
+     * chokidar change events with no error at all, so the watcher edits would
+     * silently stop hot-reloading. Polling is the documented chokidar remedy;
+     * everywhere else the native watcher stays in place.
+     * @param path - the watched rule file or candidate directory.
+     * @returns true when the watch should run in polling mode.
+     */
+    watchPollingFor(path: string): boolean;
     /** Attach (once per file path) the Chokidar watcher feeding {@link reload}. */
     private attachWatch;
     /**

package/lib/types/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAItE,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AAuBD;;;GAGG;AACH,qBAAa,sBAAsB;IA6B/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IA5BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAE9C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAQnB,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7C,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC/C;IAkBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAgBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C,8EAA8E;IAC9E,SAAS,IAAI,IAAI;IAIjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IA+B5F,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAmBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAmCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IAwE5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAItE,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AAuCD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAoBD;;;GAGG;AACH,qBAAa,sBAAsB;IAmC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAlCtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,8HAA8H;IAC9H,OAAO,CAAC,UAAU,CAAyB;IAE3C,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAQ;IAE/B,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAE9C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAYnB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC;IAI7E,uFAAuF;YACxE,kBAAkB;IAgBjC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAe3B,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7C,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC/C;IAkBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAgBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C,8EAA8E;IAC9E,SAAS,IAAI,IAAI;IAIjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IA+B5F,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAmBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAoCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IA0E5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.6.18",
+  "version": "0.6.19",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",

package/src/proxy.ts

@@ -199,13 +199,22 @@ export class NetworkProxy {
 
   /**
    * Connect to the first adjudicated address that accepts, so the tunnel lands
-   * on an address the decision approved; a hostname target with no resolution
-   * keeps the historical hostname connect. Each candidate is tried in order so
-   * a multi-address host does not lose its fallback.
+   * on an address the decision approved. Each candidate is tried in order so a
+   * multi-address host does not lose its fallback.
+   *
+   * A target whose adjudication resolved no address FAILS here instead of
+   * dialing the hostname (issue #21): dialing the name would be a second DNS
+   * resolution — the answer could differ from the one the rules were evaluated
+   * against — and it is the one remaining path where Node's happy-eyeballs
+   * race applies, with its 250 ms `autoSelectFamilyAttemptTimeout` default
+   * that kills any endpoint further away than that. Dialing an already-
+   * resolved literal skips that algorithm entirely (net.js connects an IP
+   * without a lookup), so the tunnel only ever reaches an adjudicated
+   * address; the client's retry resolves and adjudicates again.
    */
   private async connectUpstream(target: NetworkTarget, port: number): Promise<Duplex> {
     const pinned = pinnedAddresses(target)
-    if (pinned.length === 0) return connect(port, target.host)
+    if (pinned.length === 0) throw new Error(`no adjudicated address for ${target.host}`)
     let lastError: unknown
     for (const address of pinned) {
       try {

package/src/rules.ts

@@ -291,7 +291,7 @@ export interface MatchContext {
  * @returns the validated document.
  */
 export function parseRulesDocument(text: string): RulesFileDoc {
-  const parsed = parseYaml(text)
+  const parsed = parseYaml(normalizeLineEndings(text))
   // An empty (or comment-only) file is a valid empty rule set.
   if (parsed === null || parsed === undefined) return { rules: [] }
   const root = asRecord(parsed, 'rules document root')
@@ -714,6 +714,26 @@ function compileParamPatterns(key: string, patterns: readonly string[], options:
 
 // --- YAML/shape validation -------------------------------------------------
 
+/**
+ * Normalize the line endings of one rule-file body before parsing. A file
+ * authored or checked out on the Windows side arrives with CRLF, and a lone
+ * CR — one not paired with an LF — is NOT a line break to the YAML parser in
+ * every position: it survives into the scalar it terminates, so a pattern
+ * spelled `domains: [registry.npmjs.org<CR>]`, or a final line ending in a
+ * bare CR, compiled a pattern that could never match its target (issue #19
+ * item 4). CRLF becomes LF; a stray CR inside a line is dropped (it is junk
+ * there — a deliberate CR is written as the YAML escape `\r` and never
+ * reaches this text); and a CR-only file (classic Mac line endings, no LF
+ * anywhere) treats every CR as its line separator. Every line-ending style
+ * therefore parses to the same document.
+ * @param text - the raw rule-file text.
+ * @returns the same text with LF line breaks and no stray CR.
+ */
+function normalizeLineEndings(text: string): string {
+  if (!text.includes('\n')) return text.replace(/\r/g, '\n')
+  return text.replace(/\r\n/g, '\n').replace(/\r/g, '')
+}
+
 /** Parse YAML through the `yaml` dependency, mapping parse failures onto {@link RuleError}. */
 function parseYaml(text: string): unknown {
   try {

package/src/runtime.ts

@@ -18,6 +18,7 @@ import { dirname, isAbsolute, join, resolve, sep } from 'node:path'
 import chokidar from 'chokidar'
 import type { Context } from '@deepseek-ai/cordis'
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands'
+import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools'
 import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import { resolveConfig } from './config.ts'
@@ -81,6 +82,66 @@ const WEB_TOOLS: readonly string[] = ['web_fetch', 'web_search']
 /** Stale in-flight entries are dropped after this many milliseconds (attribution is best-effort). */
 const IN_FLIGHT_TTL_MS = 10 * 60 * 1000
 
+/**
+ * Clock slack for attributing a proxy block to a model call: a block recorded
+ * within this window before the call started still counts, so millisecond
+ * granularity or a listener ordering between the retry middleware and this
+ * waterfall cannot hide the block that caused the failure.
+ */
+const LLM_BLOCK_SKEW_MS = 1000
+
+/**
+ * Chokidar polling interval used when the watched path lives on a filesystem
+ * whose change events are unreliable (WSL drvfs/9p mounts): polling costs a
+ * stat per interval, which is negligible for a rule file and far cheaper than
+ * a rule edit that silently never hot-reloads.
+ */
+const POLLING_WATCH_INTERVAL_MS = 300
+
+/**
+ * Whether one watched path lies under a WSL drvfs mount (`/mnt/<drive>/…`),
+ * where inotify-style change events are known to be unreliable — chokidar
+ * then has to poll (issue #19 item 1). The separator is normalized first so
+ * the check also recognizes the path as the Windows side spells it; a
+ * Windows drive path (`D:\…`) never matches.
+ * @param path - the watched file or directory path.
+ * @returns true when the path addresses a drvfs mount.
+ */
+export function isDvrfsPath(path: string): boolean {
+  return /^\/mnt\/[a-z](?:\/|$)/i.test(path.replace(/\\/g, '/'))
+}
+
+/**
+ * Whether the running kernel is WSL's, as `/proc/version` reports it. Every
+ * WSL kernel string carries `microsoft` (`…-microsoft-standard-WSL2`), which
+ * is what the issue asks the detection to key on; a non-WSL Linux kernel
+ * never does, and hosts without `/proc/version` (Windows, macOS) answer
+ * false.
+ * @param procVersion - the `/proc/version` text, or an empty string when it cannot be read.
+ * @returns true when the kernel is Microsoft's.
+ */
+export function isWslKernel(procVersion: string): boolean {
+  return procVersion.toLowerCase().includes('microsoft')
+}
+
+/** `/proc/version` is immutable for the process lifetime: read it at most once. */
+let procVersionText: string | undefined
+
+/** Read `/proc/version`, or an empty string wherever the file is absent (Windows, macOS). */
+function readProcVersion(): string {
+  if (procVersionText === undefined) {
+    try {
+      procVersionText = readFileSync('/proc/version', 'utf8')
+    } catch {
+      procVersionText = ''
+    }
+  }
+  return procVersionText
+}
+
+/** Chokidar options that switch one watch to polling (drvfs mount or WSL host). */
+const POLLING_WATCH_OPTIONS = { usePolling: true, interval: POLLING_WATCH_INTERVAL_MS } as const
+
 /**
  * State and behavior. One instance per plugin mount; disposals are owned by
  * the watcher/timer/proxy effects registered in {@link apply}.
@@ -95,6 +156,12 @@ export class PermissionRulesRuntime {
   /** Live watchers per watched path (rule file or candidate ancestor directory), with the cwds each serves. */
   private readonly watchers = new Map<string, WatcherEntry>()
 
+  /** The configured chain session-less proxy connections are judged against (see {@link hostChain}); never a `byCwd` member. */
+  private hostLoaded: LoadedRules | undefined
+
+  /** Whether the one-time "configured chain unusable" warning was already logged. */
+  private hostChainWarned = false
+
   /** Debounce timers per rule-file path. */
   private readonly timers = new Map<string, ReturnType<typeof setTimeout>>()
 
@@ -525,9 +592,101 @@ export class PermissionRulesRuntime {
     for (const loaded of this.byCwd.values()) {
       chains.push({ ruleset: loaded.compiled, sources: loaded.sources })
     }
+    if (chains.length === 0) {
+      const host = this.hostChain()
+      if (host !== undefined) chains.push(host)
+    }
     return chains
   }
 
+  /**
+   * The CONFIGURED chain a session-less connection is judged against: the
+   * chain for the host process's own working directory (project rule file →
+   * an absolute `rulesFile` → the configured fallback → the shipped
+   * baseline), loaded on first use. Proxy traffic that carries no session —
+   * the harness's own plugin-market catalog/update/npm lookups at boot — used
+   * to be judged against an empty chain and therefore always hit the mode
+   * default, so a target an already-configured allow rule permits stayed
+   * blocked until some session had run a tool call (issue #18). The chain is
+   * kept OUT of `byCwd` on purpose: it must never outrank a session workspace
+   * chain, and it stops being consulted as soon as one is loaded (a host-level
+   * connection is then judged exactly as before, against the loaded workspace
+   * chains). It is not watched either: the session-less window is the boot
+   * window, and the first tool call of any session takes over with the normal
+   * per-workspace chain, which is watched.
+   * @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
+   */
+  private hostChain(): NetworkChain | undefined {
+    if (this.hostLoaded === undefined) {
+      try {
+        this.hostLoaded = this.load(process.cwd())
+      } catch (error: unknown) {
+        // Never throw into the proxy: an unusable configured chain degrades to
+        // the mode default (fail closed), with one warning per mount.
+        if (!this.hostChainWarned) {
+          this.hostChainWarned = true
+          this.ctx.logger.warn(`permission-rules: cannot load the configured rules for session-less connections at ${process.cwd()}: ${String(error)} (the network mode default applies)`)
+        }
+        return undefined
+      }
+    }
+    return { ruleset: this.hostLoaded.compiled, sources: this.hostLoaded.sources }
+  }
+
+  /**
+   * The `llm/stream` waterfall listener (issue #22). The proxy environment
+   * this plugin injects for shell subprocesses is process-wide, so it is also
+   * visible to the harness's own LLM transport; a provider endpoint that the
+   * policy blocks then surfaces as a bare transport failure ("Connection
+   * error. / TRANSPORT" after the retry budget) with nothing pointing at the
+   * policy. This wrapper is transparent for every call: it only ENRICHES a
+   * failure whose window contains a proxy block, so no turn fails silently on
+   * a policy decision the user cannot see.
+   * @param next - the downstream chain (the resolved adapter's stream).
+   * @returns the same chunks, with any failure carrying the policy diagnosis.
+   */
+  llmStream(next: () => AsyncIterable<StreamChunk>): AsyncIterable<StreamChunk> {
+    return this.diagnosedLlmStream(next)
+  }
+
+  /** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
+  private async *diagnosedLlmStream(next: () => AsyncIterable<StreamChunk>): AsyncGenerator<StreamChunk> {
+    const startedAt = Date.now()
+    try {
+      yield* next()
+    } catch (error: unknown) {
+      const diagnosis = this.llmFailureDiagnosis(startedAt)
+      if (diagnosis !== undefined) {
+        this.ctx.logger.warn(`permission-rules: ${diagnosis}`)
+        // Keep the original error object (its class, code, and retry facts)
+        // and only extend the message, so the failure taxonomy is unchanged.
+        if (error instanceof Error && !error.message.includes('[network:')) error.message = `${error.message} — ${diagnosis}`
+      }
+      throw error
+    }
+  }
+
+  /**
+   * The policy diagnosis for one failed model call, or undefined when the
+   * proxy blocked nothing while it ran. The newest block in the window names
+   * the target and the mode, and the remediation is the honest one: allow the
+   * endpoint or stop injecting the policy environment into the host process.
+   */
+  private llmFailureDiagnosis(since: number): string | undefined {
+    const proxy = this.networkProxy
+    if (proxy === undefined) return undefined
+    const blocks = proxy.recentBlocks().filter(record => record.time >= since - LLM_BLOCK_SKEW_MS)
+    const newest = blocks[0]
+    if (newest === undefined) return undefined
+    const target = `${newest.scheme ?? 'https'}://${newest.domain}${newest.port !== undefined ? `:${newest.port}` : ''}`
+    const marker = newest.action === 'ask' ? '[network: blocked pending approval]' : '[network: denied]'
+    const rule = newest.matched
+      ? `, rule ${(newest.ruleIndex ?? 0) + 1}${newest.source !== '' ? ` (${newest.source})` : ''}`
+      : ', no matching allow rule'
+    const more = blocks.length > 1 ? ` (and ${blocks.length - 1} more block${blocks.length > 2 ? 's' : ''} in the same window)` : ''
+    return `${marker} the local policy proxy blocked ${target} during this model call (mode ${newest.mode}${rule})${more} — the host process inherits the policy proxy environment (network.injectEnv), so the model transport is adjudicated like any other connection; add an allow rule for the provider endpoint or set network.injectEnv: false`
+  }
+
   /** Mark one delegated shell execution as in-flight (newest attribution wins). */
   private markShell(exec: ToolExecution): void {
     this.inFlight.set(String(exec.callId), { tool: exec.name, callId: exec.callId, startedAt: Date.now(), agent: exec.agent })
@@ -1014,6 +1173,20 @@ export class PermissionRulesRuntime {
     }
   }
 
+  /**
+   * Whether one watched path must be polled instead of trusting the platform's
+   * change events. WSL is the case issue #19 item 1 reports: a rule file under
+   * `/mnt/<drive>` (drvfs/9p) or any file on a WSL host can stop delivering
+   * chokidar change events with no error at all, so the watcher edits would
+   * silently stop hot-reloading. Polling is the documented chokidar remedy;
+   * everywhere else the native watcher stays in place.
+   * @param path - the watched rule file or candidate directory.
+   * @returns true when the watch should run in polling mode.
+   */
+  watchPollingFor(path: string): boolean {
+    return isDvrfsPath(path) || isWslKernel(readProcVersion())
+  }
+
   /** Attach (once per file path) the Chokidar watcher feeding {@link reload}. */
   private attachWatch(cwd: string, source: string): void {
     if (!this.config.watch || source === '' || (this.config.builtin.enabled && source === this.config.builtin.path)) return
@@ -1023,7 +1196,8 @@ export class PermissionRulesRuntime {
       return
     }
     const cwds = new Set([cwd])
-    const watcher = chokidar.watch(source, { persistent: true, ignoreInitial: true })
+    const polling = this.watchPollingFor(source)
+    const watcher = chokidar.watch(source, { persistent: true, ignoreInitial: true, ...(polling ? POLLING_WATCH_OPTIONS : {}) })
     const onEvent = (): void => this.scheduleReload(source)
     watcher.on('add', onEvent)
     watcher.on('change', onEvent)
@@ -1120,9 +1294,11 @@ export class PermissionRulesRuntime {
     }
     const cwds = new Set([cwd])
     const candidates = new Map([[cwd, candidate]])
+    const polling = this.watchPollingFor(candidate)
     const watchOptions = {
       persistent: true,
       ignoreInitial: true,
+      ...(polling ? POLLING_WATCH_OPTIONS : {}),
       ignored: (path: string): boolean => path.split(sep).includes('node_modules') || path.split(sep).includes('.git'),
     }
     const watcher = dir === parent
@@ -1279,7 +1455,14 @@ export async function apply(ctx: Context, config: Config): Promise<void> {
     return next()
   })
   attachSettingsSection(ctx, runtime, config)
-  if (resolved.network.enabled) await runtime.attachNetworkProxy()
+  if (resolved.network.enabled) {
+    await runtime.attachNetworkProxy()
+    // Issue #22: the injected proxy environment is process-wide, so the
+    // harness's own model transport is adjudicated here too. Keep a model-call
+    // failure attributable to the policy instead of leaving it a bare
+    // transport error.
+    ctx.on('llm/stream', (_options: GenerateOptions, next: () => AsyncIterable<StreamChunk>) => runtime.llmStream(next))
+  }
   ctx.inject(['systemPrompt'], (scope) => {
     const systemPrompt = scope.get('systemPrompt') as { context?: (entry: { name: string; order?: number; text: string }) => void } | undefined
     if (systemPrompt?.context === undefined) return