dsh-permission-rules 0.6.19 → 0.6.21

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v0.6.21 - 2026-09-10
+
+### Fixed
+
+- The session-less host chain no longer survives an explicit reload, so a corrected rule takes effect without restarting the process. `hostLoaded` was cached for the lifetime of the mount, and that chain is deliberately neither a `byCwd` member nor watched, so neither `reloadAll()` nor `saveRuleFile()` ever reached it — and the settings page (which drives `reloadAll()`) is the one surface usable while no session has run a tool call, i.e. exactly the window in which this chain is what judges traffic. `invalidateHostChain()` now drops the cache and re-arms the one-shot warning, and is called from `reloadAll()`, `saveRuleFile()` and `onNetworkConfigChanged()` (the last because `rulesFile` and `fallbackPath` are inputs to the chain, so a config change must not reuse a chain built from the previous one). The new test asserts both the stale read and the refreshed one, and removing the invalidation makes it fail.
+
+## v0.6.20 - 2026-09-10
+
+### Fixed
+
+- **Corrected the mechanism by which this plugin participates in host networking (issue #22).** The five READMEs, `AGENTS.md` and the v0.6.19 note claimed that the process-wide injected proxy environment also placed the harness's own LLM transport under this policy. Measurement on 2026-09-10 (Node 22; `scripts/host-egress-probe.mjs`) shows it does not: the launcher installs undici's global dispatcher from the **launch environment** before the first plugin mounts, that dispatcher routes by its policy rather than by the environment, and Node samples the proxy environment at start — so a mid-process `process.env` write reaches neither `fetch` nor `node:http`. The injection covers spawned shell children, which is what it was always for. The READMEs' known-limitations bullet now says so, and the `llm/stream` annotation shipped in v0.6.19 is recorded as inert: it can only fire when a blocked child-process connection coincides within its window with an unrelated model failure, so it misattributes rather than diagnoses — it has been **removed in this release**, along with its registration, its block-window helper, the type import it needed, and its four tests.
+
 ## v0.6.19 - 2026-09-10
 
 ### Security

package/README.es.md

@@ -78,7 +78,7 @@ Una **política de red a nivel de proceso** estilo Codex: el tráfico de subproc
 
 - **Emparejamiento** — `match.network` con `domains` / `ips` / `ports` / `schemes` (globs, comodines, CIDR, rangos de puertos; se aceptan puertos YAML numéricos). La extracción de candidatos URL en la ruta caliente `tools/pre-execute` se dispara sobre argumentos de herramientas web y URLs embebidas en texto de comandos bash/pwsh; los destinos de loopback pueden cortocircuitar reglas según la política `loopback`. Los literales IPv6 mapeados a IPv4 se normalizan a su forma IPv4 antes de comparar, y el proxy se conecta a las direcciones con las que se tomó la decisión, sin una segunda resolución DNS.
 - **Auditoría** — las conexiones denegadas anexan `permissionRules/network` a la sesión propietaria (la misma puerta adaptativa `ignorable`), con contadores de bloqueo e intercepciones recientes en `/rules network` y la página de settings.
-- **Diagnóstico** — las conexiones bloqueadas llevan un mensaje `[network: …]`, y una llamada al modelo que falla mientras el proxy bloqueó un destino (el entorno de proxy inyectado también alcanza al transporte LLM del host) nombra ese destino y la solución en el texto del fallo, en lugar de quedar como un error de transporte desnudo.
+- **Diagnóstico** — las conexiones bloqueadas llevan un mensaje `[network: …]` que nombra el destino bloqueado, el modo o la regla que decidió y la solución.
 
 ## Quick start
 
@@ -175,7 +175,7 @@ Todos los parámetros son campos Schemastery `Config` (modificables desde cordis
 - **Los candidatos de ruta son heurísticos.** Solo las claves de argumento documentadas alimentan el emparejamiento de rutas, y el emparejamiento relativo al workspace es insensible a mayúsculas ASCII solo con `caseInsensitivePaths` activado.
 - **Los globs son un subconjunto conservador.** Sin expansión de llaves — escribe dos patrones, o usa modo regex.
 - **La guardia de backtracking de regex es estructural, no exhaustiva.** Prefiere el modo glob para archivos no confiables.
-- **Los endpoints del proveedor LLM necesitan una regla allow.** El entorno de proxy inyectado es de proceso completo, así que en modo whitelist el propio transporte del modelo del host se adjudica como cualquier otra conexión, y el plugin no puede enumerar los endpoints que llamará un adaptador (las rutas de proveedor exponen ids, y las base URL configuradas viven en los settings de cada adaptador). Añade una regla allow para el endpoint del proveedor, o pon `network.injectEnv: false` para dejar el proceso del host fuera del proxy.
+- **Las peticiones salientes del propio host no pasan por este proxy.** El entorno de proxy inyectado cubre los **subprocesos de shell derivados** —que es para lo que sirve la inyección— y cualquier consumidor que lea los nombres de proxy en el momento de la petición. **No** cubre el tráfico basado en `fetch` del propio proceso del host: el launcher instala el dispatcher global de undici desde el **entorno de lanzamiento** antes de que se monte el primer plugin, ese dispatcher enruta por su política y no por el entorno, y Node muestrea el entorno de proxy al arrancar, así que un plugin que se monte después no puede redirigirlo. Consecuencias: los endpoints del proveedor **no** necesitan una regla allow, y `network.injectEnv: false` no saca al proceso del host de nada. Medido el 2026-09-10 en Node 22; reproducible con `scripts/host-egress-probe.mjs`.
 
 ## Collaborating with dsh-auto-review
 

package/README.hi.md

@@ -78,7 +78,7 @@ Codex-शैली की **प्रक्रिया-स्तरीय न
 
 - **मिलान** — `match.network` `domains` / `ips` / `ports` / `schemes` के साथ (globs, वाइल्डकार्ड, CIDR, पोर्ट श्रेणियाँ; संख्यात्मक YAML पोर्ट स्वीकृत)। `tools/pre-execute` हॉट पथ पर URL-उम्मीदवार निष्कर्षण वेब-टूल तर्कों और bash/pwsh कमांड टेक्स्ट में एम्बेडेड URLs पर चलता है; लूपबैक लक्ष्य `loopback` नीति के अनुसार नियमों को शॉर्ट-सर्किट कर सकते हैं। IPv4-मैप्ड IPv6 लिटरल तुलना से पहले IPv4 रूप में सामान्यीकृत होते हैं, और प्रॉक्सी उन्हीं पतों पर कनेक्ट करता है जिन पर निर्णय लिया गया — दूसरा DNS रिज़ॉल्यूशन नहीं।
 - **ऑडिट** — अस्वीकृत कनेक्शन स्वामी सत्र में `permissionRules/network` जोड़ते हैं (वही अनुकूली `ignorable` द्वार), `/rules network` और settings पृष्ठ में ब्लॉक काउंटर व हाल की अवरोधन के साथ।
-- **निदान** — अवरुद्ध कनेक्शन `[network: …]` संदेश लेकर आते हैं, और यदि मॉडल कॉल विफल होते समय प्रॉक्सी ने कोई लक्ष्य अवरुद्ध किया हो (इंजेक्ट किया गया प्रॉक्सी वातावरण होस्ट के LLM ट्रांसपोर्ट तक भी पहुँचता है), तो विफलता संदेश उस लक्ष्य और समाधान का नाम लेता है — केवल कच्चा ट्रांसपोर्ट त्रुटि नहीं दिखाता।
+- **निदान** — अवरुद्ध कनेक्शन `[network: …]` संदेश लेकर आते हैं जो अवरुद्ध लक्ष्य, निर्णय लेने वाला मोड या नियम, और समाधान बताता है।
 
 ## Quick start
 
@@ -175,7 +175,7 @@ dsh --profile web --dump-config | grep -A4 'id: permission-rules'
 - **पथ उम्मीदवार अनुमानी हैं।** केवल दस्तावेज़ित तर्क कुंजियाँ पथ मिलान को खिलाती हैं, और कार्यक्षेत्र-सापेक्ष मिलान केवल `caseInsensitivePaths` चालू होने पर ASCII-केस-असंवेदी है।
 - **globs एक रूढ़िवादी उपसमुच्चय हैं।** कोई ब्रेस विस्तार नहीं — दो पैटर्न लिखें, या regex मोड उपयोग करें।
 - **regex बैकट्रैकिंग गार्ड संरचनात्मक है, संपूर्ण नहीं।** अविश्वसनीय फ़ाइलों के लिए glob मोड पसंद करें।
-- **LLM प्रदाता endpoints के लिए allow नियम चाहिए।** इंजेक्ट किया गया प्रॉक्सी वातावरण पूरे प्रोसेस का है, इसलिए whitelist मोड में होस्ट का अपना मॉडल ट्रांसपोर्ट भी किसी अन्य कनेक्शन की तरह adjudicate होता है, और प्लगइन यह गिन नहीं सकता कि कोई adapter किन endpoints को कॉल करेगा (provider routes केवल ids देते हैं, और configured base URLs हर adapter की अपनी settings में रहते हैं)। प्रदाता endpoint के लिए allow नियम जोड़ें, या होस्ट प्रोसेस को प्रॉक्सी से बाहर रखने के लिए `network.injectEnv: false` सेट करें।
+- **होस्ट के अपने आउटबाउंड अनुरोध इस प्रॉक्सी से नहीं जाते।** इंजेक्ट किया गया प्रॉक्सी वातावरण **उत्पन्न shell उप-प्रक्रियाओं** को कवर करता है — इंजेक्शन इसी के लिए है — और उन उपभोक्ताओं को जो अनुरोध के समय प्रॉक्सी नाम पढ़ते हैं। यह होस्ट प्रोसेस के अपने `fetch`-आधारित ट्रैफ़िक को **नहीं** कवर करता: launcher पहले प्लगइन के माउंट होने से पहले **लॉन्च वातावरण** से undici का ग्लोबल dispatcher स्थापित कर देता है, वह dispatcher वातावरण से नहीं बल्कि अपनी नीति से रूट करता है, और Node प्रॉक्सी वातावरण को प्रारंभ पर सैंपल करता है — इसलिए बाद में माउंट होने वाला प्लगइन उसे नहीं मोड़ सकता। परिणाम: प्रदाता endpoints के लिए allow नियम की **आवश्यकता नहीं** है, और `network.injectEnv: false` होस्ट प्रोसेस को किसी चीज़ से बाहर नहीं करता। 2026-09-10 को Node 22 पर मापा गया; `scripts/host-egress-probe.mjs` से दोहराएँ।
 
 ## Collaborating with dsh-auto-review
 

package/README.md

@@ -79,7 +79,7 @@ A Codex-style **process-level network policy**: shell subprocess traffic flows t
 
 - **Matching** — `match.network` with `domains` / `ips` / `ports` / `schemes` (globs, wildcards, CIDRs, port ranges; numeric YAML ports are accepted). URL-candidate extraction on the `tools/pre-execute` hot path fires on web-tool arguments and URLs embedded in bash/pwsh command text; loopback targets can short-circuit rules per `loopback` policy. IPv4-mapped IPv6 literals are normalized to their IPv4 form before matching, and the proxy connects on the addresses the decision was made on — never a second DNS resolution.
 - **Audit** — denied connections append `permissionRules/network` to the owning session (same adaptive `ignorable` gate), with block counters and recent interceptions in `/rules network` and the settings page.
-- **Diagnosis** — blocked connections carry a `[network: …]` message, and a model call that fails while the proxy blocked a target (the injected proxy environment also reaches the host's LLM transport) names that target and the remediation in its failure text instead of failing as a bare transport error.
+- **Diagnosis** — blocked connections carry a `[network: …]` message naming the blocked target, the mode or rule that decided, and the remediation.
 
 ## Quick start
 
@@ -176,7 +176,7 @@ All tunables are Schemastery `Config` fields (changeable from cordis.yml). An id
 - **Path candidates are heuristic.** Only the documented argument keys feed path matching, and workspace-relative matching is ASCII-case-insensitive only when `caseInsensitivePaths` is on.
 - **Globs are a conservative subset.** No brace expansion — write two patterns, or use regex mode.
 - **The regex backtracking guard is structural, not exhaustive.** Prefer glob mode for untrusted files.
-- **LLM provider endpoints need an allow rule.** The injected proxy environment is process-wide, so in whitelist mode the host's own model transport is adjudicated like any other connection, and the plugin cannot enumerate the endpoints an adapter will call (provider routes expose ids, and configured base URLs live in adapter-owned settings). Add an allow rule for the provider endpoint, or set `network.injectEnv: false` to keep the host process out of the proxy.
+- **The host's own outbound requests do not go through this proxy.** The injected proxy environment covers **spawned shell children** — which is what the injection is for — and any consumer that reads the proxy names at request time. It does **not** cover the host process's own `fetch`-based traffic: the launcher installs undici's global dispatcher from the **launch environment** before the first plugin mounts, that dispatcher routes by its policy rather than by the environment, and Node samples the proxy environment at start — so a plugin mounting later cannot redirect it. Consequences: provider endpoints do **not** need an allow rule, and `network.injectEnv: false` does not take the host process out of anything. Measured 2026-09-10 on Node 22; reproduce with `scripts/host-egress-probe.mjs`.
 
 ## Collaborating with dsh-auto-review
 

package/README.pt.md

@@ -78,7 +78,7 @@ Uma **política de rede em nível de processo** estilo Codex: o tráfego de subp
 
 - **Correspondência** — `match.network` com `domains` / `ips` / `ports` / `schemes` (globs, curingas, CIDR, faixas de porta; portas YAML numéricas são aceitas). A extração de candidatos URL na rota quente `tools/pre-execute` dispara sobre argumentos de ferramentas web e URLs embutidas em texto de comando bash/pwsh; destinos de loopback podem curto-circuitar regras conforme a política `loopback`. Literais IPv6 mapeados em IPv4 são normalizados para a forma IPv4 antes da comparação, e o proxy conecta nos endereços usados na decisão, sem uma segunda resolução DNS.
 - **Auditoria** — conexões negadas anexam `permissionRules/network` à sessão proprietária (a mesma porta adaptativa `ignorable`), com contadores de bloqueio e intercepções recentes em `/rules network` e na página de settings.
-- **Diagnóstico** — conexões bloqueadas trazem uma mensagem `[network: …]`, e uma chamada ao modelo que falha enquanto o proxy bloqueou um destino (o ambiente de proxy injetado também alcança o transporte LLM do host) nomeia esse destino e a solução no texto da falha, em vez de ficar como um erro de transporte cru.
+- **Diagnóstico** — conexões bloqueadas trazem uma mensagem `[network: …]` nomeando o destino bloqueado, o modo ou a regra que decidiu e a solução.
 
 ## Quick start
 
@@ -175,7 +175,7 @@ Todos os parâmetros são campos Schemastery `Config` (alteráveis pelo cordis.y
 - **Candidatos de caminho são heurísticos.** Somente as chaves de argumento documentadas alimentam a correspondência de caminho, e a correspondência relativa ao workspace é insensível a maiúsculas ASCII apenas com `caseInsensitivePaths` ativado.
 - **Globs são um subconjunto conservador.** Sem expansão de chaves — escreva dois padrões, ou use o modo regex.
 - **A guarda de backtracking de regex é estrutural, não exaustiva.** Prefira o modo glob para arquivos não confiáveis.
-- **Os endpoints do provedor LLM precisam de uma regra allow.** O ambiente de proxy injetado é do processo inteiro, então no modo whitelist o próprio transporte do modelo do host é adjudicado como qualquer outra conexão, e o plugin não consegue enumerar os endpoints que um adaptador vai chamar (as rotas de provedor expõem apenas ids, e as base URLs configuradas ficam nos settings de cada adaptador). Adicione uma regra allow para o endpoint do provedor, ou defina `network.injectEnv: false` para manter o processo do host fora do proxy.
+- **As requisições de saída do próprio host não passam por este proxy.** O ambiente de proxy injetado cobre os **subprocessos de shell derivados** — que é para isso que a injeção serve — e qualquer consumidor que leia os nomes de proxy no momento da requisição. **Não** cobre o tráfego baseado em `fetch` do próprio processo do host: o launcher instala o dispatcher global do undici a partir do **ambiente de lançamento** antes de o primeiro plugin ser montado, esse dispatcher roteia pela sua política e não pelo ambiente, e o Node amostra o ambiente de proxy na inicialização, então um plugin montado depois não consegue redirecioná-lo. Consequências: os endpoints do provedor **não** precisam de uma regra allow, e `network.injectEnv: false` não tira o processo do host de nada. Medido em 2026-09-10 no Node 22; reproduza com `scripts/host-egress-probe.mjs`.
 
 ## Collaborating with dsh-auto-review
 

package/README.zh.md

@@ -78,7 +78,7 @@ Codex 风格的**进程级网络策略**：shell 子进程流量经内置本地
 
 - **匹配** —— `match.network` 用 `domains` / `ips` / `ports` / `schemes`（glob、通配符、CIDR、端口范围；数值型 YAML 端口可接受）。`tools/pre-execute` 热路径上的 URL 候选抽取作用于 web 工具参数与嵌入 bash/pwsh 命令文本的 URL；回环目标可按 `loopback` 策略短路规则。IPv4 映射的 IPv6 字面量在匹配前归一化为 IPv4 形式；代理按裁决到的地址建连，不做二次 DNS 解析。
 - **审计** —— 被拒连接向所属会话追加 `permissionRules/network`（同样的自适应 `ignorable` 门），块计数器与近期拦截在 `/rules network` 与设置页展示。
-- **诊断** —— 被拦截的连接带 `[network: …]` 消息；若模型调用失败时代理恰好拦截了某个目标（注入的代理环境同样作用于宿主的 LLM 传输），失败文本会点名该目标与处置办法，而不再只是一个裸的传输错误。
+- **诊断** —— 被拦截的连接带 `[network: …]` 消息，点名被拦目标、做出裁决的模式或规则，以及处置办法。
 
 ## Quick start
 
@@ -175,7 +175,7 @@ dsh --profile web --dump-config | grep -A4 'id: permission-rules'
 - **路径候选是启发式的。** 只有文档化的参数键参与路径匹配，且工作区相对匹配仅在 `caseInsensitivePaths` 开启时忽略 ASCII 大小写。
 - **glob 是保守子集。** 无花括号展开——写两个模式，或用正则模式。
 - **正则回溯守卫是结构性的、非穷尽的。** 对不可信文件优先用 glob 模式。
-- **LLM 供应商端点需要显式允许规则。** 注入的代理环境是进程级的，因此白名单模式下宿主自身的模型传输与其他连接一样被裁决，而插件无法枚举某个适配器将要调用的端点（供应商路由只暴露 id，配置的 base URL 存在各适配器自己的设置里）。请为供应商端点添加 allow 规则，或设 `network.injectEnv: false` 让宿主进程不经过该代理。
+- **宿主自身的出站请求不经过本代理。** 注入的代理环境覆盖**派生的 shell 子进程**（这正是注入的用途），以及在请求时读取代理变量名的消费者；它**不覆盖**宿主进程自身基于 `fetch` 的流量——launcher 在第一个插件挂载之前就用**启动环境**装好了 undici 的全局 dispatcher，该 dispatcher 按策略而非按环境路由，且 Node 在启动时采样代理环境，因此后挂载的插件无法改变它。结论：供应商端点**不需要**允许规则，`network.injectEnv: false` 也不会把宿主进程移出任何东西。2026-09-10 实测于 Node 22；用 `scripts/host-egress-probe.mjs` 可复现。
 
 ## Collaborating with dsh-auto-review
 

package/lib/index.js

@@ -2575,13 +2575,6 @@ const WEB_TOOLS = ["web_fetch", "web_search"];
 /** Stale in-flight entries are dropped after this many milliseconds (attribution is best-effort). */
 const IN_FLIGHT_TTL_MS = 6e5;
 /**
-* Clock slack for attributing a proxy block to a model call: a block recorded
-* within this window before the call started still counts, so millisecond
-* granularity or a listener ordering between the retry middleware and this
-* waterfall cannot hide the block that caused the failure.
-*/
-const LLM_BLOCK_SKEW_MS = 1e3;
-/**
 * Chokidar polling interval used when the watched path lives on a filesystem
 * whose change events are unreliable (WSL drvfs/9p mounts): polling costs a
 * stat per interval, which is negligible for a rule file and far cheaper than
@@ -3121,7 +3114,10 @@ var PermissionRulesRuntime = class {
 	* connection is then judged exactly as before, against the loaded workspace
 	* chains). It is not watched either: the session-less window is the boot
 	* window, and the first tool call of any session takes over with the normal
-	* per-workspace chain, which is watched.
+	* per-workspace chain, which is watched. An EXPLICIT reload still drops this
+	* cache ({@link invalidateHostChain}) — `/rules reload`, the settings-page
+	* reload and a settings save all reach it — because during the boot window a
+	* corrected rule otherwise had no effect short of restarting the process.
 	* @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
 	*/
 	hostChain() {
@@ -3140,51 +3136,16 @@ var PermissionRulesRuntime = class {
 		};
 	}
 	/**
-	* The `llm/stream` waterfall listener (issue #22). The proxy environment
-	* this plugin injects for shell subprocesses is process-wide, so it is also
-	* visible to the harness's own LLM transport; a provider endpoint that the
-	* policy blocks then surfaces as a bare transport failure ("Connection
-	* error. / TRANSPORT" after the retry budget) with nothing pointing at the
-	* policy. This wrapper is transparent for every call: it only ENRICHES a
-	* failure whose window contains a proxy block, so no turn fails silently on
-	* a policy decision the user cannot see.
-	* @param next - the downstream chain (the resolved adapter's stream).
-	* @returns the same chunks, with any failure carrying the policy diagnosis.
-	*/
-	llmStream(next) {
-		return this.diagnosedLlmStream(next);
-	}
-	/** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
-	async *diagnosedLlmStream(next) {
-		const startedAt = Date.now();
-		try {
-			yield* next();
-		} catch (error) {
-			const diagnosis = this.llmFailureDiagnosis(startedAt);
-			if (diagnosis !== void 0) {
-				this.ctx.logger.warn(`permission-rules: ${diagnosis}`);
-				if (error instanceof Error && !error.message.includes("[network:")) error.message = `${error.message} — ${diagnosis}`;
-			}
-			throw error;
-		}
-	}
-	/**
-	* The policy diagnosis for one failed model call, or undefined when the
-	* proxy blocked nothing while it ran. The newest block in the window names
-	* the target and the mode, and the remediation is the honest one: allow the
-	* endpoint or stop injecting the policy environment into the host process.
+	* Drop the cached session-less chain so the next proxy decision re-reads it,
+	* and re-arm the one-shot warning so a file that has since become loadable
+	* can report a failure again. Without this the cache was permanent: the
+	* session-less chain is deliberately not a `byCwd` member and is not watched,
+	* so neither `reloadAll()` nor a settings save ever reached it and a
+	* corrected rule needed a process restart (issue #18 follow-up).
 	*/
-	llmFailureDiagnosis(since) {
-		const proxy = this.networkProxy;
-		if (proxy === void 0) return void 0;
-		const blocks = proxy.recentBlocks().filter((record) => record.time >= since - LLM_BLOCK_SKEW_MS);
-		const newest = blocks[0];
-		if (newest === void 0) return void 0;
-		const target = `${newest.scheme ?? "https"}://${newest.domain}${newest.port !== void 0 ? `:${newest.port}` : ""}`;
-		const marker = newest.action === "ask" ? "[network: blocked pending approval]" : "[network: denied]";
-		const rule = newest.matched ? `, rule ${(newest.ruleIndex ?? 0) + 1}${newest.source !== "" ? ` (${newest.source})` : ""}` : ", no matching allow rule";
-		const more = blocks.length > 1 ? ` (and ${blocks.length - 1} more block${blocks.length > 2 ? "s" : ""} in the same window)` : "";
-		return `${marker} the local policy proxy blocked ${target} during this model call (mode ${newest.mode}${rule})${more} — the host process inherits the policy proxy environment (network.injectEnv), so the model transport is adjudicated like any other connection; add an allow rule for the provider endpoint or set network.injectEnv: false`;
+	invalidateHostChain() {
+		this.hostLoaded = void 0;
+		this.hostChainWarned = false;
 	}
 	/** Mark one delegated shell execution as in-flight (newest attribution wins). */
 	markShell(exec) {
@@ -3306,6 +3267,7 @@ var PermissionRulesRuntime = class {
 	*/
 	async onNetworkConfigChanged() {
 		if (!this.config.network.enabled) return;
+		this.invalidateHostChain();
 		await this.networkProxy?.close();
 		this.envRestore?.();
 		this.envRestore = void 0;
@@ -3387,8 +3349,15 @@ var PermissionRulesRuntime = class {
 	sourceOwner(path) {
 		for (const loaded of this.byCwd.values()) if (loaded.sources.includes(path) || !isAbsolute(this.config.rulesFile) && join(loaded.cwd, this.config.rulesFile) === path) return loaded.cwd;
 	}
-	/** Re-read every cached workspace chain (the settings-page reload action). */
+	/**
+	* Re-read every cached workspace chain and drop the session-less host chain
+	* (the settings-page reload action). The host chain matters here because the
+	* settings page is a web-client surface: it can be used while no session has
+	* run a tool call, which is exactly the window in which the host chain is
+	* what judges traffic.
+	*/
 	reloadAll() {
+		this.invalidateHostChain();
 		for (const cwd of [...this.byCwd.keys()]) this.reload(cwd);
 	}
 	/**
@@ -3425,6 +3394,7 @@ var PermissionRulesRuntime = class {
 			};
 		}
 		let reloaded = 0;
+		this.invalidateHostChain();
 		for (const cwd of [...this.byCwd.keys()]) {
 			this.reload(cwd);
 			reloaded += 1;
@@ -3969,10 +3939,7 @@ async function apply(ctx, config) {
 		return next();
 	});
 	attachSettingsSection(ctx, runtime, config);
-	if (resolved.network.enabled) {
-		await runtime.attachNetworkProxy();
-		ctx.on("llm/stream", (_options, next) => runtime.llmStream(next));
-	}
+	if (resolved.network.enabled) await runtime.attachNetworkProxy();
 	ctx.inject(["systemPrompt"], (scope) => {
 		const systemPrompt = scope.get("systemPrompt");
 		if (systemPrompt?.context === void 0) return;

package/lib/types/runtime.d.ts

@@ -12,7 +12,6 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
-import type { StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools';
 import type { Config, ResolvedConfig } from './config.js';
 import type { CompiledRuleset, RuleHit } from './rules.js';
@@ -261,32 +260,22 @@ export declare class PermissionRulesRuntime {
      * connection is then judged exactly as before, against the loaded workspace
      * chains). It is not watched either: the session-less window is the boot
      * window, and the first tool call of any session takes over with the normal
-     * per-workspace chain, which is watched.
+     * per-workspace chain, which is watched. An EXPLICIT reload still drops this
+     * cache ({@link invalidateHostChain}) — `/rules reload`, the settings-page
+     * reload and a settings save all reach it — because during the boot window a
+     * corrected rule otherwise had no effect short of restarting the process.
      * @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
      */
     private hostChain;
     /**
-     * The `llm/stream` waterfall listener (issue #22). The proxy environment
-     * this plugin injects for shell subprocesses is process-wide, so it is also
-     * visible to the harness's own LLM transport; a provider endpoint that the
-     * policy blocks then surfaces as a bare transport failure ("Connection
-     * error. / TRANSPORT" after the retry budget) with nothing pointing at the
-     * policy. This wrapper is transparent for every call: it only ENRICHES a
-     * failure whose window contains a proxy block, so no turn fails silently on
-     * a policy decision the user cannot see.
-     * @param next - the downstream chain (the resolved adapter's stream).
-     * @returns the same chunks, with any failure carrying the policy diagnosis.
+     * Drop the cached session-less chain so the next proxy decision re-reads it,
+     * and re-arm the one-shot warning so a file that has since become loadable
+     * can report a failure again. Without this the cache was permanent: the
+     * session-less chain is deliberately not a `byCwd` member and is not watched,
+     * so neither `reloadAll()` nor a settings save ever reached it and a
+     * corrected rule needed a process restart (issue #18 follow-up).
      */
-    llmStream(next: () => AsyncIterable<StreamChunk>): AsyncIterable<StreamChunk>;
-    /** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
-    private diagnosedLlmStream;
-    /**
-     * The policy diagnosis for one failed model call, or undefined when the
-     * proxy blocked nothing while it ran. The newest block in the window names
-     * the target and the mode, and the remediation is the honest one: allow the
-     * endpoint or stop injecting the policy environment into the host process.
-     */
-    private llmFailureDiagnosis;
+    private invalidateHostChain;
     /** Mark one delegated shell execution as in-flight (newest attribution wins). */
     private markShell;
     /** Drop one shell execution when it settles. */
@@ -347,7 +336,13 @@ export declare class PermissionRulesRuntime {
     };
     /** The workspace a rule source belongs to (for the editor's file list), or undefined for the fallback. */
     sourceOwner(path: string): string | undefined;
-    /** Re-read every cached workspace chain (the settings-page reload action). */
+    /**
+     * Re-read every cached workspace chain and drop the session-less host chain
+     * (the settings-page reload action). The host chain matters here because the
+     * settings page is a web-client surface: it can be used while no session has
+     * run a tool call, which is exactly the window in which the host chain is
+     * what judges traffic.
+     */
     reloadAll(): void;
     /**
      * Validate and write one known rule file. The document must parse and

package/lib/types/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAItE,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AAuCD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAoBD;;;GAGG;AACH,qBAAa,sBAAsB;IAmC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAlCtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,8HAA8H;IAC9H,OAAO,CAAC,UAAU,CAAyB;IAE3C,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAQ;IAE/B,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAE9C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAYnB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC;IAI7E,uFAAuF;YACxE,kBAAkB;IAgBjC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAe3B,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7C,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC/C;IAkBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAgBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C,8EAA8E;IAC9E,SAAS,IAAI,IAAI;IAIjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IA+B5F,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAmBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAoCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IA0E5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAItE,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAoBD;;;GAGG;AACH,qBAAa,sBAAsB;IAmC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAlCtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,8HAA8H;IAC9H,OAAO,CAAC,UAAU,CAAyB;IAE3C,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAQ;IAE/B,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAE9C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAYnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAK3B,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7C,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC/C;IAkBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAgBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C;;;;;;OAMG;IACH,SAAS,IAAI,IAAI;IAKjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAgC5F,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAmBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAoCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IA0E5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.6.19",
+  "version": "0.6.21",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",

package/src/runtime.ts

@@ -18,7 +18,6 @@ import { dirname, isAbsolute, join, resolve, sep } from 'node:path'
 import chokidar from 'chokidar'
 import type { Context } from '@deepseek-ai/cordis'
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands'
-import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools'
 import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import { resolveConfig } from './config.ts'
@@ -82,14 +81,6 @@ const WEB_TOOLS: readonly string[] = ['web_fetch', 'web_search']
 /** Stale in-flight entries are dropped after this many milliseconds (attribution is best-effort). */
 const IN_FLIGHT_TTL_MS = 10 * 60 * 1000
 
-/**
- * Clock slack for attributing a proxy block to a model call: a block recorded
- * within this window before the call started still counts, so millisecond
- * granularity or a listener ordering between the retry middleware and this
- * waterfall cannot hide the block that caused the failure.
- */
-const LLM_BLOCK_SKEW_MS = 1000
-
 /**
  * Chokidar polling interval used when the watched path lives on a filesystem
  * whose change events are unreliable (WSL drvfs/9p mounts): polling costs a
@@ -613,7 +604,10 @@ export class PermissionRulesRuntime {
    * connection is then judged exactly as before, against the loaded workspace
    * chains). It is not watched either: the session-less window is the boot
    * window, and the first tool call of any session takes over with the normal
-   * per-workspace chain, which is watched.
+   * per-workspace chain, which is watched. An EXPLICIT reload still drops this
+   * cache ({@link invalidateHostChain}) — `/rules reload`, the settings-page
+   * reload and a settings save all reach it — because during the boot window a
+   * corrected rule otherwise had no effect short of restarting the process.
    * @returns the configured chain, or undefined when it cannot be loaded (the mode default then applies).
    */
   private hostChain(): NetworkChain | undefined {
@@ -634,57 +628,16 @@ export class PermissionRulesRuntime {
   }
 
   /**
-   * The `llm/stream` waterfall listener (issue #22). The proxy environment
-   * this plugin injects for shell subprocesses is process-wide, so it is also
-   * visible to the harness's own LLM transport; a provider endpoint that the
-   * policy blocks then surfaces as a bare transport failure ("Connection
-   * error. / TRANSPORT" after the retry budget) with nothing pointing at the
-   * policy. This wrapper is transparent for every call: it only ENRICHES a
-   * failure whose window contains a proxy block, so no turn fails silently on
-   * a policy decision the user cannot see.
-   * @param next - the downstream chain (the resolved adapter's stream).
-   * @returns the same chunks, with any failure carrying the policy diagnosis.
+   * Drop the cached session-less chain so the next proxy decision re-reads it,
+   * and re-arm the one-shot warning so a file that has since become loadable
+   * can report a failure again. Without this the cache was permanent: the
+   * session-less chain is deliberately not a `byCwd` member and is not watched,
+   * so neither `reloadAll()` nor a settings save ever reached it and a
+   * corrected rule needed a process restart (issue #18 follow-up).
    */
-  llmStream(next: () => AsyncIterable<StreamChunk>): AsyncIterable<StreamChunk> {
-    return this.diagnosedLlmStream(next)
-  }
-
-  /** Delegate one model call and enrich its failure with the proxy diagnosis, if any. */
-  private async *diagnosedLlmStream(next: () => AsyncIterable<StreamChunk>): AsyncGenerator<StreamChunk> {
-    const startedAt = Date.now()
-    try {
-      yield* next()
-    } catch (error: unknown) {
-      const diagnosis = this.llmFailureDiagnosis(startedAt)
-      if (diagnosis !== undefined) {
-        this.ctx.logger.warn(`permission-rules: ${diagnosis}`)
-        // Keep the original error object (its class, code, and retry facts)
-        // and only extend the message, so the failure taxonomy is unchanged.
-        if (error instanceof Error && !error.message.includes('[network:')) error.message = `${error.message} — ${diagnosis}`
-      }
-      throw error
-    }
-  }
-
-  /**
-   * The policy diagnosis for one failed model call, or undefined when the
-   * proxy blocked nothing while it ran. The newest block in the window names
-   * the target and the mode, and the remediation is the honest one: allow the
-   * endpoint or stop injecting the policy environment into the host process.
-   */
-  private llmFailureDiagnosis(since: number): string | undefined {
-    const proxy = this.networkProxy
-    if (proxy === undefined) return undefined
-    const blocks = proxy.recentBlocks().filter(record => record.time >= since - LLM_BLOCK_SKEW_MS)
-    const newest = blocks[0]
-    if (newest === undefined) return undefined
-    const target = `${newest.scheme ?? 'https'}://${newest.domain}${newest.port !== undefined ? `:${newest.port}` : ''}`
-    const marker = newest.action === 'ask' ? '[network: blocked pending approval]' : '[network: denied]'
-    const rule = newest.matched
-      ? `, rule ${(newest.ruleIndex ?? 0) + 1}${newest.source !== '' ? ` (${newest.source})` : ''}`
-      : ', no matching allow rule'
-    const more = blocks.length > 1 ? ` (and ${blocks.length - 1} more block${blocks.length > 2 ? 's' : ''} in the same window)` : ''
-    return `${marker} the local policy proxy blocked ${target} during this model call (mode ${newest.mode}${rule})${more} — the host process inherits the policy proxy environment (network.injectEnv), so the model transport is adjudicated like any other connection; add an allow rule for the provider endpoint or set network.injectEnv: false`
+  private invalidateHostChain(): void {
+    this.hostLoaded = undefined
+    this.hostChainWarned = false
   }
 
   /** Mark one delegated shell execution as in-flight (newest attribution wins). */
@@ -807,6 +760,9 @@ export class PermissionRulesRuntime {
    */
   async onNetworkConfigChanged(): Promise<void> {
     if (!this.config.network.enabled) return
+    // The chain inputs (rulesFile, fallbackPath, …) may have changed with the
+    // config, so the session-less chain must be re-read rather than reused.
+    this.invalidateHostChain()
     await this.networkProxy?.close()
     this.envRestore?.()
     this.envRestore = undefined
@@ -887,8 +843,15 @@ export class PermissionRulesRuntime {
     return undefined
   }
 
-  /** Re-read every cached workspace chain (the settings-page reload action). */
+  /**
+   * Re-read every cached workspace chain and drop the session-less host chain
+   * (the settings-page reload action). The host chain matters here because the
+   * settings page is a web-client surface: it can be used while no session has
+   * run a tool call, which is exactly the window in which the host chain is
+   * what judges traffic.
+   */
   reloadAll(): void {
+    this.invalidateHostChain()
     for (const cwd of [...this.byCwd.keys()]) this.reload(cwd)
   }
 
@@ -923,6 +886,7 @@ export class PermissionRulesRuntime {
       return { ok: false, error: error instanceof Error ? error.message : String(error) }
     }
     let reloaded = 0
+    this.invalidateHostChain()
     for (const cwd of [...this.byCwd.keys()]) {
       this.reload(cwd)
       reloaded += 1
@@ -1455,14 +1419,7 @@ export async function apply(ctx: Context, config: Config): Promise<void> {
     return next()
   })
   attachSettingsSection(ctx, runtime, config)
-  if (resolved.network.enabled) {
-    await runtime.attachNetworkProxy()
-    // Issue #22: the injected proxy environment is process-wide, so the
-    // harness's own model transport is adjudicated here too. Keep a model-call
-    // failure attributable to the policy instead of leaving it a bare
-    // transport error.
-    ctx.on('llm/stream', (_options: GenerateOptions, next: () => AsyncIterable<StreamChunk>) => runtime.llmStream(next))
-  }
+  if (resolved.network.enabled) await runtime.attachNetworkProxy()
   ctx.inject(['systemPrompt'], (scope) => {
     const systemPrompt = scope.get('systemPrompt') as { context?: (entry: { name: string; order?: number; text: string }) => void } | undefined
     if (systemPrompt?.context === undefined) return