dsh-permission-rules 0.7.0 → 0.7.2

package/lib/index.js

@@ -1826,11 +1826,18 @@ function assertBoolean(key, value) {
 //#endregion
 //#region src/allow-host.ts
 /**
-* The settings-page "allow this host" action, as pure pieces: normalizing
+* The settings-page "allow this host" action, host-only half: normalizing
 * and validating a blocked host, inserting ONE minimal
-* `match.network.domains` allow rule at the HEAD of a rule document, choosing
-* which rule file the rule belongs in, and mapping the action's result onto
-* the notice the page renders.
+* `match.network.domains` allow rule at the HEAD of a rule document, and
+* choosing which rule file the rule belongs in.
+*
+* The workspace choices (`allowHostWorkspaces`) and the notice mapping
+* (`allowHostNotice`) live in `./allow-host-notice.ts`: the settings page
+* imports them from the BROWSER bundle, whose bundler inlines every value
+* import — keeping them next to the `node:path`/`node:net`/`yaml` code here
+* emitted `require("process")`/`require("buffer")` calls the shell's frozen
+* module table cannot answer, failing the whole plugin load. They are
+* re-exported below so existing host-side imports keep working.
 *
 * Three invariants hold here and are asserted by `test/allow-host.spec.ts`:
 *

package/lib/types/allow-host-notice.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The client-safe half of the settings-page "allow this host" action: the
+ * workspace choices offered for a host-level block ({@link allowHostWorkspaces})
+ * and the notice mapping ({@link allowHostNotice}).
+ *
+ * These live in their own module — separate from the host-only
+ * `./allow-host.ts` — because the settings page (the browser bundle built
+ * from `src/client/index.ts`) imports them, and the client bundler inlines
+ * every value import it meets. A single `import { allowHostNotice } from
+ * '../allow-host.ts'` used to drag the whole host module — `node:path`,
+ * `node:net`, `yaml`, `process.platform` — into `lib/client.js` as external
+ * `require("process")`/`require("buffer")` calls the shell's frozen module
+ * table cannot answer, which made the entire plugin fail to load.
+ *
+ * The hard rule for this module: NO runtime imports beyond pure type-only
+ * references to `./wire.ts`. Anything that needs a node builtin, the yaml
+ * parser, or the rule compiler belongs in `./allow-host.ts` (or deeper),
+ * never here.
+ * @module dsh-permission-rules/allow-host-notice
+ */
+import type { AllowHostResult, RuleSourceView } from './wire.js';
+/**
+ * The workspaces a host-level block may be allowed in: the distinct non-null
+ * `cwd`s of the loaded rule sources.
+ *
+ * A block with no cwd was judged by the proxy's session-less host chain, which
+ * any loaded workspace chain outranks the moment one exists — so writing the
+ * host file can leave the connection blocked while the rule sits in a file
+ * nothing consults. The settings page therefore offers these workspaces and
+ * sends the chosen one as the request's cwd; when there is exactly one (or
+ * none), there is nothing to choose between.
+ * @param sources - the snapshot's rule sources.
+ * @returns the distinct workspace roots, in source order.
+ */
+export declare function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[];
+/** The locale keys the allow action reports through. */
+export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed';
+/** The notice one action result maps onto: a locale key plus its interpolation values. */
+export interface AllowHostNotice {
+    readonly ok: boolean;
+    readonly key: AllowHostNoticeKey;
+    readonly vars: Record<string, string | number>;
+}
+/**
+ * Map an action result onto the page notice.
+ *
+ * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
+ * returning the RECOMPUTED decision is that the page can never say "allowed"
+ * while the connection is still blocked (a nearer chain with an earlier deny,
+ * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
+ * as success when the decision really is `allow`.
+ * @param result - the `permissionRules/allowHost` result.
+ * @returns the notice to render.
+ */
+export declare function allowHostNotice(result: AllowHostResult): AllowHostNotice;
+//# sourceMappingURL=allow-host-notice.d.ts.map

package/lib/types/allow-host-notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-host-notice.d.ts","sourceRoot":"","sources":["../../src/allow-host-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,EAAE,CAShF;AAED,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,iBAAiB,CAAA;AAEpH,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;CAC/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAOxE"}

package/lib/types/allow-host.d.ts

@@ -1,9 +1,16 @@
 /**
- * The settings-page "allow this host" action, as pure pieces: normalizing
+ * The settings-page "allow this host" action, host-only half: normalizing
  * and validating a blocked host, inserting ONE minimal
- * `match.network.domains` allow rule at the HEAD of a rule document, choosing
- * which rule file the rule belongs in, and mapping the action's result onto
- * the notice the page renders.
+ * `match.network.domains` allow rule at the HEAD of a rule document, and
+ * choosing which rule file the rule belongs in.
+ *
+ * The workspace choices (`allowHostWorkspaces`) and the notice mapping
+ * (`allowHostNotice`) live in `./allow-host-notice.ts`: the settings page
+ * imports them from the BROWSER bundle, whose bundler inlines every value
+ * import — keeping them next to the `node:path`/`node:net`/`yaml` code here
+ * emitted `require("process")`/`require("buffer")` calls the shell's frozen
+ * module table cannot answer, failing the whole plugin load. They are
+ * re-exported below so existing host-side imports keep working.
  *
  * Three invariants hold here and are asserted by `test/allow-host.spec.ts`:
  *
@@ -21,7 +28,8 @@
  * what makes the target choice testable without touching a real host.
  * @module dsh-permission-rules/allow-host
  */
-import type { AllowHostResult, RuleSourceView } from './wire.js';
+export { allowHostNotice, allowHostWorkspaces } from './allow-host-notice.js';
+export type { AllowHostNotice, AllowHostNoticeKey } from './allow-host-notice.js';
 /**
  * Canonical spelling of a host for the allow action, matching target parsing
  * exactly (see `normalizeHost`): lowercase, IPv6 brackets stripped, one
@@ -114,38 +122,4 @@ export interface AllowHostTargetInput {
  *   a path outside the writable set.
  */
 export declare function resolveAllowHostTarget(input: AllowHostTargetInput): string;
-/**
- * The workspaces a host-level block may be allowed in: the distinct non-null
- * `cwd`s of the loaded rule sources.
- *
- * A block with no cwd was judged by the proxy's session-less host chain, which
- * any loaded workspace chain outranks the moment one exists — so writing the
- * host file can leave the connection blocked while the rule sits in a file
- * nothing consults. The settings page therefore offers these workspaces and
- * sends the chosen one as the request's cwd; when there is exactly one (or
- * none), there is nothing to choose between.
- * @param sources - the snapshot's rule sources.
- * @returns the distinct workspace roots, in source order.
- */
-export declare function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[];
-/** The locale keys the allow action reports through. */
-export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed';
-/** The notice one action result maps onto: a locale key plus its interpolation values. */
-export interface AllowHostNotice {
-    readonly ok: boolean;
-    readonly key: AllowHostNoticeKey;
-    readonly vars: Record<string, string | number>;
-}
-/**
- * Map an action result onto the page notice.
- *
- * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
- * returning the RECOMPUTED decision is that the page can never say "allowed"
- * while the connection is still blocked (a nearer chain with an earlier deny,
- * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
- * as success when the decision really is `allow`.
- * @param result - the `permissionRules/allowHost` result.
- * @returns the notice to render.
- */
-export declare function allowHostNotice(result: AllowHostResult): AllowHostNotice;
 //# sourceMappingURL=allow-host.d.ts.map

package/lib/types/allow-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow-host.d.ts","sourceRoot":"","sources":["../../src/allow-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAqBhE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA0B9E;AAiCD,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAS1E;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,EAAE,CAShF;AAED,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,iBAAiB,CAAA;AAEpH,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;CAC/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAOxE"}
+{"version":3,"file":"allow-host.d.ts","sourceRoot":"","sources":["../../src/allow-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAUH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAqBjF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA0B9E;AAiCD,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAS1E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",
@@ -29,10 +29,10 @@
     "docs",
     "scripts/repair-session-logs.mjs",
     "README.md",
-    "README.zh.md",
-    "README.es.md",
-    "README.pt.md",
-    "README.hi.md",
+    "README-zh.md",
+    "README-es.md",
+    "README-pt.md",
+    "README-hi.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
@@ -76,7 +76,7 @@
       "network:outbound"
     ],
     "compatibility": {
-      "dshVersions": ["0.1.2-rc.1","0.1.5-rc.1"]
+      "dshVersions": ["0.1.2-rc.1","0.1.5-rc.2"]
     },
     "capability": {
       "id": "rules",
@@ -154,26 +154,26 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.2",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/cordis-plugin-include": "^1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-web": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-web": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.2",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.19.0",
@@ -194,6 +194,7 @@
     "test:coverage": "vitest run --coverage",
     "check:readmes": "node scripts/check-readme-sync.mjs",
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
+    "verify:client-bundle": "node scripts/verify-client-bundle.mjs",
     "pack:check": "node scripts/prepare.mjs && pnpm pack",
     "prepare": "node scripts/prepare.mjs"
   },

package/src/allow-host-notice.ts

@@ -0,0 +1,76 @@
+/**
+ * The client-safe half of the settings-page "allow this host" action: the
+ * workspace choices offered for a host-level block ({@link allowHostWorkspaces})
+ * and the notice mapping ({@link allowHostNotice}).
+ *
+ * These live in their own module — separate from the host-only
+ * `./allow-host.ts` — because the settings page (the browser bundle built
+ * from `src/client/index.ts`) imports them, and the client bundler inlines
+ * every value import it meets. A single `import { allowHostNotice } from
+ * '../allow-host.ts'` used to drag the whole host module — `node:path`,
+ * `node:net`, `yaml`, `process.platform` — into `lib/client.js` as external
+ * `require("process")`/`require("buffer")` calls the shell's frozen module
+ * table cannot answer, which made the entire plugin fail to load.
+ *
+ * The hard rule for this module: NO runtime imports beyond pure type-only
+ * references to `./wire.ts`. Anything that needs a node builtin, the yaml
+ * parser, or the rule compiler belongs in `./allow-host.ts` (or deeper),
+ * never here.
+ * @module dsh-permission-rules/allow-host-notice
+ */
+
+import type { AllowHostResult, RuleSourceView } from './wire.ts'
+
+/**
+ * The workspaces a host-level block may be allowed in: the distinct non-null
+ * `cwd`s of the loaded rule sources.
+ *
+ * A block with no cwd was judged by the proxy's session-less host chain, which
+ * any loaded workspace chain outranks the moment one exists — so writing the
+ * host file can leave the connection blocked while the rule sits in a file
+ * nothing consults. The settings page therefore offers these workspaces and
+ * sends the chosen one as the request's cwd; when there is exactly one (or
+ * none), there is nothing to choose between.
+ * @param sources - the snapshot's rule sources.
+ * @returns the distinct workspace roots, in source order.
+ */
+export function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[] {
+  const seen = new Set<string>()
+  const workspaces: string[] = []
+  for (const source of sources) {
+    if (source.cwd === null || seen.has(source.cwd)) continue
+    seen.add(source.cwd)
+    workspaces.push(source.cwd)
+  }
+  return workspaces
+}
+
+/** The locale keys the allow action reports through. */
+export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed'
+
+/** The notice one action result maps onto: a locale key plus its interpolation values. */
+export interface AllowHostNotice {
+  readonly ok: boolean
+  readonly key: AllowHostNoticeKey
+  readonly vars: Record<string, string | number>
+}
+
+/**
+ * Map an action result onto the page notice.
+ *
+ * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
+ * returning the RECOMPUTED decision is that the page can never say "allowed"
+ * while the connection is still blocked (a nearer chain with an earlier deny,
+ * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
+ * as success when the decision really is `allow`.
+ * @param result - the `permissionRules/allowHost` result.
+ * @returns the notice to render.
+ */
+export function allowHostNotice(result: AllowHostResult): AllowHostNotice {
+  if (!result.ok) return { ok: false, key: 'allowHostFailed', vars: { error: result.error ?? 'unknown error' } }
+  if (result.outcome !== 'allow') {
+    return { ok: false, key: 'allowHostStillBlocked', vars: { outcome: result.outcome ?? 'unknown' } }
+  }
+  if (result.alreadyAllowed) return { ok: true, key: 'allowHostAlready', vars: {} }
+  return { ok: true, key: 'allowHostSaved', vars: { path: result.path ?? '', reloaded: result.reloaded } }
+}

package/src/allow-host.ts

@@ -1,9 +1,16 @@
 /**
- * The settings-page "allow this host" action, as pure pieces: normalizing
+ * The settings-page "allow this host" action, host-only half: normalizing
  * and validating a blocked host, inserting ONE minimal
- * `match.network.domains` allow rule at the HEAD of a rule document, choosing
- * which rule file the rule belongs in, and mapping the action's result onto
- * the notice the page renders.
+ * `match.network.domains` allow rule at the HEAD of a rule document, and
+ * choosing which rule file the rule belongs in.
+ *
+ * The workspace choices (`allowHostWorkspaces`) and the notice mapping
+ * (`allowHostNotice`) live in `./allow-host-notice.ts`: the settings page
+ * imports them from the BROWSER bundle, whose bundler inlines every value
+ * import — keeping them next to the `node:path`/`node:net`/`yaml` code here
+ * emitted `require("process")`/`require("buffer")` calls the shell's frozen
+ * module table cannot answer, failing the whole plugin load. They are
+ * re-exported below so existing host-side imports keep working.
  *
  * Three invariants hold here and are asserted by `test/allow-host.spec.ts`:
  *
@@ -27,7 +34,11 @@ import { isIP } from 'node:net'
 import { isMap, isSeq, parseDocument } from 'yaml'
 import type { YAMLSeq } from 'yaml'
 import { RuleError, normalizeHost } from './rules.ts'
-import type { AllowHostResult, RuleSourceView } from './wire.ts'
+
+// Client-safe pieces re-exported from their own module — see the module doc
+// above for why they must not live in this host-only file.
+export { allowHostNotice, allowHostWorkspaces } from './allow-host-notice.ts'
+export type { AllowHostNotice, AllowHostNoticeKey } from './allow-host-notice.ts'
 
 /**
  * Why a generated rule may legitimately live in a rule file the parser would
@@ -251,57 +262,3 @@ function samePath(a: string, b: string): boolean {
   const right = resolve(b)
   return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right
 }
-
-/**
- * The workspaces a host-level block may be allowed in: the distinct non-null
- * `cwd`s of the loaded rule sources.
- *
- * A block with no cwd was judged by the proxy's session-less host chain, which
- * any loaded workspace chain outranks the moment one exists — so writing the
- * host file can leave the connection blocked while the rule sits in a file
- * nothing consults. The settings page therefore offers these workspaces and
- * sends the chosen one as the request's cwd; when there is exactly one (or
- * none), there is nothing to choose between.
- * @param sources - the snapshot's rule sources.
- * @returns the distinct workspace roots, in source order.
- */
-export function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[] {
-  const seen = new Set<string>()
-  const workspaces: string[] = []
-  for (const source of sources) {
-    if (source.cwd === null || seen.has(source.cwd)) continue
-    seen.add(source.cwd)
-    workspaces.push(source.cwd)
-  }
-  return workspaces
-}
-
-/** The locale keys the allow action reports through. */
-export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed'
-
-/** The notice one action result maps onto: a locale key plus its interpolation values. */
-export interface AllowHostNotice {
-  readonly ok: boolean
-  readonly key: AllowHostNoticeKey
-  readonly vars: Record<string, string | number>
-}
-
-/**
- * Map an action result onto the page notice.
- *
- * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
- * returning the RECOMPUTED decision is that the page can never say "allowed"
- * while the connection is still blocked (a nearer chain with an earlier deny,
- * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
- * as success when the decision really is `allow`.
- * @param result - the `permissionRules/allowHost` result.
- * @returns the notice to render.
- */
-export function allowHostNotice(result: AllowHostResult): AllowHostNotice {
-  if (!result.ok) return { ok: false, key: 'allowHostFailed', vars: { error: result.error ?? 'unknown error' } }
-  if (result.outcome !== 'allow') {
-    return { ok: false, key: 'allowHostStillBlocked', vars: { outcome: result.outcome ?? 'unknown' } }
-  }
-  if (result.alreadyAllowed) return { ok: true, key: 'allowHostAlready', vars: {} }
-  return { ok: true, key: 'allowHostSaved', vars: { path: result.path ?? '', reloaded: result.reloaded } }
-}

package/src/client/section.ts

@@ -11,7 +11,7 @@
 
 import * as React from 'react'
 import type { ReactElement } from 'react'
-import { allowHostNotice, allowHostWorkspaces } from '../allow-host.ts'
+import { allowHostNotice, allowHostWorkspaces } from '../allow-host-notice.ts'
 import type { PermissionRulesLocaleKey } from './locales.ts'
 import type { AllowHostRequest, AllowHostResult, NetworkBlockView, PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from '../wire.ts'