dsh-permission-rules 0.7.1 → 0.7.3

package/lib/types/typert.host.d.ts

@@ -23,8 +23,46 @@ export declare const TYPERT: Readonly<{
         }>;
         readonly parameters: readonly never[];
         readonly result: Readonly<{
+            create: () => import("zod").ZodObject<{
+                enabled: import("zod").ZodBoolean;
+                mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                configuredMode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"auto">, import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                sandboxMode: import("zod").ZodNullable<import("zod").ZodString>;
+                proxyPort: import("zod").ZodNumber;
+                proxyActive: import("zod").ZodBoolean;
+                denied: import("zod").ZodNumber;
+                askBlocked: import("zod").ZodNumber;
+                recent: import("zod").ZodArray<import("zod").ZodObject<{
+                    time: import("zod").ZodNumber;
+                    tool: import("zod").ZodString;
+                    attributed: import("zod").ZodBoolean;
+                    domain: import("zod").ZodString;
+                    scheme: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"http">, import("zod").ZodLiteral<"https">, import("zod").ZodNull]>;
+                    port: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    action: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny">, import("zod").ZodLiteral<"ask">]>;
+                    mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
+                    matched: import("zod").ZodBoolean;
+                    source: import("zod").ZodString;
+                    ruleIndex: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    reason: import("zod").ZodNullable<import("zod").ZodString>;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>>;
+                sources: import("zod").ZodArray<import("zod").ZodObject<{
+                    path: import("zod").ZodString;
+                    exists: import("zod").ZodBoolean;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>>;
+                allowHostAction: import("zod").ZodBoolean;
+                upstream: import("zod").ZodObject<{
+                    mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"off">, import("zod").ZodLiteral<"inherit">, import("zod").ZodLiteral<"url">]>;
+                    http: import("zod").ZodNullable<import("zod").ZodString>;
+                    https: import("zod").ZodNullable<import("zod").ZodString>;
+                    active: import("zod").ZodBoolean;
+                    chained: import("zod").ZodNumber;
+                }, import("zod/v4/core").$strip>;
+            }, import("zod/v4/core").$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+            typeSymbol: string;
             schema: import("zod").ZodObject<{
                 enabled: import("zod").ZodBoolean;
                 mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"deny-all">, import("zod").ZodLiteral<"whitelist">, import("zod").ZodLiteral<"allow-all">]>;
@@ -82,14 +120,21 @@ export declare const TYPERT: Readonly<{
             wire: string;
             source: "json";
             codec: Readonly<{
+                create: () => import("zod").ZodString;
                 mode: "strict";
-                typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+                typeSymbol: string;
                 schema: import("zod").ZodString;
             }>;
         }>[];
         readonly result: Readonly<{
+            create: () => import("zod").ZodObject<{
+                path: import("zod").ZodString;
+                exists: import("zod").ZodBoolean;
+                text: import("zod").ZodString;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+            typeSymbol: string;
             schema: import("zod").ZodObject<{
                 path: import("zod").ZodString;
                 exists: import("zod").ZodBoolean;
@@ -110,28 +155,25 @@ export declare const TYPERT: Readonly<{
         readonly invocation: Readonly<{
             kind: "direct";
         }>;
-        readonly parameters: readonly (Readonly<{
-            name: string;
-            wire: string;
-            source: "json";
-            codec: Readonly<{
-                mode: "strict";
-                typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
-                schema: import("zod").ZodString;
-            }>;
-        }> | Readonly<{
+        readonly parameters: readonly Readonly<{
             name: string;
             wire: string;
             source: "json";
             codec: Readonly<{
+                create: () => import("zod").ZodString;
                 mode: "strict";
-                typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+                typeSymbol: string;
                 schema: import("zod").ZodString;
             }>;
-        }>)[];
+        }>[];
         readonly result: Readonly<{
+            create: () => import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+                reloaded: import("zod").ZodNullable<import("zod").ZodNumber>;
+            }, import("zod/v4/core").$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+            typeSymbol: string;
             schema: import("zod").ZodObject<{
                 ok: import("zod").ZodBoolean;
                 error: import("zod").ZodNullable<import("zod").ZodString>;
@@ -153,8 +195,12 @@ export declare const TYPERT: Readonly<{
         }>;
         readonly parameters: readonly never[];
         readonly result: Readonly<{
+            create: () => import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+            typeSymbol: string;
             schema: import("zod").ZodObject<{
                 ok: import("zod").ZodBoolean;
                 error: import("zod").ZodNullable<import("zod").ZodString>;
@@ -178,8 +224,14 @@ export declare const TYPERT: Readonly<{
             wire: string;
             source: "json";
             codec: Readonly<{
+                create: () => import("zod").ZodObject<{
+                    host: import("zod").ZodString;
+                    scheme: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"http">, import("zod").ZodLiteral<"https">, import("zod").ZodNull]>;
+                    port: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>;
                 mode: "strict";
-                typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+                typeSymbol: string;
                 schema: import("zod").ZodObject<{
                     host: import("zod").ZodString;
                     scheme: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"http">, import("zod").ZodLiteral<"https">, import("zod").ZodNull]>;
@@ -189,8 +241,17 @@ export declare const TYPERT: Readonly<{
             }>;
         }>[];
         readonly result: Readonly<{
+            create: () => import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                path: import("zod").ZodNullable<import("zod").ZodString>;
+                created: import("zod").ZodBoolean;
+                reloaded: import("zod").ZodNumber;
+                outcome: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"allow">, import("zod").ZodLiteral<"deny">, import("zod").ZodLiteral<"ask">, import("zod").ZodNull]>;
+                alreadyAllowed: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+            typeSymbol: string;
             schema: import("zod").ZodObject<{
                 ok: import("zod").ZodBoolean;
                 path: import("zod").ZodNullable<import("zod").ZodString>;

package/lib/types/typert.host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typert.host.d.ts","sourceRoot":"","sources":["../../src/typert.host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAA"}
+{"version":3,"file":"typert.host.d.ts","sourceRoot":"","sources":["../../src/typert.host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAA"}

package/lib/types/wire.d.ts

@@ -215,8 +215,46 @@ export declare const NETWORK_STATUS_DESCRIPTOR: Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            configuredMode: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            sandboxMode: z.ZodNullable<z.ZodString>;
+            proxyPort: z.ZodNumber;
+            proxyActive: z.ZodBoolean;
+            denied: z.ZodNumber;
+            askBlocked: z.ZodNumber;
+            recent: z.ZodArray<z.ZodObject<{
+                time: z.ZodNumber;
+                tool: z.ZodString;
+                attributed: z.ZodBoolean;
+                domain: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                action: z.ZodUnion<readonly [z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+                matched: z.ZodBoolean;
+                source: z.ZodString;
+                ruleIndex: z.ZodNullable<z.ZodNumber>;
+                reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                exists: z.ZodBoolean;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+        typeSymbol: string;
         schema: z.ZodObject<{
             enabled: z.ZodBoolean;
             mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
@@ -276,14 +314,21 @@ export declare const RULES_READ_DESCRIPTOR: Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            path: z.ZodString;
+            exists: z.ZodBoolean;
+            text: z.ZodString;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             path: z.ZodString;
             exists: z.ZodBoolean;
@@ -306,28 +351,25 @@ export declare const RULES_SAVE_DESCRIPTOR: Readonly<{
     readonly invocation: Readonly<{
         kind: "direct";
     }>;
-    readonly parameters: readonly (Readonly<{
-        name: string;
-        wire: string;
-        source: "json";
-        codec: Readonly<{
-            mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
-            schema: z.ZodString;
-        }>;
-    }> | Readonly<{
+    readonly parameters: readonly Readonly<{
         name: string;
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
-    }>)[];
+    }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+            reloaded: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -351,8 +393,12 @@ export declare const RULES_RELOAD_DESCRIPTOR: Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -381,8 +427,14 @@ export declare const ALLOW_HOST_DESCRIPTOR: Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            typeSymbol: string;
             schema: z.ZodObject<{
                 host: z.ZodString;
                 scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
@@ -392,8 +444,17 @@ export declare const ALLOW_HOST_DESCRIPTOR: Readonly<{
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             path: z.ZodNullable<z.ZodString>;
@@ -425,8 +486,46 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            configuredMode: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            sandboxMode: z.ZodNullable<z.ZodString>;
+            proxyPort: z.ZodNumber;
+            proxyActive: z.ZodBoolean;
+            denied: z.ZodNumber;
+            askBlocked: z.ZodNumber;
+            recent: z.ZodArray<z.ZodObject<{
+                time: z.ZodNumber;
+                tool: z.ZodString;
+                attributed: z.ZodBoolean;
+                domain: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                action: z.ZodUnion<readonly [z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+                matched: z.ZodBoolean;
+                source: z.ZodString;
+                ruleIndex: z.ZodNullable<z.ZodNumber>;
+                reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                exists: z.ZodBoolean;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+        typeSymbol: string;
         schema: z.ZodObject<{
             enabled: z.ZodBoolean;
             mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
@@ -484,14 +583,21 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            path: z.ZodString;
+            exists: z.ZodBoolean;
+            text: z.ZodString;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             path: z.ZodString;
             exists: z.ZodBoolean;
@@ -512,28 +618,25 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     readonly invocation: Readonly<{
         kind: "direct";
     }>;
-    readonly parameters: readonly (Readonly<{
-        name: string;
-        wire: string;
-        source: "json";
-        codec: Readonly<{
-            mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
-            schema: z.ZodString;
-        }>;
-    }> | Readonly<{
+    readonly parameters: readonly Readonly<{
         name: string;
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
-    }>)[];
+    }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+            reloaded: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -555,8 +658,12 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -580,8 +687,14 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            typeSymbol: string;
             schema: z.ZodObject<{
                 host: z.ZodString;
                 scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
@@ -591,8 +704,17 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             path: z.ZodNullable<z.ZodString>;

package/lib/types/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,gFAAgF;IAChF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAClC;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sEAAsE;IACtE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IACxC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;EAaM,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMvC,CAAA"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAcvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,gFAAgF;IAChF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAClC;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sEAAsE;IACtE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IACxC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;EASM,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcQ,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMvC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",
@@ -38,6 +38,7 @@
   ],
   "sideEffects": false,
   "dsh": {
+    "manifestVersion": 1,
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
@@ -114,22 +115,23 @@
     "url": "https://github.com/PerryLink/dsh-permission-rules/issues"
   },
   "engines": {
-    "node": "^22.19.0 || >=24.0.0"
+    "node": "^22.19.0 || >=24.0.0",
+    "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
+    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-client-connection": {
@@ -189,11 +191,13 @@
   "scripts": {
     "build": "node scripts/prepare.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "typecheck:ci": "tsc -p tsconfig.ci.json --noEmit",
     "lint": "eslint src test scripts",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "check:readmes": "node scripts/check-readme-sync.mjs",
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
+    "verify:client-bundle": "node scripts/verify-client-bundle.mjs",
     "pack:check": "node scripts/prepare.mjs && pnpm pack",
     "prepare": "node scripts/prepare.mjs"
   },

package/src/allow-host-notice.ts

@@ -0,0 +1,76 @@
+/**
+ * The client-safe half of the settings-page "allow this host" action: the
+ * workspace choices offered for a host-level block ({@link allowHostWorkspaces})
+ * and the notice mapping ({@link allowHostNotice}).
+ *
+ * These live in their own module — separate from the host-only
+ * `./allow-host.ts` — because the settings page (the browser bundle built
+ * from `src/client/index.ts`) imports them, and the client bundler inlines
+ * every value import it meets. A single `import { allowHostNotice } from
+ * '../allow-host.ts'` used to drag the whole host module — `node:path`,
+ * `node:net`, `yaml`, `process.platform` — into `lib/client.js` as external
+ * `require("process")`/`require("buffer")` calls the shell's frozen module
+ * table cannot answer, which made the entire plugin fail to load.
+ *
+ * The hard rule for this module: NO runtime imports beyond pure type-only
+ * references to `./wire.ts`. Anything that needs a node builtin, the yaml
+ * parser, or the rule compiler belongs in `./allow-host.ts` (or deeper),
+ * never here.
+ * @module dsh-permission-rules/allow-host-notice
+ */
+
+import type { AllowHostResult, RuleSourceView } from './wire.ts'
+
+/**
+ * The workspaces a host-level block may be allowed in: the distinct non-null
+ * `cwd`s of the loaded rule sources.
+ *
+ * A block with no cwd was judged by the proxy's session-less host chain, which
+ * any loaded workspace chain outranks the moment one exists — so writing the
+ * host file can leave the connection blocked while the rule sits in a file
+ * nothing consults. The settings page therefore offers these workspaces and
+ * sends the chosen one as the request's cwd; when there is exactly one (or
+ * none), there is nothing to choose between.
+ * @param sources - the snapshot's rule sources.
+ * @returns the distinct workspace roots, in source order.
+ */
+export function allowHostWorkspaces(sources: readonly RuleSourceView[]): string[] {
+  const seen = new Set<string>()
+  const workspaces: string[] = []
+  for (const source of sources) {
+    if (source.cwd === null || seen.has(source.cwd)) continue
+    seen.add(source.cwd)
+    workspaces.push(source.cwd)
+  }
+  return workspaces
+}
+
+/** The locale keys the allow action reports through. */
+export type AllowHostNoticeKey = 'allowHostSaved' | 'allowHostAlready' | 'allowHostStillBlocked' | 'allowHostFailed'
+
+/** The notice one action result maps onto: a locale key plus its interpolation values. */
+export interface AllowHostNotice {
+  readonly ok: boolean
+  readonly key: AllowHostNoticeKey
+  readonly vars: Record<string, string | number>
+}
+
+/**
+ * Map an action result onto the page notice.
+ *
+ * A non-`allow` outcome outranks `alreadyAllowed`: the whole point of
+ * returning the RECOMPUTED decision is that the page can never say "allowed"
+ * while the connection is still blocked (a nearer chain with an earlier deny,
+ * or a mode default, still wins). `alreadyAllowed` therefore only ever reads
+ * as success when the decision really is `allow`.
+ * @param result - the `permissionRules/allowHost` result.
+ * @returns the notice to render.
+ */
+export function allowHostNotice(result: AllowHostResult): AllowHostNotice {
+  if (!result.ok) return { ok: false, key: 'allowHostFailed', vars: { error: result.error ?? 'unknown error' } }
+  if (result.outcome !== 'allow') {
+    return { ok: false, key: 'allowHostStillBlocked', vars: { outcome: result.outcome ?? 'unknown' } }
+  }
+  if (result.alreadyAllowed) return { ok: true, key: 'allowHostAlready', vars: {} }
+  return { ok: true, key: 'allowHostSaved', vars: { path: result.path ?? '', reloaded: result.reloaded } }
+}