dsh-permission-rules 0.7.10 → 0.7.11

package/CHANGELOG.md

@@ -517,6 +517,13 @@ All notable changes to dsh-permission-rules are recorded here, newest first.
 
 ## [Unreleased]
 
+## v0.7.11 - 2026-10-05
+
+### Fixed
+
+- An unreadable peer version now fails closed. `peerVersion()` resolves the pinned peer's `package.json` through `createRequire`; inside a profile install that lookup throws `MODULE_NOT_FOUND`, so the runtime saw `null` and the guard `version !== null && isUnmarkedHostVersion(version)` skipped the unmarked-host check entirely. Every process start then landed one unmarked audit row, and each unmarked row is what makes a session unresumable on stricter harness builds. Both call sites -- the decision path and `auditNetworkBlock` -- now read `version === null || isUnmarkedHostVersion(version)`, matching the sibling defend and auto-review plugins, and `test/audit-support.spec.ts` gains the null-version case it was missing (the sibling auto-review spec has one; this repo and defend did not).
+- Residual, by design: a STABLE `0.2.x` host is still classified as possibly-marker-aware, so the append probe still runs once there -- a restored marker surface is adopted without a new plugin release.
+
 ## v0.7.10 - 2026-10-04
 
 ### Fixed

package/lib/index.js

@@ -3555,7 +3555,7 @@ var PermissionRulesRuntime = class {
 		if (this.auditSupport === "unsupported") return;
 		if (this.auditSupport === "unknown" && !this.config.allowUnmarkedAudit) {
 			const version = this.peerVersion();
-			if (version !== null && isUnmarkedHostVersion(version)) {
+			if (version === null || isUnmarkedHostVersion(version)) {
 				this.auditSupport = "unsupported";
 				this.warnUnmarkedAuditHost();
 				return;
@@ -3740,7 +3740,7 @@ var PermissionRulesRuntime = class {
 		if (agent === void 0 || this.auditSupport === "unsupported") return;
 		if (this.auditSupport === "unknown" && !this.config.allowUnmarkedAudit) {
 			const version = this.peerVersion();
-			if (version !== null && isUnmarkedHostVersion(version)) {
+			if (version === null || isUnmarkedHostVersion(version)) {
 				this.auditSupport = "unsupported";
 				this.warnUnmarkedAuditHost();
 				return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",

package/src/runtime.ts

@@ -523,7 +523,7 @@ export class PermissionRulesRuntime {
     if (this.auditSupport === 'unsupported') return
     if (this.auditSupport === 'unknown' && !this.config.allowUnmarkedAudit) {
       const version = this.peerVersion()
-      if (version !== null && isUnmarkedHostVersion(version)) {
+      if (version === null || isUnmarkedHostVersion(version)) {
         this.auditSupport = 'unsupported'
         this.warnUnmarkedAuditHost()
         return
@@ -705,7 +705,7 @@ export class PermissionRulesRuntime {
     if (agent === undefined || this.auditSupport === 'unsupported') return
     if (this.auditSupport === 'unknown' && !this.config.allowUnmarkedAudit) {
       const version = this.peerVersion()
-      if (version !== null && isUnmarkedHostVersion(version)) {
+      if (version === null || isUnmarkedHostVersion(version)) {
         this.auditSupport = 'unsupported'
         this.warnUnmarkedAuditHost()
         return