dsh-permission-rules 0.7.2 → 0.7.3

package/lib/types/wire.d.ts

@@ -215,8 +215,46 @@ export declare const NETWORK_STATUS_DESCRIPTOR: Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            configuredMode: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            sandboxMode: z.ZodNullable<z.ZodString>;
+            proxyPort: z.ZodNumber;
+            proxyActive: z.ZodBoolean;
+            denied: z.ZodNumber;
+            askBlocked: z.ZodNumber;
+            recent: z.ZodArray<z.ZodObject<{
+                time: z.ZodNumber;
+                tool: z.ZodString;
+                attributed: z.ZodBoolean;
+                domain: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                action: z.ZodUnion<readonly [z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+                matched: z.ZodBoolean;
+                source: z.ZodString;
+                ruleIndex: z.ZodNullable<z.ZodNumber>;
+                reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                exists: z.ZodBoolean;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+        typeSymbol: string;
         schema: z.ZodObject<{
             enabled: z.ZodBoolean;
             mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
@@ -276,14 +314,21 @@ export declare const RULES_READ_DESCRIPTOR: Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            path: z.ZodString;
+            exists: z.ZodBoolean;
+            text: z.ZodString;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             path: z.ZodString;
             exists: z.ZodBoolean;
@@ -306,28 +351,25 @@ export declare const RULES_SAVE_DESCRIPTOR: Readonly<{
     readonly invocation: Readonly<{
         kind: "direct";
     }>;
-    readonly parameters: readonly (Readonly<{
-        name: string;
-        wire: string;
-        source: "json";
-        codec: Readonly<{
-            mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
-            schema: z.ZodString;
-        }>;
-    }> | Readonly<{
+    readonly parameters: readonly Readonly<{
         name: string;
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
-    }>)[];
+    }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+            reloaded: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -351,8 +393,12 @@ export declare const RULES_RELOAD_DESCRIPTOR: Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -381,8 +427,14 @@ export declare const ALLOW_HOST_DESCRIPTOR: Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            typeSymbol: string;
             schema: z.ZodObject<{
                 host: z.ZodString;
                 scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
@@ -392,8 +444,17 @@ export declare const ALLOW_HOST_DESCRIPTOR: Readonly<{
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             path: z.ZodNullable<z.ZodString>;
@@ -425,8 +486,46 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            configuredMode: z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+            sandboxMode: z.ZodNullable<z.ZodString>;
+            proxyPort: z.ZodNumber;
+            proxyActive: z.ZodBoolean;
+            denied: z.ZodNumber;
+            askBlocked: z.ZodNumber;
+            recent: z.ZodArray<z.ZodObject<{
+                time: z.ZodNumber;
+                tool: z.ZodString;
+                attributed: z.ZodBoolean;
+                domain: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                action: z.ZodUnion<readonly [z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
+                matched: z.ZodBoolean;
+                source: z.ZodString;
+                ruleIndex: z.ZodNullable<z.ZodNumber>;
+                reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                exists: z.ZodBoolean;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#PermissionRulesSnapshot";
+        typeSymbol: string;
         schema: z.ZodObject<{
             enabled: z.ZodBoolean;
             mode: z.ZodUnion<readonly [z.ZodLiteral<"deny-all">, z.ZodLiteral<"whitelist">, z.ZodLiteral<"allow-all">]>;
@@ -484,14 +583,21 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesReadRequestPath";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            path: z.ZodString;
+            exists: z.ZodBoolean;
+            text: z.ZodString;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             path: z.ZodString;
             exists: z.ZodBoolean;
@@ -512,28 +618,25 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     readonly invocation: Readonly<{
         kind: "direct";
     }>;
-    readonly parameters: readonly (Readonly<{
-        name: string;
-        wire: string;
-        source: "json";
-        codec: Readonly<{
-            mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestPath";
-            schema: z.ZodString;
-        }>;
-    }> | Readonly<{
+    readonly parameters: readonly Readonly<{
         name: string;
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodString;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#RulesSaveRequestText";
+            typeSymbol: string;
             schema: z.ZodString;
         }>;
-    }>)[];
+    }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+            reloaded: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesSaveResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -555,8 +658,12 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
     }>;
     readonly parameters: readonly never[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#RulesReloadResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             error: z.ZodNullable<z.ZodString>;
@@ -580,8 +687,14 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         wire: string;
         source: "json";
         codec: Readonly<{
+            create: () => z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
             mode: "strict";
-            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            typeSymbol: string;
             schema: z.ZodObject<{
                 host: z.ZodString;
                 scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
@@ -591,8 +704,17 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         }>;
     }>[];
     readonly result: Readonly<{
+        create: () => z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
         mode: "strict";
-        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        typeSymbol: string;
         schema: z.ZodObject<{
             ok: z.ZodBoolean;
             path: z.ZodNullable<z.ZodString>;

package/lib/types/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,gFAAgF;IAChF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAClC;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sEAAsE;IACtE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IACxC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;EAaM,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMvC,CAAA"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAcvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,gFAAgF;IAChF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAClC;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sEAAsE;IACtE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IACxC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;EASM,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcQ,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMvC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",
@@ -38,6 +38,7 @@
   ],
   "sideEffects": false,
   "dsh": {
+    "manifestVersion": 1,
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
@@ -114,22 +115,23 @@
     "url": "https://github.com/PerryLink/dsh-permission-rules/issues"
   },
   "engines": {
-    "node": "^22.19.0 || >=24.0.0"
+    "node": "^22.19.0 || >=24.0.0",
+    "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
+    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0",
-    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-client-connection": {
@@ -189,6 +191,7 @@
   "scripts": {
     "build": "node scripts/prepare.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "typecheck:ci": "tsc -p tsconfig.ci.json --noEmit",
     "lint": "eslint src test scripts",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",

package/src/proxy.ts

@@ -342,12 +342,21 @@ export class NetworkProxy {
       // The forwarded connection is pinned to the addresses the decision was
       // made on, so a hostname that re-resolves between adjudication and
       // connect (DNS rebinding) cannot reach an address the rules never
-      // approved.
+      // approved. An allow decision with NO adjudicated address (the name
+      // failed to resolve during adjudication) fails closed here — issue #23:
+      // dialing the name would be a second resolution whose answer the rules
+      // never saw, the same invariant connectUpstream enforces for CONNECT.
       const pinned = pinnedAddresses(adjudicated)
+      if (pinned.length === 0) {
+        this.options.logger.warn(`permission-rules: plain-HTTP upstream refused: no adjudicated address for ${adjudicated.host}`)
+        res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end(`[network: upstream error] no adjudicated address for ${adjudicated.host}\n`)
+        return
+      }
       const options: RequestOptions = {
         method: req.method,
         headers: req.headers,
-        ...(pinned.length === 0 ? {} : { lookup: pinnedLookup(pinned) }),
+        lookup: pinnedLookup(pinned),
       }
       proxyReq = (upstream.protocol === 'https:' ? httpsRequest : httpRequest)(upstream, options, onResponse)
     } else {

package/src/runtime.ts

@@ -1653,6 +1653,14 @@ export async function apply(ctx: Context, config: Config): Promise<void> {
     return next()
   })
   attachSettingsSection(ctx, runtime, config)
+  // Register before the first await (A02 T10): an uninstall landing while
+  // attachNetworkProxy() is pending would otherwise lose the /rules command.
+  ctx.commands.register({
+    name: 'rules',
+    description: 'list, reload, audit, dry-test, or inspect the network policy of the active permission rules for this workspace',
+    input: { hint: '[list | reload | network | decisions [n] | test [--cwd <dir>] [--env K=V] [--agent <sel>] [--platform <name>] <tool> <json-args>]' },
+    handler: invocation => runtime.command(invocation),
+  })
   if (resolved.network.enabled) await runtime.attachNetworkProxy()
   ctx.inject(['systemPrompt'], (scope) => {
     const systemPrompt = scope.get('systemPrompt') as { context?: (entry: { name: string; order?: number; text: string }) => void } | undefined
@@ -1664,12 +1672,6 @@ export async function apply(ctx: Context, config: Config): Promise<void> {
     })
   })
   await ctx.plugin(PermissionRulesRemoteService, { runtime })
-  ctx.commands.register({
-    name: 'rules',
-    description: 'list, reload, audit, dry-test, or inspect the network policy of the active permission rules for this workspace',
-    input: { hint: '[list | reload | network | decisions [n] | test [--cwd <dir>] [--env K=V] [--agent <sel>] [--platform <name>] <tool> <json-args>]' },
-    handler: invocation => runtime.command(invocation),
-  })
 }
 
 /**

package/src/wire.ts

@@ -11,6 +11,17 @@
 import { z } from 'zod'
 import type { InvocationDescriptor } from '@deepseek-ai/dsh-typert-protocol'
 
+/**
+ * Strict wire codec carrying BOTH published and checkout faces: the `schema`
+ * field feeds the npm-published 0.1.5-rc.2 line, while `create` feeds the
+ * 0.1.6-alpha.2+ line, whose typert-loader requires the factory on every
+ * codec and materializes schemas lazily on first use. Built through a
+ * variable, so neither typecheck ruler flags the other face's field as excess.
+ */
+function strictWire<T>(typeSymbol: string, schema: T) {
+  return Object.freeze({ ...{ mode: 'strict' as const, typeSymbol, schema }, create: () => schema })
+}
+
 /** The three network policy modes (wire vocabulary). */
 export type NetworkModeWire = 'deny-all' | 'whitelist' | 'allow-all'
 
@@ -230,11 +241,7 @@ export const NETWORK_STATUS_DESCRIPTOR = Object.freeze({
   method: 'networkStatus',
   invocation: Object.freeze({ kind: 'direct' }),
   parameters: Object.freeze([]),
-  result: Object.freeze({
-    mode: 'strict',
-    typeSymbol: 'dsh-permission-rules/types#PermissionRulesSnapshot',
-    schema: PERMISSION_RULES_SNAPSHOT_SCHEMA,
-  }),
+  result: strictWire('dsh-permission-rules/types#PermissionRulesSnapshot', PERMISSION_RULES_SNAPSHOT_SCHEMA),
   sourceLocation: Object.freeze({ file: 'src/wire.ts', line: 1, column: 1 }),
 } as const) satisfies InvocationDescriptor
 
@@ -249,17 +256,9 @@ export const RULES_READ_DESCRIPTOR = Object.freeze({
     name: 'path',
     wire: 'path',
     source: 'json',
-    codec: Object.freeze({
-      mode: 'strict',
-      typeSymbol: 'dsh-permission-rules/types#RulesReadRequestPath',
-      schema: z.string(),
-    }),
+    codec: strictWire('dsh-permission-rules/types#RulesReadRequestPath', z.string()),
   } satisfies InvocationDescriptor['parameters'][number])]),
-  result: Object.freeze({
-    mode: 'strict',
-    typeSymbol: 'dsh-permission-rules/types#RulesReadResult',
-    schema: RULES_READ_SCHEMA,
-  }),
+  result: strictWire('dsh-permission-rules/types#RulesReadResult', RULES_READ_SCHEMA),
   sourceLocation: Object.freeze({ file: 'src/wire.ts', line: 1, column: 1 }),
 } as const) satisfies InvocationDescriptor
 
@@ -275,28 +274,16 @@ export const RULES_SAVE_DESCRIPTOR = Object.freeze({
       name: 'path',
       wire: 'path',
       source: 'json',
-      codec: Object.freeze({
-        mode: 'strict',
-        typeSymbol: 'dsh-permission-rules/types#RulesSaveRequestPath',
-        schema: z.string(),
-      }),
+      codec: strictWire('dsh-permission-rules/types#RulesSaveRequestPath', z.string()),
     } satisfies InvocationDescriptor['parameters'][number]),
     Object.freeze({
       name: 'text',
       wire: 'text',
       source: 'json',
-      codec: Object.freeze({
-        mode: 'strict',
-        typeSymbol: 'dsh-permission-rules/types#RulesSaveRequestText',
-        schema: z.string(),
-      }),
+      codec: strictWire('dsh-permission-rules/types#RulesSaveRequestText', z.string()),
     } satisfies InvocationDescriptor['parameters'][number]),
   ]),
-  result: Object.freeze({
-    mode: 'strict',
-    typeSymbol: 'dsh-permission-rules/types#RulesSaveResult',
-    schema: RULES_SAVE_SCHEMA,
-  }),
+  result: strictWire('dsh-permission-rules/types#RulesSaveResult', RULES_SAVE_SCHEMA),
   sourceLocation: Object.freeze({ file: 'src/wire.ts', line: 1, column: 1 }),
 } as const) satisfies InvocationDescriptor
 
@@ -308,11 +295,7 @@ export const RULES_RELOAD_DESCRIPTOR = Object.freeze({
   method: 'reload',
   invocation: Object.freeze({ kind: 'direct' }),
   parameters: Object.freeze([]),
-  result: Object.freeze({
-    mode: 'strict',
-    typeSymbol: 'dsh-permission-rules/types#RulesReloadResult',
-    schema: RULES_RELOAD_SCHEMA,
-  }),
+  result: strictWire('dsh-permission-rules/types#RulesReloadResult', RULES_RELOAD_SCHEMA),
   sourceLocation: Object.freeze({ file: 'src/wire.ts', line: 1, column: 1 }),
 } as const) satisfies InvocationDescriptor
 
@@ -330,17 +313,9 @@ export const ALLOW_HOST_DESCRIPTOR = Object.freeze({
     name: 'request',
     wire: 'request',
     source: 'json',
-    codec: Object.freeze({
-      mode: 'strict',
-      typeSymbol: 'dsh-permission-rules/types#AllowHostRequest',
-      schema: ALLOW_HOST_REQUEST_SCHEMA,
-    }),
+    codec: strictWire('dsh-permission-rules/types#AllowHostRequest', ALLOW_HOST_REQUEST_SCHEMA),
   } satisfies InvocationDescriptor['parameters'][number])]),
-  result: Object.freeze({
-    mode: 'strict',
-    typeSymbol: 'dsh-permission-rules/types#AllowHostResult',
-    schema: ALLOW_HOST_RESULT_SCHEMA,
-  }),
+  result: strictWire('dsh-permission-rules/types#AllowHostResult', ALLOW_HOST_RESULT_SCHEMA),
   sourceLocation: Object.freeze({ file: 'src/wire.ts', line: 1, column: 1 }),
 } as const) satisfies InvocationDescriptor