dsh-permission-rules 0.7.4 → 0.7.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.7.4",
+  "version": "0.7.7",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",
@@ -77,7 +77,7 @@
       "network:outbound"
     ],
     "compatibility": {
-      "dshVersions": ["0.1.2-rc.1","0.1.5-rc.2"]
+      "dshVersions": ["0.1.2-rc.1","0.1.5-rc.2","0.1.7-alpha.2"]
     },
     "capability": {
       "id": "rules",
@@ -116,22 +116,22 @@
   },
   "engines": {
     "node": "^22.19.0 || >=24.0.0",
-    "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
+    "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0",
-    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
+    "@deepseek-ai/dsh-client-web": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-client-connection": {
@@ -156,27 +156,28 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-attachment": "0.1.5-rc.2",
-    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-attachment": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.4",
     "@deepseek-ai/cordis-plugin-include": "^1.0.7",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-brand": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-web": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-subagent": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
+    "@deepseek-ai/dsh-agent": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-web": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-commands": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-invariants": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-subagent": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.3",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.19.0",
     "@vitest/coverage-v8": "^3.2.0",

package/scripts/repair-session-logs.mjs

@@ -82,14 +82,15 @@ const STORAGE_ROW_TYPES = new Set([
 /**
  * The harness build's generated event vocabulary
  * (`KNOWN_SESSION_EVENT_TYPES`, `packages/core/session/src/known-event-types.ts`,
- * synced with the `0.1.5-rc.1` catalog), plus the v1/v2-only spellings the
+ * synced with the `0.1.7-alpha.1` catalog), plus the v1/v2-only spellings the
  * older generations wrote (`assistant/chunk`, `tool/code-dispatch`,
  * `tool/code-dispatch-start`; V3 renamed the latter two to `tool/ptc-dispatch`
  * and `tool/ptc-dispatch-start`), so every generation scans clean. Rows whose
  * type is outside this set are what the read path refuses when the envelope
  * lacks `ignorable: true`; the scan reports them so nothing is missed.
  * Regenerate this list from the harness checkout when it changes (0.1.5-rc.1
- * added `deliverables/presented` and `subagent/catalog`).
+ * added `deliverables/presented` and `subagent/catalog`; `0.1.7-alpha.1` added
+ * `developer/message`, `image/offload` and `workspace/changes`).
  */
 const KNOWN_SESSION_EVENT_TYPES = new Set([
   'agent-preset/selected',
@@ -109,12 +110,14 @@ const KNOWN_SESSION_EVENT_TYPES = new Set([
   'compaction/start',
   'compaction/summary',
   'deliverables/presented',
+  'developer/message',
   'feedback/message-delete',
   'feedback/message-put',
   'feedback/record',
   'goal/change',
   'hook/invoked',
   'hook/result',
+  'image/offload',
   'llm/retry',
   'llm/retry-started',
   'model/selection',
@@ -153,6 +156,7 @@ const KNOWN_SESSION_EVENT_TYPES = new Set([
   'turn/start',
   'user/message',
   'web/deepseek-search-llm-request',
+  'workspace/changes',
 ])
 
 /**

package/src/config.ts

@@ -3,6 +3,15 @@
  * a validated {@link Config} field changeable from cordis.yml; the
  * resolution step validates the numeric bounds and compiles nothing — rule
  * files are external documents resolved per session cwd at load time.
+ *
+ * Since the `0.1.7-alpha` settings contract every field is declared
+ * `.volatile()`, so the Loader hands `apply` a live reference per field
+ * ({@link LiveConfig}) and the settings surface edits them in place. The
+ * numeric bounds live in the SCHEMA (`min`/`max`/`step`) as well as in
+ * {@link resolveConfig}: the config editor resolves the merged config
+ * against this schema before it persists anything, so an out-of-range value
+ * is still refused at write time — the tradeoff the removed
+ * `settings.register(..., { validate })` callback used to carry.
  * @module dsh-permission-rules/config
  */
 
@@ -98,8 +107,10 @@ export interface Config {
   /**
    * Fallback rule file used when per-cwd discovery finds no rule file.
    * Absolute, or relative to `process.cwd()`. Unset = an empty rule set.
+   * Declared `| undefined` because a live reference to a field the schema
+   * gives no default reports an absent value explicitly.
    */
-  fallbackPath?: string
+  fallbackPath?: string | undefined
   /**
    * How an unreadable/invalid rule file is handled at load: `'fail'` throws
    * (the pending tool call errors loudly; HMR reloads keep the previous
@@ -146,9 +157,9 @@ export interface Config {
    */
   allowUnmarkedAudit?: boolean
   /** Process-level network policy (all optional; defaults inside). */
-  network?: NetworkConfig
+  network?: NetworkConfig | undefined
   /** Built-in high-risk baseline (all optional; defaults inside). */
-  builtin?: BuiltinConfig
+  builtin?: BuiltinConfig | undefined
 }
 
 /** Network config after {@link resolveConfig}: every optional field has its explicit default. */
@@ -195,43 +206,125 @@ export interface ResolvedConfig {
   readonly builtin: ResolvedBuiltinConfig
 }
 
-/** Schemastery schema: the loader validates and fills defaults before `apply`. */
-export const Config: z<Config> = z.object({
-  rulesFile: z.string().default('.dsh/rules.yaml'),
-  fallbackPath: z.string(),
-  badFilePolicy: z.union(['fail', 'ignore-with-warning'] as const).default('fail'),
-  maxRules: z.number().default(256),
-  maxCachedWorkspaces: z.number().default(512),
-  patternMode: z.union(['glob', 'regex'] as const).default('glob'),
-  watch: z.boolean().default(true),
-  watchStabilityThresholdMs: z.number().default(200),
-  language: z.union(['en', 'zh', 'es', 'pt', 'hi'] as const).default('en'),
-  caseInsensitivePaths: z.boolean().default(process.platform === 'win32'),
-  audit: z.union(['all', 'hits'] as const).default('all'),
-  searchUp: z.boolean().default(false),
-  maxGlobStars: z.number().default(2),
-  enforce: z.boolean().default(true),
-  allowUnmarkedAudit: z.boolean().default(false),
-  network: z.object({
+/**
+ * Mark one schema field as a live reference, where the host can.
+ *
+ * `.volatile()` first appeared in `@deepseek-ai/schemastery` 3.18.3, and this
+ * schema is built while the plugin module is evaluated — an unguarded call
+ * would turn every host line the package's peer ranges still advertise
+ * (`0.1.2-rc`, `0.1.5-alpha`, `0.1.6-0`) into a hard mount crash. Probed
+ * instead: on a Schemastery without the method the field stays an ordinary
+ * value, the Loader hands `apply` a plain config ({@link plainConfig} passes
+ * it straight through), and the plugin runs exactly as it did before live
+ * forms existed — only the settings form is unavailable there, which is the
+ * same degradation as a host that composes no settings service at all.
+ * @param schema - the field schema.
+ * @returns the same field schema, live where supported.
+ */
+function live<S extends { volatile(): unknown }>(schema: S): ReturnType<S['volatile']> {
+  const builder = schema as { volatile?: () => ReturnType<S['volatile']> }
+  return typeof builder.volatile === 'function'
+    ? builder.volatile()
+    : (schema as unknown as ReturnType<S['volatile']>)
+}
+
+/**
+ * Schemastery schema: the loader validates and fills defaults before
+ * `apply`. Every field is live (see {@link live}), so on a `0.1.7-alpha`
+ * host the Loader hands `apply` a reference per field and the settings
+ * surface can edit each one in place. `network` and `builtin` are marked
+ * live as WHOLE objects — Schemastery refuses a volatile inside a volatile,
+ * and the only supported shape is a fixed object path.
+ *
+ * The numeric bounds are declared here (not only in {@link resolveConfig})
+ * because the config editor resolves the merged config against THIS schema
+ * before persisting it: an out-of-range edit is refused at write time
+ * instead of disabling the plugin on the next read.
+ */
+export const Config = z.object({
+  rulesFile: live(z.string().default('.dsh/rules.yaml')),
+  fallbackPath: live(z.string()),
+  badFilePolicy: live(z.union(['fail', 'ignore-with-warning'] as const).default('fail')),
+  maxRules: live(z.number().step(1).min(1).default(256)),
+  maxCachedWorkspaces: live(z.number().step(1).min(1).default(512)),
+  patternMode: live(z.union(['glob', 'regex'] as const).default('glob')),
+  watch: live(z.boolean().default(true)),
+  watchStabilityThresholdMs: live(z.number().step(1).min(0).default(200)),
+  language: live(z.union(['en', 'zh', 'es', 'pt', 'hi'] as const).default('en')),
+  caseInsensitivePaths: live(z.boolean().default(process.platform === 'win32')),
+  audit: live(z.union(['all', 'hits'] as const).default('all')),
+  searchUp: live(z.boolean().default(false)),
+  maxGlobStars: live(z.number().step(1).min(1).default(2)),
+  enforce: live(z.boolean().default(true)),
+  allowUnmarkedAudit: live(z.boolean().default(false)),
+  network: live(z.object({
     enabled: z.boolean().default(true),
     mode: z.union(['auto', ...NETWORK_MODES] as const).default('auto'),
     autoFallback: z.union(NETWORK_MODES as [NetworkMode, ...NetworkMode[]]).default('allow-all'),
     unlisted: z.union(['ask', 'deny'] as const).default('ask'),
     proxyBind: z.string().default('127.0.0.1'),
-    proxyPort: z.number().default(0),
-    proxyMaxRecent: z.number().default(100),
+    proxyPort: z.number().step(1).min(0).max(65535).default(0),
+    proxyMaxRecent: z.number().step(1).min(1).default(100),
     loopback: z.union(['allow', 'policy'] as const).default('allow'),
     injectEnv: z.boolean().default(true),
     noProxy: z.union(['clear', 'preserve'] as const).default('clear'),
     upstreamProxy: z.string().default('off'),
     allowHostAction: z.boolean().default(true),
-  }),
-  builtin: z.object({
+  })),
+  builtin: live(z.object({
     enabled: z.boolean().default(true),
     path: z.string(),
-  }),
+  })),
 })
 
+/** The Loader-delivered config: every field is a live reference to its current value. */
+export type LiveConfig = ReturnType<typeof Config>
+
+/** What {@link resolveConfig} accepts: the raw config, or the Loader's live one. */
+export type ConfigInput = Config | LiveConfig
+
+/**
+ * Whether `value` is the Loader's live config rather than a plain one.
+ * `rulesFile` is the discriminator: it always has a schema default, so the
+ * Loader always materializes its reference, plain or absent.
+ * @param value - a raw or live config.
+ * @returns true when the fields are live references.
+ */
+function isLiveConfig(value: ConfigInput): value is LiveConfig {
+  return typeof (value as { rulesFile?: { get?: unknown } }).rulesFile?.get === 'function'
+}
+
+/**
+ * Unwrap the Loader's live references into the plain config
+ * {@link resolveConfig} validates. Reading each reference HERE is what keeps
+ * a caller's config source lazy: call it inside the closure, never at
+ * closure-construction time, or a live edit stops being visible.
+ * @param config - the raw config, or the Loader's live one.
+ * @returns the plain raw config (the input itself when it was already plain).
+ */
+export function plainConfig(config: ConfigInput): Config {
+  if (!isLiveConfig(config)) return config
+  return {
+    rulesFile: config.rulesFile.get(),
+    fallbackPath: config.fallbackPath.get(),
+    badFilePolicy: config.badFilePolicy.get(),
+    maxRules: config.maxRules.get(),
+    maxCachedWorkspaces: config.maxCachedWorkspaces.get(),
+    patternMode: config.patternMode.get(),
+    watch: config.watch.get(),
+    watchStabilityThresholdMs: config.watchStabilityThresholdMs.get(),
+    language: config.language.get(),
+    caseInsensitivePaths: config.caseInsensitivePaths.get(),
+    audit: config.audit.get(),
+    searchUp: config.searchUp.get(),
+    maxGlobStars: config.maxGlobStars.get(),
+    enforce: config.enforce.get(),
+    allowUnmarkedAudit: config.allowUnmarkedAudit.get(),
+    network: config.network.get(),
+    builtin: config.builtin.get(),
+  }
+}
+
 /**
  * Validate raw values and fill explicit defaults. A `maxRules`,
  * `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
@@ -239,10 +332,15 @@ export const Config: z<Config> = z.object({
  * absolute `rulesFile`, a value outside a closed enum, or a non-boolean
  * flag throws here — misconfiguration fails loud at mount even when the
  * plugin is mounted without the Schemastery loader.
- * @param config - raw (possibly partial) plugin config.
+ *
+ * Accepts the Loader's live config directly and unwraps it through
+ * {@link plainConfig}, so a caller can keep this call inside its config
+ * source and see every live edit on the next read.
+ * @param input - raw (possibly partial) plugin config, or the Loader's live one.
  * @returns the fully resolved config.
  */
-export function resolveConfig(config: Config = {}): ResolvedConfig {
+export function resolveConfig(input: ConfigInput = {}): ResolvedConfig {
+  const config = plainConfig(input)
   const rulesFile = config.rulesFile ?? '.dsh/rules.yaml'
   const searchUp = config.searchUp ?? false
   if (searchUp && isAbsolute(rulesFile)) {

package/src/runtime.ts

@@ -21,7 +21,7 @@ import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools'
 import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import { resolveConfig } from './config.ts'
-import type { Config, ResolvedConfig } from './config.ts'
+import type { LiveConfig, ResolvedConfig } from './config.ts'
 import type { CallId } from './call-id.ts'
 import { insertAllowRule, isWritableHost, normalizeAllowHost, resolveAllowHostTarget } from './allow-host.ts'
 import type { AllowHostInsertion } from './allow-host.ts'
@@ -1639,10 +1639,15 @@ export class PermissionRulesRuntime {
 /**
  * Mount the plugin: resolve config, validate deployment-level rule files,
  * register the pre-execute listener and the `/rules` command.
+ *
+ * The `config` argument is the Loader's LIVE config (every field a
+ * `.volatile()` reference, see {@link LiveConfig}); `resolveConfig` unwraps
+ * it, and the same object is handed to {@link attachSettingsSection} so the
+ * runtime keeps reading the current values instead of a mount-time snapshot.
  * @param ctx - the host context.
- * @param config - raw plugin config.
+ * @param config - the Loader-delivered live plugin config.
  */
-export async function apply(ctx: Context, config: Config): Promise<void> {
+export async function apply(ctx: Context, config: LiveConfig): Promise<void> {
   const resolved = resolveConfig(config)
   const runtime = new PermissionRulesRuntime(ctx, resolved)
   runtime.validateDeploymentFiles()

package/src/settings.ts

@@ -1,74 +1,89 @@
 /**
- * Host-side settings-namespace wiring: registers the whole plugin config
- * as the `permission-rules` settings section (editable from the Web
- * settings surface, loopback-only), keeps the runtime's config source
- * pointed at the resolved section, and rebinds the network proxy when a
- * bind/env-relevant knob changes live. On hosts without a settings
- * service (the rc.6 line) nothing registers and the composition entry
- * keeps serving the config — the plugin stays fully functional.
+ * Host-side live-configuration wiring for the `0.1.7-alpha` settings
+ * contract. The plugin's Config fields are declared `.volatile()`, the
+ * Loader hands `apply` one live reference per field, and the settings
+ * surface edits those references in place. This module therefore owns three
+ * things and nothing else: it tells the settings service that this plugin
+ * ships its OWN page (so no automatic form is generated for it), it keeps
+ * the runtime's config source pointed at the CURRENT reference values, and
+ * it rebinds the network proxy when a bind/env-relevant knob changes live.
  *
- * The registration uses only structural interfaces: `@deepseek-ai/
- * dsh-settings` is not an rc.6 peer, so importing it would hard-fail
- * older hosts; the real service satisfies these shapes.
+ * There is no registration any more: the namespace of a settings form is the
+ * profile entry id, chosen by the composition, not by the plugin. The
+ * service is still reached structurally (`ctx.inject(['settings'])` plus
+ * `ctx.get('settings')`) because `@deepseek-ai/dsh-settings` is not a
+ * dependency of this package — on a host without it nothing registers and
+ * the composition entry keeps serving the config, because the references
+ * ARE the entry's own values.
  * @module dsh-permission-rules/settings
  */
 
 import type { Context } from '@deepseek-ai/cordis'
-import type z from '@deepseek-ai/schemastery'
-import { Config, resolveConfig } from './config.ts'
-import type { Config as PluginConfig, ResolvedConfig } from './config.ts'
+// Type-only: merges the Loader's `loader/volatile-update` event into `Events`.
+// It is a devDependency (the Loader is composed by the host), and the import is
+// erased, so nothing is required at runtime — a host whose Loader predates the
+// event simply never emits it, and this plugin has nothing to reconcile then.
+import type {} from '@deepseek-ai/cordis-plugin-loader'
+import { resolveConfig } from './config.ts'
+import type { LiveConfig, ResolvedConfig } from './config.ts'
 import type { PermissionRulesRuntime } from './runtime.ts'
 
-/** The settings namespace this plugin owns (kebab-case, per the provider contract). */
-export const SETTINGS_NAMESPACE = 'permission-rules'
-
-/** The owner-facing scope the real settings service hands back. */
-interface SettingsScopeLike<T> {
-  get(): T
-  watch(callback: (next: T, prev: T) => void | Promise<void>): () => void
-}
-
-/** The structural settings-provider shape the real `ctx.settings` satisfies. */
-interface SettingsProviderLike {
-  register<T>(ns: string, schema: z<T>, options?: {
-    base?: Partial<T>
-    expose?: boolean
-    applies?: string
-    validate?: (value: T) => void
-  }): SettingsScopeLike<T>
+/**
+ * The structural settings-service face this plugin uses. The real
+ * `ctx.settings` is a `SettingsForms` service; only `configure` is read, and
+ * only through this shape, so an older or replaced service is tolerated.
+ */
+interface SettingsLike {
+  configure(presentation: { auto?: boolean }, owner: unknown): () => void
 }
 
 /**
- * Register the settings section and bind the runtime's live config
- * source. Runs only where a settings service is composed.
+ * Point the runtime's live config source at the Loader's references and
+ * register this instance's settings-page policy.
  * @param ctx - the plugin context.
- * @param runtime - the runtime whose config source follows the section.
- * @param entry - the composition entry config (the section's `base` layer).
+ * @param runtime - the runtime whose config source follows the references.
+ * @param config - the Loader-delivered live config (references to the entry's values).
  */
-export function attachSettingsSection(ctx: Context, runtime: PermissionRulesRuntime, entry: PluginConfig): void {
+export function attachSettingsSection(ctx: Context, runtime: PermissionRulesRuntime, config: LiveConfig): void {
   ctx.inject(['settings'], (scope) => {
-    const settings = scope.get('settings') as SettingsProviderLike | undefined
-    if (settings === undefined) return
-    const registration = settings.register<PluginConfig>(SETTINGS_NAMESPACE, Config as z<PluginConfig>, {
-      base: entry,
-      expose: true,
-      applies: 'live',
-      validate: (value: PluginConfig) => {
-        // Schemastery already enforced the closed enums; this re-runs the
-        // numeric-bounds checks so an out-of-range stored value is refused
-        // at write time instead of disabling the owner later.
-        resolveConfig(value)
-      },
-    })
-    runtime.setConfigSource(() => resolveConfig(registration.get()))
-    registration.watch((next, prev) => {
-      const nextConfig = resolveConfig(next) as ResolvedConfig
-      const prevConfig = resolveConfig(prev) as ResolvedConfig
-      const rebind = nextConfig.network.proxyPort !== prevConfig.network.proxyPort
-        || nextConfig.network.proxyBind !== prevConfig.network.proxyBind
-        || nextConfig.network.injectEnv !== prevConfig.network.injectEnv
-        || nextConfig.network.noProxy !== prevConfig.network.noProxy
-      if (rebind) void runtime.onNetworkConfigChanged()
-    })
+    const settings = scope.get('settings') as SettingsLike | undefined
+    if (settings?.configure === undefined) return
+    // The policy belongs to THIS plugin instance's fiber, and riding an effect
+    // means a late-loading or replaced Settings service still picks it up and
+    // an unload withdraws it.
+    scope.effect(() => settings.configure({ auto: false }, ctx.fiber))
+  })
+
+  // LAZY on purpose: `resolveConfig` unwraps the references on every call, so
+  // a live edit is visible to the very next read. Resolving once here instead
+  // would freeze the config at mount and silently break every later change —
+  // which is exactly what the rebind listener below exists to serve.
+  runtime.setConfigSource(() => resolveConfig(config))
+
+  // A volatile-only update does NOT remount the plugin (the Loader commits the
+  // references and emits), so every bind-time side effect has to be
+  // reconciled here. Only the four knobs below decide the proxy's socket, its
+  // injected environment, and the NO_PROXY policy; every other field is read
+  // live through the config source, so a mode or rule-file change needs no
+  // work at all.
+  let previous = resolveConfig(config)
+  ctx.on('loader/volatile-update', () => {
+    let next: ResolvedConfig
+    try {
+      next = resolveConfig(config)
+    } catch (error: unknown) {
+      // Every reference is already committed when this fires, and the Loader
+      // catches and warns on a listener throw anyway — reporting it in this
+      // plugin's own vocabulary is the only signal an operator gets that a
+      // live edit left the config unusable.
+      ctx.logger.warn(`permission-rules: live config update is not usable: ${error instanceof Error ? error.message : String(error)}`)
+      return
+    }
+    const rebind = next.network.proxyPort !== previous.network.proxyPort
+      || next.network.proxyBind !== previous.network.proxyBind
+      || next.network.injectEnv !== previous.network.injectEnv
+      || next.network.noProxy !== previous.network.noProxy
+    previous = next
+    if (rebind) void runtime.onNetworkConfigChanged()
   })
 }

package/src/wire.ts

@@ -12,14 +12,15 @@ import { z } from 'zod'
 import type { InvocationDescriptor } from '@deepseek-ai/dsh-typert-protocol'
 
 /**
- * Strict wire codec carrying BOTH published and checkout faces: the `schema`
- * field feeds the npm-published 0.1.5-rc.2 line, while `create` feeds the
- * 0.1.6-alpha.2+ line, whose typert-loader requires the factory on every
- * codec and materializes schemas lazily on first use. Built through a
- * variable, so neither typecheck ruler flags the other face's field as excess.
+ * Strict wire codec. `create` is the ONLY schema face the `0.1.7-alpha`
+ * `TypertCodec` declares — it materializes the process-realm schema on first
+ * boundary use — and the typert-loader rejects any codec without it. The
+ * older published lines also carried a literal `schema` field on the codec;
+ * that face is gone from the contract, so carrying it here would be dead
+ * weight (and only the `create` factory is ever consulted at run time).
  */
 function strictWire<T>(typeSymbol: string, schema: T) {
-  return Object.freeze({ ...{ mode: 'strict' as const, typeSymbol, schema }, create: () => schema })
+  return Object.freeze({ mode: 'strict' as const, typeSymbol, create: () => schema })
 }
 
 /** The three network policy modes (wire vocabulary). */