dsh-session-messaging 0.1.2 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-10-18
+
+### Added
+
+- A client-side sidebar panel, “Session Messaging”, with:
+  - a cross-directory toggle persisted through the dsh settings form
+    (`sameDirectoryOnly` is now a volatile config field);
+  - an npm update check against the published package;
+  - links to npm, GitHub, and the author's blog.
+
+### Changed
+
+- The `sameDirectoryOnly` config field is volatile, so the panel can edit it
+  at runtime without editing the profile patch by hand.
+
+## [0.2.0] - 2026-10-18
+
+### Changed
+
+- **Cross-directory peers are allowed by default.** `session_peers` and
+  `session_send` now accept sessions whose working directory differs from the
+  sender's. Set `sameDirectoryOnly: true` in the plugin configuration to
+  restore the previous path restriction.
+- The change is a minor release because it changes default delivery behavior:
+  review the peer-content trust boundary before enabling it in shared hosts.
+
+### Tests
+
+- Integration coverage now exercises default cross-directory discovery and
+  delivery, plus an explicit `sameDirectoryOnly: true` policy test.
+
 ## [0.1.2] - 2026-10-18
 
 ### Fixed

package/README.md

@@ -3,11 +3,12 @@
 Cross-session messaging for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh): let **user-launched sessions in the same workspace message each other** to coordinate tasks, declared file-write scopes, and conflicts — without turning them into parent/child subagents.
 
 [![CI](https://github.com/XBXyftx/dsh-session-messaging/actions/workflows/ci.yml/badge.svg)](https://github.com/XBXyftx/dsh-session-messaging/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/dsh-session-messaging.svg)](https://www.npmjs.com/package/dsh-session-messaging)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 **English** | [简体中文](README.zh-CN.md)
 
-> Status: early preview (`0.1.0`). Targets dsh `0.2.1-rc.2`. dsh plugin APIs are pre-stable, so expect breaking changes on upstream upgrades.
+> Status: early preview (`0.2.0`). Targets dsh `0.2.1-rc.2`. dsh plugin APIs are pre-stable, so expect breaking changes on upstream upgrades.
 
 ## Why
 
@@ -39,16 +40,23 @@ Two user-launched sessions used the plugin to coordinate a real fix. One session
 
 See [CHANGELOG.md](CHANGELOG.md) for the `0.1.2` entry.
 
+### Settings panel
+
+![Session Messaging settings panel](docs/assets/panel.webp)
+
+The sidebar entry opens a small panel: toggle cross-directory messaging (persisted through the dsh settings form), check the latest npm version, and open npm, GitHub, or the author's blog. After installing or upgrading the bundle, refresh the Web UI once so the client half joins the module graph.
+
 ## Features
 
 - `session_peers` — list live, same-directory, top-level sessions and their reception state.
 - `session_send` — relay a coordination message, optionally declaring `writeScopes` and replying to a message.
 - `session_reception` — pause/resume receiving peer messages for the current session and declare its write scopes.
+- **Sidebar panel** — a “Session Messaging” entry in the left sidebar with a cross-directory toggle, update check, and author links.
 - Messages appear inline in the target conversation, attributed to the sending session — no separate inbox UI.
 - Advisory **write-scope conflict detection**: if a peer declared an overlapping path, the receipt and the message envelope carry a `conflict-warning`.
 - No new Session event types and no `SESSION_FORMAT_VERSION` change: the relay is a durable `user/message` with a declared `session-message` source.
 - Bilingual plugin-card metadata and icons (English / 简体中文) for the dsh plugin manager.
-- Bounded: message size, per-sender→target rate limit, same-directory scope, top-level-only, live-only, self-send rejected.
+- Bounded: message size, per-sender→target rate limit, top-level-only, live-only, self-send rejected. Cross-directory peers are allowed by default; `sameDirectoryOnly: true` restricts to one working directory.
 
 ## How it works
 
@@ -73,13 +81,21 @@ The envelope always states that the message comes from another session, not the
 
 ## Install
 
+### From npm (recommended)
+
+```sh
+dsh plugin --profile <profile> add dsh-session-messaging
+```
+
+The package is published as [`dsh-session-messaging`](https://www.npmjs.com/package/dsh-session-messaging) (latest `0.3.0`). For library use: `npm install dsh-session-messaging`.
+
 ### From GitHub
 
 ```sh
 dsh plugin --profile <profile> add github:XBXyftx/dsh-session-messaging
 ```
 
-The repository ships the built `lib/` output, so installing from git does **not** run a build. If you prefer a registry, `npm publish` from this repository produces the same package (`dsh-session-messaging`).
+The repository ships the built `lib/` output, so a git install does not run a build.
 
 ### From a local checkout
 
@@ -130,7 +146,7 @@ The bundle row accepts validated configuration; every field has a default:
     maxMessageChars: 4000
     maxMessagesPerMinute: 12
     requireTargetOptIn: false   # sessions are open to peers by default
-    sameDirectoryOnly: true
+    sameDirectoryOnly: false
     allowSelfSend: false
 ```
 
@@ -141,7 +157,7 @@ The bundle row accepts validated configuration; every field has a default:
 - **Same process only.** Discovery uses `ctx.agents`; a session that is not live cannot receive a message in this version. Cold-session delivery and cross-process/cross-host messaging are not implemented.
 - **Advisory scopes, not locks.** dsh has optimistic filesystem version guards (`FS_STALE_VERSION`) but no file locking. `writeScopes` and `conflict-warning` are coordination aids; Bash, formatters, and code generators bypass them.
 - **In-memory state.** Reception pauses and declared scopes live for the plugin's lifetime and reset on reload/restart.
-- **Same working directory by default.** Set `sameDirectoryOnly: false` only if you understand cross-project implications.
+- **Cross-directory by default.** Sessions in different working directories can message each other. Set `sameDirectoryOnly: true` to restore a path boundary; peer content remains untrusted either way.
 - **No GUI extension.** Messages render as ordinary user messages; a dedicated title/icon for the `session-message` source would require a client plugin or an upstream `ui-chat` change.
 
 ## Development

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](README.md) | **简体中文**
 
-> 状态：早期预览（`0.1.0`），适配 dsh `0.2.1-rc.2`。dsh 插件 API 仍为 pre-stable，上游升级可能带来破坏性变更。
+> 状态：早期预览（`0.2.0`），适配 dsh `0.2.1-rc.2`。dsh 插件 API 仍为 pre-stable，上游升级可能带来破坏性变更。
 
 ## 为什么需要
 
@@ -36,16 +36,23 @@ macOS 桌面客户端（`0.2.1-rc.2`）真实运行：另一个用户启动的
 
 `0.1.2` 的变更见 [CHANGELOG.md](CHANGELOG.md)。
 
+### 设置面板
+
+![跨会话消息设置面板](docs/assets/panel.webp)
+
+侧边栏入口打开一个设置面板：切换跨目录消息（通过 dsh 设置表单持久化）、检查 npm 最新版本，并打开 npm / GitHub / 作者博客。安装或升级 bundle 后刷新一次 Web UI，客户端模块才会进入模块图。
+
 ## 功能
 
 - `session_peers`：列出同目录、live 的顶层会话及其接收状态。
 - `session_send`：发送协调消息，可附带 `writeScopes` 与 `replyTo`。
 - `session_reception`：暂停/恢复本会话接收对等消息，并声明写范围。
+- **侧边栏面板**：左侧“跨会话消息”入口，提供跨目录开关、版本更新检查与作者链接。
 - 消息直接内联显示在目标会话中，来源归属于发送会话，不需要独立收件箱。
 - 建议性**写范围冲突检测**：与 peer 声明重叠时，回执与消息信封带 `conflict-warning`。
 - 不新增 Session 事件类型、不改 `SESSION_FORMAT_VERSION`：消息就是带 `session-message` source 的 `user/message`。
 - 插件管理卡片提供中英双语标题、简介与图标（English / 简体中文）。
-- 有边界：长度上限、每 sender→target 限频、同目录、仅顶层、仅 live、拒绝自发送。
+- 有边界：长度上限、每 sender→target 限频、仅顶层、仅 live、拒绝自发送。默认允许跨目录对等会话；`sameDirectoryOnly: true` 可收紧为同工作目录。
 
 ## 工作原理
 
@@ -70,13 +77,21 @@ macOS 桌面客户端（`0.2.1-rc.2`）真实运行：另一个用户启动的
 
 ## 安装
 
+### 从 npm 安装（推荐）
+
+```sh
+dsh plugin --profile <profile> add dsh-session-messaging
+```
+
+包已发布为 [`dsh-session-messaging`](https://www.npmjs.com/package/dsh-session-messaging)（最新 `0.3.0`）。库用法：`npm install dsh-session-messaging`。
+
 ### 从 GitHub 安装
 
 ```sh
 dsh plugin --profile <profile> add github:XBXyftx/dsh-session-messaging
 ```
 
-仓库包含构建好的 `lib/`，从 git 安装**不需要**额外构建。发布到 npm 后也可用包名 `dsh-session-messaging` 安装。
+仓库包含构建好的 `lib/`，从 git 安装不需要额外构建。
 
 ### 本地目录安装
 
@@ -125,7 +140,7 @@ dsh plugin --profile <profile> add /absolute/path/to/dsh-session-messaging
     maxMessageChars: 4000
     maxMessagesPerMinute: 12
     requireTargetOptIn: false   # 默认对 peer 开放
-    sameDirectoryOnly: true
+    sameDirectoryOnly: false
     allowSelfSend: false
 ```
 
@@ -136,7 +151,7 @@ dsh plugin --profile <profile> add /absolute/path/to/dsh-session-messaging
 - **仅同进程**：发现依赖 `ctx.agents`，非 live 会话本版无法接收；冷会话投递与跨进程/跨机器通信未实现。
 - **写范围只是建议，不是锁**：dsh 只有乐观版本守卫（`FS_STALE_VERSION`），没有文件锁；Bash、格式化器、代码生成器会绕过写范围提示。
 - **状态在内存**：暂停接收与写范围声明随插件生命周期存在，重载/重启后重置。
-- **默认同目录**：除非理解跨项目影响，否则不要关闭 `sameDirectoryOnly`。
+- **默认允许跨目录**：不同工作目录的会话也可以互发消息。设置 `sameDirectoryOnly: true` 可恢复路径边界；无论是否限制，peer 内容都不可信。
 - **无 GUI 扩展**：消息按普通 user 消息显示；`session-message` 的专属标题/图标需要 client 插件或上游 `ui-chat` 改动。
 
 ## 开发

package/client/client.js

@@ -0,0 +1,242 @@
+/**
+ * Browser half: a sidebar entry and its panel for session-messaging settings,
+ * update check, and author links. Built as a ModuleLoader factory (see the
+ * dsh plugin UI template); the Host half carries the service and tools.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-session-messaging',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+    const NS = 'session-messaging'
+    const PANEL_ID = 'session-messaging'
+    const PACKAGE_NAME = 'dsh-session-messaging'
+    const FALLBACK_VERSION = '0.3.0'
+    const NPM_URL = 'https://www.npmjs.com/package/dsh-session-messaging'
+    const GITHUB_URL = 'https://github.com/XBXyftx/dsh-session-messaging'
+    const BLOG_URL = 'https://xbxyftx.top'
+
+    const zh = {
+      'panel.label': '跨会话消息',
+      'page.title': '跨会话消息',
+      'page.subtitle': '让同一 Host 内的多个用户会话互相发消息、协调任务与写入范围。',
+      'setting.title': '允许跨工作目录消息',
+      'setting.desc': '开启后，不同工作目录的顶层会话也能互相发现和发送消息。',
+      'setting.unavailable': '设置服务当前不可用，无法在线修改。',
+      'setting.loading': '正在读取配置…',
+      'setting.saveFailed': '保存失败，请重试。',
+      'update.title': '版本更新',
+      'update.checking': '正在检查更新…',
+      'update.upToDate': '已是最新版本',
+      'update.available': '发现新版本',
+      'update.failed': '更新检查失败',
+      'update.button': '检查更新',
+      'author.title': '作者',
+      'author.desc': '由 XBXyftx 开发，MIT 开源。',
+      'links.npm': 'npm',
+      'links.github': 'GitHub',
+      'links.blog': '作者博客',
+    }
+    const en = {
+      'panel.label': 'Session Messaging',
+      'page.title': 'Session Messaging',
+      'page.subtitle': 'Let user-launched sessions in the same Host message each other, coordinate tasks, and declare write scopes.',
+      'setting.title': 'Allow cross-directory messages',
+      'setting.desc': 'When on, top-level sessions in different working directories can discover and message each other.',
+      'setting.unavailable': 'The settings service is unavailable; this value cannot be edited here.',
+      'setting.loading': 'Reading configuration…',
+      'setting.saveFailed': 'Saving failed. Try again.',
+      'update.title': 'Updates',
+      'update.checking': 'Checking for updates…',
+      'update.upToDate': 'Up to date',
+      'update.available': 'Update available',
+      'update.failed': 'Update check failed',
+      'update.button': 'Check for updates',
+      'author.title': 'Author',
+      'author.desc': 'Built by XBXyftx. MIT licensed.',
+      'links.npm': 'npm',
+      'links.github': 'GitHub',
+      'links.blog': 'Blog',
+    }
+
+    const color = {
+      text: 'var(--dsw-alias-label-primary)',
+      secondary: 'var(--dsw-alias-label-secondary)',
+      border: 'var(--dsw-alias-border-l1)',
+      surface: 'var(--dsw-alias-bg-layer-1)',
+      accent: 'var(--dsw-alias-brand-primary)',
+      error: 'var(--dsw-alias-state-error-primary)',
+    }
+    const pageStyle = {
+      display: 'flex', flexDirection: 'column', gap: 16, width: '100%',
+      maxWidth: 760, margin: '0 auto', padding: '28px 32px', boxSizing: 'border-box',
+      color: color.text, overflowY: 'auto',
+    }
+    const cardStyle = {
+      display: 'flex', flexDirection: 'column', gap: 14,
+      background: color.surface, border: `1px solid ${color.border}`,
+      borderRadius: 12, padding: 18,
+    }
+    const rowStyle = { display: 'flex', alignItems: 'center', gap: 16, justifyContent: 'space-between' }
+    const titleStyle = { fontSize: 15, fontWeight: 600, margin: 0, color: color.text }
+    const descStyle = { fontSize: 13, lineHeight: 1.5, margin: '6px 0 0', color: color.secondary }
+    const linkStyle = { color: color.accent, textDecoration: 'none', fontSize: 13 }
+    const buttonStyle = {
+      appearance: 'none', border: `1px solid ${color.border}`, borderRadius: 8,
+      background: 'transparent', color: color.text, padding: '6px 12px',
+      fontSize: 13, cursor: 'pointer',
+    }
+
+    function Icon({ size = 16 }) {
+      return h('svg', {
+        viewBox: '0 0 24 24', width: size, height: size, fill: 'none',
+        stroke: 'currentColor', strokeWidth: 1.8, strokeLinecap: 'round',
+        strokeLinejoin: 'round', 'aria-hidden': true, style: { display: 'block' },
+      },
+      h('path', { d: 'M4 6a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2H8l-4 3z' }),
+      h('path', { d: 'M9 13h9a2 2 0 0 1 2 2v3a2 2 0 0 1-2 2h-2l-3 2v-2h-4a2 2 0 0 1-2-2z' }))
+    }
+
+    function compareVersions(a, b) {
+      const pa = String(a).split('-')[0].split('.').map(Number)
+      const pb = String(b).split('-')[0].split('.').map(Number)
+      for (let i = 0; i < Math.max(pa.length, pb.length); i += 1) {
+        const x = pa[i] ?? 0
+        const y = pb[i] ?? 0
+        if (x !== y) return x - y
+      }
+      return 0
+    }
+
+    function Panel({ t, form, loadCurrentVersion }) {
+      const snapshot = React.useSyncExternalStore(
+        React.useCallback(listener => form.subscribe(listener), [form]),
+        React.useCallback(() => form.getSnapshot(), [form]),
+        React.useCallback(() => form.getSnapshot(), [form]),
+      )
+      const [saving, setSaving] = React.useState(false)
+      const [saveFailed, setSaveFailed] = React.useState(false)
+      const [currentVersion, setCurrentVersion] = React.useState(FALLBACK_VERSION)
+      const [update, setUpdate] = React.useState({ status: 'checking', latest: undefined })
+      const ready = snapshot.status === 'ready'
+      const enabled = (snapshot.value && snapshot.value.sameDirectoryOnly) === true
+
+      const check = React.useCallback(async () => {
+        setUpdate(previous => ({ ...previous, status: 'checking' }))
+        try {
+          const response = await fetch('https://registry.npmjs.org/dsh-session-messaging/latest')
+          if (!response.ok) throw new Error(String(response.status))
+          const data = await response.json()
+          setUpdate({ status: 'done', latest: typeof data.version === 'string' ? data.version : undefined })
+        } catch (_error) {
+          setUpdate({ status: 'failed', latest: undefined })
+        }
+      }, [])
+
+      React.useEffect(() => {
+        let cancelled = false
+        void loadCurrentVersion().then(version => { if (!cancelled) setCurrentVersion(version) })
+        void check()
+        return () => { cancelled = true }
+      }, [check, loadCurrentVersion])
+
+      const toggle = async () => {
+        if (!ready || saving) return
+        setSaving(true)
+        setSaveFailed(false)
+        try {
+          const accepted = await form.set('sameDirectoryOnly', !enabled)
+          if (!accepted) setSaveFailed(true)
+        } catch (_error) {
+          setSaveFailed(true)
+        } finally {
+          setSaving(false)
+        }
+      }
+
+      const newer = update.status === 'done' && update.latest !== undefined
+        && compareVersions(update.latest, currentVersion) > 0
+
+      const settingHint = snapshot.status === 'loading'
+        ? t('setting.loading')
+        : snapshot.status === 'unavailable'
+          ? t('setting.unavailable')
+          : saveFailed ? t('setting.saveFailed') : t('setting.desc')
+
+      return h('div', { style: pageStyle },
+        h('div', null,
+          h('h1', { style: { fontSize: 22, fontWeight: 650, margin: 0 } }, t('page.title')),
+          h('p', { style: { ...descStyle, fontSize: 14, marginTop: 6 } }, t('page.subtitle')),
+        ),
+        h('section', { style: cardStyle },
+          h('div', { style: rowStyle },
+            h('div', null,
+              h('h2', { style: titleStyle }, t('setting.title')),
+              h('p', { style: { ...descStyle, color: saveFailed ? color.error : color.secondary } }, settingHint),
+            ),
+            h('input', {
+              type: 'checkbox', checked: enabled, disabled: !ready || saving,
+              onChange: () => { void toggle() }, 'aria-label': t('setting.title'),
+              style: { width: 18, height: 18, accentColor: color.accent, cursor: ready ? 'pointer' : 'default' },
+            }),
+          ),
+        ),
+        h('section', { style: cardStyle },
+          h('div', { style: rowStyle },
+            h('div', null,
+              h('h2', { style: titleStyle }, t('update.title')),
+              h('p', { style: descStyle },
+                update.status === 'checking' ? t('update.checking')
+                  : update.status === 'failed' ? t('update.failed')
+                    : newer ? `${t('update.available')} · v${update.latest}`
+                      : `${t('update.upToDate')} · v${currentVersion}`),
+            ),
+            h('button', { type: 'button', style: buttonStyle, onClick: () => { void check() }, disabled: update.status === 'checking' },
+              t('update.button')),
+          ),
+          newer ? h('a', { href: NPM_URL, target: '_blank', rel: 'noreferrer', style: linkStyle }, t('links.npm') + ' · v' + update.latest) : null,
+        ),
+        h('section', { style: cardStyle },
+          h('div', { style: rowStyle },
+            h('div', null,
+              h('h2', { style: titleStyle }, t('author.title')),
+              h('p', { style: descStyle }, t('author.desc')),
+            ),
+            h('div', { style: { display: 'flex', gap: 14 } },
+              h('a', { href: NPM_URL, target: '_blank', rel: 'noreferrer', style: linkStyle }, t('links.npm')),
+              h('a', { href: GITHUB_URL, target: '_blank', rel: 'noreferrer', style: linkStyle }, t('links.github')),
+              h('a', { href: BLOG_URL, target: '_blank', rel: 'noreferrer', style: linkStyle }, t('links.blog')),
+            ),
+          ),
+        ),
+      )
+    }
+
+    return {
+      inject: ['slots', 'locale', 'configForms', 'remote', 'remote.pluginManager'],
+      apply(ctx) {
+        const t = ctx.locale.bind(NS)
+        ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-session-messaging: locale')
+        const form = ctx.configForms.get(PANEL_ID)
+
+        const currentVersion = () => ctx.remote.pluginManager.listBundles()
+          .then(rows => {
+            const rowsArray = Array.isArray(rows) ? rows : []
+            const own = rowsArray.find(row => row && row.name === PACKAGE_NAME)
+            return own && typeof own.version === 'string' ? own.version : FALLBACK_VERSION
+          })
+          .catch(() => FALLBACK_VERSION)
+
+        ctx.slots.inject('main', () => ctx.slots.register({
+          name: 'main', key: PANEL_ID, locale: NS,
+          inject: () => ({ t, form, loadCurrentVersion: currentVersion }),
+        }, Panel))
+
+        ctx.slots.inject('sidebar.panellist', () => ctx.slots.register({
+          name: 'sidebar.panellist', id: PANEL_ID, order: 5,
+          label: () => t('panel.label'), locale: NS,
+        }, Icon))
+      },
+    }
+  },
+})

package/lib/config.d.ts

@@ -13,10 +13,32 @@ export interface SessionMessagingConfig {
     readonly maxMessagesPerMinute: number;
     /** Require the target session to opt in before it can receive peer messages. Off by default: sessions are mutually visible and can message each other unless they pause reception. */
     readonly requireTargetOptIn: boolean;
-    /** Only allow peers whose working directory equals the sender's. */
+    /**
+     * Restrict peers to the sender's working directory. Off by default:
+     * cross-directory peers are allowed. Declared volatile so the sidebar panel
+     * can edit it through the dsh settings form.
+     */
     readonly sameDirectoryOnly: boolean;
     /** Allow a session to relay to itself (diagnostics only; off by default). */
     readonly allowSelfSend: boolean;
 }
 /** Schemastery schema for the plugin row's `config` block. */
-export declare const Config: Schema<SessionMessagingConfig>;
+export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    maxMessageChars: Schema<number, number, "defined">;
+    maxMessagesPerMinute: Schema<number, number, "defined">;
+    requireTargetOptIn: Schema<boolean, boolean, "defined">;
+    sameDirectoryOnly: Schema<boolean, boolean, "volatile-defined">;
+    allowSelfSend: Schema<boolean, boolean, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    maxMessageChars: Schema<number, number, "defined">;
+    maxMessagesPerMinute: Schema<number, number, "defined">;
+    requireTargetOptIn: Schema<boolean, boolean, "defined">;
+    sameDirectoryOnly: Schema<boolean, boolean, "volatile-defined">;
+    allowSelfSend: Schema<boolean, boolean, "defined">;
+}>>, "plain">;
+/** Plugin runtime config: volatile fields arrive as stable references. */
+export interface ResolvedSessionMessagingConfig extends Omit<SessionMessagingConfig, 'sameDirectoryOnly'> {
+    readonly sameDirectoryOnly: {
+        get(): boolean;
+    };
+}

package/lib/config.js

@@ -11,6 +11,6 @@ export const Config = Schema.object({
     maxMessageChars: Schema.number().min(1).default(DEFAULT_MAX_MESSAGE_CHARS),
     maxMessagesPerMinute: Schema.number().min(1).default(DEFAULT_MAX_MESSAGES_PER_MINUTE),
     requireTargetOptIn: Schema.boolean().default(false),
-    sameDirectoryOnly: Schema.boolean().default(true),
+    sameDirectoryOnly: Schema.boolean().default(false).volatile(),
     allowSelfSend: Schema.boolean().default(false),
 });

package/lib/service.d.ts

@@ -9,7 +9,7 @@
 import { Service, type Context } from '@deepseek-ai/cordis';
 import type { Agent } from '@deepseek-ai/dsh-agent';
 import { Config } from './config.ts';
-import type { SessionMessagingConfig } from './config.ts';
+import type { ResolvedSessionMessagingConfig } from './config.ts';
 import type { PeerView, SendReceipt, SendRequest } from './protocol.ts';
 /** One session's receive consent and advisory write scopes. */
 interface ConsentEntry {
@@ -31,7 +31,19 @@ declare module '@deepseek-ai/cordis' {
 export declare class SessionMessagingService extends Service {
     static inject: string[];
     /** Loader-read configuration schema; defaults apply when the row omits `config`. */
-    static Config: import("@deepseek-ai/schemastery").default<SessionMessagingConfig>;
+    static Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        maxMessageChars: import("@deepseek-ai/schemastery").default<number, number, "defined">;
+        maxMessagesPerMinute: import("@deepseek-ai/schemastery").default<number, number, "defined">;
+        requireTargetOptIn: import("@deepseek-ai/schemastery").default<boolean, boolean, "defined">;
+        sameDirectoryOnly: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
+        allowSelfSend: import("@deepseek-ai/schemastery").default<boolean, boolean, "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        maxMessageChars: import("@deepseek-ai/schemastery").default<number, number, "defined">;
+        maxMessagesPerMinute: import("@deepseek-ai/schemastery").default<number, number, "defined">;
+        requireTargetOptIn: import("@deepseek-ai/schemastery").default<boolean, boolean, "defined">;
+        sameDirectoryOnly: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
+        allowSelfSend: import("@deepseek-ai/schemastery").default<boolean, boolean, "defined">;
+    }>>, "plain">;
     private readonly config;
     private readonly limiter;
     private readonly consent;
@@ -39,7 +51,7 @@ export declare class SessionMessagingService extends Service {
      * @param ctx - Cordis context with `agents` and `sessions` ready.
      * @param config - validated plugin configuration.
      */
-    constructor(ctx: Context, config: SessionMessagingConfig);
+    constructor(ctx: Context, config: ResolvedSessionMessagingConfig);
     /**
      * List live user-launched peers the caller may address.
      * @param caller - the agent whose tool call is inspecting peers.

package/lib/service.js

@@ -47,7 +47,7 @@ export class SessionMessagingService extends Service {
                 continue;
             if (!isTopLevelSessionHeader(candidate.session.header))
                 continue;
-            if (this.config.sameDirectoryOnly && !sameDirectory(callerDirectory, candidate.session.header.cwd)) {
+            if (this.config.sameDirectoryOnly.get() && !sameDirectory(callerDirectory, candidate.session.header.cwd)) {
                 continue;
             }
             const consent = this.consent.get(candidate.id);
@@ -137,7 +137,7 @@ export class SessionMessagingService extends Service {
         if (!isTopLevelSessionHeader(target.session.header)) {
             throw new MessagingError('target-not-top-level', `session ${targetId} is not a user-launched top-level session`);
         }
-        if (this.config.sameDirectoryOnly && !sameDirectory(caller.session.header.cwd, target.session.header.cwd)) {
+        if (this.config.sameDirectoryOnly.get() && !sameDirectory(caller.session.header.cwd, target.session.header.cwd)) {
             throw new MessagingError('cross-directory', 'the target session works in a different directory');
         }
         const consent = this.consent.get(targetId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-session-messaging",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "Peer messaging between user-launched sessions in one workspace: discover peers, relay coordination messages, pause reception, and get advisory write-scope conflict warnings.",
   "license": "MIT",
   "type": "module",
@@ -15,6 +15,7 @@
       "types": "./lib/tools.d.ts",
       "default": "./lib/tools.js"
     },
+    "./client": "./client/client.js",
     "./locale/*.json": "./locale/*.json",
     "./tools/locale/*.json": "./tools/locale/*.json",
     "./tools/icon": "./assets/tools-icon.svg",
@@ -23,6 +24,7 @@
   },
   "files": [
     "lib",
+    "client",
     "locale",
     "tools/locale",
     "assets",
@@ -77,12 +79,20 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --test tests/protocol.test.ts",
-    "test:integration": "node --experimental-strip-types tests/integration-smoke.ts",
+    "test:integration": "node --experimental-strip-types tests/integration-smoke.ts && node --experimental-strip-types tests/directory-policy-smoke.ts",
     "test:model-e2e": "node --experimental-strip-types tests/model-e2e-smoke.ts"
   },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-layout"
+      ]
     }
   },
   "icon": "./assets/icon.svg",