# Claude Code permission parity for dsh: replace the plain settings provider
# with the five-level settings cascade (settings.json precedence chain), then
# mount the CC permission-rule engine that reads the merged `permissions`
# section from it.

# Swap the in-box settings file provider for the cascade. The incoming cascade
# honours $DSH_HOME/settings.json and the project's .claude settings files;
# it reads config defaults via resolveSpec, so no config rows are needed.
# The disable marker targets the base row BY ID (the loader dup-checks every
# incoming entry, so the insert below must use a distinct id); the remount is
# registered under a unique id and the base row stays disabled to keep it from
# double-mounting.
- id: settings
  disabled: true

# Mount order inside the insert list is registration order: the permission
# engine reads ctx.settings lazily at call time, so either order conforms, but
# keeping the cascade first keeps boot logs readable.
- insert:
    - id: settings-cc
      name: '@dsh-cc/settings-cascade'

    # allow/deny/ask rule engine reading the `permissions` settings namespace.
    # bypass-immune rules ride the monotonic guard layer.
    - id: permission-rules
      name: '@dsh-cc/permission-rules'

    # Host-plane mount of the /permissions command + catalog wrap. The empty
    # host fiber is what dsh-client-modules scans for the popupSelect browser
    # half (preset rows never appear in ctx.loader.entries()). The CC preset
    # still has its own command-permissions row so a composition without this
    # bundle still registers the command.
    - id: command-permissions
      name: '@dsh-cc/command-permissions'