feat(web): permission presets and approval answering for the web UI

The web host now composes the sandboxed product path (sandbox-local +
sandbox-policy behind bash-sandbox/fs-sandbox, with user-approval and
permission on top); BootHostOptions.sandbox carries the deployment
defaults (workspace-write + ask).

createApiProxy owns the approval pending registry: a ctx.approval ask
becomes an answerable approval/requested mux frame with a stable rpcId,
replayed verbatim on every mux open until settled; respond routes by the
echoed rpcId, validates the ApprovalResponsePayload audit correlation,
and broadcasts approval/resolved; the ask's abort signal withdraws the
question as cancelled.

session.permissions / session.setPermission project ctx.permission into
a protocol-owned PermissionOption select; idle switches are held
last-write-wins and
flushed into the next prompted turn (the ACP bridge's anchoring
pattern). The shared hasOpenTurn fold moved to dsh-session,
deduplicating the private copies in user-approval, the ACP bridge, and
the proxy.

Client, per the designer draft: a pending approval takes over the
composer (ApprovalPanel replaces the InputBar — amber strip,
justification headline, paired command, one-shot refuse/allow, keyed by
rpcId so a queued second approval remounts live; the resolved frame
restores the composer); the sidebar session row shows an amber
waiting-approval dot that outranks the running ring (manager-tracked
approvalId set, idempotent under mux-open replays, cleared per
connection generation, lit for uninstantiated sessions too); the
permission selector is a composer bottom-row chip over an invisible
native select, with a presentation-only title-case transform
(workspace-write renders as Workspace Write; wire names untouched). Question placeholders stay in the message flow. The
connection fixture mirrors the host behavior for keyless browser
acceptance.

.agents/notes/implemented/feature/2026-07-23-web-permission-and-approval.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write
+2026-07-23-web-permission-and-approval.md: cd402a039e55e7a24a038055dab5793aa0d08438
+2026-07-23-web-permission-and-approval.zh.md: ce4964789bc94a0962796bb2f5fbf1a94e8f5145

.agents/notes/implemented/feature/2026-07-23-web-permission-and-approval.md

@@ -0,0 +1,33 @@
+# Agent Note: Web UI permission presets and approval answering
+
+Status: implemented
+
+English | [中文](2026-07-23-web-permission-and-approval.zh.md)
+
+## Problem
+
+The web host booted an unconfined agent: `bootHost` composed `dsh-bash-local` and `dsh-fs-local`, so every web session ran with full file access, no approval channel, and no permission control — while the ACP composition had shipped the complete sandboxed product path (sandbox provider + policy home + confined bash/fs + approval + presets) for months. The web wire contract had already reserved the seats — `approval/requested`/`approval/resolved` mux frames, `POST /api/respond` with `ApprovalResponsePayload`, client-side `pendingBuffers` — but the host `respond` was a stub, no answerer bridged `ctx.approval` to the stream, no RPC exposed the permission select, and the PendingCard rendered approvals as visible-but-unanswerable.
+
+## Decision
+
+The web host composes the same sandboxed product path as the acp-agent composition: `dsh-sandbox-local`, `dsh-sandbox-policy`, `dsh-bash-sandbox`, `dsh-fs-sandbox`, `dsh-user-approval`, and `dsh-permission`, with `BootHostOptions.sandbox` supplying the deployment defaults (`mode`, default `workspace-write`; `approvalPolicy`, default `ask`).
+
+`createApiProxy` owns the approval pending registry. Its `approval/request` waterfall answerer reads the approval id from the session's just-appended `approval/asked` audit event (an ask with no audit event is a foreign channel and delegates), mints one stable rpcId per question, broadcasts the answerable `approval/requested` frame to every open mux stream, and replays still-pending frames verbatim on each mux open — the refresh-recovery baseline the contract already promised. `respond` routes by the echoed rpcId, validates `ApprovalResponsePayload` with the existing zod schema, cross-checks the payload's audit correlation against the routed entry, resolves the answerer, and broadcasts `approval/resolved`; the ask's abort signal withdraws the question as `cancelled`.
+
+The permission select rides two new unary RPCs, `session.permissions` and `session.setPermission`, projecting `ctx.permission` into a protocol-owned `PermissionOption` DTO (the ACP bridge precedent: each protocol owns its presentation shape). A permission-less composition serves an empty select and clients hide the control. Idle switches are held last-write-wins in a proxy-side pending map and flushed on `agent/prompt-submit`, because knob events must stay turn-enclosed for durable replay; the shared `hasOpenTurn` fold moved to `dsh-session` and replaced the private copies in `dsh-user-approval`, the ACP bridge, and the proxy.
+
+Client-side, `Session` gained `permissions` and `setPermission`, and approval answering rides the runtime's `PendingWait` carrier. Per the designer draft, a pending approval takes over the composer: `ApprovalPanel` registers as a selector-routed entry of the conversation-declared `conversation.composer` chain (the ui-question pattern), replacing the InputBar with the justification headline, the paired command, and one-shot refuse/allow buttons; the `PendingApproval` domain face in ui-conversation's contract owns the `ApprovalResponsePayload` wire encoding over the carrier, and the broadcast resolved frame settles the wait and restores the composer. Question placeholders stay in the message flow. The sidebar mirrors the blocked state with an amber warning dot that outranks the running ring: the manager tracks per-session outstanding approvalIds (idempotent under mux-open replays, cleared per connection generation so the reopen replay is authoritative) rather than reading Session instances, so the dot lights for sessions never instantiated. The composer's bottom-row chip hosts the `PermissionSelect` control fed through the conversation inject face. The connection fixture mirrors the host: its resident approval is answerable once, and its permission select persists per session.
+
+## Alternatives considered
+
+**Reuse the ACP `session/set_config_option` shape on the web wire.** Rejected: the web contract's unary method registry (`RpcMethodMap` + per-method zod schemas) is its own dialect; a generic config-option surface would bypass the compiler-locked schema table for one select. A dedicated method pair keeps both sides derivable from the signature.
+
+**A session event for pending approvals instead of a proxy-side registry.** Rejected: approval requests are transient interaction state, not durable session data — the `approval/asked`/`decided` audit pair already logs the durable half. Persisting requested frames would re-ask dead questions on replay.
+
+**Registering the answerer only when a mux subscriber exists.** Rejected: the pending entry must survive client disconnects (refresh recovery is the point), so the registry outlives any one stream; a subscriber-gated answerer would fail asks closed during a reload window.
+
+**Optimistic card removal on click.** Rejected: the broadcast resolved frame is the truth; removing on click would hide a question that a rejected receipt or transport failure left standing. The panel disables its buttons locally and re-arms them on failure instead.
+
+## Consequences
+
+Web sessions now start confined (`workspace-write` + `ask` by default) and a sandbox-denial escalation reaches the browser as an answerable card; the deployment can widen or narrow the default through `BootHostOptions.sandbox` without touching the assembly. Question answering shipped separately through the same registry pattern (ui-question over the question pending table). The permission select reads once per mount; live refresh from another client's switch is deferred. Coverage: proxy registry and permission RPC unit suites, session-object and fixture unit suites, and the keyless web smoke exercises the fixture-mode approval answer and preset switch in a real browser.

.agents/notes/implemented/feature/2026-07-23-web-permission-and-approval.zh.md

@@ -0,0 +1,33 @@
+# Agent Note: Web UI 权限预设与审批应答
+
+Status: implemented
+
+[English](2026-07-23-web-permission-and-approval.md) | 中文
+
+## 问题
+
+Web 承载层启动的是一个不受限的 agent（智能体）：`bootHost` 组合了 `dsh-bash-local` 与 `dsh-fs-local`，因此每个 Web 会话都以完整文件访问权限运行，既无审批通道，也无权限管控——而 ACP 组合早在数月前就已交付完整的沙箱化产品路径（沙箱提供方 + 策略归属 + 受限的 bash/fs + 审批 + 预设）。Web 协议契约其实早已预留了对应位置——`approval/requested`/`approval/resolved` 的 mux 帧、携带 `ApprovalResponsePayload` 的 `POST /api/respond`、client 侧的 `pendingBuffers`——但 host 的 `respond` 只是一个 stub，没有应答者把 `ctx.approval` 桥接到流上，没有 RPC 暴露权限选择，PendingCard 把审批渲染成可见却无法应答的样子。
+
+## 决策
+
+Web 承载层组合与 acp-agent 相同的沙箱化产品路径：`dsh-sandbox-local`、`dsh-sandbox-policy`、`dsh-bash-sandbox`、`dsh-fs-sandbox`、`dsh-user-approval` 与 `dsh-permission`，由 `BootHostOptions.sandbox` 提供部署默认值（`mode`，默认 `workspace-write`；`approvalPolicy`，默认 `ask`）。
+
+`createApiProxy` 拥有审批 pending 注册表。它的 `approval/request` waterfall（瀑布式事件）应答者从会话刚追加的 `approval/asked` 审计事件中读取审批 id（没有审计事件的 ask 属于外部通道，予以委托），为每个问题 mint 一个稳定的 rpcId，向每个打开的 mux 流广播可应答的 `approval/requested` 帧，并在每次 mux 打开时原样重放仍处于 pending 的帧——这正是契约早已承诺的刷新恢复基线。`respond` 按回显的 rpcId 路由，用既有的 zod schema 校验 `ApprovalResponsePayload`，将载荷的审计关联与所路由的条目交叉核对，解析应答者，并广播 `approval/resolved`；ask 的中断信号会以 `cancelled` 撤回该问题。
+
+权限选择依托两个新的一元 RPC，`session.permissions` 与 `session.setPermission`，把 `ctx.permission` 投影为一个由协议拥有的 `PermissionOption` DTO（沿用 ACP bridge 的先例：每个协议拥有自己的呈现形状）。无权限的组合提供空的选择项，client 隐藏该控件。空闲期的切换以后写胜出（last-write-wins）的方式保存在 proxy 侧的 pending map 中，并在 `agent/prompt-submit` 时冲刷，因为旋钮事件必须保持轮次内闭合以支持持久回放；共享的 `hasOpenTurn` 折叠迁入 `dsh-session`，取代了 `dsh-user-approval`、ACP bridge 与 proxy 中各自的私有副本。
+
+在 client 侧，`Session` 新增了 `permissions` 与 `setPermission`，审批应答则依托运行时的 `PendingWait` 载体。按照设计师草稿，处于 pending 的审批会接管 composer：`ApprovalPanel` 注册为由会话声明的 `conversation.composer` 链中一个按选择器路由的条目（即 ui-question 模式），以理由标题、配对的命令与一次性的拒绝／允许按钮取代 InputBar；ui-conversation 契约中的 `PendingApproval` 领域面拥有 `ApprovalResponsePayload` 在该载体上的协议编码（wire encoding），广播的 resolved 帧使该等待落定并恢复 composer。问题占位符仍留在消息流中。侧边栏用一枚琥珀色警示圆点同步呈现这一阻塞状态，且其优先级高于表示运行中的圆环：manager 跟踪每个会话尚未解决的 approvalId（对 mux 打开时的回放幂等，并按连接代次清除，以保证重开后的回放才是权威依据），而非读取 Session 实例，因此从未实例化过的会话也能点亮该圆点。composer 底行的 chip 经会话注入面挂载 `PermissionSelect` 控件。连接 fixture（测试前置数据）与 host 保持一致：它的常驻审批可应答一次，其权限选择项按会话持久保存。
+
+## 曾考虑的替代方案
+
+**在 Web 协议上复用 ACP 的 `session/set_config_option` 形状。** 不予采纳：Web 契约的一元方法注册表（`RpcMethodMap` + 逐方法的 zod schema）是它自成一体的方言；一个通用的 config-option 接口会为一个选择项绕开编译期锁定的 schema 表。一对专用方法让两侧都能从签名推导得出。
+
+**用一个会话事件承载 pending 审批，而非 proxy 侧注册表。** 不予采纳：审批请求是瞬态的交互状态，而非持久的会话数据——`approval/asked`/`decided` 审计对已经记录了持久的那一半。持久化 requested 帧会在回放时重新问出已经作废的问题。
+
+**仅在存在 mux 订阅者时才注册应答者。** 不予采纳：pending 条目必须在 client 断连后依然存活（刷新恢复正是要点所在），因此注册表的生命周期长于任何单个流；一个受订阅者门控的应答者，会让在重载窗口期间关闭的 ask 落空。
+
+**点击即乐观移除卡片。** 不予采纳：广播的 resolved 帧才是真相；点击即移除会隐藏一个因拒绝回执或传输失败而仍然悬置的问题。面板改为在本地禁用其按钮，并在失败时重新启用。
+
+## 后果
+
+Web 会话现在从受限状态启动（默认 `workspace-write` + `ask`），一次沙箱拒绝的升级会以可应答的卡片形式抵达浏览器；部署方可以通过 `BootHostOptions.sandbox` 放宽或收紧默认值，无需触动装配。问题应答已通过同一注册表模式单独交付（ui-question 基于问题 pending 表）。权限选择在每次挂载时读取一次；来自另一个 client 切换的实时刷新暂缓实现。覆盖情况：proxy 注册表与权限 RPC 的单元测试套件、会话对象与 fixture 的单元测试套件，以及无密钥 Web 冒烟测试在真实浏览器中演练 fixture 模式的审批应答与预设切换。

apps/web/tests/smoke-fixture.e2e.ts

@@ -280,9 +280,45 @@ describe('web boot chain success pass (keyless, nine real bundles, ?fixture)', (
     await composer.getByRole('checkbox', { name: 'Agent 产品判断' }).press('Enter')
 
     await composer.waitFor({ state: 'detached' })
+    // The composer does not fall back to the InputBar yet: fx-alpha's resident
+    // approval is still pending, so the approval takeover elects next (the
+    // approval scenario below answers it and watches the InputBar return).
+    await page.locator('[data-approval-key]').waitFor({ state: 'visible', timeout: 10_000 })
+  })
+
+  it('answers the composer-takeover approval panel; the InputBar returns on the resolved frame', async () => {
+    onTestFailed(() => saveFailureShot(page, 'smoke-approval-answer'))
+    // fx-alpha carries the resident pending approval; the session is already
+    // selected by the previous scenario. With the question settled, the
+    // approval owns the composer slot — no textarea is mounted.
+    const panel = page.locator('[data-approval-key]')
+    await panel.waitFor({ state: 'visible', timeout: 10_000 })
+    expect(await panel.getByText('等待审批').count()).toBe(1)
+    expect(await page.locator('textarea').count()).toBe(0)
+    // Sidebar mirrors the blocked state: the session row shows the amber
+    // warning dot in place of the running ring.
+    expect(await page.locator('[role="treeitem"] [data-state="warning"]').count()).toBeGreaterThan(0)
+    await panel.getByRole('button', { name: '允许一次' }).click()
+    // The broadcast resolved frame removes the panel and restores the
+    // composer; the sidebar dot clears with it.
+    await panel.waitFor({ state: 'detached', timeout: 5000 })
     const restoredInput = page.locator('textarea[placeholder]')
-    await restoredInput.waitFor()
+    await restoredInput.waitFor({ state: 'visible', timeout: 5000 })
     expect(await restoredInput.getAttribute('placeholder')).toBe('回复生成中，可停止后再输入')
+    await expect.poll(() => page.locator('[role="treeitem"] [data-state="warning"]').count(), { timeout: 5000 }).toBe(0)
+  })
+
+  it('switches the permission preset through the composer select', async () => {
+    onTestFailed(() => saveFailureShot(page, 'smoke-permission-select'))
+    const select = page.locator('select').filter({ hasText: 'Workspace Write' }).first()
+    await select.waitFor({ state: 'visible', timeout: 10_000 })
+    expect(await select.inputValue()).toBe('workspace-write')
+    await select.selectOption('danger-full-access')
+    // The control disables during the round trip and adopts the confirmed
+    // value; host-side persistence across re-reads is covered by the fixture
+    // unit suite (fixture.spec.ts permissions/setPermission).
+    await expect.poll(() => select.inputValue(), { timeout: 5000 }).toBe('danger-full-access')
+    await expect.poll(() => select.isDisabled(), { timeout: 5000 }).toBe(false)
   })
 
   it('stayed clean: no page errors across the whole load chain', () => {

docs/config-catalog.md

@@ -1719,7 +1719,7 @@ export interface Config {
 export type ApprovalPolicy = 'ask' | 'never'
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:198`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:183`](../packages/ui/user-approval/src/index.ts)
 
 ## `@deepseek-ai/dsh-web`
 

docs/cordis-catalog/events.md

@@ -420,7 +420,7 @@ Ask composed answerers for one decision. Return an outcome to claim the request
 
 Types: [ApprovalOutcome](../core-data-structures/approval.md) · [ApprovalRequest](../core-data-structures/approval.md) · [ApprovalService](../core-data-structures/approval.md) · [Scoped](../core-data-structures/scope.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:30`](../../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:31`](../../packages/ui/user-approval/src/index.ts)
 
 ## `commands/*`
 
@@ -572,7 +572,7 @@ Creation announcement during session publication. A synchronous throw vetoes and
 
 Types: [Scoped](../core-data-structures/scope.md) · [Session](../core-data-structures/session.md)
 
-Source: [`packages/core/session/src/index.ts:79`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:98`](../../packages/core/session/src/index.ts)
 
 ### `session/disposed` — emit
 
@@ -593,7 +593,7 @@ Emitted once when an announced session leaves the store, including publication r
 
 Types: [Scoped](../core-data-structures/scope.md) · [Session](../core-data-structures/session.md)
 
-Source: [`packages/core/session/src/index.ts:89`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:108`](../../packages/core/session/src/index.ts)
 
 ### `session/event` — emit
 
@@ -616,7 +616,7 @@ Post-commit, fire-and-forget append feed. The listener snapshot resolves before
 
 Types: [Scoped](../core-data-structures/scope.md) · [Session](../core-data-structures/session.md) · [SessionEvent](../core-data-structures/core.md)
 
-Source: [`packages/core/session/src/index.ts:101`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:120`](../../packages/core/session/src/index.ts)
 
 ### `session/flush` — parallel
 
@@ -637,7 +637,7 @@ Awaited parallel durability checkpoint: every listener runs and the caller await
 
 Types: [Scoped](../core-data-structures/scope.md) · [Session](../core-data-structures/session.md)
 
-Source: [`packages/core/session/src/index.ts:111`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:130`](../../packages/core/session/src/index.ts)
 
 ## `subagent/*`
 

docs/cordis-catalog/services.md

@@ -246,7 +246,7 @@ async request(req: ApprovalRequest): Promise<ApprovalOutcome>
 
 Types: [ApprovalOutcome](../core-data-structures/approval.md) · [ApprovalRequest](../core-data-structures/approval.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:213`](../../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:198`](../../packages/ui/user-approval/src/index.ts)
 
 ## `ctx.bash` — `BashExecutor` (abstract seam)
 
@@ -1246,7 +1246,7 @@ fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId):
 
 Types: [CreateSessionOptions](../core-data-structures/persistence.md) · [OutOfBandSessionEventType](../core-data-structures/session.md) · [Session](../core-data-structures/session.md) · [SessionEvent](../core-data-structures/core.md) · [SessionEventMap](../core-data-structures/session.md) · [SessionId](../core-data-structures/core.md) · [TurnTrigger](../core-data-structures/session.md)
 
-Source: [`packages/core/session/src/index.ts:605`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:624`](../../packages/core/session/src/index.ts)
 
 ## `ctx.sessionTitle` — `SessionTitleService`
 

docs/event-producer-consumer.md

@@ -14,7 +14,7 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `agent/error` | `emit` | [`packages/core/agent/src/types.ts:365`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`goal-session`](../packages/goal/goal-session), `runtime`, [`tui`](../packages/ui/tui) |
 | `agent/post-step` | `serial` | [`packages/core/agent/src/types.ts:315`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy) |
 | `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:246`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`time-context`](../packages/context/time-context), [`user-approval`](../packages/ui/user-approval) |
-| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:262`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`goal-session`](../packages/goal/goal-session), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`plan-mode`](../packages/plan/plan-mode), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) |
+| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:262`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`goal-session`](../packages/goal/goal-session), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`plan-mode`](../packages/plan/plan-mode), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), `runtime` |
 | `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:207`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`goal-session`](../packages/goal/goal-session), [`tui`](../packages/ui/tui) |
 | `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:276`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`agent`](../packages/core/agent) |
 | `agent/request-error` | `waterfall` | [`packages/core/agent/src/types.ts:330`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`compact-basic`](../packages/compact/compact-basic), [`llm-retry`](../packages/llm/llm-retry), [`plan-mode`](../packages/plan/plan-mode) |
@@ -24,17 +24,17 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:303`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - |
 | `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:341`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`plan-mode`](../packages/plan/plan-mode) |
 | `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:352`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess), [`tool-goal`](../packages/goal/tool-goal) |
-| `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:30`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) |
+| `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:31`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp), `runtime` |
 | `commands/change` | `emit` | [`packages/ui/commands/src/index.ts:103`](../packages/ui/commands/src/index.ts) | [`commands`](../packages/ui/commands) (`events.dispatch`) | [`acp`](../packages/ui/acp), [`tui`](../packages/ui/tui) |
 | `fs/edit-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:62`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `fs/observed` | `emit` | [`packages/fs/fs/src/index.ts:71`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`emit`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `fs/write-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:54`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `goal/changed` | `emit` | [`packages/goal/goal/src/types.ts:167`](../packages/goal/goal/src/types.ts) | [`goal`](../packages/goal/goal) (`emit`) | [`goal-session`](../packages/goal/goal-session) |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:52`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`agent-loop`](../packages/core/agent-loop), [`llm`](../packages/llm/llm), [`llm-replay`](../packages/support/llm-replay), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy), [`session-title`](../packages/session-title/session-title) |
-| `session/created` | `emit` | [`packages/core/session/src/index.ts:79`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`compact`](../packages/compact/compact), [`goal`](../packages/goal/goal), [`hook-protocol`](../packages/hooks/hook-protocol), [`jsonrpc`](../packages/ui/jsonrpc), [`llm-retry`](../packages/llm/llm-retry), `runtime`, [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`user-approval`](../packages/ui/user-approval) |
-| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:89`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`agent-loop`](../packages/core/agent-loop), `runtime`, [`session-persistence`](../packages/session-persistence/session-persistence), [`session-title`](../packages/session-title/session-title) |
-| `session/event` | `emit` | [`packages/core/session/src/index.ts:101`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`acp`](../packages/ui/acp), [`cli-demo`](../packages/examples/cli-demo), [`compact`](../packages/compact/compact), [`goal`](../packages/goal/goal), [`goal-session`](../packages/goal/goal-session), [`hook-protocol`](../packages/hooks/hook-protocol), [`jsonrpc`](../packages/ui/jsonrpc), `runtime`, [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`session-title`](../packages/session-title/session-title), [`token-meter`](../packages/llm/token-meter), [`tui`](../packages/ui/tui), [`user-approval`](../packages/ui/user-approval), [`workspace-context`](../packages/context/workspace-context) |
-| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:111`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`session-persistence`](../packages/session-persistence/session-persistence) |
+| `session/created` | `emit` | [`packages/core/session/src/index.ts:98`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`compact`](../packages/compact/compact), [`goal`](../packages/goal/goal), [`hook-protocol`](../packages/hooks/hook-protocol), [`jsonrpc`](../packages/ui/jsonrpc), [`llm-retry`](../packages/llm/llm-retry), `runtime`, [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`user-approval`](../packages/ui/user-approval) |
+| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:108`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`agent-loop`](../packages/core/agent-loop), `runtime`, [`session-persistence`](../packages/session-persistence/session-persistence), [`session-title`](../packages/session-title/session-title) |
+| `session/event` | `emit` | [`packages/core/session/src/index.ts:120`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`acp`](../packages/ui/acp), [`cli-demo`](../packages/examples/cli-demo), [`compact`](../packages/compact/compact), [`goal`](../packages/goal/goal), [`goal-session`](../packages/goal/goal-session), [`hook-protocol`](../packages/hooks/hook-protocol), [`jsonrpc`](../packages/ui/jsonrpc), `runtime`, [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`session-title`](../packages/session-title/session-title), [`token-meter`](../packages/llm/token-meter), [`tui`](../packages/ui/tui), [`user-approval`](../packages/ui/user-approval), [`workspace-context`](../packages/context/workspace-context) |
+| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:130`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`session-persistence`](../packages/session-persistence/session-persistence) |
 | `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:139`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`jsonrpc`](../packages/ui/jsonrpc), [`subagent`](../packages/subagent/subagent) |
 | `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:113`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`subagent`](../packages/subagent/subagent), [`tool-subagent`](../packages/subagent/tool-subagent) |
 | `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:119`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`subagent`](../packages/subagent/subagent), [`tool-subagent`](../packages/subagent/tool-subagent) |

docs/persistence-catalog.md

@@ -106,7 +106,7 @@ Sources: [`packages/core/session/src/types.ts:317`](../packages/core/session/src
 
 Types: [CallId](core-data-structures/core.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:44`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:45`](../packages/ui/user-approval/src/index.ts)
 
 #### `approval/decided` — log-only
 
@@ -122,7 +122,7 @@ Source: [`packages/ui/user-approval/src/index.ts:44`](../packages/ui/user-approv
 }
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:55`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:56`](../packages/ui/user-approval/src/index.ts)
 
 #### `approval/policy` — log-only
 
@@ -138,7 +138,7 @@ Source: [`packages/ui/user-approval/src/index.ts:55`](../packages/ui/user-approv
 'approval/policy': { policy: ApprovalPolicy }
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:67`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:68`](../packages/ui/user-approval/src/index.ts)
 
 ### `assistant/*`
 

packages/client/connection/src/client/api.ts

@@ -7,7 +7,7 @@
 
 export type {
   ApiProxy, SessionsApi, SessionSummary, HostApi, EventsApi, MuxFrame, HostFrame,
-  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView,
+  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, PermissionOption, ToolEventView,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
 export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
 export type {

packages/client/connection/src/client/fixture.ts

@@ -299,10 +299,19 @@ export function createFixtureApi(): ApiProxy {
   let nextSession = 1
   let nextRpc = 1
   const mint = (): ReturnType<typeof RpcId> => RpcId(`fx-rpc-${nextRpc++}`)
-  /** Resident pending approval (stable rpcId: every mux open replays the same id, matching host replay semantics). */
+  /** Resident pending approval (stable rpcId: every mux open replays the same id while unanswered, matching host replay semantics). */
   const pendingApprovalRpcId = mint()
+  const pendingApprovalId = 'fx-approval-1' as Extract<MuxFrame, { type: 'approval/requested' }>['approvalId']
+  /** Cleared once answered through respond; replay stops and approval/resolved is broadcast. */
+  let approvalPending = true
   const pendingQuestionRpcId = mint()
   let questionPending = true
+  /** Per-session permission preset (fixture mirror of the host permission select). */
+  const permissionValues = new Map<SessionId, string>()
+  const PERMISSION_OPTIONS = [
+    { value: 'workspace-write', name: 'workspace-write', description: 'Write inside the workspace and permitted temporary directories; wider retries require approval.' },
+    { value: 'danger-full-access', name: 'danger-full-access', description: 'Full file access without approval prompts.' },
+  ]
   const fixtureQuestions: Extract<MuxFrame, { type: 'question/requested' }>['questions'] = [
     {
       id: 'harness-profile',
@@ -522,6 +531,24 @@ export function createFixtureApi(): ApiProxy {
         }
         return ok(request, { accepted: true as const })
       },
+      permissions: (request) => {
+        const { sessionId: id } = request.payload
+        if (summaryOf(id) === undefined) {
+          return err(request, { code: 'session-not-found', message: `no session ${id}`, details: { sessionId: id } })
+        }
+        return ok(request, { options: PERMISSION_OPTIONS, currentValue: permissionValues.get(id) ?? 'workspace-write' })
+      },
+      setPermission: (request) => {
+        const { sessionId: id, value } = request.payload
+        if (summaryOf(id) === undefined) {
+          return err(request, { code: 'session-not-found', message: `no session ${id}`, details: { sessionId: id } })
+        }
+        if (!PERMISSION_OPTIONS.some(option => option.value === value)) {
+          return err(request, { code: 'bad-request', message: `unknown permission value ${JSON.stringify(value)}`, details: { issues: [] } })
+        }
+        permissionValues.set(id, value)
+        return ok(request, { currentValue: value })
+      },
     },
     host: {
       describe: request => ok(request, { version: '0.0.0-fixture', cwd: '/tmp/fixture', attachedSessions: 1 }),
@@ -539,14 +566,16 @@ export function createFixtureApi(): ApiProxy {
           const title = titleFrameOf(s.sessionId, logs.get(s.sessionId) ?? [])
           if (title !== undefined) conn.push({ rpcId: mint(), payload: title })
         }
-        conn.push({
-          rpcId: pendingApprovalRpcId,
-          payload: {
-            type: 'approval/requested', sessionId: sid('fx-alpha'),
-            approvalId: 'fx-approval-1' as MuxFrame extends never ? never : Extract<MuxFrame, { type: 'approval/requested' }>['approvalId'],
-            toolName: 'dangerous_tool', reason: 'fixture 常驻占位审批（可见不可答）',
-          },
-        })
+        if (approvalPending) {
+          conn.push({
+            rpcId: pendingApprovalRpcId,
+            payload: {
+              type: 'approval/requested', sessionId: sid('fx-alpha'),
+              approvalId: pendingApprovalId,
+              toolName: 'dangerous_tool', reason: 'fixture 常驻审批（可答：批准/拒绝后消失）',
+            },
+          })
+        }
         if (questionPending) {
           conn.push({
             rpcId: pendingQuestionRpcId,
@@ -584,6 +613,19 @@ export function createFixtureApi(): ApiProxy {
       },
     },
     respond(message: ClientResponse): Promise<RpcReceipt> {
+      // Same routing discipline as the host: rpcId first, then the payload's
+      // audit correlation; a settled or unknown id is not-pending.
+      if (message.rpcId === pendingApprovalRpcId) {
+        if (!approvalPending) return Promise.resolve({ accepted: false, reason: 'not-pending' })
+        if (!message.result.ok) return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        const value = message.result.value as { approvalId?: unknown; outcome?: unknown }
+        if (value.approvalId !== pendingApprovalId || (value.outcome !== 'allowed-once' && value.outcome !== 'rejected')) {
+          return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        }
+        approvalPending = false
+        emitMux({ type: 'approval/resolved', sessionId: sid('fx-alpha'), approvalId: pendingApprovalId, outcome: value.outcome })
+        return Promise.resolve({ accepted: true })
+      }
       if (!questionPending || message.rpcId !== pendingQuestionRpcId) {
         return Promise.resolve({ accepted: false, reason: 'not-pending' })
       }
@@ -633,6 +675,8 @@ export class FixtureApiClient extends AbstractApiClient {
       case 'session.history': return this.api.sessions.history(request)
       case 'session.prompt': return this.api.sessions.prompt(request)
       case 'session.cancel': return this.api.sessions.cancel(request)
+      case 'session.permissions': return this.api.sessions.permissions(request)
+      case 'session.setPermission': return this.api.sessions.setPermission(request)
       case 'host.describe': return this.api.host.describe(request)
     }
   }

packages/client/connection/src/client/index.ts

@@ -15,7 +15,7 @@ import { WebApiClient } from './web-api-client.ts'
 // ---- Contract re-exports (browser-safe apiproxy channels + core types) ----
 export type {
   ApiProxy, SessionsApi, SessionSummary, HostApi, EventsApi, MuxFrame, HostFrame,
-  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView,
+  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, PermissionOption, ToolEventView,
   ToolCallView, ToolResultView,
   RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode,
   ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt,

packages/client/connection/tests/fake-api.ts

@@ -49,6 +49,12 @@ export class FakeApiClient implements IApiClient {
 
   onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
   onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onPermissions: (payload: unknown) =>
+  Promise<RpcResponse<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> =
+    () => Promise.resolve(ok({ options: [], currentValue: 'custom' }))
+
+  onSetPermission: (payload: { sessionId: SessionId; value: string }) => Promise<RpcResponse<{ currentValue: string }>> =
+    payload => Promise.resolve(ok({ currentValue: payload.value }))
   onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
     () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))
 
@@ -65,6 +71,8 @@ export class FakeApiClient implements IApiClient {
       this.record('session.history', payload, this.onHistory(payload)),
     prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
     cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
+    permissions: (payload: unknown) => this.record('session.permissions', payload, this.onPermissions(payload)),
+    setPermission: (payload: { sessionId: SessionId; value: string }) => this.record('session.setPermission', payload, this.onSetPermission(payload)),
   }
 
   readonly host: IApiClient['host'] = {

packages/client/connection/tests/fixture.spec.ts

@@ -255,6 +255,61 @@ describe('createFixtureApi', () => {
     })).toEqual({ accepted: true })
   })
 
+  it('respond answers the resident approval once: routing, validation, resolved broadcast, then not-pending', async () => {
+    const api = createFixtureApi()
+    // Discover the resident approval's stable rpcId from the mux baseline.
+    const abort = new AbortController()
+    const seen: { rpcId: string; frame: MuxFrame }[] = []
+    const consuming = (async () => {
+      for await (const envelope of api.events.mux(req({}), abort.signal)) seen.push({ rpcId: envelope.rpcId, frame: envelope.payload })
+    })()
+    await vi.waitFor(() => {
+      expect(seen.some(s => s.frame.type === 'approval/requested')).toBe(true)
+    })
+    const requested = seen.find(s => s.frame.type === 'approval/requested')
+    if (requested === undefined || requested.frame.type !== 'approval/requested') throw new Error('unreachable')
+    const approvalId = requested.frame.approvalId
+
+    // Routed but malformed answers.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: false, error: { code: 'internal', message: 'x', details: {} } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { approvalId: 'wrong', outcome: 'rejected' } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { approvalId, outcome: 'maybe' } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // The real answer settles the question and broadcasts resolved.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { sessionId: sid('fx-alpha'), approvalId, outcome: 'allowed-once' } } }))
+      .toEqual({ accepted: true })
+    await vi.waitFor(() => {
+      expect(seen.some(s => s.frame.type === 'approval/resolved' && s.frame.outcome === 'allowed-once')).toBe(true)
+    })
+    // Settled: a duplicate answer is late, and a fresh mux open replays nothing.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { sessionId: sid('fx-alpha'), approvalId, outcome: 'rejected' } } }))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+    await consuming
+    const abort2 = new AbortController()
+    const replayed = await collect(api.events.mux(req({}), abort2.signal), abort2, frames => frames.length === 2)
+    expect(replayed.some(f => f.type === 'approval/requested')).toBe(false)
+  })
+
+  it('permissions/setPermission mirror the host select: read, switch, validation', async () => {
+    const api = createFixtureApi()
+    const read = await api.sessions.permissions(req({ sessionId: sid('fx-alpha') }))
+    expect(read.result).toMatchObject({ ok: true, value: { currentValue: 'workspace-write' } })
+    const switched = await api.sessions.setPermission(req({ sessionId: sid('fx-alpha'), value: 'danger-full-access' }))
+    expect(switched.result).toMatchObject({ ok: true, value: { currentValue: 'danger-full-access' } })
+    const reread = await api.sessions.permissions(req({ sessionId: sid('fx-alpha') }))
+    expect(reread.result).toMatchObject({ ok: true, value: { currentValue: 'danger-full-access' } })
+    // Validation: ghost session and unknown value.
+    const ghostRead = await api.sessions.permissions(req({ sessionId: sid('fx-ghost') }))
+    expect(ghostRead.result.ok).toBe(false)
+    const ghostSwitch = await api.sessions.setPermission(req({ sessionId: sid('fx-ghost'), value: 'workspace-write' }))
+    expect(ghostSwitch.result.ok).toBe(false)
+    const unknown = await api.sessions.setPermission(req({ sessionId: sid('fx-alpha'), value: 'nope' }))
+    expect(unknown.result.ok).toBe(false)
+  })
+
   it('describe answers the fixture identity', async () => {
     const api = createFixtureApi()
     const response = await api.host.describe(req({}))
@@ -345,6 +400,8 @@ describe('FixtureApiClient (protocol-level fake carrier)', () => {
     expect((await client.sessions.history({ sessionId: id })).result.ok).toBe(true)
     expect((await client.sessions.prompt({ sessionId: id, mode: 'queue', content: [{ type: 'text', text: '嗨' }] })).result.ok).toBe(true)
     expect((await client.sessions.cancel({ sessionId: id })).result.ok).toBe(true)
+    expect((await client.sessions.permissions({ sessionId: id })).result.ok).toBe(true)
+    expect((await client.sessions.setPermission({ sessionId: id, value: 'danger-full-access' })).result.ok).toBe(true)
     expect((await client.host.describe({})).result.ok).toBe(true)
   })
 

packages/client/runtime/src/client/index.ts

@@ -38,7 +38,15 @@ export type {
 // PendingWait is a value export: tests construct fixture waits directly.
 export { PendingWait } from './sessions/pending.ts'
 export type { PendingInteraction, PendingKind, PendingPayloads } from './sessions/pending.ts'
-export type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
+export type { PermissionOption, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+
+/** The permission select material as the object layer serves it to UI plugins. */
+export interface PermissionSelect {
+  /** Switchable presets plus (when derived) the current-only `custom`. */
+  options: { value: string; name: string; description?: string }[]
+  /** The effective current value (`custom` when knobs match no preset). */
+  currentValue: string
+}
 
 // ---- Narrowed aliases (the single narrowing point of the slot type chain:
 // ui-slots/web-react stay generic and dependency-inverted; the client-tree

packages/client/runtime/src/client/sessions/lineage.ts

@@ -9,7 +9,7 @@ export interface TitledSessionSummary extends SessionSummary {
   title?: string
 }
 
-/** One flattened session-list row (summary + lineage indent depth). */
+/** One flattened session-list row (summary + lineage indent depth + live pending-approval bit). */
 export interface SessionListEntry {
   sessionId: SessionId
   title?: string
@@ -17,6 +17,8 @@ export interface SessionListEntry {
   running: boolean
   parentSessionId?: SessionId
   cwd?: string
+  /** An approval question is pending on this session (mux-frame derived; the sidebar's amber dot). */
+  waitingApproval: boolean
   /** Lineage indent depth: root = 0; the UI just multiplies by the indent width. */
   depth: number
 }
@@ -25,9 +27,10 @@ export interface SessionListEntry {
  * summaries -> flat list with lineage indentation (pure; roots by updatedAt
  * desc, DFS children in the same order, orphans degrade to roots).
  * @param summaries - the host's session.list items.
+ * @param waitingApproval - sessions with a pending approval question (manager-owned live fact; absent = false).
  * @returns display rows in render order.
  */
-export function flattenLineage(summaries: readonly TitledSessionSummary[]): SessionListEntry[] {
+export function flattenLineage(summaries: readonly TitledSessionSummary[], waitingApproval?: ReadonlySet<SessionId>): SessionListEntry[] {
   const byId = new Map<SessionId, TitledSessionSummary>()
   for (const s of summaries) byId.set(s.sessionId, s)
 
@@ -54,7 +57,7 @@ export function flattenLineage(summaries: readonly TitledSessionSummary[]): Sess
       return
     }
     visited.add(s.sessionId)
-    out.push({ ...s, depth })
+    out.push({ ...s, waitingApproval: waitingApproval?.has(s.sessionId) ?? false, depth })
     const kids = children.get(s.sessionId)
     if (kids === undefined) return
     kids.sort(byUpdatedDesc)

packages/client/runtime/src/client/sessions/manager.ts

@@ -36,6 +36,11 @@ export class SessionManager {
    *  drop-and-backfill path; replayed and cleared on instantiation. Bounded per session (these
    *  frames are low-frequency; overflow drops oldest) and dropped on session-removed (audit S7). */
   private readonly pendingBuffers = new Map<SessionId, RpcRequest<MuxFrame>[]>()
+  /** Outstanding approval questions per session, keyed by approvalId (idempotent under mux-open
+   *  replays of the same requested frame). Manager-owned rather than read off Session instances
+   *  because the sidebar must light up for sessions never instantiated. Cleared per connection
+   *  generation — the reopen replay re-adds still-pending questions — and on session-removed. */
+  private readonly waitingApprovals = new Map<SessionId, Set<string>>()
   private readonly titleSnapshots = new Map<SessionId, SessionTitleSnapshot>()
   private summaries: SessionSummary[] = []
   private listState: 'idle' | 'loading' | 'error' = 'idle'
@@ -186,6 +191,22 @@ export class SessionManager {
         this.notifier.markDirty()
       }
     }
+    // List-level waiting-approval bit (the sidebar amber dot): tracked here for
+    // every session, instantiated or not; approvalId keys make replays idempotent.
+    if (frame.type === 'approval/requested') {
+      let ids = this.waitingApprovals.get(frame.sessionId)
+      if (ids === undefined) this.waitingApprovals.set(frame.sessionId, ids = new Set())
+      if (!ids.has(frame.approvalId)) {
+        ids.add(frame.approvalId)
+        this.notifier.markDirty()
+      }
+    } else if (frame.type === 'approval/resolved') {
+      const ids = this.waitingApprovals.get(frame.sessionId)
+      if (ids !== undefined && ids.delete(frame.approvalId)) {
+        if (ids.size === 0) this.waitingApprovals.delete(frame.sessionId)
+        this.notifier.markDirty()
+      }
+    }
     const session = this.sessions.get(frame.sessionId)
     if (session === undefined) {
       // Approval/question frames never hit history: buffer for replay on instantiation;
@@ -232,6 +253,7 @@ export class SessionManager {
         this.summaries = this.summaries.filter(s => s.sessionId !== frame.sessionId)
         this.sessions.get(frame.sessionId)?.handleRemoved() // instance survives (resident-instance rule), only flagged in the snapshot
         this.pendingBuffers.delete(frame.sessionId) // a removed session's buffered frames must not replay on a future instantiation
+        this.waitingApprovals.delete(frame.sessionId) // a removed session cannot wait on anyone
         this.titleSnapshots.delete(frame.sessionId)
         this.notifier.markDirty()
         return
@@ -254,6 +276,12 @@ export class SessionManager {
 
   /** After each connection generation (first connect included): refresh the list + resync opened instances (reconnect = rebuild). */
   handleConnected(): void {
+    // Approvals resolved while disconnected send no frame: drop the bits and
+    // let the mux-open replay re-add every still-pending question.
+    if (this.waitingApprovals.size > 0) {
+      this.waitingApprovals.clear()
+      this.notifier.markDirty()
+    }
     void this.refreshList()
     for (const session of this.sessions.values()) void session.resync()
   }
@@ -265,13 +293,14 @@ export class SessionManager {
         ? summary
         : { ...summary, title: title.title, updatedAt: Math.max(summary.updatedAt, title.updatedAt) }
     })
-    const fresh = flattenLineage(merged)
+    const fresh = flattenLineage(merged, new Set(this.waitingApprovals.keys()))
     const items = fresh.map((entry) => {
       const prev = this.entryCache.get(entry.sessionId)
       if (
         prev !== undefined && prev.updatedAt === entry.updatedAt && prev.running === entry.running
         && prev.parentSessionId === entry.parentSessionId && prev.cwd === entry.cwd
         && prev.title === entry.title && prev.depth === entry.depth
+        && prev.waitingApproval === entry.waitingApproval
       ) return prev
       this.entryCache.set(entry.sessionId, entry)
       return entry

packages/client/runtime/src/client/sessions/service.ts

@@ -32,6 +32,8 @@ export interface SessionSummary {
   cwd?: string
   parentId?: SessionId
   running: boolean
+  /** An approval question is pending on this session (sidebar amber-dot state). */
+  waitingApproval: boolean
   updatedAt: number
 }
 
@@ -310,6 +312,7 @@ export class SessionsService {
         id: entry.sessionId,
         displayTitle: displayTitleOf(entry.title, entry.cwd, entry.sessionId),
         running: entry.running,
+        waitingApproval: entry.waitingApproval,
         updatedAt: entry.updatedAt,
         ...(entry.title !== undefined ? { title: entry.title } : {}),
         ...(entry.cwd !== undefined ? { cwd: entry.cwd } : {}),

packages/client/runtime/src/client/sessions/session.ts

@@ -128,6 +128,31 @@ export class Session implements ObservableSnapshot<ConversationSnapshot> {
     return result
   }
 
+  /**
+   * Read the permission select (options + effective current value).
+   * @returns the select material, or the error branch on failure.
+   */
+  async permissions(): Promise<RpcResult<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> {
+    try {
+      return (await this.api.sessions.permissions({ sessionId: this.sessionId })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
+  /**
+   * Switch the permission preset.
+   * @param value - a preset value advertised by {@link Session.permissions} (never `custom`).
+   * @returns the confirmed current value, or the error branch on failure.
+   */
+  async setPermission(value: string): Promise<RpcResult<{ currentValue: string }>> {
+    try {
+      return (await this.api.sessions.setPermission({ sessionId: this.sessionId, value })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
   /** First open: pull the tail page (idempotent — in-flight/already-open returns the existing promise). */
   open(): Promise<void> {
     if (this.openState === 'open') return Promise.resolve()

packages/client/runtime/tests/fake-api.ts

@@ -52,6 +52,13 @@ export class FakeApiClient implements IApiClient {
 
   onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
   onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onPermissions: (payload: unknown) =>
+  Promise<RpcResponse<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> =
+    () => Promise.resolve(ok({ options: [], currentValue: 'custom' }))
+
+  onSetPermission: (payload: { sessionId: SessionId; value: string }) => Promise<RpcResponse<{ currentValue: string }>> =
+    payload => Promise.resolve(ok({ currentValue: payload.value }))
+
   onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
     () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))
 
@@ -68,6 +75,8 @@ export class FakeApiClient implements IApiClient {
       this.record('session.history', payload, this.onHistory(payload)),
     prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
     cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
+    permissions: (payload: unknown) => this.record('session.permissions', payload, this.onPermissions(payload)),
+    setPermission: (payload: { sessionId: SessionId; value: string }) => this.record('session.setPermission', payload, this.onSetPermission(payload)),
   }
 
   readonly host: IApiClient['host'] = {

packages/client/runtime/tests/manager.spec.ts

@@ -281,3 +281,42 @@ describe('connected generation', () => {
     })
   })
 })
+
+describe('waiting-approval list bit', () => {
+  it('lights on requested, survives replay duplicates, and clears on resolved — without instantiation', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    // Mux-open replay of the same question (same approvalId) is idempotent.
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleMuxEnvelope({ rpcId: 'rx' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'ap1' as never, outcome: 'allowed-once' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+  })
+
+  it('clears only when the last outstanding question resolves; session-removed drops the bit', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    manager.handleMuxEnvelope({ rpcId: 'r1' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a1' as never, toolName: 'rm' } })
+    manager.handleMuxEnvelope({ rpcId: 'r2' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a2' as never, toolName: 'rm' } })
+    manager.handleMuxEnvelope({ rpcId: 'rx' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'a1' as never, outcome: 'rejected' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleMuxEnvelope({ rpcId: 'ry' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'a2' as never, outcome: 'rejected' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+    // Removed sessions drop their bit outright.
+    manager.handleMuxEnvelope({ rpcId: 'r3' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a3' as never, toolName: 'rm' } })
+    manager.handleHostEnvelope({ rpcId: 'h2' as never, payload: { type: 'host/session-removed', sessionId: S1 } })
+    expect(manager.getListSnapshot().items).toHaveLength(0)
+  })
+
+  it('drops stale bits on reconnect — the reopen replay re-adds still-pending questions', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleConnected() // resolved-while-disconnected questions send no frame
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+  })
+})

packages/client/runtime/tests/session.spec.ts

@@ -669,3 +669,27 @@ describe('reference stability (the memo contract)', () => {
     expect(resolved.pending).toBe(after.pending)
   })
 })
+
+describe('permissions / setPermission', () => {
+  it('passes the select read and switch through with the session id', async () => {
+    const { api, session } = makeSession()
+    api.onPermissions = () => Promise.resolve(ok({ options: [{ value: 'workspace-write', name: 'workspace-write' }], currentValue: 'workspace-write' }))
+    const read = await session.permissions()
+    expect(read.ok).toBe(true)
+    if (read.ok) expect(read.value.currentValue).toBe('workspace-write')
+    expect(api.callsOf('session.permissions')).toMatchObject([{ sessionId: SID }])
+
+    const switched = await session.setPermission('danger-full-access')
+    expect(switched.ok).toBe(true)
+    if (switched.ok) expect(switched.value.currentValue).toBe('danger-full-access')
+    expect(api.callsOf('session.setPermission')).toMatchObject([{ sessionId: SID, value: 'danger-full-access' }])
+  })
+
+  it('folds transport failures into the error branch', async () => {
+    const { api, session } = makeSession()
+    api.onPermissions = () => Promise.reject(new Error('down'))
+    api.onSetPermission = () => Promise.reject(new Error('down'))
+    expect((await session.permissions()).ok).toBe(false)
+    expect((await session.setPermission('x')).ok).toBe(false)
+  })
+})

packages/client/ui-conversation/README.md

@@ -4,6 +4,8 @@ Conversation domain: skeleton (header/tabs/composer/empty state), chat view (gro
 
 The view ring IS a slot: the conversation registration declares the `'conversation.view'` list slot (session scope) in its `children` table, ConversationRoot renders the active entry through its renderSlot share (`only: <active id>`), and view tabs project from the ring ledger's registration options (`id`/`order`/`label`). The chat view is this package's own ring entry; other plugins (ui-trajectory) contribute tabs through plain `ctx.slots.register` — the former package-local view registry (`registerView`/`ViewEntry`/`ConversationViewMap` and the chrome attachment table) is retired, with per-view chrome dissolved into the view components themselves.
 
+Approvals take over the composer through the chain this package declares: `ApprovalPanel` registers as a selector-routed `'conversation.composer'` entry (the ui-question pattern) and occupies the composer in place of the InputBar while an approval wait is pending (amber strip, justification headline, paired command line from the running call's args, one-shot refuse/allow). The `PendingApproval` domain face in `contract/slots.ts` owns the wire encoding — the `ApprovalResponsePayload` value with the audit correlation — over the runtime's `PendingWait` carrier; the broadcast `approval/resolved` frame settles the wait and restores the composer. The sidebar mirrors the blocked state: the session row's amber warning dot (a manager-tracked `waitingApproval` list bit, lit for uninstantiated sessions too) outranks the running ring until the question resolves. Question placeholders remain in the message flow as display-only PendingCards while ui-question owns the answering takeover. The composer's bottom-row chip mounts the permission-preset select (`PermissionSelect`), fed by the injected `permissions`/`setPermission` callbacks over the object layer's session RPCs; empty options (a permission-less host) hide the control, and the derived `custom` value renders as current-only.
+
 Generic tool rows classify the built-in bash, read, search, write, and edit names into dedicated visual variants. The filesystem variants render the edit icon and `Write · <path>` or `Edit · <path>` summary while retaining the shared row-to-details interaction.
 
 Tool rows are slots too — the standalone tool ring (`ToolViewRegistry`/`ctx.toolviews`/outlet) is retired. The chat entry declares the keyed `'conversation.chat.toolview'` hole (session scope; the key space is runtime-open); its render site dispatches per row via `entryKey: toolName` with `GenericToolCard` as the call-site `fallback`. The owner payload is the uniform `ToolRowOwnerProps` (`callId`/`toolName`/`block`/`openDetails`) and `ToolRowProps` pre-composes it with the session standard kit. A registrant is a plain plugin: `ctx.slots.register({ name: 'conversation.chat.toolview', key: '<tool>', inject? }, Row)` with `inject: ['slots', 'conversation']` as the load-order seam (apply mounts ConversationService after the chat registration, so the service being present guarantees the slot is declared); session differentiation happens inside the component (`useSessions` reading `parentId` — the bash sample is the third-party-posture exemplar). Trajectory/waterfall toolview slots share this shape and land with their own render sites (RendersCheck rejects a declaration nobody renders).
@@ -26,4 +28,5 @@ None; this package neither assembles nor sends a provider request.
 - **Details panel is the minimal form** — selected call args/result raw display; the Input/Output/Metadata switch, Prev/Next stepping, and See-in-trajectory deep link are deferred.
 - **Assistant footer extensions (IconActions row, per-message paging) are reserved slots** — drawn in the design, not implemented.
 - **The sparkle icon for the others tool row is a hand-drawn approximation** — the design glyph's vector geometry is not exportable locally; promotion into ui-primitives waits on an exact export.
-- **Approval cards are display-only placeholders** — question requests answer through the composer chain (ui-question), while web-side approval answering is the P-II approvals project.
+- **The permission select reads once per mount** — a host-side preset change from another client surfaces only after a session re-select; live knob-event-driven refresh is deferred.
+- **The approval panel's "Always allow this type" is deferred** — durable grants need a grant-storage design; only allow-once/reject answer today.

packages/client/ui-conversation/src/client/apply.ts

@@ -15,12 +15,13 @@ import type { SessionId, SessionsService } from '@deepseek-ai/dsh-client-runtime
 import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type { ViewTab } from './contract/views.ts'
 import type {
-  ChatViewInjected, ConversationInjected, DetailsInjected, EmptyStateInjected,
+  ApprovalWait, ChatViewInjected, ComposerChainProps, ConversationInjected, DetailsInjected, EmptyStateInjected,
 } from './contract/slots.ts'
 import { createChatStore } from './stores.ts'
 import { ConversationService } from './service.ts'
 import { ChatView } from './chat/ChatView.tsx'
 import { bashToolviewSample } from './toolviews/bash-sample.tsx'
+import { ApprovalPanel } from './skeleton/ApprovalPanel.tsx'
 import { ConversationRoot } from './skeleton/ConversationRoot.tsx'
 import { DetailsPanel } from './skeleton/DetailsPanel.tsx'
 import { EmptyState } from './skeleton/EmptyState.tsx'
@@ -37,6 +38,11 @@ function scopedConversation(sessions: SessionsService, id: SessionId): Conversat
   return conversation
 }
 
+/** Chain routing: claim the composer while an approval wait is pending (pure — owner props only). */
+function selectApproval({ interactions }: ComposerChainProps): ApprovalWait | null {
+  return interactions.find((i): i is ApprovalWait => i.kind === 'approval') ?? null
+}
+
 /**
  * Client plugin body.
  * @param ctx - client root context.
@@ -104,10 +110,31 @@ export function apply(ctx: Context): void {
           })
         },
         open: (target: SessionId) => { sessions.open(target) },
+        permissions: async () => {
+          const result = await sessions.manager.get(sessionId).permissions()
+          // Empty options = permission-less host composition: hide the control
+          // rather than show an empty select (deployment shape, not an error).
+          if (!result.ok || result.value.options.length === 0) return null
+          return result.value
+        },
+        setPermission: async (value) => {
+          const result = await sessions.manager.get(sessionId).setPermission(value)
+          return result.ok ? result.value.currentValue : null
+        },
       }
     },
   }, ConversationRoot)
 
+  // The approval takeover: a selector-routed entry of the chain this package
+  // just declared (the ui-question registration pattern; the entry lives here
+  // because approval answering is core conversation UX, not an optional tool).
+  // Zero business face — data and verbs both ride the matched carrier.
+  // priority 1: question takeovers (default 0) win when both kinds are
+  // pending — a question is a conversation the model is waiting on, while an
+  // approval only blocks one tool call; answering the question first cannot
+  // strand the approval (it re-elects the moment the question resolves).
+  slots.register({ name: 'conversation.composer', select: selectApproval, priority: 1 }, ApprovalPanel)
+
   // The chat view: first entry of the ring this package just declared.
   // Declaring the keyed toolview hole here is claiming it: ChatView is the
   // only component authorized to render per-tool rows. Shares the chat

packages/client/ui-conversation/src/client/chat/ChatView.tsx

@@ -254,7 +254,9 @@ export function ChatView({ useSession, useStore, renderSlot, openDetails, loadOl
             ))}
           </div>
         )}
-        {pending.map((item) => <PendingCard key={item.key} item={item} />)}
+        {/* Approvals take over the composer (ApprovalPanel); only question
+            placeholders remain in the flow. */}
+        {pending.filter((item) => item.kind === 'question').map((item) => <PendingCard key={item.key} item={item} />)}
         </div>
       </div>
       <StatsLine useSession={useSession} />

packages/client/ui-conversation/src/client/chat/PendingCard.module.css

@@ -1,4 +1,4 @@
-/* Amber pending strip (approval waiting = warn semantic, figma state colors). */
+/* Amber pending strip (question waiting = warn semantic, figma state colors). */
 
 .card {
   margin: 6px 0;
@@ -13,19 +13,3 @@
   font-weight: 500;
   color: var(--dsw-alias-label-primary);
 }
-
-.mono {
-  font-family: var(--ds-font-family-code);
-}
-
-.reason {
-  margin-top: 4px;
-  font-size: 12px;
-  color: var(--dsw-alias-label-secondary);
-}
-
-.hint {
-  margin-top: 6px;
-  font-size: 11px;
-  color: var(--dsw-alias-label-tertiary);
-}

packages/client/ui-conversation/src/client/chat/PendingCard.tsx

@@ -1,6 +1,7 @@
-// PendingCard: approval/question placeholder card (visible, not answerable —
-// the composer-takeover approval panel is a P-II item; wire pending semantics
-// already exist so the flow must show them).
+// PendingCard: question pending placeholder in the message flow (visible
+// while the question composer owns the takeover slot elsewhere). Approvals
+// do not render here: they take over the composer (skeleton ApprovalPanel)
+// per the designer draft.
 
 import { memo } from 'react'
 import type { PendingInteraction } from '@deepseek-ai/dsh-client-runtime/client'
@@ -8,24 +9,14 @@ import { JsonBlock } from '@deepseek-ai/dsh-client-ui-primitives'
 import css from './PendingCard.module.css'
 
 export interface PendingCardProps {
-  item: PendingInteraction
+  item: Extract<PendingInteraction, { kind: 'question' }>
 }
 
 export const PendingCard = memo(function PendingCard({ item }: PendingCardProps) {
   return (
     <div className={css.card}>
-      {item.kind === 'approval' ? (
-        <>
-          <div className={css.title}>等待审批：<span className={css.mono}>{item.payload.toolName}</span></div>
-          {item.payload.reason !== undefined && <div className={css.reason}>{item.payload.reason}</div>}
-        </>
-      ) : (
-        <>
-          <div className={css.title}>等待回答（{item.payload.questions.length} 题）</div>
-          <JsonBlock label="问题内容" payload={item.payload.questions} />
-        </>
-      )}
-      <div className={css.hint}>请在原客户端处理（web 端作答后续里程碑提供）</div>
+      <div className={css.title}>等待回答（{item.payload.questions.length} 题）</div>
+      <JsonBlock label="问题内容" payload={item.payload.questions} />
     </div>
   )
 })

packages/client/ui-conversation/src/client/contract/slots.ts

@@ -11,7 +11,7 @@
  * here.
  */
 import type { PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
-import type { PendingInteraction, SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
+import type { PendingInteraction, PendingWait, PermissionSelect, SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
 import type { createChatStore } from '../stores.ts'
 import type { CallId, SelectionTarget, ViewTab } from './views.ts'
 
@@ -113,6 +113,10 @@ export interface ConversationInjected {
   stop(): void
   /** Navigate to another session (breadcrumb ancestors). */
   open(id: SessionId): void
+  /** Read the permission select (options + effective current value); null hides the control. */
+  permissions(): Promise<PermissionSelect | null>
+  /** Switch the permission preset; resolves the confirmed value, or null on failure (caller keeps the old value). */
+  setPermission(value: string): Promise<string | null>
 }
 
 /**
@@ -132,6 +136,68 @@ export type ConversationSlotProps =
   PropsRuntime<'conversation'> & PropsRenderSlots<'conversation.view' | 'conversation.composer'>
   & PropsStore<ChatStore> & ConversationInjected
 
+/** The pending approval carrier the owner dispatches into the composer chain. */
+export type ApprovalWait = PendingWait<'approval'>
+
+/**
+ * Approval domain face over the carrier (the ui-question PendingQuestion
+ * pattern): render identity and question material forwarded transparently;
+ * answer owns the wire encoding — the ApprovalResponsePayload value shape
+ * with the audit correlation the host reconciles — and turns a rejected
+ * carrier receipt into a thrown error. Minted per carrier via useMemo.
+ */
+export class PendingApproval {
+  /**
+   * @param wait - the runtime carrier for one pending approval question.
+   */
+  constructor(private readonly wait: ApprovalWait) {}
+
+  /** Opaque render identity (React key / one-shot latch remount axis), forwarded from the carrier. */
+  get key(): string {
+    return this.wait.key
+  }
+
+  /** The tool the question is about (headline fallback), forwarded from the carrier payload. */
+  get toolName(): string {
+    return this.wait.payload.toolName
+  }
+
+  /** The asker's human-readable WHY (headline when present), forwarded from the carrier payload. */
+  get reason(): string | undefined {
+    return this.wait.payload.reason
+  }
+
+  /** The paired tool call's id when the ask names one (command-line lookup key), forwarded from the carrier payload. */
+  get callId(): string | undefined {
+    return this.wait.payload.callId
+  }
+
+  /**
+   * Deliver the user's decision; a rejected carrier receipt throws. Panel
+   * removal stays frame-driven: the broadcast `approval/resolved` settles the
+   * wait and drops it from the pending list.
+   * @param outcome - the only two client-answerable outcomes.
+   */
+  async answer(outcome: 'allowed-once' | 'rejected'): Promise<void> {
+    const receipt = await this.wait.respond({
+      ok: true,
+      value: { sessionId: this.wait.sessionId, approvalId: this.wait.payload.approvalId, outcome },
+    })
+    if (!receipt.accepted) {
+      throw new Error(`approval response rejected: ${receipt.reason}`)
+    }
+  }
+}
+
+/**
+ * Full approval-composer props: the framework runtime share (chain currency +
+ * session/global standard kit) plus the chain `matched` share — the entry's
+ * selector result, already narrowed to the approval carrier. No injected
+ * share: the carrier plus the domain face above carry the whole behavior
+ * surface; the paired command line derives from useSession in-component.
+ */
+export type ApprovalComposerProps = PropsRuntime<'conversation.composer'> & { matched: ApprovalWait }
+
 /**
  * Injected share of the chat view entry: the two callbacks whose targets live
  * outside the view (layout orchestration; the session object layer).

packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.module.css

@@ -0,0 +1,107 @@
+/* Composer-takeover approval panel (draft approval.png): the same floating
+   capsule footprint as the InputBar card, with an amber header band, the
+   justification headline, a muted command line, and right-aligned actions.
+   Warn semantics ride the alias state tokens; no hardcoded colors. */
+
+/* Mirrors InputBar .root so the takeover is a content swap, not a layout jump. */
+.root {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 8px 32px 12px;
+}
+
+.card {
+  overflow: hidden;
+  width: 100%;
+  max-width: 776px;
+  border: 1px solid var(--dsw-alias-state-warn-secondary);
+  border-radius: 20px;
+  background: var(--dsw-specific-input-major);
+  box-shadow: var(--dsw-shadow-lv2);
+}
+
+/* Tinted full-width header band. */
+.strip {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 16px;
+  background: var(--dsw-alias-state-warn-tertiary);
+  color: var(--dsw-alias-state-warn-primary);
+  font-size: 13px;
+  line-height: 18px;
+}
+
+.dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--dsw-alias-state-warn-primary);
+}
+
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  padding: 12px 16px 14px;
+}
+
+/* The model's justification is the panel's message, not a footnote. */
+.headline {
+  color: var(--dsw-alias-label-primary);
+  font-size: 15px;
+  font-weight: 500;
+  line-height: 24px;
+}
+
+.command {
+  color: var(--dsw-alias-label-tertiary);
+  font-family: var(--ds-font-family-code);
+  font-size: 13px;
+  line-height: 20px;
+  word-break: break-all;
+}
+
+.actionRow {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 8px;
+}
+
+.allow,
+.reject {
+  padding: 6px 16px;
+  border-radius: 10px;
+  font-size: 13px;
+  line-height: 18px;
+  cursor: pointer;
+}
+
+.allow:disabled,
+.reject:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+
+/* Primary action: filled ink (draft's rightmost emphasis, minus the dropped
+   always-allow button). */
+.allow {
+  border: none;
+  background: var(--dsw-alias-label-primary);
+  color: var(--dsw-alias-label-primary-foreground);
+}
+
+/* Secondary: quiet outline. */
+.reject {
+  border: 1px solid var(--dsw-alias-border-l2-darkmode-thin);
+  background: transparent;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.reject:hover:not(:disabled) {
+  background: var(--dsw-alias-interactive-bg-hover-danger);
+  color: var(--dsw-alias-state-error-primary);
+  border-color: transparent;
+}

packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.tsx

@@ -0,0 +1,71 @@
+// ApprovalPanel: the composer-takeover approval prompt (designer draft
+// approval.png), registered as a selector-routed entry of the
+// conversation-declared composer chain. While an approval question is
+// pending, this panel occupies the composer slot in place of the InputBar:
+// an amber "Waiting for approval" strip on the card top, the model's
+// justification as the headline, the paired command in muted code text, and
+// a right-aligned refuse/allow action row. One-shot: the buttons disable
+// after a click and the panel leaves (the InputBar returns) on the broadcast
+// resolved frame. The draft's "Always allow this type" is deferred with
+// grant storage.
+
+import { useMemo, useState } from 'react'
+import type { RunningToolCall } from '@deepseek-ai/dsh-client-runtime/client'
+import { PendingApproval, type ApprovalComposerProps } from '../contract/slots.ts'
+import css from './ApprovalPanel.module.css'
+
+/** Extract the shell command from an approval's paired running call (bash-family args carry `command`); undefined hides the line. */
+export function commandOf(call: RunningToolCall | undefined): string | undefined {
+  if (call === undefined) return undefined
+  try {
+    const args = JSON.parse(call.argsRaw) as Record<string, unknown>
+    return typeof args.command === 'string' ? args.command : undefined
+  } catch {
+    // Unparseable model args: the panel still renders, just without the command line.
+    return undefined
+  }
+}
+
+/**
+ * Composer takeover boundary: mints the domain face on the carrier's stable
+ * identity and remounts the flow per request key, so the one-shot answered
+ * latch never leaks to the next pending approval.
+ * @param props - the selector-matched pending approval carrier plus the framework standard kit.
+ * @returns The approval prompt for this request.
+ */
+export function ApprovalPanel(props: ApprovalComposerProps) {
+  const approval = useMemo(() => new PendingApproval(props.matched), [props.matched])
+  const command = props.useSession(s => commandOf(
+    approval.callId === undefined ? undefined : s.runningCalls.find(call => call.callId === approval.callId)))
+  return <ApprovalFlow key={approval.key} pending={approval} {...command === undefined ? {} : { command }} />
+}
+
+function ApprovalFlow({ pending, command }: { pending: PendingApproval; command?: string }) {
+  // Local one-shot latch: the panel leaves only when the resolved frame
+  // lands; until then the buttons must not re-fire. An answer failure
+  // (rejected receipt / transport) re-arms them for retry.
+  const [answered, setAnswered] = useState(false)
+  const answer = (outcome: 'allowed-once' | 'rejected'): void => {
+    setAnswered(true)
+    void pending.answer(outcome).catch(() => { setAnswered(false) })
+  }
+  return (
+    <div className={css.root} data-approval-key={pending.key}>
+      <div className={css.card}>
+        <div className={css.strip}><span className={css.dot} />等待审批</div>
+        <div className={css.body}>
+          <div className={css.headline}>{pending.reason ?? `工具 ${pending.toolName} 请求越权执行`}</div>
+          {command !== undefined && <div className={css.command}>{command}</div>}
+          <div className={css.actionRow}>
+            <button type="button" className={css.reject} disabled={answered} onClick={() => { answer('rejected') }}>
+              拒绝
+            </button>
+            <button type="button" className={css.allow} disabled={answered} onClick={() => { answer('allowed-once') }}>
+              允许一次
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}

packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx

@@ -15,6 +15,7 @@ import type { SessionId, SessionListState, SessionSummary } from '@deepseek-ai/d
 import type { ConversationSlotProps } from '../contract/slots.ts'
 import { InputBar } from './InputBar.tsx'
 import type { InputBarError } from './InputBar.tsx'
+import { PermissionSelect } from './PermissionSelect.tsx'
 import css from './ConversationRoot.module.css'
 
 /** Full props = the automatic shares & injected share — composed by reference
@@ -38,7 +39,7 @@ function deriveAncestry(list: SessionListState, id: SessionId): readonly Session
 
 export function ConversationRoot({
   sessionId, useSession, useSessions, useStore, actions, renderSlot, renderSlotChain,
-  views, send, stop, open,
+  views, send, stop, open, permissions, setPermission,
 }: ConversationRootProps) {
   useSyncExternalStore(views.subscribe, views.version)
   const tabs = views.list()
@@ -68,6 +69,7 @@ export function ConversationRoot({
       disabled={removed}
       error={error}
       variant="composer"
+      controls={<PermissionSelect permissions={permissions} setPermission={setPermission} />}
       onDraftChange={actions.setDraft}
       onSend={(mode) => { send(draft, mode) }}
       onStop={stop}

packages/client/ui-conversation/src/client/skeleton/InputBar.tsx

@@ -30,6 +30,8 @@ export interface InputBarProps {
   placeholder?: string
   /** Optional leading accessory row above the textarea (kept for callers; empty state no longer uses it). */
   accessory?: ReactNode
+  /** Host-wired access-mode control (the composer mounts the permission chip here); replaces the visual-only placeholder. */
+  controls?: ReactNode
   onDraftChange: (text: string) => void
   onSend: (mode: 'queue' | 'steer') => void
   onStop: () => void
@@ -56,7 +58,7 @@ const MODEL_OPTIONS: readonly SelectOption[] = [
 ]
 
 export function InputBar({
-  draft, running, disabled, error, variant, placeholder, accessory, onDraftChange, onSend, onStop,
+  draft, running, disabled, error, variant, placeholder, accessory, controls, onDraftChange, onSend, onStop,
 }: InputBarProps) {
   const empty = draft.trim() === ''
   const inputRef = useRef<HTMLTextAreaElement | null>(null)
@@ -177,7 +179,8 @@ export function InputBar({
             </button>
             <div className={css.modes}>
               {renderSelect('Plan mode', planId, PLAN_OPTIONS, setPlanId)}
-              {renderSelect('Access mode', readonlyId, READONLY_OPTIONS, setReadonlyId)}
+              {/* The wired permission chip supersedes the visual-only Access placeholder. */}
+              {controls ?? renderSelect('Access mode', readonlyId, READONLY_OPTIONS, setReadonlyId)}
             </div>
           </div>
           <div className={css.trailing}>

packages/client/ui-conversation/src/client/skeleton/PermissionSelect.module.css

@@ -0,0 +1,49 @@
+/* Composer bottom-row permission chip (draft start.jpeg `Read-only ∨`): a
+   quiet text chip with a chevron; hover paints the standard interactive pill.
+   The native select is stretched invisibly over the chip so the platform
+   dropdown does the menu work — keyboard/AT semantics come free. */
+
+.root {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+}
+
+.chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 6px 8px;
+  border-radius: 8px;
+  color: var(--dsw-alias-label-secondary);
+  font-size: 14px;
+  line-height: 20px;
+  pointer-events: none; /* the overlaid select owns the interaction */
+}
+
+.root:hover .chip {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.chevron {
+  color: var(--dsw-alias-label-caption);
+}
+
+/* Invisible native select stretched over the chip: real menu, zero drawing. */
+.select {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  opacity: 0;
+  border: none;
+  cursor: pointer;
+}
+
+.select:disabled {
+  cursor: default;
+}
+
+.root:has(.select:disabled) .chip {
+  opacity: 0.5;
+}

packages/client/ui-conversation/src/client/skeleton/PermissionSelect.tsx

@@ -0,0 +1,88 @@
+// PermissionSelect: the composer bottom-row permission chip (draft
+// start.jpeg's `Read-only ∨` control). Options and the current value load on
+// mount from the injected permissions() callback; empty options
+// (permission-less host composition) render nothing. The visible chip is
+// presentation only — an invisible native select stretched over it owns the
+// menu and interaction. A switch disables the control until the host
+// confirms, then adopts the confirmed value (`custom` is shown as the current
+// value but never offered as a target — the host already omits it from
+// switchable options; a stale-select failure restores the previous value).
+
+import { useEffect, useRef, useState } from 'react'
+import type { PermissionSelect as PermissionSelectData } from '@deepseek-ai/dsh-client-runtime/client'
+import css from './PermissionSelect.module.css'
+
+/**
+ * Display transform: kebab-case machine names render as title-case labels
+ * (`workspace-write` → `Workspace Write`). Presentation-only — the wire
+ * vocabulary and the host's advertised names are untouched; a host-configured
+ * name that is not kebab-case (contains spaces or uppercase) passes through.
+ */
+function displayName(name: string): string {
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) return name
+  return name.split('-').map(word => word.charAt(0).toUpperCase() + word.slice(1)).join(' ')
+}
+
+export interface PermissionSelectProps {
+  /** Read the select material; null hides the control. */
+  permissions: () => Promise<PermissionSelectData | null>
+  /** Switch the preset; resolves the confirmed value, or null on failure. */
+  setPermission: (value: string) => Promise<string | null>
+}
+
+export function PermissionSelect({ permissions, setPermission }: PermissionSelectProps) {
+  const [data, setData] = useState<PermissionSelectData | null>(null)
+  const [switching, setSwitching] = useState(false)
+  // Unmount guard: the load/switch promises outlive a session switch's remount.
+  const aliveRef = useRef(true)
+  useEffect(() => {
+    aliveRef.current = true
+    void permissions().then((loaded) => {
+      if (aliveRef.current) setData(loaded)
+    })
+    return () => {
+      aliveRef.current = false
+    }
+  }, [permissions])
+
+  if (data === null) return null
+
+  const onChange = (value: string): void => {
+    if (value === data.currentValue) return
+    setSwitching(true)
+    const previous = data
+    setData({ ...data, currentValue: value })
+    void setPermission(value).then((confirmed) => {
+      if (!aliveRef.current) return
+      setSwitching(false)
+      if (confirmed === null) setData(previous)
+      else setData({ ...previous, currentValue: confirmed })
+    })
+  }
+
+  const current = data.options.find(option => option.value === data.currentValue)
+
+  return (
+    <label className={css.root} title={current?.description}>
+      <span className={css.chip}>
+        {displayName(current?.name ?? data.currentValue)}
+        <svg className={css.chevron} viewBox="0 0 12 12" width="12" height="12" aria-hidden>
+          <path d="M3 4.5L6 7.5L9 4.5" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" fill="none" />
+        </svg>
+      </span>
+      <select
+        className={css.select}
+        aria-label="权限策略"
+        value={data.currentValue}
+        disabled={switching}
+        onChange={(e) => { onChange(e.target.value) }}
+      >
+        {data.options.map(option => (
+          <option key={option.value} value={option.value} disabled={option.value === 'custom'}>
+            {displayName(option.name)}
+          </option>
+        ))}
+      </select>
+    </label>
+  )
+}

packages/client/ui-conversation/tests/apply-inject.spec.tsx

@@ -61,6 +61,10 @@ async function bench() {
       () => Promise.resolve({ ok: true, value: { accepted: true } })),
     cancel: vi.fn<() => Promise<{ ok: boolean; value?: object; error?: { code: string; message: string } }>>(
       () => Promise.resolve({ ok: true, value: { accepted: true } })),
+    permissions: vi.fn<() => Promise<{ ok: boolean; value?: { options: { value: string; name: string }[]; currentValue: string }; error?: { code: string; message: string } }>>(
+      () => Promise.resolve({ ok: true, value: { options: [{ value: 'workspace-write', name: 'workspace-write' }], currentValue: 'workspace-write' } })),
+    setPermission: vi.fn<() => Promise<{ ok: boolean; value?: { currentValue: string }; error?: { code: string; message: string } }>>(
+      () => Promise.resolve({ ok: true, value: { currentValue: 'danger-full-access' } })),
   }
   const scopes = new Map<SessionId, Context>()
   const mint = (id: SessionId): Context => {
@@ -143,6 +147,32 @@ describe('conversation slot inject surface', () => {
     expect(b.sessionFake.loadOlder).toHaveBeenCalledTimes(1)
   })
 
+  it('permissions/setPermission thread the object layer; empty options and failures fold to null', async () => {
+    const b = await bench()
+    const { injected } = b.conversationSurface(ROOT)
+    expect(await injected.permissions()).toMatchObject({ currentValue: 'workspace-write' })
+    expect(await injected.setPermission('danger-full-access')).toBe('danger-full-access')
+    // Empty options (permission-less host) and the error branch both hide the control.
+    b.sessionFake.permissions.mockResolvedValueOnce({ ok: true, value: { options: [], currentValue: 'custom' } })
+    expect(await injected.permissions()).toBeNull()
+    b.sessionFake.permissions.mockResolvedValueOnce({ ok: false, error: { code: 'internal', message: 'x' } })
+    expect(await injected.permissions()).toBeNull()
+    b.sessionFake.setPermission.mockResolvedValueOnce({ ok: false, error: { code: 'bad-request', message: 'x' } })
+    expect(await injected.setPermission('nope')).toBeNull()
+  })
+
+  it('registers the approval takeover on the composer chain: routing selector, no inject face', async () => {
+    const b = await bench()
+    const entry = b.slots.entries('conversation.composer')[0]!
+    expect(entry.inject).toBeUndefined()
+    // The selector narrows the chain currency: approval wait in → that wait; none → null.
+    const select = entry.select as (owner: { interactions: readonly { kind: string }[] }) => unknown
+    const approval = { kind: 'approval' }
+    expect(select({ interactions: [{ kind: 'question' }, approval] })).toBe(approval)
+    expect(select({ interactions: [{ kind: 'question' }] })).toBeNull()
+    expect(select({ interactions: [] })).toBeNull()
+  })
+
   it('send trims, optimistically clears through actions, restores on failure without clobbering new typing', async () => {
     const b = await bench()
     const { instance, injected } = b.conversationSurface(ROOT)

packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx

@@ -44,11 +44,11 @@ describe('MessageItem arms', () => {
 })
 
 describe('small branch tails', () => {
-  it('PendingCard approval reason renders when present', () => {
+  it('PendingCard renders the question count', () => {
     const view = render(
-      <PendingCard item={new PendingWait('approval', RpcId('r1'), 's1' as SessionId, { approvalId: 'a1', toolName: 'rm', reason: 'careful' } as PendingWait<'approval'>['payload'], vi.fn())} />,
+      <PendingCard item={new PendingWait('question', RpcId('r1'), 's1' as SessionId, { questions: [{ id: 'q1', question: '选择' }] } as PendingWait<'question'>['payload'], vi.fn())} />,
     )
-    expect(view.getByText('careful')).toBeTruthy()
+    expect(view.getByText(/等待回答（1 题）/)).toBeTruthy()
   })
 
   it('AssistantMarkdown single-line reasoning summary skips the newline cut', () => {

packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx

@@ -123,8 +123,8 @@ describe('bash sample row', () => {
     return createSnapshotStore<SessionListState>({
       ids: [ROOT, CHILD],
       byId: {
-        [ROOT]: { id: ROOT, title: 'r', displayTitle: 'r', running: false, updatedAt: 0 },
-        [CHILD]: { id: CHILD, title: 'c', displayTitle: 'c', parentId: ROOT, running: false, updatedAt: 0 },
+        [ROOT]: { id: ROOT, title: 'r', displayTitle: 'r', running: false, waitingApproval: false, updatedAt: 0 },
+        [CHILD]: { id: CHILD, title: 'c', displayTitle: 'c', parentId: ROOT, running: false, waitingApproval: false, updatedAt: 0 },
       },
       current: undefined,
     } as SessionListState)
@@ -158,7 +158,7 @@ describe('bash sample row', () => {
     const orphan = 'late-child' as SessionId
     store.update((d) => {
       d.ids.push(orphan)
-      d.byId[orphan] = { id: orphan, title: 'l', displayTitle: 'l', running: false, updatedAt: 0 }
+      d.byId[orphan] = { id: orphan, title: 'l', displayTitle: 'l', running: false, waitingApproval: false, updatedAt: 0 }
     })
     const view = render(<BashRow {...rowProps(orphan, { store })} />)
     expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()

packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx

@@ -75,7 +75,14 @@ async function bench(nodes: ToolResultNode[]) {
   const layout = { openDetails: vi.fn(), closeDetails: vi.fn() }
   ctx.provide('sessions', {
     list,
-    manager: { get: () => ({ loadOlder: vi.fn() }) },
+    manager: {
+      get: () => ({
+        loadOlder: vi.fn(),
+        // The mounted PermissionSelect loads on mount; empty options hide the control.
+        permissions: vi.fn(() => Promise.resolve({ ok: true, value: { options: [], currentValue: 'custom' } })),
+        setPermission: vi.fn(() => Promise.resolve({ ok: false, error: { code: 'bad-request', message: 'unused', details: { issues: [] } } })),
+      }),
+    },
     scope: () => ({ get: () => scoped }),
     cell: (id: string) => (id === SID ? cell : undefined),
     create: vi.fn(),

packages/client/ui-conversation/tests/chat-view.spec.tsx

@@ -342,12 +342,17 @@ describe('ChatView', () => {
     expect(lv.getByText('载入历史…')).toBeTruthy()
   })
 
-  it('pending interactions render placeholder cards', () => {
+  it('question waits render placeholder cards; approvals leave the flow (composer takeover)', () => {
     const h = makeHarness({
-      pending: [new PendingWait('approval', RpcId('r1'), SID,
-        { approvalId: 'ap1', toolName: 'bash' } as PendingWait<'approval'>['payload'], vi.fn())],
+      pending: [
+        new PendingWait('approval', RpcId('r1'), SID,
+          { approvalId: 'ap1', toolName: 'bash' } as PendingWait<'approval'>['payload'], vi.fn()),
+        new PendingWait('question', RpcId('r2'), SID,
+          { questions: [{ id: 'q1', question: '选择' }] } as PendingWait<'question'>['payload'], vi.fn()),
+      ],
     })
     const view = render(<h.ChatView {...h.props} />)
-    expect(view.getByText(/等待审批/)).toBeTruthy()
+    expect(view.getByText(/等待回答（1 题）/)).toBeTruthy()
+    expect(view.queryByText(/等待审批/)).toBeNull()
   })
 })

packages/client/ui-conversation/tests/skeleton-branches.spec.tsx

@@ -82,6 +82,8 @@ describe('ConversationRoot branches', () => {
         send={vi.fn()}
         stop={vi.fn()}
         open={open}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
       />,
     )
     return { view, open, chat }
@@ -141,6 +143,8 @@ describe('ConversationRoot branches', () => {
         send={vi.fn()}
         stop={vi.fn()}
         open={vi.fn()}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
       />,
     )
     expect(view.getByTestId('view-body')).toBeTruthy()

packages/client/ui-conversation/tests/skeleton.spec.tsx

@@ -221,6 +221,8 @@ describe('ConversationRoot', () => {
         send={send}
         stop={stop}
         open={open}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
       />)
     return { ui, chat, send, stop, open, renderSlot }
   }

packages/client/ui-sidebar/README.md

@@ -18,6 +18,6 @@ None; this package neither assembles nor sends a provider request.
 
 ## Known Limitations and Deferred Work
 
-- **State dots have two live data states (running/none)** — the done/error/amber sources arrive with P-II approvals and notifications; the four-color primitive is already wired.
+- **State dots have three live data states (running/amber approval-waiting/none)** — the done/error sources arrive with notifications; the four-color primitive is already wired.
 - **Group-by menu ships by-workspace only** — Update/Status grouping strategies are drawn without specs and deferred.
 - **"New task completed" unread marking is local viewing state** — completion-time > last-seen never reaches the host.

packages/client/ui-sidebar/src/client/Rows.tsx

@@ -102,7 +102,11 @@ export function SessionRowItem({ row, selected, now, onOpen, onToggle }: {
             </button>
           )
         : <span className={css.slot} />}
-      <span className={css.slot}>{row.running && <StateDot state="ongoing" />}</span>
+      {/* Waiting-approval (amber) outranks the running ring: the session is
+          blocked on the user, which is the more actionable fact. */}
+      <span className={css.slot}>
+        {row.waitingApproval ? <StateDot state="warning" /> : row.running && <StateDot state="ongoing" />}
+      </span>
       <span className={css.title}>{row.title}</span>
       <span className={css.time}>{formatRelativeTime(row.updatedAt, now)}</span>
       <span className={css.rowActions}>

packages/client/ui-sidebar/src/client/tree.ts

@@ -38,6 +38,8 @@ export interface SessionRow {
   hasChildren: boolean
   expanded: boolean
   running: boolean
+  /** An approval question is pending (amber warning dot outranks the running ring). */
+  waitingApproval: boolean
   updatedAt: number
 }
 
@@ -159,6 +161,7 @@ function sessionRow(g: Group, s: SessionSummary, depth: number, hasChildren: boo
     hasChildren,
     expanded,
     running: s.running,
+    waitingApproval: s.waitingApproval,
     updatedAt: s.updatedAt,
   }
 }

packages/client/ui-sidebar/tests/apply.spec.tsx

@@ -23,7 +23,7 @@ async function bench() {
   await ctx.plugin(SlotsService).await()
   const list = createSnapshotStore<SessionListState>({
     ids: [sid('a')],
-    byId: { [sid('a')]: { id: sid('a'), title: 'alpha', displayTitle: 'alpha', cwd: '/proj', running: false, updatedAt: 1 } },
+    byId: { [sid('a')]: { id: sid('a'), title: 'alpha', displayTitle: 'alpha', cwd: '/proj', running: false, waitingApproval: false, updatedAt: 1 } },
     current: undefined,
   })
   const sessions = {

packages/client/ui-sidebar/tests/sidebar-root.spec.tsx

@@ -31,6 +31,7 @@ interface SummaryInit {
   cwd?: string
   parentId?: string
   running?: boolean
+  waitingApproval?: boolean
   updatedAt?: number
 }
 
@@ -40,6 +41,7 @@ function summary(init: SummaryInit): SessionSummary {
     title: init.title ?? init.id,
     displayTitle: init.title ?? init.id,
     running: init.running ?? false,
+    waitingApproval: init.waitingApproval ?? false,
     updatedAt: init.updatedAt ?? 0,
   }
   if (init.cwd !== undefined) s.cwd = init.cwd
@@ -290,4 +292,17 @@ describe('SidebarRoot', () => {
     expect(busyRow.querySelector('[data-state="ongoing"]')).toBeTruthy()
     expect(idleRow.querySelector('[data-state="ongoing"]')).toBeNull()
   })
+
+  it('waiting-approval shows the amber warning dot and outranks the running ring', () => {
+    mount(
+      summary({ id: 'blocked', title: 'blocked one', cwd: '/p', running: true, waitingApproval: true, updatedAt: 2 }),
+      summary({ id: 'busy', title: 'busy one', cwd: '/p', running: true, updatedAt: 1 }),
+    )
+    act(() => { fireEvent.click(screen.getByText('p')) })
+    const blockedRow = screen.getByText('blocked one').closest('[role="treeitem"]')!
+    const busyRow = screen.getByText('busy one').closest('[role="treeitem"]')!
+    expect(blockedRow.querySelector('[data-state="warning"]')).toBeTruthy()
+    expect(blockedRow.querySelector('[data-state="ongoing"]')).toBeNull()
+    expect(busyRow.querySelector('[data-state="ongoing"]')).toBeTruthy()
+  })
 })

packages/client/ui-sidebar/tests/tree.spec.ts

@@ -15,6 +15,7 @@ interface SummaryInit {
   cwd?: string
   parentId?: string
   running?: boolean
+  waitingApproval?: boolean
   updatedAt?: number
 }
 
@@ -23,6 +24,7 @@ function summary(init: SummaryInit): SessionSummary {
     id: sid(init.id),
     displayTitle: init.displayTitle ?? init.title ?? init.id,
     running: init.running ?? false,
+    waitingApproval: init.waitingApproval ?? false,
     updatedAt: init.updatedAt ?? 0,
   }
   if (init.title !== undefined) s.title = init.title

packages/client/ui-trajectory/tests/views.spec.tsx

@@ -144,6 +144,8 @@ function mount(slots: SlotsService, nodes: ConversationSnapshot['nodes'] = NODES
       send={vi.fn()}
       stop={vi.fn()}
       open={vi.fn()}
+      permissions={() => Promise.resolve(null)}
+      setPermission={() => Promise.resolve(null)}
     />,
   )
 }

packages/core/session/src/index.ts

@@ -59,6 +59,25 @@ export function findLastMessageTurnEnd(
   return latest
 }
 
+/**
+ * Whether the log currently sits inside an open turn (a `turn/start` not yet
+ * closed by a `turn/end`). The turn is the durable log's commit/replay
+ * boundary: a bare event appended between turns is indistinguishable from a
+ * crash tail and silently dropped on reload, so writers of turn-enclosed
+ * events (approval audit pairs, permission/sandbox knob switches) gate on
+ * this fold and hold idle writes until the next turn opens.
+ * @param events - session events, or an owned suffix, to inspect.
+ * @returns true when the last turn boundary event is a `turn/start`.
+ */
+export function hasOpenTurn(events: readonly SessionEvent[]): boolean {
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const type = (events[index] as SessionEvent).type
+    if (type === 'turn/start') return true
+    if (type === 'turn/end') return false
+  }
+  return false
+}
+
 declare module 'cordis' {
   interface Context {
     sessions: SessionStore

packages/core/session/tests/session.spec.ts

@@ -4,6 +4,7 @@ import { CallId } from '@deepseek-ai/dsh-llm'
 import SessionStore, {
   displayPromptContent,
   findLastMessageTurnEnd,
+  hasOpenTurn,
   SESSION_FORMAT_VERSION,
   Session,
   SessionEvent,
@@ -91,6 +92,17 @@ describe('Session', () => {
     expect(findLastMessageTurnEnd(session.events)).toBe(messageEnd)
   })
 
+  it('reports an open turn only between turn/start and its turn/end', () => {
+    const session = new Session(SessionId('open-turn'))
+    expect(hasOpenTurn(session.events)).toBe(false)
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    expect(hasOpenTurn(session.events)).toBe(true)
+    session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
+    expect(hasOpenTurn(session.events)).toBe(true)
+    session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    expect(hasOpenTurn(session.events)).toBe(false)
+  })
+
   it('round-trips the coarse aborted turn outcome', () => {
     const session = new Session(SessionId('aborted'))
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })

packages/host/apiproxy/README.md

@@ -24,6 +24,6 @@ None; this package neither assembles nor sends a provider request.
 
 ## Known Limitations and Deferred Work
 
-- **`respond` routing is shipped, but pending-interaction state is host-side work** — the wire shape (POST `/api/respond`, `RpcReceipt`) is final; the pending table that makes late/duplicate answers meaningful lives in `dsh-host-runtime` and is still a stub there.
+- **`respond` is routed by host-side pending tables** — the wire shape (POST `/api/respond`, `RpcReceipt`) is final here; the approval and question registries that make late/duplicate answers meaningful live in `dsh-host-runtime`.
 - **Reserved seams stay out of `RpcMethodMap`** — `session.fork`, `prompt.mode: 'inject'`, `task.list`, `host.listModels`, and a describe `hostInstanceId` are documented reservations; an unknown method fails loud at envelope parse rather than getting a not-implemented code.
 - **No protocol version field** — client and host ship together; `host.describe` gains a version negotiation field only when an independently released client exists.

packages/host/apiproxy/src/api/index.ts

@@ -19,7 +19,7 @@ export interface ApiProxy {
 }
 
 // ---- Domain interfaces and payload entities ----
-export type { HistoryEntry, SessionsApi, SessionSummary } from './sessions.ts'
+export type { HistoryEntry, PermissionOption, SessionsApi, SessionSummary } from './sessions.ts'
 export type { HostApi } from './host.ts'
 export type { EventsApi, MuxFrame, HostFrame, ToolCallView, ToolEventView, ToolResultView } from './events.ts'
 export type { ApprovalResponsePayload } from './approvals.ts'

packages/host/apiproxy/src/api/rpc-map.ts

@@ -15,6 +15,8 @@ export interface RpcMethodMap {
   'session.history': SessionsApi['history']
   'session.prompt': SessionsApi['prompt']
   'session.cancel': SessionsApi['cancel']
+  'session.permissions': SessionsApi['permissions']
+  'session.setPermission': SessionsApi['setPermission']
   'host.describe': HostApi['describe']
 }
 

packages/host/apiproxy/src/api/sessions.schema.ts

@@ -9,7 +9,7 @@ import { z } from 'zod'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
 import type { RequestPayload, ResponseValue } from './rpc-map.ts'
 import type { Wire } from './rpc.schema.ts'
-import type { HistoryEntry, SessionSummary } from './sessions.ts'
+import type { HistoryEntry, PermissionOption, SessionSummary } from './sessions.ts'
 import type { ToolEventView } from './events.ts'
 
 /** SessionId: one brand cast after shape validation (the only cast point in this domain). */
@@ -108,3 +108,32 @@ export const sessionCancelRequestSchema = z.object({
 export const sessionCancelValueSchema = z.object({
   accepted: z.literal(true),
 }) satisfies z.ZodType<Wire<ResponseValue<'session.cancel'>>>
+
+/** One permission select option (a preset table key, or the derived `custom`). */
+export const permissionOptionSchema = z.object({
+  value: z.string(),
+  name: z.string(),
+  description: z.string().optional(),
+}) satisfies z.ZodType<Wire<PermissionOption>>
+
+/** session.permissions request payload. */
+export const sessionPermissionsRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+}) satisfies z.ZodType<Wire<RequestPayload<'session.permissions'>>>
+
+/** session.permissions response value. */
+export const sessionPermissionsValueSchema = z.object({
+  options: z.array(permissionOptionSchema),
+  currentValue: z.string(),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.permissions'>>>
+
+/** session.setPermission request payload. */
+export const sessionSetPermissionRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+  value: z.string(),
+}) satisfies z.ZodType<Wire<RequestPayload<'session.setPermission'>>>
+
+/** session.setPermission response value. */
+export const sessionSetPermissionValueSchema = z.object({
+  currentValue: z.string(),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.setPermission'>>>

packages/host/apiproxy/src/api/sessions.ts

@@ -44,6 +44,21 @@ export interface SessionSummary {
   cwd?: string
 }
 
+/**
+ * One selectable permission preset (or the derived `custom` state) as the
+ * client renders it. Protocol-owned DTO (the ACP bridge precedent: each
+ * protocol owns its presentation shape); the host projects it from
+ * `ctx.permission` without exposing that service's types on the wire.
+ */
+export interface PermissionOption {
+  /** The machine value (`session.setPermission` vocabulary): a preset table key, or `custom`. */
+  value: string
+  /** The display label. */
+  name: string
+  /** One user-facing sentence on what the value means. */
+  description?: string
+}
+
 /** Session-domain unary methods (the map keys session.* of RpcMethodMap). */
 export interface SessionsApi {
   /** Lists persisted sessions (updatedAt descending). v1 returns everything; cursor is a reserved seat, unimplemented. */
@@ -70,4 +85,24 @@ export interface SessionsApi {
 
   /** Stops: clears both FIFOs + aborts the current step (1:1 with agent.cancel). */
   cancel(request: RpcRequest<{ sessionId: SessionId }>): Promise<RpcResponse<{ accepted: true }>>
+
+  /**
+   * Reads the session's permission select: every switchable preset plus the
+   * effective current value (`custom` when the knobs match no preset — shown,
+   * never a switch target). A host composed without the permission service
+   * returns empty options and `custom`; clients hide the control.
+   */
+  permissions(request: RpcRequest<{ sessionId: SessionId }>):
+  Promise<RpcResponse<{ options: PermissionOption[]; currentValue: string }>>
+
+  /**
+   * Switches the session's permission preset. Mirrors the ACP bridge's
+   * turn-anchoring: inside an open turn the knob events append immediately;
+   * idle switches are held last-write-wins and flushed into the next prompted
+   * turn (approval-policy and sandbox-mode events must stay turn-enclosed for
+   * durable replay). A current-value echo is acknowledged without recording.
+   * Unknown values and a permission-less composition are bad-request.
+   */
+  setPermission(request: RpcRequest<{ sessionId: SessionId; value: string }>):
+  Promise<RpcResponse<{ currentValue: string }>>
 }

packages/host/apiproxy/src/fetch/client.ts

@@ -19,7 +19,9 @@ import {
   sessionCreateValueSchema,
   sessionHistoryValueSchema,
   sessionListValueSchema,
+  sessionPermissionsValueSchema,
   sessionPromptValueSchema,
+  sessionSetPermissionValueSchema,
 } from '../api/sessions.schema.ts'
 
 /**
@@ -44,6 +46,8 @@ export interface IApiClient {
     history(payload: RequestPayload<'session.history'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.history'>>>
     prompt(payload: RequestPayload<'session.prompt'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.prompt'>>>
     cancel(payload: RequestPayload<'session.cancel'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.cancel'>>>
+    permissions(payload: RequestPayload<'session.permissions'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.permissions'>>>
+    setPermission(payload: RequestPayload<'session.setPermission'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.setPermission'>>>
   }
   host: {
     describe(payload: RequestPayload<'host.describe'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'host.describe'>>>
@@ -66,6 +70,8 @@ const UNARY_VALUE_SCHEMAS: { [K in keyof RpcMethodMap]: z.ZodType<Wire<ResponseV
   'session.history': sessionHistoryValueSchema,
   'session.prompt': sessionPromptValueSchema,
   'session.cancel': sessionCancelValueSchema,
+  'session.permissions': sessionPermissionsValueSchema,
+  'session.setPermission': sessionSetPermissionValueSchema,
   'host.describe': hostDescribeValueSchema,
 }
 
@@ -247,6 +253,8 @@ export abstract class AbstractApiClient implements IApiClient {
     history: (payload, signal) => this.callUnary('session.history', payload, signal),
     prompt: (payload, signal) => this.callUnary('session.prompt', payload, signal),
     cancel: (payload, signal) => this.callUnary('session.cancel', payload, signal),
+    permissions: (payload, signal) => this.callUnary('session.permissions', payload, signal),
+    setPermission: (payload, signal) => this.callUnary('session.setPermission', payload, signal),
   }
 
   readonly host: IApiClient['host'] = {

packages/host/apiproxy/src/fetch/handler.ts

@@ -19,7 +19,9 @@ import {
   sessionCreateRequestSchema,
   sessionHistoryRequestSchema,
   sessionListRequestSchema,
+  sessionPermissionsRequestSchema,
   sessionPromptRequestSchema,
+  sessionSetPermissionRequestSchema,
 } from '../api/sessions.schema.ts'
 import { hostDescribeRequestSchema } from '../api/host.schema.ts'
 
@@ -43,6 +45,8 @@ const UNARY_ROUTES: UnaryRoutes = {
   'session.history': { schema: sessionHistoryRequestSchema, invoke: (api, r) => api.sessions.history(r) },
   'session.prompt': { schema: sessionPromptRequestSchema, invoke: (api, r) => api.sessions.prompt(r) },
   'session.cancel': { schema: sessionCancelRequestSchema, invoke: (api, r) => api.sessions.cancel(r) },
+  'session.permissions': { schema: sessionPermissionsRequestSchema, invoke: (api, r) => api.sessions.permissions(r) },
+  'session.setPermission': { schema: sessionSetPermissionRequestSchema, invoke: (api, r) => api.sessions.setPermission(r) },
   'host.describe': { schema: hostDescribeRequestSchema, invoke: (api, r) => api.host.describe(r) },
 }
 

packages/host/apiproxy/tests/client-handler.spec.ts

@@ -31,6 +31,8 @@ function scriptedApi(overrides: {
       history: r => ok(r, { events: [], hasMore: false }),
       prompt: r => ok(r, { accepted: true as const }),
       cancel: r => ok(r, { accepted: true as const }),
+      permissions: r => ok(r, { options: [], currentValue: 'custom' }),
+      setPermission: r => ok(r, { currentValue: r.payload.value }),
       ...overrides.sessions,
     },
     host: { describe: r => ok(r, { version: '0-test', cwd: '/t', attachedSessions: 0 }), ...overrides.host },

packages/host/apiproxy/tests/fetch-carrier.spec.ts

@@ -36,6 +36,12 @@ function fakeApi(overrides: Partial<{ muxFrames: MuxFrame[]; hostFrames: HostFra
       async cancel(request) {
         return { rpcId: request.rpcId, result: { ok: true, value: { accepted: true as const } } }
       },
+      async permissions(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { options: [], currentValue: 'custom' } } }
+      },
+      async setPermission(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { currentValue: request.payload.value } } }
+      },
     },
     host: {
       async describe(request) {
@@ -75,11 +81,13 @@ describe('unary round trip (handler ⇄ client, no network)', () => {
     if (!response.result.ok) expect(response.result.error.code).toBe('session-not-found')
   })
 
-  it('covers create/prompt/cancel/describe passthrough', async () => {
+  it('covers create/prompt/cancel/permissions/setPermission/describe passthrough', async () => {
     const c = client()
     expect((await c.sessions.create({})).result.ok).toBe(true)
     expect((await c.sessions.prompt({ sessionId: 's' as never, mode: 'queue', content: [{ type: 'text', text: 'x' }] })).result.ok).toBe(true)
     expect((await c.sessions.cancel({ sessionId: 's' as never })).result.ok).toBe(true)
+    expect((await c.sessions.permissions({ sessionId: 's' as never })).result.ok).toBe(true)
+    expect((await c.sessions.setPermission({ sessionId: 's' as never, value: 'workspace-write' })).result.ok).toBe(true)
     expect((await c.host.describe({})).result.ok).toBe(true)
   })
 })

packages/host/runtime/README.md

@@ -1,6 +1,6 @@
 # @deepseek-ai/dsh-host-runtime
 
-Host runtime assembly for `dsh`: `bootHost` composes the core plugin spine (LLM service + DeepSeek adapter, sessions with JSONL persistence and immediate fallback titles, optional first-message model summaries, system prompt, tools, agents, agent loop, workspace instructions, local bash, and the provider-neutral user-interaction service), `createApiProxy` implements the [`dsh-host-apiproxy`](../apiproxy/README.md) contract over that composition, and `startHost` is the one-step shell seam returning `{ api, handler, defaults, ctx, dispose }`.
+Host runtime assembly for `dsh`: `bootHost` composes the core plugin spine (LLM service + DeepSeek adapter, sessions with JSONL persistence and immediate fallback titles, optional first-message model summaries, system prompt, tools, agents, agent loop, workspace instructions, the provider-neutral user-interaction service, and the sandboxed product path — `dsh-sandbox-local` + `dsh-sandbox-policy` behind the confined `dsh-bash-sandbox`/`dsh-fs-sandbox` families, with `dsh-user-approval` and `dsh-permission` on top), `createApiProxy` implements the [`dsh-host-apiproxy`](../apiproxy/README.md) contract over that composition, and `startHost` is the one-step shell seam returning `{ api, handler, defaults, ctx, dispose }`.
 
 Which plugins mount and with what defaults is decided only here — shells must not `ctx.plugin` to alter the assembly. `RunningHost.ctx` is a formal seam with exactly two sanctioned uses: mounting protocol front-door plugins (e.g. a future `dsh acp`) and headless session-event subscription; consuming clients must not bypass `api` through it.
 
@@ -15,11 +15,15 @@ Which plugins mount and with what defaults is decided only here — shells must
 | `cwd` | `process.cwd()` | Default project directory for a session whose create request omits `cwd`. |
 | `sessionTitle` | 5 words / 40 fallback bytes / 80 accepted bytes | Deterministic fallback and accepted-title limits. |
 | `sessionTitleLlm` | disabled | `true` enables the 5-word / 10-CJK-character, 4,096-input-byte, 64-output-token, 60-second first-message policy; an explicit config overrides it. An omitted route inherits the logged main-request provider and model. |
+| `sandbox.mode` | `'workspace-write'` | File-sandbox mode sessions start from (`ctx.sandboxPolicy` default; per-session switches ride `sandbox/mode` events). |
+| `sandbox.approvalPolicy` | `'ask'` | Approval policy for sessions without an `approval/policy` override. |
 
 ## ApiProxy implementation notes
 
 Unary methods take the narrow `RpcRequest<P>` and echo `request.rpcId`; a prompt's rpcId rides `MessageSource` into the `user/message` event so clients can promote optimistic echoes. `history`/`prompt` on a cold session implicitly resume it, deduplicating concurrent calls through an in-flight table; `history` paginates backwards on message boundaries (never mid-message). The mux stream replays a `session/subscribed` baseline per attached session and every still-pending question with its original rpcId. Question responses, including blank per-item answers, are validated against the owning session and exact request before an atomic first-wins claim; answer, whole-request cancellation, owner abort, and provider disposal broadcast `question/resolved`. The host stream carries session lifecycle, running flips, and `agent/error` as the only outlet for live failures with no turn position.
 
+The proxy is also the approval channel for the agents this host owns: an ask through `ctx.approval` becomes an answerable `approval/requested` mux frame with a stable rpcId held in a pending table, replayed verbatim on every mux open until settled. `respond` routes by the echoed rpcId (approvals first, then questions), validates the `ApprovalResponsePayload` audit correlation at the wire boundary, resolves the answerer, and broadcasts `approval/resolved`; the ask's own abort signal withdraws the question as `cancelled`. `session.permissions`/`session.setPermission` project `ctx.permission` (empty select when not composed); idle switches are held last-write-wins and flushed into the next prompted turn on `agent/prompt-submit`, because knob events must stay turn-enclosed for durable replay (the ACP bridge's anchoring pattern).
+
 ## Model Experience
 
 Indirectly, through the non-blocking first-message title request owned by [`dsh-session-title-llm`](../../session-title/session-title-llm/README.md) when `sessionTitleLlm` is enabled, the provider/model defaults injected into created and resumed agents, the other model-facing plugins `bootHost` mounts, and the logged [workspace-instruction prefix](../../context/workspace-context/README.md#prompt-shape) when `workspaceContext` is enabled.
@@ -30,6 +34,6 @@ No main-request invalidation; when enabled, the auxiliary title request has its
 
 ## Known Limitations and Deferred Work
 
-- **Question waits are process-memory state** — browser reconnects recover them, but a host process restart aborts the owning tool call instead of restoring the wait from persistence.
+- **Question and approval waits are process-memory state** — browser reconnects recover them, but a host process restart aborts the owning tool call instead of restoring the wait from persistence.
 - **`host.describe.version` is a placeholder** — it does not yet report the `apps/cli` package version.
 - **The assembly is fixed** — per-deployment plugin selection (user profile, log sinks, alternative persistence) has a documented home here but no configuration surface yet.

packages/host/runtime/package.json

@@ -31,13 +31,17 @@
     "@cordisjs/plugin-timer": "workspace:^",
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-agent-loop": "workspace:^",
-    "@deepseek-ai/dsh-bash-local": "workspace:^",
+    "@deepseek-ai/dsh-bash-sandbox": "workspace:^",
     "@deepseek-ai/dsh-compact-basic": "workspace:^",
-    "@deepseek-ai/dsh-fs-local": "workspace:^",
     "@deepseek-ai/dsh-fs-policy": "workspace:^",
+    "@deepseek-ai/dsh-fs-sandbox": "workspace:^",
     "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-llm-deepseek": "workspace:^",
+    "@deepseek-ai/dsh-permission": "workspace:^",
+    "@deepseek-ai/dsh-sandbox": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-local": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-policy": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
     "@deepseek-ai/dsh-session-persistence": "workspace:^",
     "@deepseek-ai/dsh-session-persistence-jsonl": "workspace:^",
@@ -63,6 +67,7 @@
     "@deepseek-ai/dsh-tool-todo": "workspace:^",
     "@deepseek-ai/dsh-tool-workflow": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
+    "@deepseek-ai/dsh-user-approval": "workspace:^",
     "@deepseek-ai/dsh-user-interaction": "workspace:^",
     "@deepseek-ai/dsh-workflow-workerthread": "workspace:^",
     "@deepseek-ai/dsh-workspace-context": "workspace:^"

packages/host/runtime/src/api-proxy.ts

@@ -1,19 +1,31 @@
 /**
- * Host-side ApiProxy implementation. Signature discipline: unary takes the
- * narrow RpcRequest<P> and echoes request.rpcId on the RpcResponse<T>.
+ * Host-side ApiProxy implementation. Unary methods, both streams, and the
+ * pending-interaction registries are real: the approval registry turns
+ * `ctx.approval` asks into answerable `approval/requested` mux frames and the
+ * question provider does the same for `ask_user_question`; both are answered
+ * through `respond` (routed by the echoed rpcId). Signature discipline: unary
+ * takes the narrow RpcRequest<P> and echoes request.rpcId on the RpcResponse<T>.
  */
 
 import { randomUUID } from 'node:crypto'
 import { mkdir, stat } from 'node:fs/promises'
 import type { Context } from 'cordis'
 import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
+import type { CallId } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm'
+import { hasOpenTurn } from '@deepseek-ai/dsh-session'
 import type { JsonValue, Session, SessionEvent, SessionHeader, SessionId } from '@deepseek-ai/dsh-session'
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 import { foldSessionTitle } from '@deepseek-ai/dsh-session-title'
+import type { ApprovalOutcome, ApprovalRequestId } from '@deepseek-ai/dsh-user-approval'
+// Side-effect type imports: resolve `ctx.approval` / `ctx.get('permission')`
+// without value dependencies on the seams (both are optional compositions here).
+import type {} from '@deepseek-ai/dsh-user-approval'
+import type {} from '@deepseek-ai/dsh-permission'
 import type {
   ApiProxy, HistoryEntry, HostFrame, MuxFrame, QuestionResponsePayload, SessionSummary, ToolEventView,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
+import { approvalResponsePayloadSchema } from '@deepseek-ai/dsh-host-apiproxy/api/approvals.schema'
 import { questionResponsePayloadSchema } from '@deepseek-ai/dsh-host-apiproxy/api/questions.schema'
 import type { ClientResponse, RpcError, RpcReceipt, RpcRequest, RpcResponse } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
@@ -183,6 +195,36 @@ interface ToolCallData { callId: string; name: string; arguments: string }
 /** The tool/result payload fields the presenter path reads. */
 interface ToolResultData { callId: string; content: ContentBlock[]; isError: boolean; meta?: JsonValue }
 
+/**
+ * One outstanding approval question: the stable server-request id, the frame
+ * material replayed to late mux subscribers, and the resolver that settles the
+ * answerer's promise back into `ctx.approval`.
+ */
+interface PendingApproval {
+  rpcId: RpcId
+  sessionId: SessionId
+  approvalId: ApprovalRequestId
+  toolName: string
+  callId?: CallId
+  reason?: string
+  resolve(outcome: ApprovalOutcome): void
+}
+
+/** Project a pending entry into its answerable mux frame (initial push and mux-open replay share it). */
+function requestedFrame(pending: PendingApproval): RpcRequest<MuxFrame> {
+  return {
+    rpcId: pending.rpcId,
+    payload: {
+      type: 'approval/requested',
+      sessionId: pending.sessionId,
+      approvalId: pending.approvalId,
+      toolName: pending.toolName,
+      ...pending.callId === undefined ? {} : { callId: pending.callId },
+      ...pending.reason === undefined ? {} : { reason: pending.reason },
+    },
+  }
+}
+
 /** One host-owned question wait, addressed by the stable server-request id. */
 interface PendingQuestion {
   rpcId: RpcId
@@ -283,6 +325,7 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
   /** Implicit resume of cold sessions, deduplicating concurrent calls (follows the jsonrpc sessionCreations precedent). */
   const resumes = new Map<SessionId, Promise<Agent>>()
   const pendingQuestions = new Map<RpcId, PendingQuestion>()
+  const pendingApprovals = new Map<RpcId, PendingApproval>()
   const muxQueues = new Set<FrameQueue<RpcRequest<MuxFrame>>>()
 
   /** Send one transient frame to every connected mux consumer. */
@@ -341,6 +384,95 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
     }
   }, 'api-proxy: user-interaction provider')
 
+  // --- Approval pending registry ------------------------------------------
+  // The proxy is the approval channel for every agent this host owns: an ask
+  // through `ctx.approval` becomes an answerable server-request on the mux
+  // stream (stable rpcId), settled by POST /api/respond. The entry survives
+  // client disconnects — mux-open replays still-pending requested frames with
+  // the same rpcId (the refresh-recovery baseline) — and withdraws on the
+  // ask's own abort signal (turn cancel), pushing `cancelled` to subscribers.
+  if (ctx.get('approval') !== undefined) {
+    ctx.on('approval/request', (req, next) => {
+      // The audit pair `approval/asked` is already appended by the service
+      // before dispatch, but dispatch rides a microtask: parallel tool calls
+      // can append several asked events before any answerer runs. THIS
+      // request's event is therefore the newest asked event that is still
+      // undecided, unclaimed by another pending entry, and — when the ask
+      // names a call — carries the same callId.
+      const events = req.agent.session.events
+      const claimed = new Set<ApprovalRequestId>()
+      for (const entry of pendingApprovals.values()) claimed.add(entry.approvalId)
+      const decided = new Set<ApprovalRequestId>()
+      let approvalId: ApprovalRequestId | undefined
+      for (let i = events.length - 1; i >= 0; i -= 1) {
+        const event = events[i] as SessionEvent
+        if (event.type === 'approval/decided') {
+          decided.add(event.data.id)
+        } else if (event.type === 'approval/asked') {
+          if (decided.has(event.data.id) || claimed.has(event.data.id)) continue
+          if (req.callId !== undefined && event.data.callId !== req.callId) continue
+          approvalId = event.data.id
+          break
+        }
+      }
+      // No asked event means the request bypassed the service's audit path —
+      // not this channel's question; delegate to the fail-closed default.
+      if (approvalId === undefined) return next()
+      const id = approvalId
+      return new Promise<ApprovalOutcome>((resolve) => {
+        const settle = (outcome: ApprovalOutcome): void => {
+          /* v8 ignore next 3 -- defensive double-settle guard: respond() routes
+             through the pending table (a settled id is not-pending before it can
+             re-settle) and the first settle removes the abort listener, so no
+             reachable path settles twice; kept against future settle callers. */
+          if (!pendingApprovals.delete(pending.rpcId)) return
+          req.signal?.removeEventListener('abort', onAbort)
+          broadcast({ type: 'approval/resolved', sessionId: pending.sessionId, approvalId: id, outcome })
+          // A cancelled ask was already settled by the service's own signal
+          // race, which discards this late resolution; resolving is a no-op
+          // there and keeps this promise from dangling forever.
+          resolve(outcome)
+        }
+        const onAbort = (): void => { settle('cancelled') }
+        const pending: PendingApproval = {
+          rpcId: RpcId(randomUUID()),
+          sessionId: req.agent.session.id,
+          approvalId: id,
+          toolName: req.toolName,
+          ...req.callId === undefined ? {} : { callId: req.callId },
+          ...req.reason === undefined ? {} : { reason: req.reason },
+          resolve: settle,
+        }
+        pendingApprovals.set(pending.rpcId, pending)
+        req.signal?.addEventListener('abort', onAbort, { once: true })
+        const envelope = requestedFrame(pending)
+        for (const queue of muxQueues) queue.push(envelope)
+      })
+    })
+  }
+
+  // --- Permission switch anchoring ----------------------------------------
+  // Knob events (`permission/preset`, `sandbox/mode`, `approval/policy`) must
+  // be turn-enclosed for durable replay, so an idle switch is held here
+  // last-write-wins and flushed when the next prompted turn opens (the ACP
+  // bridge's pendingSwitches pattern; prompt-submit is inside the new turn but
+  // before prompt assembly, so the switch is visible to that turn's request).
+  const pendingSwitches = new Map<SessionId, string>()
+  ctx.on('agent/prompt-submit', (agent, _content, _source, _signal, next) => {
+    const preset = pendingSwitches.get(agent.session.id)
+    if (preset !== undefined) {
+      pendingSwitches.delete(agent.session.id)
+      const presets = ctx.get('permission')
+      /* v8 ignore next -- a pending preset exists only if setPermission saw the
+         service; it cannot unmount between that and the next turn here. */
+      if (presets !== undefined) presets.set(agent.session, preset)
+    }
+    return next()
+  })
+  ctx.on('session/disposed', (session: Session) => {
+    pendingSwitches.delete(session.id)
+  })
+
   /**
    * Gate the cold path on the store: an id absent from it, or naming a legacy
    * log without a cwd (pre-release stance: not served, no compatibility), is
@@ -468,6 +600,48 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
         agent.cancel()
         return Promise.resolve(ok(request, { accepted: true as const }))
       },
+
+      async permissions(request) {
+        const { sessionId } = request.payload
+        const presets = ctx.get('permission')
+        // A permission-less composition advertises an empty select (client
+        // hides the control) rather than erroring — the control's absence is
+        // deployment shape, not a caller mistake.
+        if (presets === undefined) return ok(request, { options: [], currentValue: 'custom' })
+        const found = await agentFor(sessionId)
+        if ('error' in found) return err(request, found.error)
+        const events = found.agent.session.events
+        const currentValue = pendingSwitches.get(sessionId) ?? presets.current(events)
+        const options = [
+          ...presets.names.map(name => presets.optionOf(name)),
+          // `custom` echoes the current derived state but is never a target.
+          ...currentValue === 'custom' ? [presets.optionOf('custom')] : [],
+        ]
+        return ok(request, { options, currentValue })
+      },
+
+      async setPermission(request) {
+        const { sessionId, value } = request.payload
+        const presets = ctx.get('permission')
+        if (presets === undefined) {
+          return err(request, { code: 'bad-request', message: 'no permission service is composed on this host', details: { issues: [] } })
+        }
+        const found = await agentFor(sessionId)
+        if ('error' in found) return err(request, found.error)
+        const agent = found.agent
+        // A current-value echo is acknowledged without recording a switch.
+        const current = pendingSwitches.get(sessionId) ?? presets.current(agent.session.events)
+        if (value === current) return ok(request, { currentValue: value })
+        if (!presets.names.includes(value)) {
+          return err(request, { code: 'bad-request', message: `unknown permission value ${JSON.stringify(value)}`, details: { issues: [] } })
+        }
+        // Turn-anchoring (the ACP bridge pattern): knob events must be enclosed
+        // by the durable log's turn boundary, so an idle switch is held
+        // last-write-wins and flushed into the next prompted turn.
+        if (hasOpenTurn(agent.session.events)) presets.set(agent.session, value)
+        else pendingSwitches.set(sessionId, value)
+        return ok(request, { currentValue: value })
+      },
     },
 
     host: {
@@ -499,6 +673,9 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
             },
           })
         }
+        // Refresh recovery: still-pending approval questions replay with their
+        // stable rpcId so a reconnecting client can still answer them.
+        for (const pending of pendingApprovals.values()) queue.push(requestedFrame(pending))
         // Per-session open-call table for result-view pairing. Bounded by the
         // per-turn call count: entries clear on turn/end; a table miss (stream
         // opened mid-turn) backscans the session's in-memory events instead.
@@ -564,6 +741,20 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
     },
 
     respond(message: ClientResponse): Promise<RpcReceipt> {
+      // Route by the echoed rpcId (the wire correlation): approvals first,
+      // then questions — the two registries share one id space of UUIDs.
+      const approval = pendingApprovals.get(message.rpcId)
+      if (approval !== undefined) {
+        if (!message.result.ok) return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        const parsed = approvalResponsePayloadSchema.safeParse(message.result.value)
+        // The payload's audit correlation must match the entry the rpcId routed
+        // to — a mismatched answer is malformed, not merely late.
+        if (!parsed.success || parsed.data.approvalId !== approval.approvalId || parsed.data.sessionId !== approval.sessionId) {
+          return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        }
+        approval.resolve(parsed.data.outcome)
+        return Promise.resolve({ accepted: true })
+      }
       const pending = pendingQuestions.get(message.rpcId)
       if (pending === undefined) return Promise.resolve({ accepted: false, reason: 'not-pending' })
       if (!message.result.ok) {

packages/host/runtime/src/boot.ts

@@ -18,11 +18,17 @@ import TaskService from '@deepseek-ai/dsh-tasks'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
 import SessionPersistenceJsonl from '@deepseek-ai/dsh-session-persistence-jsonl'
-import LocalBashExecutor from '@deepseek-ai/dsh-bash-local'
+import SandboxLocal from '@deepseek-ai/dsh-sandbox-local'
+import SandboxPolicy from '@deepseek-ai/dsh-sandbox-policy'
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
+import SandboxBashExecutor from '@deepseek-ai/dsh-bash-sandbox'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import type { ApprovalPolicy } from '@deepseek-ai/dsh-user-approval'
+import PermissionService from '@deepseek-ai/dsh-permission'
 import * as toolBash from '@deepseek-ai/dsh-tool-bash'
 import * as toolTodo from '@deepseek-ai/dsh-tool-todo'
 import * as toolTasks from '@deepseek-ai/dsh-tool-tasks'
-import FsLocal from '@deepseek-ai/dsh-fs-local'
+import FsSandbox from '@deepseek-ai/dsh-fs-sandbox'
 import * as fsPolicy from '@deepseek-ai/dsh-fs-policy'
 import * as toolFs from '@deepseek-ai/dsh-tool-fs'
 import * as toolFsSearch from '@deepseek-ai/dsh-tool-fs-search'
@@ -73,6 +79,17 @@ export interface BootHostOptions {
   sessionTitle?: SessionTitleConfig
   /** Opt-in first-message model-title policy; `true` selects host defaults and an explicit config overrides them. */
   sessionTitleLlm?: true | SessionTitleLlmConfig
+  /**
+   * Sandbox/approval composition knobs. The host always composes the confined
+   * bash + fs families over `ctx.sandboxPolicy` (the acp-agent composition);
+   * these fields choose the deployment defaults every session starts from.
+   */
+  sandbox?: {
+    /** File-sandbox mode sessions start from (default `workspace-write`). */
+    mode?: SandboxMode
+    /** Approval policy for sessions without an override (default `ask`). */
+    approvalPolicy?: ApprovalPolicy
+  }
   /**
    * Default project directory for sessions created without an explicit cwd
    * (defaults to the host process working directory). A session's cwd is its
@@ -131,16 +148,30 @@ export async function bootHost(options: BootHostOptions): Promise<HostHandle> {
   await ctx.plugin(AgentLoop, { agents: [] })
   await ctx.plugin(LlmDeepSeek, {})
   await ctx.plugin(SessionPersistenceJsonl, { root: options.persistenceRoot })
-  await ctx.plugin(LocalBashExecutor, {})
+  // The sandboxed product path (the acp-agent composition, sandbox Agent
+  // Note): per-platform runner provider, the shared policy home, the confined
+  // bash executor, and the approval seam its escalation asks through. Sessions
+  // start from the configured default mode; per-session switches ride the
+  // `sandbox/mode` / `approval/policy` events written by ctx.permission.
+  await ctx.plugin(SandboxLocal, {})
+  await ctx.plugin(SandboxPolicy, {
+    mode: options.sandbox?.mode ?? 'workspace-write',
+    workspaceRoot: defaults.cwd,
+  })
+  await ctx.plugin(SandboxBashExecutor, {})
+  await ctx.plugin(ApprovalService, { policy: options.sandbox?.approvalPolicy ?? 'ask' })
   // Tool suite mirroring the demo:repl composition (repl-agent/cordis.yml +
   // the agent-spine bundle) so web sessions get the same coding-agent tool
   // face; deviations are noted inline.
   await ctx.plugin(toolBash, {})
+  // Presets over the two knobs (requires the confining executor + approval).
+  await ctx.plugin(PermissionService, {})
   await ctx.plugin(toolTodo)
   await ctx.plugin(toolTasks, {})
   // fs paths resolve against the host default project rather than the raw
-  // process cwd — the same source create() injects into session.cwd.
-  await ctx.plugin(FsLocal, { cwd: defaults.cwd })
+  // process cwd — the same source create() injects into session.cwd. The
+  // sandboxed backend fences write/edit by the same policy as bash.
+  await ctx.plugin(FsSandbox, { cwd: defaults.cwd })
   await ctx.plugin(fsPolicy)
   await ctx.plugin(toolFs, {})
   await ctx.plugin(toolFsSearch, {})

packages/host/runtime/tests/api-proxy-approval.spec.ts

@@ -0,0 +1,275 @@
+/**
+ * Approval pending registry over the proxy: an ask through `ctx.approval`
+ * becomes an answerable `approval/requested` mux frame (stable rpcId, replayed
+ * verbatim on a later mux open), `respond` routes by the echoed rpcId and
+ * validates the audit correlation, and the ask's abort signal withdraws the
+ * question with a broadcast `cancelled`.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import type { ApprovalRequestId } from '@deepseek-ai/dsh-user-approval'
+import type { ApiProxy, MuxFrame, RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api'
+import type { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import { RpcId as mintRpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import { createApiProxy } from '../src/api-proxy.ts'
+
+async function harness(): Promise<{ ctx: Context; api: ApiProxy }> {
+  const ctx = new Context()
+  await ctx.plugin(SessionStore)
+  await ctx.plugin(SystemPrompt, { persona: '' })
+  await ctx.plugin(UserInteractionService)
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(ApprovalService)
+  const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp' })
+  return { ctx, api }
+}
+
+/** A minimal agent stand-in inside an open turn (the service only reaches `.session`). */
+function agentOf(ctx: Context): Agent {
+  const session = ctx.sessions.create()
+  session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+  return { session } as unknown as Agent
+}
+
+/** Open a mux stream and capture frames into an array (returns an on-demand waiter). */
+function openMux(api: ApiProxy, abort: AbortController): { frames: MuxFrame[]; envelopes: RpcRequest<MuxFrame>[]; waitFor(type: MuxFrame['type']): Promise<MuxFrame> } {
+  const frames: MuxFrame[] = []
+  const envelopes: RpcRequest<MuxFrame>[] = []
+  const waiters: { type: MuxFrame['type']; resolve: (frame: MuxFrame) => void }[] = []
+  void (async () => {
+    for await (const envelope of api.events.mux({ rpcId: mintRpcId('t-mux'), payload: {} }, abort.signal)) {
+      frames.push(envelope.payload)
+      envelopes.push(envelope)
+      for (let i = waiters.length - 1; i >= 0; i -= 1) {
+        const waiter = waiters[i] as (typeof waiters)[number]
+        if (waiter.type === envelope.payload.type) {
+          waiters.splice(i, 1)
+          waiter.resolve(envelope.payload)
+        }
+      }
+    }
+  })()
+  return {
+    frames,
+    envelopes,
+    waitFor: (type) => {
+      const found = frames.find(frame => frame.type === type)
+      if (found !== undefined) return Promise.resolve(found)
+      return new Promise((resolve) => { waiters.push({ type, resolve }) })
+    },
+  }
+}
+
+function requestedOf(frame: MuxFrame): Extract<MuxFrame, { type: 'approval/requested' }> {
+  if (frame.type !== 'approval/requested') throw new Error(`expected approval/requested, got ${frame.type}`)
+  return frame
+}
+
+/** Wait until the stream delivered `count` frames of `type` (bounded poll; waitFor only covers the first). */
+async function waitForCount(mux: { frames: MuxFrame[] }, type: MuxFrame['type'], count: number): Promise<void> {
+  for (let i = 0; i < 200 && mux.frames.filter(frame => frame.type === type).length < count; i += 1) {
+    await new Promise(resolve => setTimeout(resolve, 5))
+  }
+  expect(mux.frames.filter(frame => frame.type === type).length).toBeGreaterThanOrEqual(count)
+}
+
+function answer(rpcId: RpcId, sessionId: unknown, approvalId: ApprovalRequestId, outcome: 'allowed-once' | 'rejected'): Parameters<ApiProxy['respond']>[0] {
+  return { type: 'client-response', rpcId, result: { ok: true, value: { sessionId, approvalId, outcome } } }
+}
+
+describe('approval pending registry', () => {
+  it('round-trips ask → requested frame → respond → outcome + resolved broadcast', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+
+    const asked = ctx.approval.request({ agent, toolName: 'bash', reason: 'sandbox escalation' })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    expect(requested).toMatchObject({ toolName: 'bash', reason: 'sandbox escalation', sessionId: agent.session.id })
+
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    const receipt = await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once'))
+    expect(receipt).toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('allowed-once')
+
+    const resolved = await mux.waitFor('approval/resolved')
+    expect(resolved).toMatchObject({ approvalId: requested.approvalId, outcome: 'allowed-once' })
+
+    // The question settled: a duplicate answer is late, not re-decidable.
+    const dup = await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'rejected'))
+    expect(dup).toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+  })
+
+  it('replays a still-pending requested frame (same rpcId) on a later mux open', async () => {
+    const { ctx, api } = await harness()
+    const first = new AbortController()
+    const firstMux = openMux(api, first)
+    const agent = agentOf(ctx)
+    const asked = ctx.approval.request({ agent, toolName: 'write' })
+    const requested = requestedOf(await firstMux.waitFor('approval/requested'))
+    const firstEnvelope = firstMux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    first.abort()
+
+    // A fresh subscriber (refresh recovery) sees the same stable rpcId.
+    const second = new AbortController()
+    const secondMux = openMux(api, second)
+    const replayed = requestedOf(await secondMux.waitFor('approval/requested'))
+    const secondEnvelope = secondMux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    expect(secondEnvelope.rpcId).toBe(firstEnvelope.rpcId)
+    expect(replayed.approvalId).toBe(requested.approvalId)
+
+    const receipt = await api.respond(answer(secondEnvelope.rpcId, replayed.sessionId, replayed.approvalId, 'rejected'))
+    expect(receipt).toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('rejected')
+    second.abort()
+  })
+
+  it('rejects malformed and mismatched answers as bad-response, unknown ids as not-pending', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    void ctx.approval.request({ agent, toolName: 'bash' })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+
+    // Unknown rpcId: not routed to any pending entry.
+    expect(await api.respond(answer(mintRpcId('ghost'), requested.sessionId, requested.approvalId, 'rejected')))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    // Error-branch result: the client can only answer with a value.
+    expect(await api.respond({ type: 'client-response', rpcId: envelope.rpcId, result: { ok: false, error: { code: 'internal', message: 'x', details: {} } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // Wrong audit correlation: the rpcId routed, but the payload disagrees.
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, 'other-approval' as ApprovalRequestId, 'rejected')))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // Malformed payload shape.
+    expect(await api.respond({ type: 'client-response', rpcId: envelope.rpcId, result: { ok: true, value: { nonsense: 1 } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    abort.abort()
+  })
+
+  it('withdraws the question on the ask signal: cancelled outcome, resolved broadcast, late answer not-pending', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const cancel = new AbortController()
+    const asked = ctx.approval.request({ agent, toolName: 'bash', signal: cancel.signal })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+
+    cancel.abort()
+    await expect(asked).resolves.toBe('cancelled')
+    const resolved = await mux.waitFor('approval/resolved')
+    expect(resolved).toMatchObject({ approvalId: requested.approvalId, outcome: 'cancelled' })
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once')))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+  })
+
+  it('carries callId on the frame and ignores a late abort after the answer settled', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const cancel = new AbortController()
+    const asked = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-9' as never, signal: cancel.signal })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    expect(requested.callId).toBe('call-9')
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('allowed-once')
+    // Late abort: the pending entry is gone; settle's delete-guard returns.
+    cancel.abort()
+    expect(mux.frames.filter(f => f.type === 'approval/resolved')).toHaveLength(1)
+    abort.abort()
+  })
+
+  it('pairs parallel asks by callId: each requested frame carries its own audit id', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    // Both asks append their approval/asked audit events before either
+    // answerer's microtask dispatch runs — the parallel tool-call window.
+    const askA = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-a' as never })
+    const askB = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-b' as never })
+    await waitForCount(mux, 'approval/requested', 2)
+    const frames = mux.envelopes.filter(e => e.payload.type === 'approval/requested')
+    const frameA = frames.find(e => requestedOf(e.payload).callId === 'call-a') as RpcRequest<MuxFrame>
+    const frameB = frames.find(e => requestedOf(e.payload).callId === 'call-b') as RpcRequest<MuxFrame>
+    // Each frame claimed the asked event with its own callId, not merely the newest.
+    const askedIdByCall = new Map(agent.session.events
+      .filter(event => event.type === 'approval/asked')
+      .map(event => [String(event.data.callId), event.data.id]))
+    expect(requestedOf(frameA.payload).approvalId).toBe(askedIdByCall.get('call-a'))
+    expect(requestedOf(frameB.payload).approvalId).toBe(askedIdByCall.get('call-b'))
+    // Answers route back to the right ask through the pairing.
+    expect(await api.respond(answer(frameB.rpcId, agent.session.id, requestedOf(frameB.payload).approvalId, 'rejected')))
+      .toEqual({ accepted: true })
+    expect(await api.respond(answer(frameA.rpcId, agent.session.id, requestedOf(frameA.payload).approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    await expect(askA).resolves.toBe('allowed-once')
+    await expect(askB).resolves.toBe('rejected')
+    abort.abort()
+  })
+
+  it('gives parallel callId-less asks distinct audit ids (claimed-entry skip); both stay answerable', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const askA = ctx.approval.request({ agent, toolName: 'alpha' })
+    const askB = ctx.approval.request({ agent, toolName: 'beta' })
+    await waitForCount(mux, 'approval/requested', 2)
+    const frames = mux.envelopes.filter(e => e.payload.type === 'approval/requested')
+    const frameA = frames.find(e => requestedOf(e.payload).toolName === 'alpha') as RpcRequest<MuxFrame>
+    const frameB = frames.find(e => requestedOf(e.payload).toolName === 'beta') as RpcRequest<MuxFrame>
+    // Without a callId the pairing is heuristic, but never shared: the second
+    // dispatch skips the id the first pending entry already claimed.
+    expect(requestedOf(frameA.payload).approvalId).not.toBe(requestedOf(frameB.payload).approvalId)
+    expect(await api.respond(answer(frameA.rpcId, agent.session.id, requestedOf(frameA.payload).approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    expect(await api.respond(answer(frameB.rpcId, agent.session.id, requestedOf(frameB.payload).approvalId, 'rejected')))
+      .toEqual({ accepted: true })
+    await expect(askA).resolves.toBe('allowed-once')
+    await expect(askB).resolves.toBe('rejected')
+    abort.abort()
+  })
+
+  it('delegates a dispatch whose only asked candidate is already decided (stale re-dispatch)', async () => {
+    const { ctx, api } = await harness()
+    void api // the answerer is registered; the fake below bypasses the service
+    // Bypass ApprovalService: a log whose sole asked event already has its
+    // decided partner must not be re-claimed — the answerer delegates.
+    const session = ctx.sessions.create()
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('approval/asked', { id: 'stale-ask' as ApprovalRequestId, toolName: 'bash' })
+    session.append('approval/decided', { id: 'stale-ask' as ApprovalRequestId, outcome: 'rejected' })
+    const agent = { session } as unknown as Agent
+    const outcome = await ctx.waterfall('approval/request', { agent, toolName: 'bash' }, () => Promise.resolve('unavailable' as const))
+    expect(outcome).toBe('unavailable')
+  })
+
+  it('delegates an ask whose session log carries no asked audit event (foreign channel)', async () => {
+    const { ctx, api } = await harness()
+    void api // the answerer is registered; the fake below bypasses the audit path
+    // Bypass ApprovalService: dispatch the waterfall directly with a session
+    // that has no approval/asked event — the proxy answerer must call next().
+    const session = ctx.sessions.create()
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const agent = { session } as unknown as Agent
+    const outcome = await ctx.waterfall('approval/request', { agent, toolName: 'x' }, () => Promise.resolve('unavailable' as const))
+    expect(outcome).toBe('unavailable')
+  })
+})

packages/host/runtime/tests/api-proxy-permission.spec.ts

@@ -0,0 +1,152 @@
+/**
+ * Permission select over the proxy: permissions() projects the preset table
+ * plus the derived current value (custom shown only when derived),
+ * setPermission() validates against the table and anchors idle switches to
+ * the next prompted turn (the ACP bridge's pendingSwitches pattern), and a
+ * permission-less composition serves an empty select instead of an error.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import PermissionService from '@deepseek-ai/dsh-permission'
+import type { ApiProxy, RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api'
+import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import type { SessionId } from '@deepseek-ai/dsh-session'
+import { createApiProxy } from '../src/api-proxy.ts'
+
+let nextRpc = 1
+function request<P>(payload: P): RpcRequest<P> {
+  return { rpcId: RpcId(`req-${String(nextRpc++)}`), payload }
+}
+
+async function harness(options: { permission?: boolean } = {}): Promise<{ ctx: Context; api: ApiProxy; sessionId: SessionId }> {
+  const ctx = new Context()
+  await ctx.plugin(SessionStore)
+  await ctx.plugin(SystemPrompt, { persona: '' })
+  await ctx.plugin(UserInteractionService)
+  await ctx.plugin(AgentRegistry)
+  if (options.permission !== false) {
+    // The permission service requires a confining executor fact + approval.
+    ctx.provide('bash', {
+      sandboxMode: 'workspace-write',
+      resolve() { throw new Error('permission proxy tests do not execute bash') },
+      run() { throw new Error('permission proxy tests do not execute bash') },
+      start() { throw new Error('permission proxy tests do not execute bash') },
+    })
+    await ctx.plugin(ApprovalService)
+    await ctx.plugin(PermissionService, {})
+  }
+  const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp' })
+  // No agent-loop in this harness: register a bare live agent directly (the
+  // proxy only reaches `.session`); api-proxy-view.spec.ts precedent.
+  const session = ctx.sessions.create()
+  ctx.agents.register({ id: session.id, session, status: 'idle', ctx } as Agent)
+  return { ctx, api, sessionId: session.id }
+}
+
+function expectOk<T>(response: { result: { ok: true; value: T } | { ok: false } }): T {
+  expect(response.result.ok).toBe(true)
+  if (!response.result.ok) throw new Error('unreachable')
+  return response.result.value
+}
+
+describe('session.permissions', () => {
+  it('projects the preset table with the effective current value; custom is absent when a preset matches', async () => {
+    const { api, sessionId } = await harness()
+    const value = expectOk<{ options: { value: string }[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value.currentValue).toBe('workspace-write')
+    expect(value.options.map(o => o.value)).toEqual(['workspace-write', 'danger-full-access'])
+  })
+
+  it('serves an empty select (custom) on a permission-less composition', async () => {
+    const { api, sessionId } = await harness({ permission: false })
+    const value = expectOk<{ options: unknown[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value).toEqual({ options: [], currentValue: 'custom' })
+  })
+
+  it('appends the derived custom option when the knobs match no preset', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('sandbox/mode', { mode: 'read-only' })
+    const value = expectOk<{ options: { value: string }[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value.currentValue).toBe('custom')
+    expect(value.options.map(o => o.value)).toEqual(['workspace-write', 'danger-full-access', 'custom'])
+  })
+
+  it('propagates the agentFor error for a ghost session (persistence-less harness: internal)', async () => {
+    // The not-found/internal split is agentFor's documented gate and already
+    // covered by the history specs; here only the pass-through matters.
+    const { api } = await harness()
+    const response = await api.sessions.permissions(request({ sessionId: 'session-void' as SessionId }))
+    expect(response.result.ok).toBe(false)
+  })
+})
+
+describe('session.setPermission', () => {
+  it('holds an idle switch pending (visible in permissions()) and flushes it into the next prompted turn', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    expect(agent).toBeDefined()
+    const switched = expectOk<{ currentValue: string }>(
+      await api.sessions.setPermission(request({ sessionId, value: 'danger-full-access' })))
+    expect(switched.currentValue).toBe('danger-full-access')
+    // No turn open: nothing appended yet; the pending value masks the fold.
+    expect(agent?.session.events.some(e => e.type === 'permission/preset')).toBe(false)
+    const echoed = expectOk<{ currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(echoed.currentValue).toBe('danger-full-access')
+
+    // The waterfall flush path: prompt-submit inside the new turn writes through.
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    await ctx.waterfall('agent/prompt-submit', agent as never, [], { kind: 'user' } as never, new AbortController().signal, () => Promise.resolve({ kind: 'allow' as const }))
+    expect(agent?.session.events.map(e => e.type)).toContain('permission/preset')
+    expect(agent?.session.events.map(e => e.type)).toContain('sandbox/mode')
+    expect(agent?.session.events.map(e => e.type)).toContain('approval/policy')
+  })
+
+  it('writes through immediately inside an open turn', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    expectOk(await api.sessions.setPermission(request({ sessionId, value: 'danger-full-access' })))
+    expect(agent?.session.events.map(e => e.type)).toContain('permission/preset')
+  })
+
+  it('acknowledges a current-value echo without recording a switch', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const echoed = expectOk<{ currentValue: string }>(
+      await api.sessions.setPermission(request({ sessionId, value: 'workspace-write' })))
+    expect(echoed.currentValue).toBe('workspace-write')
+    expect(agent?.session.events.some(e => e.type === 'permission/preset')).toBe(false)
+  })
+
+  it('propagates the agentFor error for a ghost session', async () => {
+    const { api } = await harness()
+    const response = await api.sessions.setPermission(request({ sessionId: 'session-void' as SessionId, value: 'workspace-write' }))
+    expect(response.result.ok).toBe(false)
+  })
+
+  it('rejects unknown values (custom included) and a permission-less composition as bad-request', async () => {
+    const { api, sessionId } = await harness()
+    for (const value of ['custom', 'nope']) {
+      const response = await api.sessions.setPermission(request({ sessionId, value }))
+      expect(response.result.ok).toBe(false)
+      if (!response.result.ok) expect(response.result.error.code).toBe('bad-request')
+    }
+    const bare = await harness({ permission: false })
+    const response = await bare.api.sessions.setPermission(request({ sessionId: bare.sessionId, value: 'workspace-write' }))
+    expect(response.result.ok).toBe(false)
+    if (!response.result.ok) expect(response.result.error.code).toBe('bad-request')
+  })
+})

packages/host/runtime/tsconfig.json

@@ -48,16 +48,31 @@
       "path": "../../session-persistence/session-persistence-jsonl"
     },
     {
-      "path": "../../bash/bash-local"
+      "path": "../../bash/bash-sandbox"
     },
     {
       "path": "../../bash/tool-bash"
     },
+    {
+      "path": "../../sandbox/sandbox"
+    },
+    {
+      "path": "../../sandbox/sandbox-local"
+    },
+    {
+      "path": "../../sandbox/sandbox-policy"
+    },
+    {
+      "path": "../../ui/user-approval"
+    },
+    {
+      "path": "../../ui/permission"
+    },
     {
       "path": "../../compact/compact-basic"
     },
     {
-      "path": "../../fs/fs-local"
+      "path": "../../fs/fs-sandbox"
     },
     {
       "path": "../../fs/fs-policy"

packages/ui/acp/src/index.ts

@@ -60,7 +60,7 @@ import {
 } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-commands'
 import { encodeSessionReferenceUri } from '@deepseek-ai/dsh-session-reference'
-import { displayPromptContent, SessionId, type JsonValue } from '@deepseek-ai/dsh-session'
+import { displayPromptContent, hasOpenTurn, SessionId, type JsonValue } from '@deepseek-ai/dsh-session'
 // Side-effect type import: resolves `ctx.get('permission')` to the service.
 import type {} from '@deepseek-ai/dsh-permission'
 import type { SessionEvent, TodoItem, TurnEndReason } from '@deepseek-ai/dsh-session'
@@ -708,17 +708,6 @@ export function apply(ctx: Context, config: AcpConfig): void {
     }]
   }
 
-  /** Whether the log has an open turn in which a config switch can be enclosed. */
-  const isTurnOpen = (agent: Agent): boolean => {
-    const events = agent.session.events
-    for (let index = events.length - 1; index >= 0; index -= 1) {
-      const type = (events[index] as SessionEvent).type
-      if (type === 'turn/start') return true
-      if (type === 'turn/end') return false
-    }
-    return false
-  }
-
   /** Anchor last-write-wins idle switches into a just-opened turn. */
   const flushPendingSwitches = (rec: SessionRecord): void => {
     const pending = rec.pendingSwitches
@@ -1159,7 +1148,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
             if (!presets.names.includes(params.value)) {
               throw invalidParams(`unknown permission value ${JSON.stringify(params.value)}`)
             }
-            if (isTurnOpen(rec.agent)) presets.set(rec.agent.session, params.value)
+            if (hasOpenTurn(rec.agent.session.events)) presets.set(rec.agent.session, params.value)
             else rec.pendingSwitches.preset = params.value
             break
           }

packages/ui/user-approval/src/index.ts

@@ -11,6 +11,7 @@ import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { CallId } from '@deepseek-ai/dsh-llm'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
+import { hasOpenTurn } from '@deepseek-ai/dsh-session'
 import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 
@@ -138,22 +139,6 @@ export function effectiveApprovalPolicy(events: readonly SessionEvent[]): Approv
   return undefined
 }
 
-/**
- * Whether the log currently sits inside an open turn (a `turn/start` not yet
- * closed by a `turn/end`) — the {@link ApprovalService.request} precondition.
- * The audit pair must be turn-enclosed: the turn is the durable log's
- * commit/replay boundary, so a bare event appended between turns is
- * indistinguishable from a crash tail and silently dropped on reload.
- */
-function hasOpenTurn(events: readonly SessionEvent[]): boolean {
-  for (let index = events.length - 1; index >= 0; index -= 1) {
-    const type = (events[index] as SessionEvent).type
-    if (type === 'turn/start') return true
-    if (type === 'turn/end') return false
-  }
-  return false
-}
-
 /**
  * Append the sole durable representation of a session policy override. Invalid
  * values throw before the log changes; consumers fold the new value on each read.

pnpm-lock.yaml

@@ -2091,18 +2091,18 @@ importers:
       '@deepseek-ai/dsh-agent-loop':
         specifier: workspace:^
         version: link:../../core/agent-loop
-      '@deepseek-ai/dsh-bash-local':
+      '@deepseek-ai/dsh-bash-sandbox':
         specifier: workspace:^
-        version: link:../../bash/bash-local
+        version: link:../../bash/bash-sandbox
       '@deepseek-ai/dsh-compact-basic':
         specifier: workspace:^
         version: link:../../compact/compact-basic
-      '@deepseek-ai/dsh-fs-local':
-        specifier: workspace:^
-        version: link:../../fs/fs-local
       '@deepseek-ai/dsh-fs-policy':
         specifier: workspace:^
         version: link:../../fs/fs-policy
+      '@deepseek-ai/dsh-fs-sandbox':
+        specifier: workspace:^
+        version: link:../../fs/fs-sandbox
       '@deepseek-ai/dsh-host-apiproxy':
         specifier: workspace:^
         version: link:../apiproxy
@@ -2112,6 +2112,18 @@ importers:
       '@deepseek-ai/dsh-llm-deepseek':
         specifier: workspace:^
         version: link:../../llm/llm-deepseek
+      '@deepseek-ai/dsh-permission':
+        specifier: workspace:^
+        version: link:../../ui/permission
+      '@deepseek-ai/dsh-sandbox':
+        specifier: workspace:^
+        version: link:../../sandbox/sandbox
+      '@deepseek-ai/dsh-sandbox-local':
+        specifier: workspace:^
+        version: link:../../sandbox/sandbox-local
+      '@deepseek-ai/dsh-sandbox-policy':
+        specifier: workspace:^
+        version: link:../../sandbox/sandbox-policy
       '@deepseek-ai/dsh-session':
         specifier: workspace:^
         version: link:../../core/session
@@ -2187,6 +2199,9 @@ importers:
       '@deepseek-ai/dsh-tools':
         specifier: workspace:^
         version: link:../../core/tools
+      '@deepseek-ai/dsh-user-approval':
+        specifier: workspace:^
+        version: link:../../ui/user-approval
       '@deepseek-ai/dsh-user-interaction':
         specifier: workspace:^
         version: link:../../ui/user-interaction