5569f3f8ac
The automation-only rewrite edited many implemented Agent Notes; several edits replaced still-live or historical rationale instead of reframing: - llm-model-catalog: restore the prompt/request consistency section and selection-ownership alternatives — installAgentLlmTarget and the TUI /model selector still ship that design; only the ACP wire is gone. - plan-specific-collaboration-state, acp-multi-session, todo-write, ask-user-question: link the superseding automation-only note instead of silently rewriting the original decision or motivation; drop a paragraph duplicating the Web-provider facts stated two paragraphs up. - sandbox: stop claiming unit coverage for turn-enclosed config writes (that mechanism left with the bridge) and retitle the commit-boundary paragraph accordingly. - Fix the missing blank line before '## Consequences' in the plugin-command-registration pair, the JSON-RPC/Web render-intent consumer misattribution (the second consumer is the host/client runtime), stale bash_output/bash_kill names, and 'optional goals' in architecture.md. - examples/acp-agent/README.md: point at the package contract instead of restating it; packages/ui/permission and plan-mode READMEs record the consumer-less preset service and the exit_plan_mode coverage gap under Known Limitations. - 2026-06-19-acp-snapshot-tests: the new note defers the corpus migration rather than committing to it; say so. Re-record the touched bilingual pairs.
@deepseek-ai/dsh-permission
User-facing permission presets through ctx.permission (PermissionService). Each configured name bundles sandbox/mode with approval/policy; the defaults are workspace-write (workspace-write + ask) and danger-full-access (danger-full-access + never). UI adapters may expose the table as one selector, while sandbox execution and approval continue to consume their own knobs.
set(session, name) records a changed selection in a log-only permission/preset event, then calls each knob's setter only when its effective value changes. The selection event precedes the knob events and preserves user intent when presets share a bundle; a net-zero selection appends nothing. current(events) prefers a still-matching recorded selection, then the first matching table entry, and otherwise returns custom. Clients may display custom as the current value, but cannot select it.
The service requires a confining ctx.bash executor and ctx.approval. A table entry named custom throws at load; composition defaults outside the table instead make a zero-event session derive custom. See the sandbox switching design.
Model Experience
Indirectly, through dsh-user-approval and dsh-tool-bash, which render the approval-policy prompt, switch notice, and sandboxed tool outcomes selected by this service's knob events; permission/preset itself is log-only.
KV Cache effect
No direct invalidation; the named consumer owns any request-prefix changes.
Known Limitations and Deferred Work
- No shipped composition currently mounts the service — the ACP bridge was its only selector before ACP became automation-only; the preset table is kept for the interactive front door that next exposes a runtime policy switch.
- Only two mechanism knobs are bundled — presets select sandbox mode and approval policy; an agent/profile choice is not part of
PresetSpecyet. customis derived-only — callers can switch away from an unmatched knob combination but cannot target or persist a named custom preset through this service.- The preset table is process-level — configuration is fixed for the plugin lifetime; changing available presets requires reloading the plugin.