feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity

Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.

- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
  deployment default mode + workspaceRoot and the per-session override event,
  renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
  Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
  write/edit by the per-call mode (read-only denies, workspace-write contains to
  the workspace + temp roots via the shared writableRoots, danger passes
  through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
  re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
  ladder, denial/hint markers, approveEscalation) both tool families use;
  approveEscalation takes a structural approver so dsh-sandbox gains no
  approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
  confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
  and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
  that disabled the fs stack under confined modes.

RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.

packages/fs/fs/package.json

@@ -24,11 +24,13 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-brand": "^0.0.1",
     "@deepseek-ai/dsh-llm": "^0.0.1",
+    "@deepseek-ai/dsh-sandbox": "^0.0.1",
     "cordis": "^4.0.0-rc.6"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-brand": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
+    "@deepseek-ai/dsh-sandbox": "workspace:^",
     "cordis": "^4.0.0-rc.6"
   }
 }

packages/fs/fs/src/index.ts

@@ -58,6 +58,7 @@
  */
 
 import { Context, Service } from 'cordis'
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
 import type {
   FsDirEntry,
   FsEditOutcome,
@@ -174,6 +175,22 @@ export abstract class FileSystem extends Service {
     super(ctx, 'fs')
   }
 
+  /**
+   * The sandbox mode this backend enforces on mutations BY DEFAULT, or
+   * `undefined` when it does not confine at all — the capability fact the tool
+   * layer reads to advertise the escalation fields honestly (mirrors
+   * `BashExecutor.sandboxMode`). The base class and the bare local backend
+   * report `undefined`; a sandboxing backend (`@deepseek-ai/dsh-fs-sandbox`)
+   * overrides it with the deployment default. A session override may make the
+   * effective mode narrower or wider, so strict escalation widening is checked
+   * per call rather than encoded in this default-relative fact.
+   * @returns the configured default mode of a sandboxing backend; `undefined`
+   *   for a backend that never confines.
+   */
+  get sandboxMode(): SandboxMode | undefined {
+    return undefined
+  }
+
   /**
    * Resolve a model/plugin-supplied path into a stable {@link FsTarget}. May
    * perform I/O (a remote/sandboxed backend may need a round-trip to map a path
@@ -238,9 +255,18 @@ export abstract class FileSystem extends Service {
    * @param content - the full new file content.
    * @param expected - the write intent guarding the write; omit for unconditional.
    * @param signal - aborts before the atomic rename takes effect.
+   * @param sandboxMode - the per-call sandbox mode this write runs under; a
+   *   sandboxing backend fences the write by it, the bare backend ignores it.
+   *   Omit to leave the backend its own default.
    * @returns the outcome, including the version the write produced.
    */
-  abstract writeText(target: FsTarget, content: string, expected?: FsWriteIntent, signal?: AbortSignal): Promise<FsWriteOutcome>
+  abstract writeText(
+    target: FsTarget,
+    content: string,
+    expected?: FsWriteIntent,
+    signal?: AbortSignal,
+    sandboxMode?: SandboxMode,
+  ): Promise<FsWriteOutcome>
 
   /**
    * Apply a literal edit to an existing UTF-8 text file. When `expected` is
@@ -252,9 +278,18 @@ export abstract class FileSystem extends Service {
    * @param edit - the literal search/replace request.
    * @param expected - the version guard; omit for an unconditional edit.
    * @param signal - aborts before the atomic rename takes effect.
+   * @param sandboxMode - the per-call sandbox mode this edit runs under; a
+   *   sandboxing backend fences the edit by it, the bare backend ignores it.
+   *   Omit to leave the backend its own default.
    * @returns the outcome, including the version the edit produced.
    */
-  abstract editText(target: FsTarget, edit: FsEditRequest, expected?: { version: FsVersion }, signal?: AbortSignal): Promise<FsEditOutcome>
+  abstract editText(
+    target: FsTarget,
+    edit: FsEditRequest,
+    expected?: { version: FsVersion },
+    signal?: AbortSignal,
+    sandboxMode?: SandboxMode,
+  ): Promise<FsEditOutcome>
 }
 
 export default FileSystem

packages/fs/fs/src/types.ts

@@ -173,6 +173,7 @@ export type FsErrorCode =
   | 'FS_NOT_TEXT'
   | 'FS_NOT_REGULAR_FILE'
   | 'FS_PERMISSION_DENIED'
+  | 'FS_SANDBOX_DENIED'
   | 'FS_IO_ERROR'
   | 'FS_STALE_VERSION'
   | 'FS_NOT_OBSERVED'

packages/fs/fs/tsconfig.json

@@ -9,6 +9,7 @@
     { "path": "../../../vendor/cosmokit" },
     { "path": "../../../vendor/cordis" },
     { "path": "../../util/brand" },
-    { "path": "../../llm/llm" }
+    { "path": "../../llm/llm" },
+    { "path": "../../sandbox/sandbox" }
   ]
 }