feat(modes): per-session sandbox/approval switching — the session log as the store, ACP config options

effective(session) = findLast(the session own knob events)?.value ?? the
composition-config default. One log-only event per knob, owned by its
domain (bash/sandbox-mode in dsh-bash, approval/policy in dsh-approval),
each exporting the same three-piece kit: the event declaration, a pure
fold, and THE write path — a switch IS its event; no owner service, no
facts map. Restart immunity and multi-session isolation fall out of the
log replay by construction.

Execution follows the fold on both sides: the bash tool stamps
escalation grant > session override > executor default, and the approval
seam prepends the never-gate that auto-rejects before any interactive
answerer. Visibility is two layers per knob: a per-agent prompt section
states the effective value on every request (logged through
request/header*, so what-the-model-was-told replays from the log), and an
agent/pre-step narrator injects at most one coalesced delta notice with
positional attribution (user switch vs operator/config drift). The ACP
bridge advertises one capability-gated select per composable knob with
currentValue folded per session, validates set_config_option against the
closed vocabularies, and anchors idle switches at the next turn
prompt-submit under the turn-enclosure contract.

packages/bash/tool-bash/src/index.ts

@@ -41,8 +41,16 @@
  * through `ctx.approval` BEFORE anything executes and failing closed on every
  * unanswerable path. The fields exist only when the mounted executor reports
  * a confining default (`ctx.bash.sandboxMode`) — a lever is never advertised
- * that the composition cannot honor. Per-session mode switching is the
- * sandbox RFC's staged follow-up.
+ * that the composition cannot honor.
+ *
+ * Per-session mode switching (the sandbox RFC § Per-session mode switching): a session may carry a
+ * standing sandbox-mode override — the `bash/sandbox-mode` event fold from
+ * `@deepseek-ai/dsh-bash` — which this plugin makes real at EXECUTION: each
+ * call is stamped `escalation grant > session override > executor default`.
+ * The prompt deliberately does NOT state the mode and no switch is narrated:
+ * the model learns the boundary from the denial marker (which names the mode
+ * it ran under) exactly when it matters, instead of preemptively refusing
+ * work a standing declaration would discourage.
  *
  * @module @deepseek-ai/dsh-tool-bash
  */
@@ -59,7 +67,7 @@ import type {} from '@deepseek-ai/dsh-system-prompt'
 // stays optional at runtime, same pattern as dsh-tools' ask routing).
 import type {} from '@deepseek-ai/dsh-approval'
 import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
-import { BashTaskId, OwnerToken } from '@deepseek-ai/dsh-bash'
+import { BashTaskId, OwnerToken, effectiveSandboxMode } from '@deepseek-ai/dsh-bash'
 import type { BashRunResult, BashTask, CollectedOutput } from '@deepseek-ai/dsh-bash'
 
 export const name = 'tool-bash'
@@ -472,6 +480,19 @@ export function apply(ctx: Context): void {
   const defaultMode = ctx.bash.sandboxMode
   const escalationModes: readonly SandboxMode[] = defaultMode === undefined ? [] : ESCALATION_TARGETS
 
+  /**
+   * The session's standing mode override for an ordinary (non-escalating)
+   * call: the `bash/sandbox-mode` fold of the calling agent's log, stamped
+   * onto the request so EXECUTION follows the same effective mode the prompt
+   * section states. Weakest precedence — an escalation grant (freshly
+   * approved for exactly this call) outranks it, and without either the
+   * executor's `resolve()` applies its configured default. Undefined for a
+   * non-sandboxing executor (nothing honors it) and for agent-less callers
+   * (no session to fold).
+   */
+  const sessionOverride = (exec: ToolExecution): SandboxMode | undefined =>
+    defaultMode === undefined || exec.agent === undefined ? undefined : effectiveSandboxMode(exec.agent.session.events)
+
   /**
    * Resolve a sandbox-escalation request through `ctx.approval` BEFORE
    * anything executes. Returns the granted mode to stamp onto the bash
@@ -493,10 +514,12 @@ export function apply(ctx: Context): void {
       throw new Error('sandbox_permissions is not available in this composition (no sandboxing executor to escalate)')
     }
     // Strict widening is an EXECUTION check against the call's effective
-    // mode, deliberately not a schema constraint (the enum is the closed
-    // target vocabulary; the effective mode is per-call truth). A
-    // non-widening request fails closed here and never prompts a human.
-    const effectiveMode = defaultMode as SandboxMode
+    // mode — session override ?? executor default, the same fold ordinary
+    // calls are stamped with — deliberately not a schema constraint (the
+    // enum is the closed target vocabulary; the effective mode is per-call
+    // truth). A non-widening request fails closed here and never prompts a
+    // human.
+    const effectiveMode = (sessionOverride(exec) ?? defaultMode) as SandboxMode
     if (!(WIDER_MODES[effectiveMode] ?? []).includes(mode as SandboxMode)) {
       throw new Error(`sandbox escalation to "${mode}" is not strictly wider than this call's current "${effectiveMode}" mode`)
     }
@@ -564,9 +587,11 @@ export function apply(ctx: Context): void {
       // An escalating call resolves approval BEFORE anything executes; every
       // non-grant outcome throws its distinct error text and runs nothing.
       // (validateBashArgs pinned the pairing, so the double narrow is exact.)
+      // An ordinary call carries the session's standing override instead —
+      // grant > session override > executor default (see sessionOverride).
       const sandboxMode = args.sandbox_permissions !== undefined && args.justification !== undefined
         ? await approveEscalation(args.sandbox_permissions, args.justification, exec)
-        : undefined
+        : sessionOverride(exec)
       // Default the workdir to the calling agent's session cwd so each ACP
       // session runs in its own workspace (see resolveWorkdir); an explicit
       // model workdir still wins.