Default shipped UI sessions to workspace-write

apps/cli/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/README.md
-README.md: e2567bebea80b154c01d1cad8094008818e5fd13
-README.zh.md: a3b7f433040ce0ff02848e3741f407dffe8f8cb8
+README.md: c43658e066b42c58252b1665c2cd3883d5cb5d4b
+README.zh.md: 0690231e637135f6f2481880bee520958ad5b5c0

apps/cli/README.md

@@ -23,6 +23,8 @@ The TUI surface:
 
 The Web and headless surfaces boot `base.cordis.yml` plus `web.cordis.yml`, then apply `$DSH_HOME/config.yaml`; an explicit `--config <path>` replaces that personal overlay. Both surfaces otherwise share the same composition: both treat the invoking directory as the default project and Workspace root, create named Workspaces beneath that root unless `--workspace-root <path>` overrides it, load applicable `AGENTS.md`/`CLAUDE.md` instructions into each agent-loop request prefix with a 65,536-byte render budget, opt into first-message model titles, use the same bounded transient model-request retry policy as the TUI, and mount a disposable in-memory SQLite content-index service. That service is ACTIVE at boot, while its `node:sqlite` module and database handle open only on the first content search. This keeps Node 22 startup output free of SQLite's experimental warning before search is used; the first actual search may still emit the runtime warning. Each service instance owns its database, so parallel invocations neither share unsupported SQLite state nor leave derived index files behind, and the first search lazily reconciles live and persisted logs. Headless differs only in listening on an OS-assigned port (parallel `dsh -p` runs never collide; the stderr-printed URL opens the live session in a browser). Both need the frontend dist and client bundles built (`pnpm run build && pnpm run build:web`).
 
+The shared composition defaults new TUI, Web, and headless sessions to the `workspace-write` permission preset (`workspace-write` file mode plus `ask` approval policy). Sandbox-enforced bash and filesystem mutations may write only under the session workspace and platform temporary roots; reads, network access, and process visibility are not confined. The browser answers one-shot approval requests and exposes the Access picker; the TUI exposes `/permission`, but has no approval-request answerer, so an automatic wider retry there fails closed until the user deliberately changes the session preset. `DSH_PERMISSION_MODE` changes the process fallback, while a stored General-settings Permission value applies to later sessions without changing an open one.
+
 The shipped TUI and Web compositions register the native DeepSeek adapter plus pi-ai OpenAI and Anthropic profiles. Credentials and endpoint overrides come from the provider-standard `DEEPSEEK_API_KEY` / `DEEPSEEK_BASE_URL`, `OPENAI_API_KEY` / `OPENAI_BASE_URL`, and `ANTHROPIC_API_KEY` / `ANTHROPIC_BASE_URL` pairs in the boot's layered environment.
 
 Every surface also registers `web_search` and only `web_search`. Search uses DeepSeek's Anthropic-compatible Messages endpoint, resolves the same `DEEPSEEK_API_KEY` reference for every call, and accepts the separate `DEEPSEEK_SEARCH_BASE_URL` endpoint override; each search is an auxiliary model request with its own latency and token cost. `web_fetch` remains disabled and the composition mounts no default fetch provider, so deployments that need arbitrary page retrieval must opt in through an overlay. The deployment decision and its security boundary live in the [default Web search Agent Note](../../.agents/notes/implemented/feature/2026-07-31-web-default-search.md).

apps/cli/README.zh.md

@@ -23,6 +23,8 @@ TUI 界面：
 
 Web 和无头界面启动 `base.cordis.yml` 与 `web.cordis.yml`，随后应用 `$DSH_HOME/config.yaml`；显式的 `--config <path>` 会替代该个人覆盖。除此之外，两者共享同一套组合：两者都将调用目录视为默认项目和 Workspace 根目录，除非通过 `--workspace-root <path>` 覆盖，否则会在该根目录下创建具名 Workspace；它们会把适用的 `AGENTS.md`/`CLAUDE.md` 指令加载到每个 agent-loop 请求前缀中，渲染预算为 65,536 字节，选用首条消息模型标题，采用与 TUI 相同的有界暂时性模型请求重试策略，并挂载一个可丢弃的内存 SQLite 内容索引服务。该服务在启动时处于 ACTIVE 状态，但其 `node:sqlite` 模块与数据库句柄分别要到首次内容搜索才会导入和打开。这样可使 Node 22 在尚未使用搜索时的启动输出不出现 SQLite 实验性警告；首次实际搜索仍可能发出运行时警告。每个服务实例独占自己的数据库，因此并行调用既不会共享不受支持的 SQLite 状态，也不会留下派生索引文件，首次搜索还会惰性对账实时日志与持久化日志。无头界面唯一的差异是监听操作系统分配的端口（并行 `dsh -p` 运行绝不冲突；stderr 打印的 URL 会在浏览器中打开实时会话）。两者都需要先构建前端 dist 和客户端 bundle（`pnpm run build && pnpm run build:web`）。
 
+共享组合把新建 TUI、Web 和无头会话的权限默认设为 `workspace-write` preset（`workspace-write` 文件模式加 `ask` 审批策略）。由沙箱强制约束的 bash 与文件系统修改只能写入会话工作区和平台临时根目录；读取、网络访问和进程可见性不受该策略约束。浏览器可以应答一次性审批请求，并提供 Access 选择器；TUI 提供 `/permission`，但没有审批请求应答者，因此自动请求更宽权限的重试会以拒绝方式关闭，直到用户主动更改会话 preset。`DSH_PERMISSION_MODE` 会更改进程回退值，而「通用」设置中已存储的「权限」值只适用于之后的会话，不会更改已打开的会话。
+
 已交付的 TUI 和 Web 组合会注册原生 DeepSeek 适配器，以及 pi-ai 的 OpenAI 和 Anthropic 提供方配置。凭据和端点覆盖来自启动分层环境中的提供方标准变量对：`DEEPSEEK_API_KEY` / `DEEPSEEK_BASE_URL`、`OPENAI_API_KEY` / `OPENAI_BASE_URL` 和 `ANTHROPIC_API_KEY` / `ANTHROPIC_BASE_URL`。
 
 每个界面也都只注册 `web_search` 这一个 Web 工具。搜索使用 DeepSeek 的 Anthropic 兼容 Messages 端点，每次调用都会解析同一个 `DEEPSEEK_API_KEY` 凭据引用，并接受独立的 `DEEPSEEK_SEARCH_BASE_URL` 端点覆盖；每次搜索都是一次辅助模型请求，会产生独立的延迟与 token 成本。`web_fetch` 仍处于禁用状态，组合也未挂载默认抓取提供方；需要任意页面抓取能力的部署必须通过覆盖层选择启用。部署决策及其安全边界见[默认 Web 搜索 Agent Note](../../.agents/notes/implemented/feature/2026-07-31-web-default-search.md)。

apps/cli/composition.md

@@ -42,8 +42,16 @@ flowchart LR
   cfg --> plugin_tui_telemetry_otel
   plugin_tui_subprocess["subprocess<br/>@deepseek-ai/dsh-subprocess-local"]
   cfg --> plugin_tui_subprocess
-  plugin_tui_bash_local["bash-local<br/>@deepseek-ai/dsh-bash-local"]
-  cfg --> plugin_tui_bash_local
+  plugin_tui_sandbox["sandbox<br/>@deepseek-ai/dsh-sandbox-local"]
+  cfg --> plugin_tui_sandbox
+  plugin_tui_sandbox_policy["sandbox-policy<br/>@deepseek-ai/dsh-sandbox-policy"]
+  cfg --> plugin_tui_sandbox_policy
+  plugin_tui_bash_sandbox["bash-sandbox<br/>@deepseek-ai/dsh-bash-sandbox"]
+  cfg --> plugin_tui_bash_sandbox
+  plugin_tui_approval["approval<br/>@deepseek-ai/dsh-user-approval"]
+  cfg --> plugin_tui_approval
+  plugin_tui_permission["permission<br/>@deepseek-ai/dsh-permission"]
+  cfg --> plugin_tui_permission
   plugin_tui_tool_bash["tool-bash<br/>@deepseek-ai/dsh-tool-bash"]
   cfg --> plugin_tui_tool_bash
   plugin_tui_tool_tasks["tool-tasks<br/>@deepseek-ai/dsh-tool-tasks"]
@@ -126,8 +134,8 @@ flowchart LR
   cfg --> plugin_tui_system_prompt
   plugin_tui_agent_loop["agent-loop<br/>@deepseek-ai/dsh-agent-loop"]
   cfg --> plugin_tui_agent_loop
-  plugin_tui_fs_local["fs-local<br/>@deepseek-ai/dsh-fs-local"]
-  cfg --> plugin_tui_fs_local
+  plugin_tui_fs_sandbox["fs-sandbox<br/>@deepseek-ai/dsh-fs-sandbox"]
+  cfg --> plugin_tui_fs_sandbox
   plugin_tui_llm_deepseek["llm-deepseek<br/>@deepseek-ai/dsh-llm-deepseek"]
   cfg --> plugin_tui_llm_deepseek
 ```
@@ -151,7 +159,11 @@ flowchart LR
 | `session-query-sqlite` | `@deepseek-ai/dsh-session-query-sqlite` |
 | `telemetry-otel` | `@deepseek-ai/dsh-session-telemetry-otel` |
 | `subprocess` | `@deepseek-ai/dsh-subprocess-local` |
-| `bash-local` | `@deepseek-ai/dsh-bash-local` |
+| `sandbox` | `@deepseek-ai/dsh-sandbox-local` |
+| `sandbox-policy` | `@deepseek-ai/dsh-sandbox-policy` |
+| `bash-sandbox` | `@deepseek-ai/dsh-bash-sandbox` |
+| `approval` | `@deepseek-ai/dsh-user-approval` |
+| `permission` | `@deepseek-ai/dsh-permission` |
 | `tool-bash` | `@deepseek-ai/dsh-tool-bash` |
 | `tool-tasks` | `@deepseek-ai/dsh-tool-tasks` |
 | `fs-policy` | `@deepseek-ai/dsh-fs-policy` |
@@ -193,7 +205,7 @@ flowchart LR
 | `tools` | `@deepseek-ai/dsh-tools` |
 | `system-prompt` | `@deepseek-ai/dsh-system-prompt` |
 | `agent-loop` | `@deepseek-ai/dsh-agent-loop` |
-| `fs-local` | `@deepseek-ai/dsh-fs-local` |
+| `fs-sandbox` | `@deepseek-ai/dsh-fs-sandbox` |
 | `llm-deepseek` | `@deepseek-ai/dsh-llm-deepseek` |
 
 Source config: [`apps/cli/config/base.cordis.yml`](config/base.cordis.yml).

apps/cli/config/base.cordis.yml

@@ -131,11 +131,42 @@
 - id: subprocess
   name: '@deepseek-ai/dsh-subprocess-local'
 
-- id: bash-local
-  name: '@deepseek-ai/dsh-bash-local'
+# Every shipped product surface starts with the same file-effect boundary.
+# The environment remains an explicit deployment override; otherwise fresh
+# sessions pin workspace-write + ask through the permission service below.
+- id: sandbox
+  name: '@deepseek-ai/dsh-sandbox-local'
+
+- id: sandbox-policy
+  name: '@deepseek-ai/dsh-sandbox-policy'
+  config:
+    mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
+    workspaceRoot: !!js process.cwd()
+
+- id: bash-sandbox
+  name: '@deepseek-ai/dsh-bash-sandbox'
   config:
     timeoutMs: 60000
 
+- id: approval
+  name: '@deepseek-ai/dsh-user-approval'
+  config:
+    policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'never' : 'ask'"
+
+- id: permission
+  name: '@deepseek-ai/dsh-permission'
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
 
@@ -339,10 +370,10 @@
   config:
     agents: []
 
-# The filesystem provider. `cwd` defaults to the package's `process.cwd()`; the
-# TUI states it explicitly because that value is also the session workspace.
-- id: fs-local
-  name: '@deepseek-ai/dsh-fs-local'
+# The sandboxed filesystem provider. `cwd` defaults to `process.cwd()`; the TUI
+# states it explicitly because that value is also the session workspace.
+- id: fs-sandbox
+  name: '@deepseek-ai/dsh-fs-sandbox'
 
 # The native DeepSeek adapter. No key or endpoint is inlined: both resolve per
 # request from the `llm-deepseek:` settings section over this entry, with the

apps/cli/config/tui.cordis.yml

@@ -46,7 +46,7 @@
     reasoningEffort: max
 
 # This single-session app resolves relative paths from the process cwd.
-- id: fs-local
+- id: fs-sandbox
   config:
     cwd: !!js process.cwd()
 

apps/cli/config/web.cordis.yml

@@ -36,50 +36,6 @@
     apiKey: !!js process.env.DEEPSEEK_API_KEY
     baseURL: !!js process.env.DEEPSEEK_BASE_URL
 
-# The web surface replaces the unrestricted local executors with the shared
-# sandbox policy. Its default preserves the previous unrestricted behavior;
-# DSH_PERMISSION_MODE and the browser permission picker can confine a session.
-- insert:
-    - id: sandbox
-      name: '@deepseek-ai/dsh-sandbox-local'
-
-    - id: sandbox-policy
-      name: '@deepseek-ai/dsh-sandbox-policy'
-      config:
-        mode: !!js process.env.DSH_PERMISSION_MODE ?? 'danger-full-access'
-        workspaceRoot: !!js process.cwd()
-
-    - id: bash-sandbox
-      name: '@deepseek-ai/dsh-bash-sandbox'
-
-    - id: approval
-      name: '@deepseek-ai/dsh-user-approval'
-      config:
-        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'danger-full-access') === 'danger-full-access' ? 'never' : 'ask'"
-
-    - id: permission
-      name: '@deepseek-ai/dsh-permission'
-      config:
-        presets:
-          read-only:
-            sandbox: read-only
-            approval: ask
-          workspace-write:
-            sandbox: workspace-write
-            approval: ask
-          danger-full-access:
-            sandbox: danger-full-access
-            approval: never
-
-    - id: fs-sandbox
-      name: '@deepseek-ai/dsh-fs-sandbox'
-
-- id: bash-local
-  disabled: true
-
-- id: fs-local
-  disabled: true
-
 # ── web-only host rows, the transport layer, and the browser roster ─────────
 
 # `dshClient` rows are the browser roster the modules node half scans into

apps/cli/tests/shipped-composition.e2e.ts

@@ -11,6 +11,7 @@ import { acknowledgeTuiFirstRunWelcome } from '../src/tui-onboarding/tui-first-r
 
 const dshBinScript = fileURLToPath(new URL('../src/bin.ts', import.meta.url))
 const tsconfigPath = fileURLToPath(new URL('../../../tsconfig.json', import.meta.url))
+const PERMISSION_SUMMARY = 'current preset workspace-write (available: read-only, workspace-write, danger-full-access)'
 // An overlay over the shipped tree, so the catalog under test is the one
 // `base.cordis.yml` + `tui.cordis.yml` assemble; the tail only swaps the model
 // and redirects session artifacts.
@@ -67,6 +68,8 @@ interface LoggedHeader {
   names: string[]
   /** `bash`'s assembled parameter properties; the escalation pair is present only under a confining executor. */
   bashArguments: Record<string, unknown>
+  /** Initial permission facts pinned by the shipped composition. */
+  permissionEvents: Array<[string, unknown]>
 }
 
 /**
@@ -82,18 +85,22 @@ async function loggedHeader(cwd: string): Promise<LoggedHeader> {
   // A single keyless run writes one session log.
   const logRelPath = entries.find(name => name.endsWith('.jsonl'))
   if (logRelPath === undefined) throw new Error(`no session log written under ${sessionsDir}`)
-  const lines = (await readFile(join(sessionsDir, logRelPath), 'utf8')).split('\n').filter(Boolean)
-  for (const line of lines) {
-    const event = JSON.parse(line) as SessionEvent
-    if (event.type !== 'request/header') continue
-    const tools = event.data.header.tools ?? []
-    const bash = tools.find(schema => schema.name === 'bash')
-    return {
-      names: tools.map(schema => schema.name).sort(),
-      bashArguments: (bash?.parameters as { properties?: Record<string, unknown> } | undefined)?.properties ?? {},
-    }
+  const events = (await readFile(join(sessionsDir, logRelPath), 'utf8')).split('\n').filter(Boolean)
+    .map(line => JSON.parse(line) as SessionEvent)
+  const header = events.find(event => event.type === 'request/header')
+  if (header === undefined || header.type !== 'request/header') {
+    throw new Error(`session log ${logRelPath} has no request/header event`)
+  }
+  const tools = header.data.header.tools ?? []
+  const bash = tools.find(schema => schema.name === 'bash')
+  return {
+    names: tools.map(schema => schema.name).sort(),
+    bashArguments: (bash?.parameters as { properties?: Record<string, unknown> } | undefined)?.properties ?? {},
+    permissionEvents: events.flatMap(event =>
+      event.type === 'permission/preset' || event.type === 'sandbox/mode' || event.type === 'approval/policy'
+        ? [[event.type, event.data] as [string, unknown]]
+        : []),
   }
-  throw new Error(`session log ${logRelPath} has no request/header event`)
 }
 
 describe('shipped dsh composition (real Loader tree in a PTY)', () => {
@@ -110,17 +117,22 @@ describe('shipped dsh composition (real Loader tree in a PTY)', () => {
       // Artifact CI builds and smokes concurrently on a contended runner.
       ...(process.env.DSH_EXAMPLE_MODE === 'lib' ? { timeoutMs: 60_000 } : {}),
       actions: [
-        { waitFor: COMPOSITION_SETTLED_MARKER, send: 'Describe the shipped composition.\r' },
+        { waitFor: COMPOSITION_SETTLED_MARKER, send: '/permission\r' },
+        { waitFor: PERMISSION_SUMMARY, send: 'Describe the shipped composition.\r' },
         { waitFor: COMPOSITION_REPLY_TEXT, send: '/exit\r' },
       ],
       inspect: async (cwd) => { observed = await loggedHeader(cwd) },
     })
     expect(output).toContain(COMPOSITION_REPLY_TEXT)
+    expect(output).toContain(PERMISSION_SUMMARY)
     expect(observed?.names.filter(name => !RIPGREP_TOOLS.includes(name))).toEqual(EXPECTED_TUI_TOOLS)
     expect([[], RIPGREP_TOOLS]).toContainEqual(observed?.names.filter(name => RIPGREP_TOOLS.includes(name)))
-    // The TUI mounts the unrestricted local executors, so `tool-bash` emits no
-    // escalation pair. Pinning its absence keeps a later sandbox change from
-    // arriving here unannounced.
-    expect(Object.keys(observed?.bashArguments ?? {})).not.toContain('sandbox_permissions')
+    expect(observed?.bashArguments).toHaveProperty('sandbox_permissions')
+    expect(observed?.bashArguments).toHaveProperty('justification')
+    expect(observed?.permissionEvents).toEqual([
+      ['permission/preset', { preset: 'workspace-write' }],
+      ['sandbox/mode', { mode: 'workspace-write' }],
+      ['approval/policy', { policy: 'ask' }],
+    ])
   }, LOADER_SMOKE_TEST_TIMEOUT_MS)
 })

apps/web/tests/access-confirmation.e2e.ts

@@ -70,14 +70,7 @@ describe('web e2e: Full access confirmation', () => {
     const access = page.locator('button[aria-label^="访问模式"]').first()
     await access.waitFor({ timeout: 10_000 })
 
-    // Normalize the starting preset through the real command path. The
-    // shipped web config may already start at Full access.
-    if ((await access.getAttribute('aria-label'))?.endsWith('Full access') === true) {
-      await access.click()
-      await page.getByRole('menuitem', { name: 'Workspace Write' }).click()
-      await expect.poll(() => access.getAttribute('aria-label'), { timeout: 10_000 })
-        .toBe('访问模式，当前：Workspace Write')
-    }
+    expect(await access.getAttribute('aria-label')).toBe('访问模式，当前：Workspace Write')
 
     await access.click()
     await page.getByRole('menuitem', { name: 'Full access' }).click()

apps/web/tests/seeded-history.e2e.ts

@@ -339,19 +339,19 @@ describe('web e2e: seeded history renders through cold resume', () => {
     onTestFailed(() => saveFailureShot(page, 'web-e2e-seeded-command-row'))
     // The Access chip submits `/permission <preset>` — a host command with no
     // model call, so the settled row renders keylessly over this cold history.
-    // The row copy is the assertion: `permission · preset workspace-write`,
+    // The row copy is the assertion: `permission · preset read-only`,
     // where neither half repeats the other (the dispatched `/` and its
     // argument stay out of the title, and the settlement text never restates
     // the command's own name).
-    await page.getByRole('button', { name: 'Access mode, current: Full access' }).click()
-    await page.getByRole('menuitem', { name: 'Workspace Write' }).click()
-    await page.getByRole('button', { name: 'Access mode, current: Workspace Write' }).waitFor({ timeout: 10_000 })
+    await page.getByRole('button', { name: 'Access mode, current: Workspace Write' }).click()
+    await page.getByRole('menuitem', { name: 'Read Only' }).click()
+    await page.getByRole('button', { name: 'Access mode, current: Read Only' }).waitFor({ timeout: 10_000 })
     // Scoped to the row itself, so unrelated page text that happens to read
     // `permission` (a future resident slash menu) cannot satisfy or break it.
-    const row = page.locator('[data-variant="others"]').filter({ hasText: 'preset workspace-write' })
+    const row = page.locator('[data-variant="others"]').filter({ hasText: 'preset read-only' })
     await expect.poll(() => row.count(), { timeout: 10_000 }).toBe(1)
     expect(await row.getByText('permission', { exact: true }).count()).toBe(1)
-    expect(await row.getByText('/permission workspace-write', { exact: true }).count()).toBe(0)
+    expect(await row.getByText('/permission read-only', { exact: true }).count()).toBe(0)
     const snapshot = (await captureStableAria(page, '[class*="centerCol"]', scaffold.workspaceCwd))
       .split(SEED_ID).join('{{seededId}}')
     await compareOrRefreshGolden(COMMAND_ROW_EXPECTED, snapshot, MODE)

apps/web/tests/settings-chrome.e2e.ts

@@ -57,7 +57,7 @@ describe('web e2e: settings modal and General preferences', () => {
     expect(await trigger.getAttribute('aria-expanded')).toBe('true')
     // General is active by default; Permission, Language and Appearance are functional.
     expect(await dialog.getByRole('button', { name: '通用设置' }).getAttribute('aria-current')).toBe('true')
-    await dialog.getByRole('button', { name: 'Full access' }).waitFor({ timeout: 10_000 })
+    await dialog.getByRole('button', { name: 'Workspace Write' }).waitFor({ timeout: 10_000 })
     await expect.poll(() => dialog.getByText('语言', { exact: true }).count(), { timeout: 5_000 }).toBe(1)
     await expect.poll(() => dialog.getByText('外观', { exact: true }).count(), { timeout: 5_000 }).toBe(1)
     // Golden of the freshly opened dialog (default zh, General active).
@@ -82,12 +82,12 @@ describe('web e2e: settings modal and General preferences', () => {
     onTestFailed(() => saveFailureShot(page, 'web-e2e-settings-permission'))
     const existing = scaffold.ctx.sessions.create(SessionId('settings-permission-before'))
     expect(existing.events.find(event => event.type === 'permission/preset')?.data)
-      .toEqual({ preset: 'danger-full-access' })
+      .toEqual({ preset: 'workspace-write' })
 
     await page.getByRole('button', { name: '设置', exact: true }).click()
     const dialog = page.getByRole('dialog', { name: '设置' })
     await dialog.waitFor({ timeout: 10_000 })
-    const selector = dialog.getByRole('button', { name: 'Full access' })
+    const selector = dialog.getByRole('button', { name: 'Workspace Write' })
     await selector.waitFor({ timeout: 10_000 })
     await expect.poll(() => selector.isEnabled(), { timeout: 5_000 }).toBe(true)
     await selector.click()
@@ -98,7 +98,7 @@ describe('web e2e: settings modal and General preferences', () => {
     expect(document).toContain('permission:')
     expect(document).toContain('defaultPreset: read-only')
     expect(existing.events.find(event => event.type === 'permission/preset')?.data)
-      .toEqual({ preset: 'danger-full-access' })
+      .toEqual({ preset: 'workspace-write' })
 
     const created = scaffold.ctx.sessions.create(SessionId('settings-permission-after'))
     expect(created.events.map(event => [event.type, event.data])).toEqual([

apps/web/tests/shipped-composition.e2e.ts

@@ -10,6 +10,7 @@ import { canonicalPath, writableRoots } from '@deepseek-ai/dsh-sandbox'
 import type {} from '@deepseek-ai/dsh-tools'
 import type {} from '@deepseek-ai/dsh-sandbox-policy'
 import type {} from '@deepseek-ai/dsh-user-approval'
+import type {} from '@deepseek-ai/dsh-permission'
 import { launchWebScaffold, type WebScaffold } from './scaffold.ts'
 
 /**
@@ -63,7 +64,7 @@ afterEach(async () => {
   scaffold = undefined
 })
 
-it('assembles the shipped Web catalog and keeps its access default', async () => {
+it('assembles the shipped Web catalog with the confined access default', async () => {
   scaffold = await launchWebScaffold()
   const names = scaffold.ctx.tools.schemas().map(schema => schema.name).sort()
   expect(names.filter(name => !RIPGREP_TOOLS.includes(name))).toEqual(EXPECTED_TOOLS)
@@ -76,8 +77,7 @@ it('assembles the shipped Web catalog and keeps its access default', async () =>
   expect(writableRoots(scaffold.ctx.sandboxPolicy.resolve({ mode: 'workspace-write' }))).toEqual(
     expect.arrayContaining([canonicalPath('/tmp'), canonicalPath(tmpdir())]),
   )
-  // The Web surface keeps its shipped access default; the base's confined one
-  // reaches the TUI. Pinning both keeps a base change from moving Web silently.
-  expect(scaffold.ctx.sandboxPolicy.defaultMode).toBe('danger-full-access')
-  expect(scaffold.ctx.approval.config.policy).toBe('never')
+  expect(scaffold.ctx.sandboxPolicy.defaultMode).toBe('workspace-write')
+  expect(scaffold.ctx.approval.config.policy).toBe('ask')
+  expect(scaffold.ctx.permission.defaultPreset).toBe('workspace-write')
 }, 120_000)

apps/web/tests/snapshots/code-mode-round/ui.expected.md

@@ -39,7 +39,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/cordis-tool-round/ui.expected.md

@@ -54,7 +54,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/fresh-round-trip/ui.expected.md

@@ -34,7 +34,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/lifecycle-chrome/hero.expected.md

@@ -28,7 +28,7 @@
 - textbox "Describe what you want to build"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/lifecycle-chrome/plan-active.expected.md

@@ -28,7 +28,7 @@
 - textbox "Describe what you want to build"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Plan mode on, press to turn off": Plan
 - button "Select model, current deepseek-v4-flash":
   - text: deepseek-v4-flash

apps/web/tests/snapshots/lifecycle-chrome/reloaded.expected.md

@@ -26,7 +26,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/live-interactions/cancel.expected.md

@@ -23,7 +23,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/live-interactions/error-auth.expected.md

@@ -19,7 +19,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/live-interactions/loading.expected.md

@@ -18,7 +18,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/live-interactions/retry.expected.md

@@ -28,7 +28,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/message-actions/ui.expected.md

@@ -37,7 +37,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current deepseek-v4-flash":
   - text: deepseek-v4-flash
   - img

apps/web/tests/snapshots/plan-review/approved.expected.md

@@ -39,7 +39,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/question-composer/answered.expected.md

@@ -34,7 +34,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/queue-actions/collapsed.expected.md

@@ -19,7 +19,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/queue-actions/editing.expected.md

@@ -32,7 +32,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/queue-actions/ui.expected.md

@@ -25,7 +25,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/seeded-history/command-row.expected.md

@@ -41,11 +41,11 @@
   - img
   - text: Context injection
 - img
-- text: permission preset workspace-write
+- text: permission preset read-only
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Workspace Write"': Workspace Write
+- 'button "Access mode, current: Read Only"': Read Only
 - button "Select model, current deepseek-v4-flash":
   - text: deepseek-v4-flash
   - img

apps/web/tests/snapshots/seeded-history/ui.expected.md

@@ -43,7 +43,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current deepseek-v4-flash":
   - text: deepseek-v4-flash
   - img

apps/web/tests/snapshots/settings-chrome/dialog.expected.md

@@ -11,8 +11,8 @@
     - img
     - text: 关闭
   - text: 权限 选择新会话的默认权限模式
-  - button "Full access":
-    - text: Full access
+  - button "Workspace Write":
+    - text: Workspace Write
     - img
   - text: 语言
   - button "中文":

apps/web/tests/snapshots/steering/settled.expected.md

@@ -35,7 +35,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img

apps/web/tests/snapshots/web-search-round/ui.expected.md

@@ -26,7 +26,7 @@
 - textbox "Message the agent"
 - button "Commands":
   - img
-- 'button "Access mode, current: Full access"': Full access
+- 'button "Access mode, current: Workspace Write"': Workspace Write
 - button "Select model, current DeepSeek-V4-Flash":
   - text: DeepSeek-V4-Flash
   - img