Default shipped UI sessions to workspace-write

apps/cli/config/base.cordis.yml

@@ -131,11 +131,42 @@
 - id: subprocess
   name: '@deepseek-ai/dsh-subprocess-local'
 
-- id: bash-local
-  name: '@deepseek-ai/dsh-bash-local'
+# Every shipped product surface starts with the same file-effect boundary.
+# The environment remains an explicit deployment override; otherwise fresh
+# sessions pin workspace-write + ask through the permission service below.
+- id: sandbox
+  name: '@deepseek-ai/dsh-sandbox-local'
+
+- id: sandbox-policy
+  name: '@deepseek-ai/dsh-sandbox-policy'
+  config:
+    mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
+    workspaceRoot: !!js process.cwd()
+
+- id: bash-sandbox
+  name: '@deepseek-ai/dsh-bash-sandbox'
   config:
     timeoutMs: 60000
 
+- id: approval
+  name: '@deepseek-ai/dsh-user-approval'
+  config:
+    policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'never' : 'ask'"
+
+- id: permission
+  name: '@deepseek-ai/dsh-permission'
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
 
@@ -339,10 +370,10 @@
   config:
     agents: []
 
-# The filesystem provider. `cwd` defaults to the package's `process.cwd()`; the
-# TUI states it explicitly because that value is also the session workspace.
-- id: fs-local
-  name: '@deepseek-ai/dsh-fs-local'
+# The sandboxed filesystem provider. `cwd` defaults to `process.cwd()`; the TUI
+# states it explicitly because that value is also the session workspace.
+- id: fs-sandbox
+  name: '@deepseek-ai/dsh-fs-sandbox'
 
 # The native DeepSeek adapter. No key or endpoint is inlined: both resolve per
 # request from the `llm-deepseek:` settings section over this entry, with the

apps/cli/config/tui.cordis.yml

@@ -46,7 +46,7 @@
     reasoningEffort: max
 
 # This single-session app resolves relative paths from the process cwd.
-- id: fs-local
+- id: fs-sandbox
   config:
     cwd: !!js process.cwd()
 

apps/cli/config/web.cordis.yml

@@ -36,50 +36,6 @@
     apiKey: !!js process.env.DEEPSEEK_API_KEY
     baseURL: !!js process.env.DEEPSEEK_BASE_URL
 
-# The web surface replaces the unrestricted local executors with the shared
-# sandbox policy. Its default preserves the previous unrestricted behavior;
-# DSH_PERMISSION_MODE and the browser permission picker can confine a session.
-- insert:
-    - id: sandbox
-      name: '@deepseek-ai/dsh-sandbox-local'
-
-    - id: sandbox-policy
-      name: '@deepseek-ai/dsh-sandbox-policy'
-      config:
-        mode: !!js process.env.DSH_PERMISSION_MODE ?? 'danger-full-access'
-        workspaceRoot: !!js process.cwd()
-
-    - id: bash-sandbox
-      name: '@deepseek-ai/dsh-bash-sandbox'
-
-    - id: approval
-      name: '@deepseek-ai/dsh-user-approval'
-      config:
-        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'danger-full-access') === 'danger-full-access' ? 'never' : 'ask'"
-
-    - id: permission
-      name: '@deepseek-ai/dsh-permission'
-      config:
-        presets:
-          read-only:
-            sandbox: read-only
-            approval: ask
-          workspace-write:
-            sandbox: workspace-write
-            approval: ask
-          danger-full-access:
-            sandbox: danger-full-access
-            approval: never
-
-    - id: fs-sandbox
-      name: '@deepseek-ai/dsh-fs-sandbox'
-
-- id: bash-local
-  disabled: true
-
-- id: fs-local
-  disabled: true
-
 # ── web-only host rows, the transport layer, and the browser roster ─────────
 
 # `dshClient` rows are the browser roster the modules node half scans into