feat(web): permission presets and approval answering for the web UI

The web host now composes the sandboxed product path (sandbox-local + sandbox-policy behind bash-sandbox/fs-sandbox, with user-approval and permission on top); BootHostOptions.sandbox carries the deployment defaults (workspace-write + ask). createApiProxy owns the approval pending registry: a ctx.approval ask becomes an answerable approval/requested mux frame with a stable rpcId, replayed verbatim on every mux open until settled; respond routes by the echoed rpcId, validates the ApprovalResponsePayload audit correlation, and broadcasts approval/resolved; the ask's abort signal withdraws the question as cancelled. session.permissions / session.setPermission project ctx.permission into a protocol-owned PermissionOption select; idle switches are held last-write-wins and flushed into the next prompted turn (the ACP bridge's anchoring pattern). The shared hasOpenTurn fold moved to dsh-session, deduplicating the private copies in user-approval, the ACP bridge, and the proxy. Client, per the designer draft: a pending approval takes over the composer (ApprovalPanel replaces the InputBar — amber strip, justification headline, paired command, one-shot refuse/allow, keyed by rpcId so a queued second approval remounts live; the resolved frame restores the composer); the sidebar session row shows an amber waiting-approval dot that outranks the running ring (manager-tracked approvalId set, idempotent under mux-open replays, cleared per connection generation, lit for uninstantiated sessions too); the permission selector is a composer bottom-row chip over an invisible native select, with a presentation-only title-case transform (workspace-write renders as Workspace Write; wire names untouched). Question placeholders stay in the message flow. The connection fixture mirrors the host behavior for keyless browser acceptance.
2026-07-24 13:39:00 +08:00
parent 0133e80767
commit f0410d592d
69 changed files with 1744 additions and 139 deletions
--- a/packages/client/connection/src/client/api.ts
+++ b/packages/client/connection/src/client/api.ts
@@ -7,7 +7,7 @@

 export type {
  ApiProxy, SessionsApi, SessionSummary, HostApi, EventsApi, MuxFrame, HostFrame,
-  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView,
+  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, PermissionOption, ToolEventView,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
 export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
 export type {
--- a/packages/client/connection/src/client/fixture.ts
+++ b/packages/client/connection/src/client/fixture.ts
@@ -299,10 +299,19 @@ export function createFixtureApi(): ApiProxy {
  let nextSession = 1
  let nextRpc = 1
  const mint = (): ReturnType<typeof RpcId> => RpcId(`fx-rpc-${nextRpc++}`)
-  /** Resident pending approval (stable rpcId: every mux open replays the same id, matching host replay semantics). */
+  /** Resident pending approval (stable rpcId: every mux open replays the same id while unanswered, matching host replay semantics). */
  const pendingApprovalRpcId = mint()
+  const pendingApprovalId = 'fx-approval-1' as Extract<MuxFrame, { type: 'approval/requested' }>['approvalId']
+  /** Cleared once answered through respond; replay stops and approval/resolved is broadcast. */
+  let approvalPending = true
  const pendingQuestionRpcId = mint()
  let questionPending = true
+  /** Per-session permission preset (fixture mirror of the host permission select). */
+  const permissionValues = new Map<SessionId, string>()
+  const PERMISSION_OPTIONS = [
+    { value: 'workspace-write', name: 'workspace-write', description: 'Write inside the workspace and permitted temporary directories; wider retries require approval.' },
+    { value: 'danger-full-access', name: 'danger-full-access', description: 'Full file access without approval prompts.' },
+  ]
  const fixtureQuestions: Extract<MuxFrame, { type: 'question/requested' }>['questions'] = [
    {
      id: 'harness-profile',
@@ -522,6 +531,24 @@ export function createFixtureApi(): ApiProxy {
        }
        return ok(request, { accepted: true as const })
      },
+      permissions: (request) => {
+        const { sessionId: id } = request.payload
+        if (summaryOf(id) === undefined) {
+          return err(request, { code: 'session-not-found', message: `no session ${id}`, details: { sessionId: id } })
+        }
+        return ok(request, { options: PERMISSION_OPTIONS, currentValue: permissionValues.get(id) ?? 'workspace-write' })
+      },
+      setPermission: (request) => {
+        const { sessionId: id, value } = request.payload
+        if (summaryOf(id) === undefined) {
+          return err(request, { code: 'session-not-found', message: `no session ${id}`, details: { sessionId: id } })
+        }
+        if (!PERMISSION_OPTIONS.some(option => option.value === value)) {
+          return err(request, { code: 'bad-request', message: `unknown permission value ${JSON.stringify(value)}`, details: { issues: [] } })
+        }
+        permissionValues.set(id, value)
+        return ok(request, { currentValue: value })
+      },
    },
    host: {
      describe: request => ok(request, { version: '0.0.0-fixture', cwd: '/tmp/fixture', attachedSessions: 1 }),
@@ -539,14 +566,16 @@ export function createFixtureApi(): ApiProxy {
          const title = titleFrameOf(s.sessionId, logs.get(s.sessionId) ?? [])
          if (title !== undefined) conn.push({ rpcId: mint(), payload: title })
        }
-        conn.push({
-          rpcId: pendingApprovalRpcId,
-          payload: {
-            type: 'approval/requested', sessionId: sid('fx-alpha'),
-            approvalId: 'fx-approval-1' as MuxFrame extends never ? never : Extract<MuxFrame, { type: 'approval/requested' }>['approvalId'],
-            toolName: 'dangerous_tool', reason: 'fixture 常驻占位审批（可见不可答）',
-          },
-        })
+        if (approvalPending) {
+          conn.push({
+            rpcId: pendingApprovalRpcId,
+            payload: {
+              type: 'approval/requested', sessionId: sid('fx-alpha'),
+              approvalId: pendingApprovalId,
+              toolName: 'dangerous_tool', reason: 'fixture 常驻审批（可答：批准/拒绝后消失）',
+            },
+          })
+        }
        if (questionPending) {
          conn.push({
            rpcId: pendingQuestionRpcId,
@@ -584,6 +613,19 @@ export function createFixtureApi(): ApiProxy {
      },
    },
    respond(message: ClientResponse): Promise<RpcReceipt> {
+      // Same routing discipline as the host: rpcId first, then the payload's
+      // audit correlation; a settled or unknown id is not-pending.
+      if (message.rpcId === pendingApprovalRpcId) {
+        if (!approvalPending) return Promise.resolve({ accepted: false, reason: 'not-pending' })
+        if (!message.result.ok) return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        const value = message.result.value as { approvalId?: unknown; outcome?: unknown }
+        if (value.approvalId !== pendingApprovalId || (value.outcome !== 'allowed-once' && value.outcome !== 'rejected')) {
+          return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        }
+        approvalPending = false
+        emitMux({ type: 'approval/resolved', sessionId: sid('fx-alpha'), approvalId: pendingApprovalId, outcome: value.outcome })
+        return Promise.resolve({ accepted: true })
+      }
      if (!questionPending || message.rpcId !== pendingQuestionRpcId) {
        return Promise.resolve({ accepted: false, reason: 'not-pending' })
      }
@@ -633,6 +675,8 @@ export class FixtureApiClient extends AbstractApiClient {
      case 'session.history': return this.api.sessions.history(request)
      case 'session.prompt': return this.api.sessions.prompt(request)
      case 'session.cancel': return this.api.sessions.cancel(request)
+      case 'session.permissions': return this.api.sessions.permissions(request)
+      case 'session.setPermission': return this.api.sessions.setPermission(request)
      case 'host.describe': return this.api.host.describe(request)
    }
  }
--- a/packages/client/connection/src/client/index.ts
+++ b/packages/client/connection/src/client/index.ts
@@ -15,7 +15,7 @@ import { WebApiClient } from './web-api-client.ts'
 // ---- Contract re-exports (browser-safe apiproxy channels + core types) ----
 export type {
  ApiProxy, SessionsApi, SessionSummary, HostApi, EventsApi, MuxFrame, HostFrame,
-  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView,
+  ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, PermissionOption, ToolEventView,
  ToolCallView, ToolResultView,
  RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode,
  ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt,
--- a/packages/client/connection/tests/fake-api.ts
+++ b/packages/client/connection/tests/fake-api.ts
@@ -49,6 +49,12 @@ export class FakeApiClient implements IApiClient {

  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onPermissions: (payload: unknown) =>
+  Promise<RpcResponse<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> =
+    () => Promise.resolve(ok({ options: [], currentValue: 'custom' }))
+
+  onSetPermission: (payload: { sessionId: SessionId; value: string }) => Promise<RpcResponse<{ currentValue: string }>> =
+    payload => Promise.resolve(ok({ currentValue: payload.value }))
  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
    () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))

@@ -65,6 +71,8 @@ export class FakeApiClient implements IApiClient {
      this.record('session.history', payload, this.onHistory(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
+    permissions: (payload: unknown) => this.record('session.permissions', payload, this.onPermissions(payload)),
+    setPermission: (payload: { sessionId: SessionId; value: string }) => this.record('session.setPermission', payload, this.onSetPermission(payload)),
  }

  readonly host: IApiClient['host'] = {
--- a/packages/client/connection/tests/fixture.spec.ts
+++ b/packages/client/connection/tests/fixture.spec.ts
@@ -255,6 +255,61 @@ describe('createFixtureApi', () => {
    })).toEqual({ accepted: true })
  })

+  it('respond answers the resident approval once: routing, validation, resolved broadcast, then not-pending', async () => {
+    const api = createFixtureApi()
+    // Discover the resident approval's stable rpcId from the mux baseline.
+    const abort = new AbortController()
+    const seen: { rpcId: string; frame: MuxFrame }[] = []
+    const consuming = (async () => {
+      for await (const envelope of api.events.mux(req({}), abort.signal)) seen.push({ rpcId: envelope.rpcId, frame: envelope.payload })
+    })()
+    await vi.waitFor(() => {
+      expect(seen.some(s => s.frame.type === 'approval/requested')).toBe(true)
+    })
+    const requested = seen.find(s => s.frame.type === 'approval/requested')
+    if (requested === undefined || requested.frame.type !== 'approval/requested') throw new Error('unreachable')
+    const approvalId = requested.frame.approvalId
+
+    // Routed but malformed answers.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: false, error: { code: 'internal', message: 'x', details: {} } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { approvalId: 'wrong', outcome: 'rejected' } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { approvalId, outcome: 'maybe' } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // The real answer settles the question and broadcasts resolved.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { sessionId: sid('fx-alpha'), approvalId, outcome: 'allowed-once' } } }))
+      .toEqual({ accepted: true })
+    await vi.waitFor(() => {
+      expect(seen.some(s => s.frame.type === 'approval/resolved' && s.frame.outcome === 'allowed-once')).toBe(true)
+    })
+    // Settled: a duplicate answer is late, and a fresh mux open replays nothing.
+    expect(await api.respond({ type: 'client-response', rpcId: RpcId(requested.rpcId), result: { ok: true, value: { sessionId: sid('fx-alpha'), approvalId, outcome: 'rejected' } } }))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+    await consuming
+    const abort2 = new AbortController()
+    const replayed = await collect(api.events.mux(req({}), abort2.signal), abort2, frames => frames.length === 2)
+    expect(replayed.some(f => f.type === 'approval/requested')).toBe(false)
+  })
+
+  it('permissions/setPermission mirror the host select: read, switch, validation', async () => {
+    const api = createFixtureApi()
+    const read = await api.sessions.permissions(req({ sessionId: sid('fx-alpha') }))
+    expect(read.result).toMatchObject({ ok: true, value: { currentValue: 'workspace-write' } })
+    const switched = await api.sessions.setPermission(req({ sessionId: sid('fx-alpha'), value: 'danger-full-access' }))
+    expect(switched.result).toMatchObject({ ok: true, value: { currentValue: 'danger-full-access' } })
+    const reread = await api.sessions.permissions(req({ sessionId: sid('fx-alpha') }))
+    expect(reread.result).toMatchObject({ ok: true, value: { currentValue: 'danger-full-access' } })
+    // Validation: ghost session and unknown value.
+    const ghostRead = await api.sessions.permissions(req({ sessionId: sid('fx-ghost') }))
+    expect(ghostRead.result.ok).toBe(false)
+    const ghostSwitch = await api.sessions.setPermission(req({ sessionId: sid('fx-ghost'), value: 'workspace-write' }))
+    expect(ghostSwitch.result.ok).toBe(false)
+    const unknown = await api.sessions.setPermission(req({ sessionId: sid('fx-alpha'), value: 'nope' }))
+    expect(unknown.result.ok).toBe(false)
+  })
+
  it('describe answers the fixture identity', async () => {
    const api = createFixtureApi()
    const response = await api.host.describe(req({}))
@@ -345,6 +400,8 @@ describe('FixtureApiClient (protocol-level fake carrier)', () => {
    expect((await client.sessions.history({ sessionId: id })).result.ok).toBe(true)
    expect((await client.sessions.prompt({ sessionId: id, mode: 'queue', content: [{ type: 'text', text: '嗨' }] })).result.ok).toBe(true)
    expect((await client.sessions.cancel({ sessionId: id })).result.ok).toBe(true)
+    expect((await client.sessions.permissions({ sessionId: id })).result.ok).toBe(true)
+    expect((await client.sessions.setPermission({ sessionId: id, value: 'danger-full-access' })).result.ok).toBe(true)
    expect((await client.host.describe({})).result.ok).toBe(true)
  })

--- a/packages/client/runtime/src/client/index.ts
+++ b/packages/client/runtime/src/client/index.ts
@@ -38,7 +38,15 @@ export type {
 // PendingWait is a value export: tests construct fixture waits directly.
 export { PendingWait } from './sessions/pending.ts'
 export type { PendingInteraction, PendingKind, PendingPayloads } from './sessions/pending.ts'
-export type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
+export type { PermissionOption, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+
+/** The permission select material as the object layer serves it to UI plugins. */
+export interface PermissionSelect {
+  /** Switchable presets plus (when derived) the current-only `custom`. */
+  options: { value: string; name: string; description?: string }[]
+  /** The effective current value (`custom` when knobs match no preset). */
+  currentValue: string
+}

 // ---- Narrowed aliases (the single narrowing point of the slot type chain:
 // ui-slots/web-react stay generic and dependency-inverted; the client-tree
--- a/packages/client/runtime/src/client/sessions/lineage.ts
+++ b/packages/client/runtime/src/client/sessions/lineage.ts
@@ -9,7 +9,7 @@ export interface TitledSessionSummary extends SessionSummary {
  title?: string
 }

-/** One flattened session-list row (summary + lineage indent depth). */
+/** One flattened session-list row (summary + lineage indent depth + live pending-approval bit). */
 export interface SessionListEntry {
  sessionId: SessionId
  title?: string
@@ -17,6 +17,8 @@ export interface SessionListEntry {
  running: boolean
  parentSessionId?: SessionId
  cwd?: string
+  /** An approval question is pending on this session (mux-frame derived; the sidebar's amber dot). */
+  waitingApproval: boolean
  /** Lineage indent depth: root = 0; the UI just multiplies by the indent width. */
  depth: number
 }
@@ -25,9 +27,10 @@ export interface SessionListEntry {
 * summaries -> flat list with lineage indentation (pure; roots by updatedAt
 * desc, DFS children in the same order, orphans degrade to roots).
 * @param summaries - the host's session.list items.
+ * @param waitingApproval - sessions with a pending approval question (manager-owned live fact; absent = false).
 * @returns display rows in render order.
 */
-export function flattenLineage(summaries: readonly TitledSessionSummary[]): SessionListEntry[] {
+export function flattenLineage(summaries: readonly TitledSessionSummary[], waitingApproval?: ReadonlySet<SessionId>): SessionListEntry[] {
  const byId = new Map<SessionId, TitledSessionSummary>()
  for (const s of summaries) byId.set(s.sessionId, s)

@@ -54,7 +57,7 @@ export function flattenLineage(summaries: readonly TitledSessionSummary[]): Sess
      return
    }
    visited.add(s.sessionId)
-    out.push({ ...s, depth })
+    out.push({ ...s, waitingApproval: waitingApproval?.has(s.sessionId) ?? false, depth })
    const kids = children.get(s.sessionId)
    if (kids === undefined) return
    kids.sort(byUpdatedDesc)
--- a/packages/client/runtime/src/client/sessions/manager.ts
+++ b/packages/client/runtime/src/client/sessions/manager.ts
@@ -36,6 +36,11 @@ export class SessionManager {
   *  drop-and-backfill path; replayed and cleared on instantiation. Bounded per session (these
   *  frames are low-frequency; overflow drops oldest) and dropped on session-removed (audit S7). */
  private readonly pendingBuffers = new Map<SessionId, RpcRequest<MuxFrame>[]>()
+  /** Outstanding approval questions per session, keyed by approvalId (idempotent under mux-open
+   *  replays of the same requested frame). Manager-owned rather than read off Session instances
+   *  because the sidebar must light up for sessions never instantiated. Cleared per connection
+   *  generation — the reopen replay re-adds still-pending questions — and on session-removed. */
+  private readonly waitingApprovals = new Map<SessionId, Set<string>>()
  private readonly titleSnapshots = new Map<SessionId, SessionTitleSnapshot>()
  private summaries: SessionSummary[] = []
  private listState: 'idle' | 'loading' | 'error' = 'idle'
@@ -186,6 +191,22 @@ export class SessionManager {
        this.notifier.markDirty()
      }
    }
+    // List-level waiting-approval bit (the sidebar amber dot): tracked here for
+    // every session, instantiated or not; approvalId keys make replays idempotent.
+    if (frame.type === 'approval/requested') {
+      let ids = this.waitingApprovals.get(frame.sessionId)
+      if (ids === undefined) this.waitingApprovals.set(frame.sessionId, ids = new Set())
+      if (!ids.has(frame.approvalId)) {
+        ids.add(frame.approvalId)
+        this.notifier.markDirty()
+      }
+    } else if (frame.type === 'approval/resolved') {
+      const ids = this.waitingApprovals.get(frame.sessionId)
+      if (ids !== undefined && ids.delete(frame.approvalId)) {
+        if (ids.size === 0) this.waitingApprovals.delete(frame.sessionId)
+        this.notifier.markDirty()
+      }
+    }
    const session = this.sessions.get(frame.sessionId)
    if (session === undefined) {
      // Approval/question frames never hit history: buffer for replay on instantiation;
@@ -232,6 +253,7 @@ export class SessionManager {
        this.summaries = this.summaries.filter(s => s.sessionId !== frame.sessionId)
        this.sessions.get(frame.sessionId)?.handleRemoved() // instance survives (resident-instance rule), only flagged in the snapshot
        this.pendingBuffers.delete(frame.sessionId) // a removed session's buffered frames must not replay on a future instantiation
+        this.waitingApprovals.delete(frame.sessionId) // a removed session cannot wait on anyone
        this.titleSnapshots.delete(frame.sessionId)
        this.notifier.markDirty()
        return
@@ -254,6 +276,12 @@ export class SessionManager {

  /** After each connection generation (first connect included): refresh the list + resync opened instances (reconnect = rebuild). */
  handleConnected(): void {
+    // Approvals resolved while disconnected send no frame: drop the bits and
+    // let the mux-open replay re-add every still-pending question.
+    if (this.waitingApprovals.size > 0) {
+      this.waitingApprovals.clear()
+      this.notifier.markDirty()
+    }
    void this.refreshList()
    for (const session of this.sessions.values()) void session.resync()
  }
@@ -265,13 +293,14 @@ export class SessionManager {
        ? summary
        : { ...summary, title: title.title, updatedAt: Math.max(summary.updatedAt, title.updatedAt) }
    })
-    const fresh = flattenLineage(merged)
+    const fresh = flattenLineage(merged, new Set(this.waitingApprovals.keys()))
    const items = fresh.map((entry) => {
      const prev = this.entryCache.get(entry.sessionId)
      if (
        prev !== undefined && prev.updatedAt === entry.updatedAt && prev.running === entry.running
        && prev.parentSessionId === entry.parentSessionId && prev.cwd === entry.cwd
        && prev.title === entry.title && prev.depth === entry.depth
+        && prev.waitingApproval === entry.waitingApproval
      ) return prev
      this.entryCache.set(entry.sessionId, entry)
      return entry
--- a/packages/client/runtime/src/client/sessions/service.ts
+++ b/packages/client/runtime/src/client/sessions/service.ts
@@ -32,6 +32,8 @@ export interface SessionSummary {
  cwd?: string
  parentId?: SessionId
  running: boolean
+  /** An approval question is pending on this session (sidebar amber-dot state). */
+  waitingApproval: boolean
  updatedAt: number
 }

@@ -310,6 +312,7 @@ export class SessionsService {
        id: entry.sessionId,
        displayTitle: displayTitleOf(entry.title, entry.cwd, entry.sessionId),
        running: entry.running,
+        waitingApproval: entry.waitingApproval,
        updatedAt: entry.updatedAt,
        ...(entry.title !== undefined ? { title: entry.title } : {}),
        ...(entry.cwd !== undefined ? { cwd: entry.cwd } : {}),
--- a/packages/client/runtime/src/client/sessions/session.ts
+++ b/packages/client/runtime/src/client/sessions/session.ts
@@ -128,6 +128,31 @@ export class Session implements ObservableSnapshot<ConversationSnapshot> {
    return result
  }

+  /**
+   * Read the permission select (options + effective current value).
+   * @returns the select material, or the error branch on failure.
+   */
+  async permissions(): Promise<RpcResult<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> {
+    try {
+      return (await this.api.sessions.permissions({ sessionId: this.sessionId })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
+  /**
+   * Switch the permission preset.
+   * @param value - a preset value advertised by {@link Session.permissions} (never `custom`).
+   * @returns the confirmed current value, or the error branch on failure.
+   */
+  async setPermission(value: string): Promise<RpcResult<{ currentValue: string }>> {
+    try {
+      return (await this.api.sessions.setPermission({ sessionId: this.sessionId, value })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
  /** First open: pull the tail page (idempotent — in-flight/already-open returns the existing promise). */
  open(): Promise<void> {
    if (this.openState === 'open') return Promise.resolve()
--- a/packages/client/runtime/tests/fake-api.ts
+++ b/packages/client/runtime/tests/fake-api.ts
@@ -52,6 +52,13 @@ export class FakeApiClient implements IApiClient {

  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onPermissions: (payload: unknown) =>
+  Promise<RpcResponse<{ options: { value: string; name: string; description?: string }[]; currentValue: string }>> =
+    () => Promise.resolve(ok({ options: [], currentValue: 'custom' }))
+
+  onSetPermission: (payload: { sessionId: SessionId; value: string }) => Promise<RpcResponse<{ currentValue: string }>> =
+    payload => Promise.resolve(ok({ currentValue: payload.value }))
+
  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
    () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))

@@ -68,6 +75,8 @@ export class FakeApiClient implements IApiClient {
      this.record('session.history', payload, this.onHistory(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
+    permissions: (payload: unknown) => this.record('session.permissions', payload, this.onPermissions(payload)),
+    setPermission: (payload: { sessionId: SessionId; value: string }) => this.record('session.setPermission', payload, this.onSetPermission(payload)),
  }

  readonly host: IApiClient['host'] = {
--- a/packages/client/runtime/tests/manager.spec.ts
+++ b/packages/client/runtime/tests/manager.spec.ts
@@ -281,3 +281,42 @@ describe('connected generation', () => {
    })
  })
 })
+
+describe('waiting-approval list bit', () => {
+  it('lights on requested, survives replay duplicates, and clears on resolved — without instantiation', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    // Mux-open replay of the same question (same approvalId) is idempotent.
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleMuxEnvelope({ rpcId: 'rx' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'ap1' as never, outcome: 'allowed-once' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+  })
+
+  it('clears only when the last outstanding question resolves; session-removed drops the bit', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    manager.handleMuxEnvelope({ rpcId: 'r1' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a1' as never, toolName: 'rm' } })
+    manager.handleMuxEnvelope({ rpcId: 'r2' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a2' as never, toolName: 'rm' } })
+    manager.handleMuxEnvelope({ rpcId: 'rx' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'a1' as never, outcome: 'rejected' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleMuxEnvelope({ rpcId: 'ry' as never, payload: { type: 'approval/resolved', sessionId: S1, approvalId: 'a2' as never, outcome: 'rejected' as never } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+    // Removed sessions drop their bit outright.
+    manager.handleMuxEnvelope({ rpcId: 'r3' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'a3' as never, toolName: 'rm' } })
+    manager.handleHostEnvelope({ rpcId: 'h2' as never, payload: { type: 'host/session-removed', sessionId: S1 } })
+    expect(manager.getListSnapshot().items).toHaveLength(0)
+  })
+
+  it('drops stale bits on reconnect — the reopen replay re-adds still-pending questions', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleHostEnvelope({ rpcId: 'h1' as never, payload: { type: 'host/session-added', sessionId: S1 } })
+    manager.handleMuxEnvelope({ rpcId: 'ra' as never, payload: { type: 'approval/requested', sessionId: S1, approvalId: 'ap1' as never, toolName: 'rm' } })
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(true)
+    manager.handleConnected() // resolved-while-disconnected questions send no frame
+    expect(manager.getListSnapshot().items[0]?.waitingApproval).toBe(false)
+  })
+})
--- a/packages/client/runtime/tests/session.spec.ts
+++ b/packages/client/runtime/tests/session.spec.ts
@@ -669,3 +669,27 @@ describe('reference stability (the memo contract)', () => {
    expect(resolved.pending).toBe(after.pending)
  })
 })
+
+describe('permissions / setPermission', () => {
+  it('passes the select read and switch through with the session id', async () => {
+    const { api, session } = makeSession()
+    api.onPermissions = () => Promise.resolve(ok({ options: [{ value: 'workspace-write', name: 'workspace-write' }], currentValue: 'workspace-write' }))
+    const read = await session.permissions()
+    expect(read.ok).toBe(true)
+    if (read.ok) expect(read.value.currentValue).toBe('workspace-write')
+    expect(api.callsOf('session.permissions')).toMatchObject([{ sessionId: SID }])
+
+    const switched = await session.setPermission('danger-full-access')
+    expect(switched.ok).toBe(true)
+    if (switched.ok) expect(switched.value.currentValue).toBe('danger-full-access')
+    expect(api.callsOf('session.setPermission')).toMatchObject([{ sessionId: SID, value: 'danger-full-access' }])
+  })
+
+  it('folds transport failures into the error branch', async () => {
+    const { api, session } = makeSession()
+    api.onPermissions = () => Promise.reject(new Error('down'))
+    api.onSetPermission = () => Promise.reject(new Error('down'))
+    expect((await session.permissions()).ok).toBe(false)
+    expect((await session.setPermission('x')).ok).toBe(false)
+  })
+})
--- a/packages/client/ui-conversation/README.md
+++ b/packages/client/ui-conversation/README.md
@@ -4,6 +4,8 @@ Conversation domain: skeleton (header/tabs/composer/empty state), chat view (gro

 The view ring IS a slot: the conversation registration declares the `'conversation.view'` list slot (session scope) in its `children` table, ConversationRoot renders the active entry through its renderSlot share (`only: <active id>`), and view tabs project from the ring ledger's registration options (`id`/`order`/`label`). The chat view is this package's own ring entry; other plugins (ui-trajectory) contribute tabs through plain `ctx.slots.register` — the former package-local view registry (`registerView`/`ViewEntry`/`ConversationViewMap` and the chrome attachment table) is retired, with per-view chrome dissolved into the view components themselves.

+Approvals take over the composer through the chain this package declares: `ApprovalPanel` registers as a selector-routed `'conversation.composer'` entry (the ui-question pattern) and occupies the composer in place of the InputBar while an approval wait is pending (amber strip, justification headline, paired command line from the running call's args, one-shot refuse/allow). The `PendingApproval` domain face in `contract/slots.ts` owns the wire encoding — the `ApprovalResponsePayload` value with the audit correlation — over the runtime's `PendingWait` carrier; the broadcast `approval/resolved` frame settles the wait and restores the composer. The sidebar mirrors the blocked state: the session row's amber warning dot (a manager-tracked `waitingApproval` list bit, lit for uninstantiated sessions too) outranks the running ring until the question resolves. Question placeholders remain in the message flow as display-only PendingCards while ui-question owns the answering takeover. The composer's bottom-row chip mounts the permission-preset select (`PermissionSelect`), fed by the injected `permissions`/`setPermission` callbacks over the object layer's session RPCs; empty options (a permission-less host) hide the control, and the derived `custom` value renders as current-only.
+
 Generic tool rows classify the built-in bash, read, search, write, and edit names into dedicated visual variants. The filesystem variants render the edit icon and `Write · <path>` or `Edit · <path>` summary while retaining the shared row-to-details interaction.

 Tool rows are slots too — the standalone tool ring (`ToolViewRegistry`/`ctx.toolviews`/outlet) is retired. The chat entry declares the keyed `'conversation.chat.toolview'` hole (session scope; the key space is runtime-open); its render site dispatches per row via `entryKey: toolName` with `GenericToolCard` as the call-site `fallback`. The owner payload is the uniform `ToolRowOwnerProps` (`callId`/`toolName`/`block`/`openDetails`) and `ToolRowProps` pre-composes it with the session standard kit. A registrant is a plain plugin: `ctx.slots.register({ name: 'conversation.chat.toolview', key: '<tool>', inject? }, Row)` with `inject: ['slots', 'conversation']` as the load-order seam (apply mounts ConversationService after the chat registration, so the service being present guarantees the slot is declared); session differentiation happens inside the component (`useSessions` reading `parentId` — the bash sample is the third-party-posture exemplar). Trajectory/waterfall toolview slots share this shape and land with their own render sites (RendersCheck rejects a declaration nobody renders).
@@ -26,4 +28,5 @@ None; this package neither assembles nor sends a provider request.
 - **Details panel is the minimal form** — selected call args/result raw display; the Input/Output/Metadata switch, Prev/Next stepping, and See-in-trajectory deep link are deferred.
 - **Assistant footer extensions (IconActions row, per-message paging) are reserved slots** — drawn in the design, not implemented.
 - **The sparkle icon for the others tool row is a hand-drawn approximation** — the design glyph's vector geometry is not exportable locally; promotion into ui-primitives waits on an exact export.
- **Approval cards are display-only placeholders** — question requests answer through the composer chain (ui-question), while web-side approval answering is the P-II approvals project.
+- **The permission select reads once per mount** — a host-side preset change from another client surfaces only after a session re-select; live knob-event-driven refresh is deferred.
+- **The approval panel's "Always allow this type" is deferred** — durable grants need a grant-storage design; only allow-once/reject answer today.
--- a/packages/client/ui-conversation/src/client/apply.ts
+++ b/packages/client/ui-conversation/src/client/apply.ts
@@ -15,12 +15,13 @@ import type { SessionId, SessionsService } from '@deepseek-ai/dsh-client-runtime
 import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type { ViewTab } from './contract/views.ts'
 import type {
-  ChatViewInjected, ConversationInjected, DetailsInjected, EmptyStateInjected,
+  ApprovalWait, ChatViewInjected, ComposerChainProps, ConversationInjected, DetailsInjected, EmptyStateInjected,
 } from './contract/slots.ts'
 import { createChatStore } from './stores.ts'
 import { ConversationService } from './service.ts'
 import { ChatView } from './chat/ChatView.tsx'
 import { bashToolviewSample } from './toolviews/bash-sample.tsx'
+import { ApprovalPanel } from './skeleton/ApprovalPanel.tsx'
 import { ConversationRoot } from './skeleton/ConversationRoot.tsx'
 import { DetailsPanel } from './skeleton/DetailsPanel.tsx'
 import { EmptyState } from './skeleton/EmptyState.tsx'
@@ -37,6 +38,11 @@ function scopedConversation(sessions: SessionsService, id: SessionId): Conversat
  return conversation
 }

+/** Chain routing: claim the composer while an approval wait is pending (pure — owner props only). */
+function selectApproval({ interactions }: ComposerChainProps): ApprovalWait | null {
+  return interactions.find((i): i is ApprovalWait => i.kind === 'approval') ?? null
+}
+
 /**
 * Client plugin body.
 * @param ctx - client root context.
@@ -104,10 +110,31 @@ export function apply(ctx: Context): void {
          })
        },
        open: (target: SessionId) => { sessions.open(target) },
+        permissions: async () => {
+          const result = await sessions.manager.get(sessionId).permissions()
+          // Empty options = permission-less host composition: hide the control
+          // rather than show an empty select (deployment shape, not an error).
+          if (!result.ok || result.value.options.length === 0) return null
+          return result.value
+        },
+        setPermission: async (value) => {
+          const result = await sessions.manager.get(sessionId).setPermission(value)
+          return result.ok ? result.value.currentValue : null
+        },
      }
    },
  }, ConversationRoot)

+  // The approval takeover: a selector-routed entry of the chain this package
+  // just declared (the ui-question registration pattern; the entry lives here
+  // because approval answering is core conversation UX, not an optional tool).
+  // Zero business face — data and verbs both ride the matched carrier.
+  // priority 1: question takeovers (default 0) win when both kinds are
+  // pending — a question is a conversation the model is waiting on, while an
+  // approval only blocks one tool call; answering the question first cannot
+  // strand the approval (it re-elects the moment the question resolves).
+  slots.register({ name: 'conversation.composer', select: selectApproval, priority: 1 }, ApprovalPanel)
+
  // The chat view: first entry of the ring this package just declared.
  // Declaring the keyed toolview hole here is claiming it: ChatView is the
  // only component authorized to render per-tool rows. Shares the chat
--- a/packages/client/ui-conversation/src/client/chat/ChatView.tsx
+++ b/packages/client/ui-conversation/src/client/chat/ChatView.tsx
@@ -254,7 +254,9 @@ export function ChatView({ useSession, useStore, renderSlot, openDetails, loadOl
            ))}
          </div>
        )}
-        {pending.map((item) => <PendingCard key={item.key} item={item} />)}
+        {/* Approvals take over the composer (ApprovalPanel); only question
+            placeholders remain in the flow. */}
+        {pending.filter((item) => item.kind === 'question').map((item) => <PendingCard key={item.key} item={item} />)}
        </div>
      </div>
      <StatsLine useSession={useSession} />
--- a/packages/client/ui-conversation/src/client/chat/PendingCard.module.css
+++ b/packages/client/ui-conversation/src/client/chat/PendingCard.module.css
@@ -1,4 +1,4 @@
-/* Amber pending strip (approval waiting = warn semantic, figma state colors). */
+/* Amber pending strip (question waiting = warn semantic, figma state colors). */

 .card {
  margin: 6px 0;
@@ -13,19 +13,3 @@
  font-weight: 500;
  color: var(--dsw-alias-label-primary);
 }
-
-.mono {
-  font-family: var(--ds-font-family-code);
-}
-
-.reason {
-  margin-top: 4px;
-  font-size: 12px;
-  color: var(--dsw-alias-label-secondary);
-}
-
-.hint {
-  margin-top: 6px;
-  font-size: 11px;
-  color: var(--dsw-alias-label-tertiary);
-}
--- a/packages/client/ui-conversation/src/client/chat/PendingCard.tsx
+++ b/packages/client/ui-conversation/src/client/chat/PendingCard.tsx
@@ -1,6 +1,7 @@
-// PendingCard: approval/question placeholder card (visible, not answerable —
-// the composer-takeover approval panel is a P-II item; wire pending semantics
-// already exist so the flow must show them).
+// PendingCard: question pending placeholder in the message flow (visible
+// while the question composer owns the takeover slot elsewhere). Approvals
+// do not render here: they take over the composer (skeleton ApprovalPanel)
+// per the designer draft.

 import { memo } from 'react'
 import type { PendingInteraction } from '@deepseek-ai/dsh-client-runtime/client'
@@ -8,24 +9,14 @@ import { JsonBlock } from '@deepseek-ai/dsh-client-ui-primitives'
 import css from './PendingCard.module.css'

 export interface PendingCardProps {
-  item: PendingInteraction
+  item: Extract<PendingInteraction, { kind: 'question' }>
 }

 export const PendingCard = memo(function PendingCard({ item }: PendingCardProps) {
  return (
    <div className={css.card}>
-      {item.kind === 'approval' ? (
-        <>
-          <div className={css.title}>等待审批：<span className={css.mono}>{item.payload.toolName}</span></div>
-          {item.payload.reason !== undefined && <div className={css.reason}>{item.payload.reason}</div>}
-        </>
-      ) : (
-        <>
-          <div className={css.title}>等待回答（{item.payload.questions.length} 题）</div>
-          <JsonBlock label="问题内容" payload={item.payload.questions} />
-        </>
-      )}
-      <div className={css.hint}>请在原客户端处理（web 端作答后续里程碑提供）</div>
+      <div className={css.title}>等待回答（{item.payload.questions.length} 题）</div>
+      <JsonBlock label="问题内容" payload={item.payload.questions} />
    </div>
  )
 })
--- a/packages/client/ui-conversation/src/client/contract/slots.ts
+++ b/packages/client/ui-conversation/src/client/contract/slots.ts
@@ -11,7 +11,7 @@
 * here.
 */
 import type { PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
-import type { PendingInteraction, SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
+import type { PendingInteraction, PendingWait, PermissionSelect, SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
 import type { createChatStore } from '../stores.ts'
 import type { CallId, SelectionTarget, ViewTab } from './views.ts'

@@ -113,6 +113,10 @@ export interface ConversationInjected {
  stop(): void
  /** Navigate to another session (breadcrumb ancestors). */
  open(id: SessionId): void
+  /** Read the permission select (options + effective current value); null hides the control. */
+  permissions(): Promise<PermissionSelect | null>
+  /** Switch the permission preset; resolves the confirmed value, or null on failure (caller keeps the old value). */
+  setPermission(value: string): Promise<string | null>
 }

 /**
@@ -132,6 +136,68 @@ export type ConversationSlotProps =
  PropsRuntime<'conversation'> & PropsRenderSlots<'conversation.view' | 'conversation.composer'>
  & PropsStore<ChatStore> & ConversationInjected

+/** The pending approval carrier the owner dispatches into the composer chain. */
+export type ApprovalWait = PendingWait<'approval'>
+
+/**
+ * Approval domain face over the carrier (the ui-question PendingQuestion
+ * pattern): render identity and question material forwarded transparently;
+ * answer owns the wire encoding — the ApprovalResponsePayload value shape
+ * with the audit correlation the host reconciles — and turns a rejected
+ * carrier receipt into a thrown error. Minted per carrier via useMemo.
+ */
+export class PendingApproval {
+  /**
+   * @param wait - the runtime carrier for one pending approval question.
+   */
+  constructor(private readonly wait: ApprovalWait) {}
+
+  /** Opaque render identity (React key / one-shot latch remount axis), forwarded from the carrier. */
+  get key(): string {
+    return this.wait.key
+  }
+
+  /** The tool the question is about (headline fallback), forwarded from the carrier payload. */
+  get toolName(): string {
+    return this.wait.payload.toolName
+  }
+
+  /** The asker's human-readable WHY (headline when present), forwarded from the carrier payload. */
+  get reason(): string | undefined {
+    return this.wait.payload.reason
+  }
+
+  /** The paired tool call's id when the ask names one (command-line lookup key), forwarded from the carrier payload. */
+  get callId(): string | undefined {
+    return this.wait.payload.callId
+  }
+
+  /**
+   * Deliver the user's decision; a rejected carrier receipt throws. Panel
+   * removal stays frame-driven: the broadcast `approval/resolved` settles the
+   * wait and drops it from the pending list.
+   * @param outcome - the only two client-answerable outcomes.
+   */
+  async answer(outcome: 'allowed-once' | 'rejected'): Promise<void> {
+    const receipt = await this.wait.respond({
+      ok: true,
+      value: { sessionId: this.wait.sessionId, approvalId: this.wait.payload.approvalId, outcome },
+    })
+    if (!receipt.accepted) {
+      throw new Error(`approval response rejected: ${receipt.reason}`)
+    }
+  }
+}
+
+/**
+ * Full approval-composer props: the framework runtime share (chain currency +
+ * session/global standard kit) plus the chain `matched` share — the entry's
+ * selector result, already narrowed to the approval carrier. No injected
+ * share: the carrier plus the domain face above carry the whole behavior
+ * surface; the paired command line derives from useSession in-component.
+ */
+export type ApprovalComposerProps = PropsRuntime<'conversation.composer'> & { matched: ApprovalWait }
+
 /**
 * Injected share of the chat view entry: the two callbacks whose targets live
 * outside the view (layout orchestration; the session object layer).
--- a/packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.module.css
@@ -0,0 +1,107 @@
+/* Composer-takeover approval panel (draft approval.png): the same floating
+   capsule footprint as the InputBar card, with an amber header band, the
+   justification headline, a muted command line, and right-aligned actions.
+   Warn semantics ride the alias state tokens; no hardcoded colors. */
+
+/* Mirrors InputBar .root so the takeover is a content swap, not a layout jump. */
+.root {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 8px 32px 12px;
+}
+
+.card {
+  overflow: hidden;
+  width: 100%;
+  max-width: 776px;
+  border: 1px solid var(--dsw-alias-state-warn-secondary);
+  border-radius: 20px;
+  background: var(--dsw-specific-input-major);
+  box-shadow: var(--dsw-shadow-lv2);
+}
+
+/* Tinted full-width header band. */
+.strip {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 16px;
+  background: var(--dsw-alias-state-warn-tertiary);
+  color: var(--dsw-alias-state-warn-primary);
+  font-size: 13px;
+  line-height: 18px;
+}
+
+.dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--dsw-alias-state-warn-primary);
+}
+
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  padding: 12px 16px 14px;
+}
+
+/* The model's justification is the panel's message, not a footnote. */
+.headline {
+  color: var(--dsw-alias-label-primary);
+  font-size: 15px;
+  font-weight: 500;
+  line-height: 24px;
+}
+
+.command {
+  color: var(--dsw-alias-label-tertiary);
+  font-family: var(--ds-font-family-code);
+  font-size: 13px;
+  line-height: 20px;
+  word-break: break-all;
+}
+
+.actionRow {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 8px;
+}
+
+.allow,
+.reject {
+  padding: 6px 16px;
+  border-radius: 10px;
+  font-size: 13px;
+  line-height: 18px;
+  cursor: pointer;
+}
+
+.allow:disabled,
+.reject:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+
+/* Primary action: filled ink (draft's rightmost emphasis, minus the dropped
+   always-allow button). */
+.allow {
+  border: none;
+  background: var(--dsw-alias-label-primary);
+  color: var(--dsw-alias-label-primary-foreground);
+}
+
+/* Secondary: quiet outline. */
+.reject {
+  border: 1px solid var(--dsw-alias-border-l2-darkmode-thin);
+  background: transparent;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.reject:hover:not(:disabled) {
+  background: var(--dsw-alias-interactive-bg-hover-danger);
+  color: var(--dsw-alias-state-error-primary);
+  border-color: transparent;
+}
--- a/packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/ApprovalPanel.tsx
@@ -0,0 +1,71 @@
+// ApprovalPanel: the composer-takeover approval prompt (designer draft
+// approval.png), registered as a selector-routed entry of the
+// conversation-declared composer chain. While an approval question is
+// pending, this panel occupies the composer slot in place of the InputBar:
+// an amber "Waiting for approval" strip on the card top, the model's
+// justification as the headline, the paired command in muted code text, and
+// a right-aligned refuse/allow action row. One-shot: the buttons disable
+// after a click and the panel leaves (the InputBar returns) on the broadcast
+// resolved frame. The draft's "Always allow this type" is deferred with
+// grant storage.
+
+import { useMemo, useState } from 'react'
+import type { RunningToolCall } from '@deepseek-ai/dsh-client-runtime/client'
+import { PendingApproval, type ApprovalComposerProps } from '../contract/slots.ts'
+import css from './ApprovalPanel.module.css'
+
+/** Extract the shell command from an approval's paired running call (bash-family args carry `command`); undefined hides the line. */
+export function commandOf(call: RunningToolCall | undefined): string | undefined {
+  if (call === undefined) return undefined
+  try {
+    const args = JSON.parse(call.argsRaw) as Record<string, unknown>
+    return typeof args.command === 'string' ? args.command : undefined
+  } catch {
+    // Unparseable model args: the panel still renders, just without the command line.
+    return undefined
+  }
+}
+
+/**
+ * Composer takeover boundary: mints the domain face on the carrier's stable
+ * identity and remounts the flow per request key, so the one-shot answered
+ * latch never leaks to the next pending approval.
+ * @param props - the selector-matched pending approval carrier plus the framework standard kit.
+ * @returns The approval prompt for this request.
+ */
+export function ApprovalPanel(props: ApprovalComposerProps) {
+  const approval = useMemo(() => new PendingApproval(props.matched), [props.matched])
+  const command = props.useSession(s => commandOf(
+    approval.callId === undefined ? undefined : s.runningCalls.find(call => call.callId === approval.callId)))
+  return <ApprovalFlow key={approval.key} pending={approval} {...command === undefined ? {} : { command }} />
+}
+
+function ApprovalFlow({ pending, command }: { pending: PendingApproval; command?: string }) {
+  // Local one-shot latch: the panel leaves only when the resolved frame
+  // lands; until then the buttons must not re-fire. An answer failure
+  // (rejected receipt / transport) re-arms them for retry.
+  const [answered, setAnswered] = useState(false)
+  const answer = (outcome: 'allowed-once' | 'rejected'): void => {
+    setAnswered(true)
+    void pending.answer(outcome).catch(() => { setAnswered(false) })
+  }
+  return (
+    <div className={css.root} data-approval-key={pending.key}>
+      <div className={css.card}>
+        <div className={css.strip}><span className={css.dot} />等待审批</div>
+        <div className={css.body}>
+          <div className={css.headline}>{pending.reason ?? `工具 ${pending.toolName} 请求越权执行`}</div>
+          {command !== undefined && <div className={css.command}>{command}</div>}
+          <div className={css.actionRow}>
+            <button type="button" className={css.reject} disabled={answered} onClick={() => { answer('rejected') }}>
+              拒绝
+            </button>
+            <button type="button" className={css.allow} disabled={answered} onClick={() => { answer('allowed-once') }}>
+              允许一次
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
@@ -15,6 +15,7 @@ import type { SessionId, SessionListState, SessionSummary } from '@deepseek-ai/d
 import type { ConversationSlotProps } from '../contract/slots.ts'
 import { InputBar } from './InputBar.tsx'
 import type { InputBarError } from './InputBar.tsx'
+import { PermissionSelect } from './PermissionSelect.tsx'
 import css from './ConversationRoot.module.css'

 /** Full props = the automatic shares & injected share — composed by reference
@@ -38,7 +39,7 @@ function deriveAncestry(list: SessionListState, id: SessionId): readonly Session

 export function ConversationRoot({
  sessionId, useSession, useSessions, useStore, actions, renderSlot, renderSlotChain,
-  views, send, stop, open,
+  views, send, stop, open, permissions, setPermission,
 }: ConversationRootProps) {
  useSyncExternalStore(views.subscribe, views.version)
  const tabs = views.list()
@@ -68,6 +69,7 @@ export function ConversationRoot({
      disabled={removed}
      error={error}
      variant="composer"
+      controls={<PermissionSelect permissions={permissions} setPermission={setPermission} />}
      onDraftChange={actions.setDraft}
      onSend={(mode) => { send(draft, mode) }}
      onStop={stop}
--- a/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
@@ -30,6 +30,8 @@ export interface InputBarProps {
  placeholder?: string
  /** Optional leading accessory row above the textarea (kept for callers; empty state no longer uses it). */
  accessory?: ReactNode
+  /** Host-wired access-mode control (the composer mounts the permission chip here); replaces the visual-only placeholder. */
+  controls?: ReactNode
  onDraftChange: (text: string) => void
  onSend: (mode: 'queue' | 'steer') => void
  onStop: () => void
@@ -56,7 +58,7 @@ const MODEL_OPTIONS: readonly SelectOption[] = [
 ]

 export function InputBar({
-  draft, running, disabled, error, variant, placeholder, accessory, onDraftChange, onSend, onStop,
+  draft, running, disabled, error, variant, placeholder, accessory, controls, onDraftChange, onSend, onStop,
 }: InputBarProps) {
  const empty = draft.trim() === ''
  const inputRef = useRef<HTMLTextAreaElement | null>(null)
@@ -177,7 +179,8 @@ export function InputBar({
            </button>
            <div className={css.modes}>
              {renderSelect('Plan mode', planId, PLAN_OPTIONS, setPlanId)}
-              {renderSelect('Access mode', readonlyId, READONLY_OPTIONS, setReadonlyId)}
+              {/* The wired permission chip supersedes the visual-only Access placeholder. */}
+              {controls ?? renderSelect('Access mode', readonlyId, READONLY_OPTIONS, setReadonlyId)}
            </div>
          </div>
          <div className={css.trailing}>
--- a/packages/client/ui-conversation/src/client/skeleton/PermissionSelect.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/PermissionSelect.module.css
@@ -0,0 +1,49 @@
+/* Composer bottom-row permission chip (draft start.jpeg `Read-only ∨`): a
+   quiet text chip with a chevron; hover paints the standard interactive pill.
+   The native select is stretched invisibly over the chip so the platform
+   dropdown does the menu work — keyboard/AT semantics come free. */
+
+.root {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+}
+
+.chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 6px 8px;
+  border-radius: 8px;
+  color: var(--dsw-alias-label-secondary);
+  font-size: 14px;
+  line-height: 20px;
+  pointer-events: none; /* the overlaid select owns the interaction */
+}
+
+.root:hover .chip {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.chevron {
+  color: var(--dsw-alias-label-caption);
+}
+
+/* Invisible native select stretched over the chip: real menu, zero drawing. */
+.select {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  opacity: 0;
+  border: none;
+  cursor: pointer;
+}
+
+.select:disabled {
+  cursor: default;
+}
+
+.root:has(.select:disabled) .chip {
+  opacity: 0.5;
+}
--- a/packages/client/ui-conversation/src/client/skeleton/PermissionSelect.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/PermissionSelect.tsx
@@ -0,0 +1,88 @@
+// PermissionSelect: the composer bottom-row permission chip (draft
+// start.jpeg's `Read-only ∨` control). Options and the current value load on
+// mount from the injected permissions() callback; empty options
+// (permission-less host composition) render nothing. The visible chip is
+// presentation only — an invisible native select stretched over it owns the
+// menu and interaction. A switch disables the control until the host
+// confirms, then adopts the confirmed value (`custom` is shown as the current
+// value but never offered as a target — the host already omits it from
+// switchable options; a stale-select failure restores the previous value).
+
+import { useEffect, useRef, useState } from 'react'
+import type { PermissionSelect as PermissionSelectData } from '@deepseek-ai/dsh-client-runtime/client'
+import css from './PermissionSelect.module.css'
+
+/**
+ * Display transform: kebab-case machine names render as title-case labels
+ * (`workspace-write` → `Workspace Write`). Presentation-only — the wire
+ * vocabulary and the host's advertised names are untouched; a host-configured
+ * name that is not kebab-case (contains spaces or uppercase) passes through.
+ */
+function displayName(name: string): string {
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) return name
+  return name.split('-').map(word => word.charAt(0).toUpperCase() + word.slice(1)).join(' ')
+}
+
+export interface PermissionSelectProps {
+  /** Read the select material; null hides the control. */
+  permissions: () => Promise<PermissionSelectData | null>
+  /** Switch the preset; resolves the confirmed value, or null on failure. */
+  setPermission: (value: string) => Promise<string | null>
+}
+
+export function PermissionSelect({ permissions, setPermission }: PermissionSelectProps) {
+  const [data, setData] = useState<PermissionSelectData | null>(null)
+  const [switching, setSwitching] = useState(false)
+  // Unmount guard: the load/switch promises outlive a session switch's remount.
+  const aliveRef = useRef(true)
+  useEffect(() => {
+    aliveRef.current = true
+    void permissions().then((loaded) => {
+      if (aliveRef.current) setData(loaded)
+    })
+    return () => {
+      aliveRef.current = false
+    }
+  }, [permissions])
+
+  if (data === null) return null
+
+  const onChange = (value: string): void => {
+    if (value === data.currentValue) return
+    setSwitching(true)
+    const previous = data
+    setData({ ...data, currentValue: value })
+    void setPermission(value).then((confirmed) => {
+      if (!aliveRef.current) return
+      setSwitching(false)
+      if (confirmed === null) setData(previous)
+      else setData({ ...previous, currentValue: confirmed })
+    })
+  }
+
+  const current = data.options.find(option => option.value === data.currentValue)
+
+  return (
+    <label className={css.root} title={current?.description}>
+      <span className={css.chip}>
+        {displayName(current?.name ?? data.currentValue)}
+        <svg className={css.chevron} viewBox="0 0 12 12" width="12" height="12" aria-hidden>
+          <path d="M3 4.5L6 7.5L9 4.5" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" fill="none" />
+        </svg>
+      </span>
+      <select
+        className={css.select}
+        aria-label="权限策略"
+        value={data.currentValue}
+        disabled={switching}
+        onChange={(e) => { onChange(e.target.value) }}
+      >
+        {data.options.map(option => (
+          <option key={option.value} value={option.value} disabled={option.value === 'custom'}>
+            {displayName(option.name)}
+          </option>
+        ))}
+      </select>
+    </label>
+  )
+}
--- a/packages/client/ui-conversation/tests/apply-inject.spec.tsx
+++ b/packages/client/ui-conversation/tests/apply-inject.spec.tsx
@@ -61,6 +61,10 @@ async function bench() {
      () => Promise.resolve({ ok: true, value: { accepted: true } })),
    cancel: vi.fn<() => Promise<{ ok: boolean; value?: object; error?: { code: string; message: string } }>>(
      () => Promise.resolve({ ok: true, value: { accepted: true } })),
+    permissions: vi.fn<() => Promise<{ ok: boolean; value?: { options: { value: string; name: string }[]; currentValue: string }; error?: { code: string; message: string } }>>(
+      () => Promise.resolve({ ok: true, value: { options: [{ value: 'workspace-write', name: 'workspace-write' }], currentValue: 'workspace-write' } })),
+    setPermission: vi.fn<() => Promise<{ ok: boolean; value?: { currentValue: string }; error?: { code: string; message: string } }>>(
+      () => Promise.resolve({ ok: true, value: { currentValue: 'danger-full-access' } })),
  }
  const scopes = new Map<SessionId, Context>()
  const mint = (id: SessionId): Context => {
@@ -143,6 +147,32 @@ describe('conversation slot inject surface', () => {
    expect(b.sessionFake.loadOlder).toHaveBeenCalledTimes(1)
  })

+  it('permissions/setPermission thread the object layer; empty options and failures fold to null', async () => {
+    const b = await bench()
+    const { injected } = b.conversationSurface(ROOT)
+    expect(await injected.permissions()).toMatchObject({ currentValue: 'workspace-write' })
+    expect(await injected.setPermission('danger-full-access')).toBe('danger-full-access')
+    // Empty options (permission-less host) and the error branch both hide the control.
+    b.sessionFake.permissions.mockResolvedValueOnce({ ok: true, value: { options: [], currentValue: 'custom' } })
+    expect(await injected.permissions()).toBeNull()
+    b.sessionFake.permissions.mockResolvedValueOnce({ ok: false, error: { code: 'internal', message: 'x' } })
+    expect(await injected.permissions()).toBeNull()
+    b.sessionFake.setPermission.mockResolvedValueOnce({ ok: false, error: { code: 'bad-request', message: 'x' } })
+    expect(await injected.setPermission('nope')).toBeNull()
+  })
+
+  it('registers the approval takeover on the composer chain: routing selector, no inject face', async () => {
+    const b = await bench()
+    const entry = b.slots.entries('conversation.composer')[0]!
+    expect(entry.inject).toBeUndefined()
+    // The selector narrows the chain currency: approval wait in → that wait; none → null.
+    const select = entry.select as (owner: { interactions: readonly { kind: string }[] }) => unknown
+    const approval = { kind: 'approval' }
+    expect(select({ interactions: [{ kind: 'question' }, approval] })).toBe(approval)
+    expect(select({ interactions: [{ kind: 'question' }] })).toBeNull()
+    expect(select({ interactions: [] })).toBeNull()
+  })
+
  it('send trims, optimistically clears through actions, restores on failure without clobbering new typing', async () => {
    const b = await bench()
    const { instance, injected } = b.conversationSurface(ROOT)
--- a/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
@@ -44,11 +44,11 @@ describe('MessageItem arms', () => {
 })

 describe('small branch tails', () => {
-  it('PendingCard approval reason renders when present', () => {
+  it('PendingCard renders the question count', () => {
    const view = render(
-      <PendingCard item={new PendingWait('approval', RpcId('r1'), 's1' as SessionId, { approvalId: 'a1', toolName: 'rm', reason: 'careful' } as PendingWait<'approval'>['payload'], vi.fn())} />,
+      <PendingCard item={new PendingWait('question', RpcId('r1'), 's1' as SessionId, { questions: [{ id: 'q1', question: '选择' }] } as PendingWait<'question'>['payload'], vi.fn())} />,
    )
-    expect(view.getByText('careful')).toBeTruthy()
+    expect(view.getByText(/等待回答（1 题）/)).toBeTruthy()
  })

  it('AssistantMarkdown single-line reasoning summary skips the newline cut', () => {
--- a/packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx
@@ -123,8 +123,8 @@ describe('bash sample row', () => {
    return createSnapshotStore<SessionListState>({
      ids: [ROOT, CHILD],
      byId: {
-        [ROOT]: { id: ROOT, title: 'r', displayTitle: 'r', running: false, updatedAt: 0 },
-        [CHILD]: { id: CHILD, title: 'c', displayTitle: 'c', parentId: ROOT, running: false, updatedAt: 0 },
+        [ROOT]: { id: ROOT, title: 'r', displayTitle: 'r', running: false, waitingApproval: false, updatedAt: 0 },
+        [CHILD]: { id: CHILD, title: 'c', displayTitle: 'c', parentId: ROOT, running: false, waitingApproval: false, updatedAt: 0 },
      },
      current: undefined,
    } as SessionListState)
@@ -158,7 +158,7 @@ describe('bash sample row', () => {
    const orphan = 'late-child' as SessionId
    store.update((d) => {
      d.ids.push(orphan)
-      d.byId[orphan] = { id: orphan, title: 'l', displayTitle: 'l', running: false, updatedAt: 0 }
+      d.byId[orphan] = { id: orphan, title: 'l', displayTitle: 'l', running: false, waitingApproval: false, updatedAt: 0 }
    })
    const view = render(<BashRow {...rowProps(orphan, { store })} />)
    expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
--- a/packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx
@@ -75,7 +75,14 @@ async function bench(nodes: ToolResultNode[]) {
  const layout = { openDetails: vi.fn(), closeDetails: vi.fn() }
  ctx.provide('sessions', {
    list,
-    manager: { get: () => ({ loadOlder: vi.fn() }) },
+    manager: {
+      get: () => ({
+        loadOlder: vi.fn(),
+        // The mounted PermissionSelect loads on mount; empty options hide the control.
+        permissions: vi.fn(() => Promise.resolve({ ok: true, value: { options: [], currentValue: 'custom' } })),
+        setPermission: vi.fn(() => Promise.resolve({ ok: false, error: { code: 'bad-request', message: 'unused', details: { issues: [] } } })),
+      }),
+    },
    scope: () => ({ get: () => scoped }),
    cell: (id: string) => (id === SID ? cell : undefined),
    create: vi.fn(),
--- a/packages/client/ui-conversation/tests/chat-view.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-view.spec.tsx
@@ -342,12 +342,17 @@ describe('ChatView', () => {
    expect(lv.getByText('载入历史…')).toBeTruthy()
  })

-  it('pending interactions render placeholder cards', () => {
+  it('question waits render placeholder cards; approvals leave the flow (composer takeover)', () => {
    const h = makeHarness({
-      pending: [new PendingWait('approval', RpcId('r1'), SID,
-        { approvalId: 'ap1', toolName: 'bash' } as PendingWait<'approval'>['payload'], vi.fn())],
+      pending: [
+        new PendingWait('approval', RpcId('r1'), SID,
+          { approvalId: 'ap1', toolName: 'bash' } as PendingWait<'approval'>['payload'], vi.fn()),
+        new PendingWait('question', RpcId('r2'), SID,
+          { questions: [{ id: 'q1', question: '选择' }] } as PendingWait<'question'>['payload'], vi.fn()),
+      ],
    })
    const view = render(<h.ChatView {...h.props} />)
-    expect(view.getByText(/等待审批/)).toBeTruthy()
+    expect(view.getByText(/等待回答（1 题）/)).toBeTruthy()
+    expect(view.queryByText(/等待审批/)).toBeNull()
  })
 })
--- a/packages/client/ui-conversation/tests/skeleton-branches.spec.tsx
+++ b/packages/client/ui-conversation/tests/skeleton-branches.spec.tsx
@@ -82,6 +82,8 @@ describe('ConversationRoot branches', () => {
        send={vi.fn()}
        stop={vi.fn()}
        open={open}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
      />,
    )
    return { view, open, chat }
@@ -141,6 +143,8 @@ describe('ConversationRoot branches', () => {
        send={vi.fn()}
        stop={vi.fn()}
        open={vi.fn()}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
      />,
    )
    expect(view.getByTestId('view-body')).toBeTruthy()
--- a/packages/client/ui-conversation/tests/skeleton.spec.tsx
+++ b/packages/client/ui-conversation/tests/skeleton.spec.tsx
@@ -221,6 +221,8 @@ describe('ConversationRoot', () => {
        send={send}
        stop={stop}
        open={open}
+        permissions={() => Promise.resolve(null)}
+        setPermission={() => Promise.resolve(null)}
      />)
    return { ui, chat, send, stop, open, renderSlot }
  }
--- a/packages/client/ui-sidebar/README.md
+++ b/packages/client/ui-sidebar/README.md
@@ -18,6 +18,6 @@ None; this package neither assembles nor sends a provider request.

 ## Known Limitations and Deferred Work

- **State dots have two live data states (running/none)** — the done/error/amber sources arrive with P-II approvals and notifications; the four-color primitive is already wired.
+- **State dots have three live data states (running/amber approval-waiting/none)** — the done/error sources arrive with notifications; the four-color primitive is already wired.
 - **Group-by menu ships by-workspace only** — Update/Status grouping strategies are drawn without specs and deferred.
 - **"New task completed" unread marking is local viewing state** — completion-time > last-seen never reaches the host.
--- a/packages/client/ui-sidebar/src/client/Rows.tsx
+++ b/packages/client/ui-sidebar/src/client/Rows.tsx
@@ -102,7 +102,11 @@ export function SessionRowItem({ row, selected, now, onOpen, onToggle }: {
            </button>
          )
        : <span className={css.slot} />}
-      <span className={css.slot}>{row.running && <StateDot state="ongoing" />}</span>
+      {/* Waiting-approval (amber) outranks the running ring: the session is
+          blocked on the user, which is the more actionable fact. */}
+      <span className={css.slot}>
+        {row.waitingApproval ? <StateDot state="warning" /> : row.running && <StateDot state="ongoing" />}
+      </span>
      <span className={css.title}>{row.title}</span>
      <span className={css.time}>{formatRelativeTime(row.updatedAt, now)}</span>
      <span className={css.rowActions}>
--- a/packages/client/ui-sidebar/src/client/tree.ts
+++ b/packages/client/ui-sidebar/src/client/tree.ts
@@ -38,6 +38,8 @@ export interface SessionRow {
  hasChildren: boolean
  expanded: boolean
  running: boolean
+  /** An approval question is pending (amber warning dot outranks the running ring). */
+  waitingApproval: boolean
  updatedAt: number
 }

@@ -159,6 +161,7 @@ function sessionRow(g: Group, s: SessionSummary, depth: number, hasChildren: boo
    hasChildren,
    expanded,
    running: s.running,
+    waitingApproval: s.waitingApproval,
    updatedAt: s.updatedAt,
  }
 }
--- a/packages/client/ui-sidebar/tests/apply.spec.tsx
+++ b/packages/client/ui-sidebar/tests/apply.spec.tsx
@@ -23,7 +23,7 @@ async function bench() {
  await ctx.plugin(SlotsService).await()
  const list = createSnapshotStore<SessionListState>({
    ids: [sid('a')],
-    byId: { [sid('a')]: { id: sid('a'), title: 'alpha', displayTitle: 'alpha', cwd: '/proj', running: false, updatedAt: 1 } },
+    byId: { [sid('a')]: { id: sid('a'), title: 'alpha', displayTitle: 'alpha', cwd: '/proj', running: false, waitingApproval: false, updatedAt: 1 } },
    current: undefined,
  })
  const sessions = {
--- a/packages/client/ui-sidebar/tests/sidebar-root.spec.tsx
+++ b/packages/client/ui-sidebar/tests/sidebar-root.spec.tsx
@@ -31,6 +31,7 @@ interface SummaryInit {
  cwd?: string
  parentId?: string
  running?: boolean
+  waitingApproval?: boolean
  updatedAt?: number
 }

@@ -40,6 +41,7 @@ function summary(init: SummaryInit): SessionSummary {
    title: init.title ?? init.id,
    displayTitle: init.title ?? init.id,
    running: init.running ?? false,
+    waitingApproval: init.waitingApproval ?? false,
    updatedAt: init.updatedAt ?? 0,
  }
  if (init.cwd !== undefined) s.cwd = init.cwd
@@ -290,4 +292,17 @@ describe('SidebarRoot', () => {
    expect(busyRow.querySelector('[data-state="ongoing"]')).toBeTruthy()
    expect(idleRow.querySelector('[data-state="ongoing"]')).toBeNull()
  })
+
+  it('waiting-approval shows the amber warning dot and outranks the running ring', () => {
+    mount(
+      summary({ id: 'blocked', title: 'blocked one', cwd: '/p', running: true, waitingApproval: true, updatedAt: 2 }),
+      summary({ id: 'busy', title: 'busy one', cwd: '/p', running: true, updatedAt: 1 }),
+    )
+    act(() => { fireEvent.click(screen.getByText('p')) })
+    const blockedRow = screen.getByText('blocked one').closest('[role="treeitem"]')!
+    const busyRow = screen.getByText('busy one').closest('[role="treeitem"]')!
+    expect(blockedRow.querySelector('[data-state="warning"]')).toBeTruthy()
+    expect(blockedRow.querySelector('[data-state="ongoing"]')).toBeNull()
+    expect(busyRow.querySelector('[data-state="ongoing"]')).toBeTruthy()
+  })
 })
--- a/packages/client/ui-sidebar/tests/tree.spec.ts
+++ b/packages/client/ui-sidebar/tests/tree.spec.ts
@@ -15,6 +15,7 @@ interface SummaryInit {
  cwd?: string
  parentId?: string
  running?: boolean
+  waitingApproval?: boolean
  updatedAt?: number
 }

@@ -23,6 +24,7 @@ function summary(init: SummaryInit): SessionSummary {
    id: sid(init.id),
    displayTitle: init.displayTitle ?? init.title ?? init.id,
    running: init.running ?? false,
+    waitingApproval: init.waitingApproval ?? false,
    updatedAt: init.updatedAt ?? 0,
  }
  if (init.title !== undefined) s.title = init.title
--- a/packages/client/ui-trajectory/tests/views.spec.tsx
+++ b/packages/client/ui-trajectory/tests/views.spec.tsx
@@ -144,6 +144,8 @@ function mount(slots: SlotsService, nodes: ConversationSnapshot['nodes'] = NODES
      send={vi.fn()}
      stop={vi.fn()}
      open={vi.fn()}
+      permissions={() => Promise.resolve(null)}
+      setPermission={() => Promise.resolve(null)}
    />,
  )
 }
--- a/packages/core/session/src/index.ts
+++ b/packages/core/session/src/index.ts
@@ -59,6 +59,25 @@ export function findLastMessageTurnEnd(
  return latest
 }

+/**
+ * Whether the log currently sits inside an open turn (a `turn/start` not yet
+ * closed by a `turn/end`). The turn is the durable log's commit/replay
+ * boundary: a bare event appended between turns is indistinguishable from a
+ * crash tail and silently dropped on reload, so writers of turn-enclosed
+ * events (approval audit pairs, permission/sandbox knob switches) gate on
+ * this fold and hold idle writes until the next turn opens.
+ * @param events - session events, or an owned suffix, to inspect.
+ * @returns true when the last turn boundary event is a `turn/start`.
+ */
+export function hasOpenTurn(events: readonly SessionEvent[]): boolean {
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const type = (events[index] as SessionEvent).type
+    if (type === 'turn/start') return true
+    if (type === 'turn/end') return false
+  }
+  return false
+}
+
 declare module 'cordis' {
  interface Context {
    sessions: SessionStore
--- a/packages/core/session/tests/session.spec.ts
+++ b/packages/core/session/tests/session.spec.ts
@@ -4,6 +4,7 @@ import { CallId } from '@deepseek-ai/dsh-llm'
 import SessionStore, {
  displayPromptContent,
  findLastMessageTurnEnd,
+  hasOpenTurn,
  SESSION_FORMAT_VERSION,
  Session,
  SessionEvent,
@@ -91,6 +92,17 @@ describe('Session', () => {
    expect(findLastMessageTurnEnd(session.events)).toBe(messageEnd)
  })

+  it('reports an open turn only between turn/start and its turn/end', () => {
+    const session = new Session(SessionId('open-turn'))
+    expect(hasOpenTurn(session.events)).toBe(false)
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    expect(hasOpenTurn(session.events)).toBe(true)
+    session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
+    expect(hasOpenTurn(session.events)).toBe(true)
+    session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    expect(hasOpenTurn(session.events)).toBe(false)
+  })
+
  it('round-trips the coarse aborted turn outcome', () => {
    const session = new Session(SessionId('aborted'))
    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
--- a/packages/host/apiproxy/README.md
+++ b/packages/host/apiproxy/README.md
@@ -24,6 +24,6 @@ None; this package neither assembles nor sends a provider request.

 ## Known Limitations and Deferred Work

- **`respond` routing is shipped, but pending-interaction state is host-side work** — the wire shape (POST `/api/respond`, `RpcReceipt`) is final; the pending table that makes late/duplicate answers meaningful lives in `dsh-host-runtime` and is still a stub there.
+- **`respond` is routed by host-side pending tables** — the wire shape (POST `/api/respond`, `RpcReceipt`) is final here; the approval and question registries that make late/duplicate answers meaningful live in `dsh-host-runtime`.
 - **Reserved seams stay out of `RpcMethodMap`** — `session.fork`, `prompt.mode: 'inject'`, `task.list`, `host.listModels`, and a describe `hostInstanceId` are documented reservations; an unknown method fails loud at envelope parse rather than getting a not-implemented code.
 - **No protocol version field** — client and host ship together; `host.describe` gains a version negotiation field only when an independently released client exists.
--- a/packages/host/apiproxy/src/api/index.ts
+++ b/packages/host/apiproxy/src/api/index.ts
@@ -19,7 +19,7 @@ export interface ApiProxy {
 }

 // ---- Domain interfaces and payload entities ----
-export type { HistoryEntry, SessionsApi, SessionSummary } from './sessions.ts'
+export type { HistoryEntry, PermissionOption, SessionsApi, SessionSummary } from './sessions.ts'
 export type { HostApi } from './host.ts'
 export type { EventsApi, MuxFrame, HostFrame, ToolCallView, ToolEventView, ToolResultView } from './events.ts'
 export type { ApprovalResponsePayload } from './approvals.ts'
--- a/packages/host/apiproxy/src/api/rpc-map.ts
+++ b/packages/host/apiproxy/src/api/rpc-map.ts
@@ -15,6 +15,8 @@ export interface RpcMethodMap {
  'session.history': SessionsApi['history']
  'session.prompt': SessionsApi['prompt']
  'session.cancel': SessionsApi['cancel']
+  'session.permissions': SessionsApi['permissions']
+  'session.setPermission': SessionsApi['setPermission']
  'host.describe': HostApi['describe']
 }

--- a/packages/host/apiproxy/src/api/sessions.schema.ts
+++ b/packages/host/apiproxy/src/api/sessions.schema.ts
@@ -9,7 +9,7 @@ import { z } from 'zod'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
 import type { RequestPayload, ResponseValue } from './rpc-map.ts'
 import type { Wire } from './rpc.schema.ts'
-import type { HistoryEntry, SessionSummary } from './sessions.ts'
+import type { HistoryEntry, PermissionOption, SessionSummary } from './sessions.ts'
 import type { ToolEventView } from './events.ts'

 /** SessionId: one brand cast after shape validation (the only cast point in this domain). */
@@ -108,3 +108,32 @@ export const sessionCancelRequestSchema = z.object({
 export const sessionCancelValueSchema = z.object({
  accepted: z.literal(true),
 }) satisfies z.ZodType<Wire<ResponseValue<'session.cancel'>>>
+
+/** One permission select option (a preset table key, or the derived `custom`). */
+export const permissionOptionSchema = z.object({
+  value: z.string(),
+  name: z.string(),
+  description: z.string().optional(),
+}) satisfies z.ZodType<Wire<PermissionOption>>
+
+/** session.permissions request payload. */
+export const sessionPermissionsRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+}) satisfies z.ZodType<Wire<RequestPayload<'session.permissions'>>>
+
+/** session.permissions response value. */
+export const sessionPermissionsValueSchema = z.object({
+  options: z.array(permissionOptionSchema),
+  currentValue: z.string(),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.permissions'>>>
+
+/** session.setPermission request payload. */
+export const sessionSetPermissionRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+  value: z.string(),
+}) satisfies z.ZodType<Wire<RequestPayload<'session.setPermission'>>>
+
+/** session.setPermission response value. */
+export const sessionSetPermissionValueSchema = z.object({
+  currentValue: z.string(),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.setPermission'>>>
--- a/packages/host/apiproxy/src/api/sessions.ts
+++ b/packages/host/apiproxy/src/api/sessions.ts
@@ -44,6 +44,21 @@ export interface SessionSummary {
  cwd?: string
 }

+/**
+ * One selectable permission preset (or the derived `custom` state) as the
+ * client renders it. Protocol-owned DTO (the ACP bridge precedent: each
+ * protocol owns its presentation shape); the host projects it from
+ * `ctx.permission` without exposing that service's types on the wire.
+ */
+export interface PermissionOption {
+  /** The machine value (`session.setPermission` vocabulary): a preset table key, or `custom`. */
+  value: string
+  /** The display label. */
+  name: string
+  /** One user-facing sentence on what the value means. */
+  description?: string
+}
+
 /** Session-domain unary methods (the map keys session.* of RpcMethodMap). */
 export interface SessionsApi {
  /** Lists persisted sessions (updatedAt descending). v1 returns everything; cursor is a reserved seat, unimplemented. */
@@ -70,4 +85,24 @@ export interface SessionsApi {

  /** Stops: clears both FIFOs + aborts the current step (1:1 with agent.cancel). */
  cancel(request: RpcRequest<{ sessionId: SessionId }>): Promise<RpcResponse<{ accepted: true }>>
+
+  /**
+   * Reads the session's permission select: every switchable preset plus the
+   * effective current value (`custom` when the knobs match no preset — shown,
+   * never a switch target). A host composed without the permission service
+   * returns empty options and `custom`; clients hide the control.
+   */
+  permissions(request: RpcRequest<{ sessionId: SessionId }>):
+  Promise<RpcResponse<{ options: PermissionOption[]; currentValue: string }>>
+
+  /**
+   * Switches the session's permission preset. Mirrors the ACP bridge's
+   * turn-anchoring: inside an open turn the knob events append immediately;
+   * idle switches are held last-write-wins and flushed into the next prompted
+   * turn (approval-policy and sandbox-mode events must stay turn-enclosed for
+   * durable replay). A current-value echo is acknowledged without recording.
+   * Unknown values and a permission-less composition are bad-request.
+   */
+  setPermission(request: RpcRequest<{ sessionId: SessionId; value: string }>):
+  Promise<RpcResponse<{ currentValue: string }>>
 }
--- a/packages/host/apiproxy/src/fetch/client.ts
+++ b/packages/host/apiproxy/src/fetch/client.ts
@@ -19,7 +19,9 @@ import {
  sessionCreateValueSchema,
  sessionHistoryValueSchema,
  sessionListValueSchema,
+  sessionPermissionsValueSchema,
  sessionPromptValueSchema,
+  sessionSetPermissionValueSchema,
 } from '../api/sessions.schema.ts'

 /**
@@ -44,6 +46,8 @@ export interface IApiClient {
    history(payload: RequestPayload<'session.history'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.history'>>>
    prompt(payload: RequestPayload<'session.prompt'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.prompt'>>>
    cancel(payload: RequestPayload<'session.cancel'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.cancel'>>>
+    permissions(payload: RequestPayload<'session.permissions'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.permissions'>>>
+    setPermission(payload: RequestPayload<'session.setPermission'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.setPermission'>>>
  }
  host: {
    describe(payload: RequestPayload<'host.describe'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'host.describe'>>>
@@ -66,6 +70,8 @@ const UNARY_VALUE_SCHEMAS: { [K in keyof RpcMethodMap]: z.ZodType<Wire<ResponseV
  'session.history': sessionHistoryValueSchema,
  'session.prompt': sessionPromptValueSchema,
  'session.cancel': sessionCancelValueSchema,
+  'session.permissions': sessionPermissionsValueSchema,
+  'session.setPermission': sessionSetPermissionValueSchema,
  'host.describe': hostDescribeValueSchema,
 }

@@ -247,6 +253,8 @@ export abstract class AbstractApiClient implements IApiClient {
    history: (payload, signal) => this.callUnary('session.history', payload, signal),
    prompt: (payload, signal) => this.callUnary('session.prompt', payload, signal),
    cancel: (payload, signal) => this.callUnary('session.cancel', payload, signal),
+    permissions: (payload, signal) => this.callUnary('session.permissions', payload, signal),
+    setPermission: (payload, signal) => this.callUnary('session.setPermission', payload, signal),
  }

  readonly host: IApiClient['host'] = {
--- a/packages/host/apiproxy/src/fetch/handler.ts
+++ b/packages/host/apiproxy/src/fetch/handler.ts
@@ -19,7 +19,9 @@ import {
  sessionCreateRequestSchema,
  sessionHistoryRequestSchema,
  sessionListRequestSchema,
+  sessionPermissionsRequestSchema,
  sessionPromptRequestSchema,
+  sessionSetPermissionRequestSchema,
 } from '../api/sessions.schema.ts'
 import { hostDescribeRequestSchema } from '../api/host.schema.ts'

@@ -43,6 +45,8 @@ const UNARY_ROUTES: UnaryRoutes = {
  'session.history': { schema: sessionHistoryRequestSchema, invoke: (api, r) => api.sessions.history(r) },
  'session.prompt': { schema: sessionPromptRequestSchema, invoke: (api, r) => api.sessions.prompt(r) },
  'session.cancel': { schema: sessionCancelRequestSchema, invoke: (api, r) => api.sessions.cancel(r) },
+  'session.permissions': { schema: sessionPermissionsRequestSchema, invoke: (api, r) => api.sessions.permissions(r) },
+  'session.setPermission': { schema: sessionSetPermissionRequestSchema, invoke: (api, r) => api.sessions.setPermission(r) },
  'host.describe': { schema: hostDescribeRequestSchema, invoke: (api, r) => api.host.describe(r) },
 }

--- a/packages/host/apiproxy/tests/client-handler.spec.ts
+++ b/packages/host/apiproxy/tests/client-handler.spec.ts
@@ -31,6 +31,8 @@ function scriptedApi(overrides: {
      history: r => ok(r, { events: [], hasMore: false }),
      prompt: r => ok(r, { accepted: true as const }),
      cancel: r => ok(r, { accepted: true as const }),
+      permissions: r => ok(r, { options: [], currentValue: 'custom' }),
+      setPermission: r => ok(r, { currentValue: r.payload.value }),
      ...overrides.sessions,
    },
    host: { describe: r => ok(r, { version: '0-test', cwd: '/t', attachedSessions: 0 }), ...overrides.host },
--- a/packages/host/apiproxy/tests/fetch-carrier.spec.ts
+++ b/packages/host/apiproxy/tests/fetch-carrier.spec.ts
@@ -36,6 +36,12 @@ function fakeApi(overrides: Partial<{ muxFrames: MuxFrame[]; hostFrames: HostFra
      async cancel(request) {
        return { rpcId: request.rpcId, result: { ok: true, value: { accepted: true as const } } }
      },
+      async permissions(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { options: [], currentValue: 'custom' } } }
+      },
+      async setPermission(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { currentValue: request.payload.value } } }
+      },
    },
    host: {
      async describe(request) {
@@ -75,11 +81,13 @@ describe('unary round trip (handler ⇄ client, no network)', () => {
    if (!response.result.ok) expect(response.result.error.code).toBe('session-not-found')
  })

-  it('covers create/prompt/cancel/describe passthrough', async () => {
+  it('covers create/prompt/cancel/permissions/setPermission/describe passthrough', async () => {
    const c = client()
    expect((await c.sessions.create({})).result.ok).toBe(true)
    expect((await c.sessions.prompt({ sessionId: 's' as never, mode: 'queue', content: [{ type: 'text', text: 'x' }] })).result.ok).toBe(true)
    expect((await c.sessions.cancel({ sessionId: 's' as never })).result.ok).toBe(true)
+    expect((await c.sessions.permissions({ sessionId: 's' as never })).result.ok).toBe(true)
+    expect((await c.sessions.setPermission({ sessionId: 's' as never, value: 'workspace-write' })).result.ok).toBe(true)
    expect((await c.host.describe({})).result.ok).toBe(true)
  })
 })
--- a/packages/host/runtime/README.md
+++ b/packages/host/runtime/README.md
@@ -1,6 +1,6 @@
 # @deepseek-ai/dsh-host-runtime

-Host runtime assembly for `dsh`: `bootHost` composes the core plugin spine (LLM service + DeepSeek adapter, sessions with JSONL persistence and immediate fallback titles, optional first-message model summaries, system prompt, tools, agents, agent loop, workspace instructions, local bash, and the provider-neutral user-interaction service), `createApiProxy` implements the [`dsh-host-apiproxy`](../apiproxy/README.md) contract over that composition, and `startHost` is the one-step shell seam returning `{ api, handler, defaults, ctx, dispose }`.
+Host runtime assembly for `dsh`: `bootHost` composes the core plugin spine (LLM service + DeepSeek adapter, sessions with JSONL persistence and immediate fallback titles, optional first-message model summaries, system prompt, tools, agents, agent loop, workspace instructions, the provider-neutral user-interaction service, and the sandboxed product path — `dsh-sandbox-local` + `dsh-sandbox-policy` behind the confined `dsh-bash-sandbox`/`dsh-fs-sandbox` families, with `dsh-user-approval` and `dsh-permission` on top), `createApiProxy` implements the [`dsh-host-apiproxy`](../apiproxy/README.md) contract over that composition, and `startHost` is the one-step shell seam returning `{ api, handler, defaults, ctx, dispose }`.

 Which plugins mount and with what defaults is decided only here — shells must not `ctx.plugin` to alter the assembly. `RunningHost.ctx` is a formal seam with exactly two sanctioned uses: mounting protocol front-door plugins (e.g. a future `dsh acp`) and headless session-event subscription; consuming clients must not bypass `api` through it.

@@ -15,11 +15,15 @@ Which plugins mount and with what defaults is decided only here — shells must
 | `cwd` | `process.cwd()` | Default project directory for a session whose create request omits `cwd`. |
 | `sessionTitle` | 5 words / 40 fallback bytes / 80 accepted bytes | Deterministic fallback and accepted-title limits. |
 | `sessionTitleLlm` | disabled | `true` enables the 5-word / 10-CJK-character, 4,096-input-byte, 64-output-token, 60-second first-message policy; an explicit config overrides it. An omitted route inherits the logged main-request provider and model. |
+| `sandbox.mode` | `'workspace-write'` | File-sandbox mode sessions start from (`ctx.sandboxPolicy` default; per-session switches ride `sandbox/mode` events). |
+| `sandbox.approvalPolicy` | `'ask'` | Approval policy for sessions without an `approval/policy` override. |

 ## ApiProxy implementation notes

 Unary methods take the narrow `RpcRequest<P>` and echo `request.rpcId`; a prompt's rpcId rides `MessageSource` into the `user/message` event so clients can promote optimistic echoes. `history`/`prompt` on a cold session implicitly resume it, deduplicating concurrent calls through an in-flight table; `history` paginates backwards on message boundaries (never mid-message). The mux stream replays a `session/subscribed` baseline per attached session and every still-pending question with its original rpcId. Question responses, including blank per-item answers, are validated against the owning session and exact request before an atomic first-wins claim; answer, whole-request cancellation, owner abort, and provider disposal broadcast `question/resolved`. The host stream carries session lifecycle, running flips, and `agent/error` as the only outlet for live failures with no turn position.

+The proxy is also the approval channel for the agents this host owns: an ask through `ctx.approval` becomes an answerable `approval/requested` mux frame with a stable rpcId held in a pending table, replayed verbatim on every mux open until settled. `respond` routes by the echoed rpcId (approvals first, then questions), validates the `ApprovalResponsePayload` audit correlation at the wire boundary, resolves the answerer, and broadcasts `approval/resolved`; the ask's own abort signal withdraws the question as `cancelled`. `session.permissions`/`session.setPermission` project `ctx.permission` (empty select when not composed); idle switches are held last-write-wins and flushed into the next prompted turn on `agent/prompt-submit`, because knob events must stay turn-enclosed for durable replay (the ACP bridge's anchoring pattern).
+
 ## Model Experience

 Indirectly, through the non-blocking first-message title request owned by [`dsh-session-title-llm`](../../session-title/session-title-llm/README.md) when `sessionTitleLlm` is enabled, the provider/model defaults injected into created and resumed agents, the other model-facing plugins `bootHost` mounts, and the logged [workspace-instruction prefix](../../context/workspace-context/README.md#prompt-shape) when `workspaceContext` is enabled.
@@ -30,6 +34,6 @@ No main-request invalidation; when enabled, the auxiliary title request has its

 ## Known Limitations and Deferred Work

- **Question waits are process-memory state** — browser reconnects recover them, but a host process restart aborts the owning tool call instead of restoring the wait from persistence.
+- **Question and approval waits are process-memory state** — browser reconnects recover them, but a host process restart aborts the owning tool call instead of restoring the wait from persistence.
 - **`host.describe.version` is a placeholder** — it does not yet report the `apps/cli` package version.
 - **The assembly is fixed** — per-deployment plugin selection (user profile, log sinks, alternative persistence) has a documented home here but no configuration surface yet.
--- a/packages/host/runtime/package.json
+++ b/packages/host/runtime/package.json
@@ -31,13 +31,17 @@
    "@cordisjs/plugin-timer": "workspace:^",
    "@deepseek-ai/dsh-agent": "workspace:^",
    "@deepseek-ai/dsh-agent-loop": "workspace:^",
-    "@deepseek-ai/dsh-bash-local": "workspace:^",
+    "@deepseek-ai/dsh-bash-sandbox": "workspace:^",
    "@deepseek-ai/dsh-compact-basic": "workspace:^",
-    "@deepseek-ai/dsh-fs-local": "workspace:^",
    "@deepseek-ai/dsh-fs-policy": "workspace:^",
+    "@deepseek-ai/dsh-fs-sandbox": "workspace:^",
    "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
    "@deepseek-ai/dsh-llm": "workspace:^",
    "@deepseek-ai/dsh-llm-deepseek": "workspace:^",
+    "@deepseek-ai/dsh-permission": "workspace:^",
+    "@deepseek-ai/dsh-sandbox": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-local": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-policy": "workspace:^",
    "@deepseek-ai/dsh-session": "workspace:^",
    "@deepseek-ai/dsh-session-persistence": "workspace:^",
    "@deepseek-ai/dsh-session-persistence-jsonl": "workspace:^",
@@ -63,6 +67,7 @@
    "@deepseek-ai/dsh-tool-todo": "workspace:^",
    "@deepseek-ai/dsh-tool-workflow": "workspace:^",
    "@deepseek-ai/dsh-tools": "workspace:^",
+    "@deepseek-ai/dsh-user-approval": "workspace:^",
    "@deepseek-ai/dsh-user-interaction": "workspace:^",
    "@deepseek-ai/dsh-workflow-workerthread": "workspace:^",
    "@deepseek-ai/dsh-workspace-context": "workspace:^"
--- a/packages/host/runtime/src/api-proxy.ts
+++ b/packages/host/runtime/src/api-proxy.ts
@@ -1,19 +1,31 @@
 /**
- * Host-side ApiProxy implementation. Signature discipline: unary takes the
- * narrow RpcRequest<P> and echoes request.rpcId on the RpcResponse<T>.
+ * Host-side ApiProxy implementation. Unary methods, both streams, and the
+ * pending-interaction registries are real: the approval registry turns
+ * `ctx.approval` asks into answerable `approval/requested` mux frames and the
+ * question provider does the same for `ask_user_question`; both are answered
+ * through `respond` (routed by the echoed rpcId). Signature discipline: unary
+ * takes the narrow RpcRequest<P> and echoes request.rpcId on the RpcResponse<T>.
 */

 import { randomUUID } from 'node:crypto'
 import { mkdir, stat } from 'node:fs/promises'
 import type { Context } from 'cordis'
 import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
+import type { CallId } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm'
+import { hasOpenTurn } from '@deepseek-ai/dsh-session'
 import type { JsonValue, Session, SessionEvent, SessionHeader, SessionId } from '@deepseek-ai/dsh-session'
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 import { foldSessionTitle } from '@deepseek-ai/dsh-session-title'
+import type { ApprovalOutcome, ApprovalRequestId } from '@deepseek-ai/dsh-user-approval'
+// Side-effect type imports: resolve `ctx.approval` / `ctx.get('permission')`
+// without value dependencies on the seams (both are optional compositions here).
+import type {} from '@deepseek-ai/dsh-user-approval'
+import type {} from '@deepseek-ai/dsh-permission'
 import type {
  ApiProxy, HistoryEntry, HostFrame, MuxFrame, QuestionResponsePayload, SessionSummary, ToolEventView,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
+import { approvalResponsePayloadSchema } from '@deepseek-ai/dsh-host-apiproxy/api/approvals.schema'
 import { questionResponsePayloadSchema } from '@deepseek-ai/dsh-host-apiproxy/api/questions.schema'
 import type { ClientResponse, RpcError, RpcReceipt, RpcRequest, RpcResponse } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
@@ -183,6 +195,36 @@ interface ToolCallData { callId: string; name: string; arguments: string }
 /** The tool/result payload fields the presenter path reads. */
 interface ToolResultData { callId: string; content: ContentBlock[]; isError: boolean; meta?: JsonValue }

+/**
+ * One outstanding approval question: the stable server-request id, the frame
+ * material replayed to late mux subscribers, and the resolver that settles the
+ * answerer's promise back into `ctx.approval`.
+ */
+interface PendingApproval {
+  rpcId: RpcId
+  sessionId: SessionId
+  approvalId: ApprovalRequestId
+  toolName: string
+  callId?: CallId
+  reason?: string
+  resolve(outcome: ApprovalOutcome): void
+}
+
+/** Project a pending entry into its answerable mux frame (initial push and mux-open replay share it). */
+function requestedFrame(pending: PendingApproval): RpcRequest<MuxFrame> {
+  return {
+    rpcId: pending.rpcId,
+    payload: {
+      type: 'approval/requested',
+      sessionId: pending.sessionId,
+      approvalId: pending.approvalId,
+      toolName: pending.toolName,
+      ...pending.callId === undefined ? {} : { callId: pending.callId },
+      ...pending.reason === undefined ? {} : { reason: pending.reason },
+    },
+  }
+}
+
 /** One host-owned question wait, addressed by the stable server-request id. */
 interface PendingQuestion {
  rpcId: RpcId
@@ -283,6 +325,7 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
  /** Implicit resume of cold sessions, deduplicating concurrent calls (follows the jsonrpc sessionCreations precedent). */
  const resumes = new Map<SessionId, Promise<Agent>>()
  const pendingQuestions = new Map<RpcId, PendingQuestion>()
+  const pendingApprovals = new Map<RpcId, PendingApproval>()
  const muxQueues = new Set<FrameQueue<RpcRequest<MuxFrame>>>()

  /** Send one transient frame to every connected mux consumer. */
@@ -341,6 +384,95 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
    }
  }, 'api-proxy: user-interaction provider')

+  // --- Approval pending registry ------------------------------------------
+  // The proxy is the approval channel for every agent this host owns: an ask
+  // through `ctx.approval` becomes an answerable server-request on the mux
+  // stream (stable rpcId), settled by POST /api/respond. The entry survives
+  // client disconnects — mux-open replays still-pending requested frames with
+  // the same rpcId (the refresh-recovery baseline) — and withdraws on the
+  // ask's own abort signal (turn cancel), pushing `cancelled` to subscribers.
+  if (ctx.get('approval') !== undefined) {
+    ctx.on('approval/request', (req, next) => {
+      // The audit pair `approval/asked` is already appended by the service
+      // before dispatch, but dispatch rides a microtask: parallel tool calls
+      // can append several asked events before any answerer runs. THIS
+      // request's event is therefore the newest asked event that is still
+      // undecided, unclaimed by another pending entry, and — when the ask
+      // names a call — carries the same callId.
+      const events = req.agent.session.events
+      const claimed = new Set<ApprovalRequestId>()
+      for (const entry of pendingApprovals.values()) claimed.add(entry.approvalId)
+      const decided = new Set<ApprovalRequestId>()
+      let approvalId: ApprovalRequestId | undefined
+      for (let i = events.length - 1; i >= 0; i -= 1) {
+        const event = events[i] as SessionEvent
+        if (event.type === 'approval/decided') {
+          decided.add(event.data.id)
+        } else if (event.type === 'approval/asked') {
+          if (decided.has(event.data.id) || claimed.has(event.data.id)) continue
+          if (req.callId !== undefined && event.data.callId !== req.callId) continue
+          approvalId = event.data.id
+          break
+        }
+      }
+      // No asked event means the request bypassed the service's audit path —
+      // not this channel's question; delegate to the fail-closed default.
+      if (approvalId === undefined) return next()
+      const id = approvalId
+      return new Promise<ApprovalOutcome>((resolve) => {
+        const settle = (outcome: ApprovalOutcome): void => {
+          /* v8 ignore next 3 -- defensive double-settle guard: respond() routes
+             through the pending table (a settled id is not-pending before it can
+             re-settle) and the first settle removes the abort listener, so no
+             reachable path settles twice; kept against future settle callers. */
+          if (!pendingApprovals.delete(pending.rpcId)) return
+          req.signal?.removeEventListener('abort', onAbort)
+          broadcast({ type: 'approval/resolved', sessionId: pending.sessionId, approvalId: id, outcome })
+          // A cancelled ask was already settled by the service's own signal
+          // race, which discards this late resolution; resolving is a no-op
+          // there and keeps this promise from dangling forever.
+          resolve(outcome)
+        }
+        const onAbort = (): void => { settle('cancelled') }
+        const pending: PendingApproval = {
+          rpcId: RpcId(randomUUID()),
+          sessionId: req.agent.session.id,
+          approvalId: id,
+          toolName: req.toolName,
+          ...req.callId === undefined ? {} : { callId: req.callId },
+          ...req.reason === undefined ? {} : { reason: req.reason },
+          resolve: settle,
+        }
+        pendingApprovals.set(pending.rpcId, pending)
+        req.signal?.addEventListener('abort', onAbort, { once: true })
+        const envelope = requestedFrame(pending)
+        for (const queue of muxQueues) queue.push(envelope)
+      })
+    })
+  }
+
+  // --- Permission switch anchoring ----------------------------------------
+  // Knob events (`permission/preset`, `sandbox/mode`, `approval/policy`) must
+  // be turn-enclosed for durable replay, so an idle switch is held here
+  // last-write-wins and flushed when the next prompted turn opens (the ACP
+  // bridge's pendingSwitches pattern; prompt-submit is inside the new turn but
+  // before prompt assembly, so the switch is visible to that turn's request).
+  const pendingSwitches = new Map<SessionId, string>()
+  ctx.on('agent/prompt-submit', (agent, _content, _source, _signal, next) => {
+    const preset = pendingSwitches.get(agent.session.id)
+    if (preset !== undefined) {
+      pendingSwitches.delete(agent.session.id)
+      const presets = ctx.get('permission')
+      /* v8 ignore next -- a pending preset exists only if setPermission saw the
+         service; it cannot unmount between that and the next turn here. */
+      if (presets !== undefined) presets.set(agent.session, preset)
+    }
+    return next()
+  })
+  ctx.on('session/disposed', (session: Session) => {
+    pendingSwitches.delete(session.id)
+  })
+
  /**
   * Gate the cold path on the store: an id absent from it, or naming a legacy
   * log without a cwd (pre-release stance: not served, no compatibility), is
@@ -468,6 +600,48 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
        agent.cancel()
        return Promise.resolve(ok(request, { accepted: true as const }))
      },
+
+      async permissions(request) {
+        const { sessionId } = request.payload
+        const presets = ctx.get('permission')
+        // A permission-less composition advertises an empty select (client
+        // hides the control) rather than erroring — the control's absence is
+        // deployment shape, not a caller mistake.
+        if (presets === undefined) return ok(request, { options: [], currentValue: 'custom' })
+        const found = await agentFor(sessionId)
+        if ('error' in found) return err(request, found.error)
+        const events = found.agent.session.events
+        const currentValue = pendingSwitches.get(sessionId) ?? presets.current(events)
+        const options = [
+          ...presets.names.map(name => presets.optionOf(name)),
+          // `custom` echoes the current derived state but is never a target.
+          ...currentValue === 'custom' ? [presets.optionOf('custom')] : [],
+        ]
+        return ok(request, { options, currentValue })
+      },
+
+      async setPermission(request) {
+        const { sessionId, value } = request.payload
+        const presets = ctx.get('permission')
+        if (presets === undefined) {
+          return err(request, { code: 'bad-request', message: 'no permission service is composed on this host', details: { issues: [] } })
+        }
+        const found = await agentFor(sessionId)
+        if ('error' in found) return err(request, found.error)
+        const agent = found.agent
+        // A current-value echo is acknowledged without recording a switch.
+        const current = pendingSwitches.get(sessionId) ?? presets.current(agent.session.events)
+        if (value === current) return ok(request, { currentValue: value })
+        if (!presets.names.includes(value)) {
+          return err(request, { code: 'bad-request', message: `unknown permission value ${JSON.stringify(value)}`, details: { issues: [] } })
+        }
+        // Turn-anchoring (the ACP bridge pattern): knob events must be enclosed
+        // by the durable log's turn boundary, so an idle switch is held
+        // last-write-wins and flushed into the next prompted turn.
+        if (hasOpenTurn(agent.session.events)) presets.set(agent.session, value)
+        else pendingSwitches.set(sessionId, value)
+        return ok(request, { currentValue: value })
+      },
    },

    host: {
@@ -499,6 +673,9 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
            },
          })
        }
+        // Refresh recovery: still-pending approval questions replay with their
+        // stable rpcId so a reconnecting client can still answer them.
+        for (const pending of pendingApprovals.values()) queue.push(requestedFrame(pending))
        // Per-session open-call table for result-view pairing. Bounded by the
        // per-turn call count: entries clear on turn/end; a table miss (stream
        // opened mid-turn) backscans the session's in-memory events instead.
@@ -564,6 +741,20 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
    },

    respond(message: ClientResponse): Promise<RpcReceipt> {
+      // Route by the echoed rpcId (the wire correlation): approvals first,
+      // then questions — the two registries share one id space of UUIDs.
+      const approval = pendingApprovals.get(message.rpcId)
+      if (approval !== undefined) {
+        if (!message.result.ok) return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        const parsed = approvalResponsePayloadSchema.safeParse(message.result.value)
+        // The payload's audit correlation must match the entry the rpcId routed
+        // to — a mismatched answer is malformed, not merely late.
+        if (!parsed.success || parsed.data.approvalId !== approval.approvalId || parsed.data.sessionId !== approval.sessionId) {
+          return Promise.resolve({ accepted: false, reason: 'bad-response' })
+        }
+        approval.resolve(parsed.data.outcome)
+        return Promise.resolve({ accepted: true })
+      }
      const pending = pendingQuestions.get(message.rpcId)
      if (pending === undefined) return Promise.resolve({ accepted: false, reason: 'not-pending' })
      if (!message.result.ok) {
--- a/packages/host/runtime/src/boot.ts
+++ b/packages/host/runtime/src/boot.ts
@@ -18,11 +18,17 @@ import TaskService from '@deepseek-ai/dsh-tasks'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
 import SessionPersistenceJsonl from '@deepseek-ai/dsh-session-persistence-jsonl'
-import LocalBashExecutor from '@deepseek-ai/dsh-bash-local'
+import SandboxLocal from '@deepseek-ai/dsh-sandbox-local'
+import SandboxPolicy from '@deepseek-ai/dsh-sandbox-policy'
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
+import SandboxBashExecutor from '@deepseek-ai/dsh-bash-sandbox'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import type { ApprovalPolicy } from '@deepseek-ai/dsh-user-approval'
+import PermissionService from '@deepseek-ai/dsh-permission'
 import * as toolBash from '@deepseek-ai/dsh-tool-bash'
 import * as toolTodo from '@deepseek-ai/dsh-tool-todo'
 import * as toolTasks from '@deepseek-ai/dsh-tool-tasks'
-import FsLocal from '@deepseek-ai/dsh-fs-local'
+import FsSandbox from '@deepseek-ai/dsh-fs-sandbox'
 import * as fsPolicy from '@deepseek-ai/dsh-fs-policy'
 import * as toolFs from '@deepseek-ai/dsh-tool-fs'
 import * as toolFsSearch from '@deepseek-ai/dsh-tool-fs-search'
@@ -73,6 +79,17 @@ export interface BootHostOptions {
  sessionTitle?: SessionTitleConfig
  /** Opt-in first-message model-title policy; `true` selects host defaults and an explicit config overrides them. */
  sessionTitleLlm?: true | SessionTitleLlmConfig
+  /**
+   * Sandbox/approval composition knobs. The host always composes the confined
+   * bash + fs families over `ctx.sandboxPolicy` (the acp-agent composition);
+   * these fields choose the deployment defaults every session starts from.
+   */
+  sandbox?: {
+    /** File-sandbox mode sessions start from (default `workspace-write`). */
+    mode?: SandboxMode
+    /** Approval policy for sessions without an override (default `ask`). */
+    approvalPolicy?: ApprovalPolicy
+  }
  /**
   * Default project directory for sessions created without an explicit cwd
   * (defaults to the host process working directory). A session's cwd is its
@@ -131,16 +148,30 @@ export async function bootHost(options: BootHostOptions): Promise<HostHandle> {
  await ctx.plugin(AgentLoop, { agents: [] })
  await ctx.plugin(LlmDeepSeek, {})
  await ctx.plugin(SessionPersistenceJsonl, { root: options.persistenceRoot })
-  await ctx.plugin(LocalBashExecutor, {})
+  // The sandboxed product path (the acp-agent composition, sandbox Agent
+  // Note): per-platform runner provider, the shared policy home, the confined
+  // bash executor, and the approval seam its escalation asks through. Sessions
+  // start from the configured default mode; per-session switches ride the
+  // `sandbox/mode` / `approval/policy` events written by ctx.permission.
+  await ctx.plugin(SandboxLocal, {})
+  await ctx.plugin(SandboxPolicy, {
+    mode: options.sandbox?.mode ?? 'workspace-write',
+    workspaceRoot: defaults.cwd,
+  })
+  await ctx.plugin(SandboxBashExecutor, {})
+  await ctx.plugin(ApprovalService, { policy: options.sandbox?.approvalPolicy ?? 'ask' })
  // Tool suite mirroring the demo:repl composition (repl-agent/cordis.yml +
  // the agent-spine bundle) so web sessions get the same coding-agent tool
  // face; deviations are noted inline.
  await ctx.plugin(toolBash, {})
+  // Presets over the two knobs (requires the confining executor + approval).
+  await ctx.plugin(PermissionService, {})
  await ctx.plugin(toolTodo)
  await ctx.plugin(toolTasks, {})
  // fs paths resolve against the host default project rather than the raw
-  // process cwd — the same source create() injects into session.cwd.
-  await ctx.plugin(FsLocal, { cwd: defaults.cwd })
+  // process cwd — the same source create() injects into session.cwd. The
+  // sandboxed backend fences write/edit by the same policy as bash.
+  await ctx.plugin(FsSandbox, { cwd: defaults.cwd })
  await ctx.plugin(fsPolicy)
  await ctx.plugin(toolFs, {})
  await ctx.plugin(toolFsSearch, {})
--- a/packages/host/runtime/tests/api-proxy-approval.spec.ts
+++ b/packages/host/runtime/tests/api-proxy-approval.spec.ts
@@ -0,0 +1,275 @@
+/**
+ * Approval pending registry over the proxy: an ask through `ctx.approval`
+ * becomes an answerable `approval/requested` mux frame (stable rpcId, replayed
+ * verbatim on a later mux open), `respond` routes by the echoed rpcId and
+ * validates the audit correlation, and the ask's abort signal withdraws the
+ * question with a broadcast `cancelled`.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import type { ApprovalRequestId } from '@deepseek-ai/dsh-user-approval'
+import type { ApiProxy, MuxFrame, RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api'
+import type { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import { RpcId as mintRpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import { createApiProxy } from '../src/api-proxy.ts'
+
+async function harness(): Promise<{ ctx: Context; api: ApiProxy }> {
+  const ctx = new Context()
+  await ctx.plugin(SessionStore)
+  await ctx.plugin(SystemPrompt, { persona: '' })
+  await ctx.plugin(UserInteractionService)
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(ApprovalService)
+  const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp' })
+  return { ctx, api }
+}
+
+/** A minimal agent stand-in inside an open turn (the service only reaches `.session`). */
+function agentOf(ctx: Context): Agent {
+  const session = ctx.sessions.create()
+  session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+  return { session } as unknown as Agent
+}
+
+/** Open a mux stream and capture frames into an array (returns an on-demand waiter). */
+function openMux(api: ApiProxy, abort: AbortController): { frames: MuxFrame[]; envelopes: RpcRequest<MuxFrame>[]; waitFor(type: MuxFrame['type']): Promise<MuxFrame> } {
+  const frames: MuxFrame[] = []
+  const envelopes: RpcRequest<MuxFrame>[] = []
+  const waiters: { type: MuxFrame['type']; resolve: (frame: MuxFrame) => void }[] = []
+  void (async () => {
+    for await (const envelope of api.events.mux({ rpcId: mintRpcId('t-mux'), payload: {} }, abort.signal)) {
+      frames.push(envelope.payload)
+      envelopes.push(envelope)
+      for (let i = waiters.length - 1; i >= 0; i -= 1) {
+        const waiter = waiters[i] as (typeof waiters)[number]
+        if (waiter.type === envelope.payload.type) {
+          waiters.splice(i, 1)
+          waiter.resolve(envelope.payload)
+        }
+      }
+    }
+  })()
+  return {
+    frames,
+    envelopes,
+    waitFor: (type) => {
+      const found = frames.find(frame => frame.type === type)
+      if (found !== undefined) return Promise.resolve(found)
+      return new Promise((resolve) => { waiters.push({ type, resolve }) })
+    },
+  }
+}
+
+function requestedOf(frame: MuxFrame): Extract<MuxFrame, { type: 'approval/requested' }> {
+  if (frame.type !== 'approval/requested') throw new Error(`expected approval/requested, got ${frame.type}`)
+  return frame
+}
+
+/** Wait until the stream delivered `count` frames of `type` (bounded poll; waitFor only covers the first). */
+async function waitForCount(mux: { frames: MuxFrame[] }, type: MuxFrame['type'], count: number): Promise<void> {
+  for (let i = 0; i < 200 && mux.frames.filter(frame => frame.type === type).length < count; i += 1) {
+    await new Promise(resolve => setTimeout(resolve, 5))
+  }
+  expect(mux.frames.filter(frame => frame.type === type).length).toBeGreaterThanOrEqual(count)
+}
+
+function answer(rpcId: RpcId, sessionId: unknown, approvalId: ApprovalRequestId, outcome: 'allowed-once' | 'rejected'): Parameters<ApiProxy['respond']>[0] {
+  return { type: 'client-response', rpcId, result: { ok: true, value: { sessionId, approvalId, outcome } } }
+}
+
+describe('approval pending registry', () => {
+  it('round-trips ask → requested frame → respond → outcome + resolved broadcast', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+
+    const asked = ctx.approval.request({ agent, toolName: 'bash', reason: 'sandbox escalation' })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    expect(requested).toMatchObject({ toolName: 'bash', reason: 'sandbox escalation', sessionId: agent.session.id })
+
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    const receipt = await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once'))
+    expect(receipt).toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('allowed-once')
+
+    const resolved = await mux.waitFor('approval/resolved')
+    expect(resolved).toMatchObject({ approvalId: requested.approvalId, outcome: 'allowed-once' })
+
+    // The question settled: a duplicate answer is late, not re-decidable.
+    const dup = await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'rejected'))
+    expect(dup).toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+  })
+
+  it('replays a still-pending requested frame (same rpcId) on a later mux open', async () => {
+    const { ctx, api } = await harness()
+    const first = new AbortController()
+    const firstMux = openMux(api, first)
+    const agent = agentOf(ctx)
+    const asked = ctx.approval.request({ agent, toolName: 'write' })
+    const requested = requestedOf(await firstMux.waitFor('approval/requested'))
+    const firstEnvelope = firstMux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    first.abort()
+
+    // A fresh subscriber (refresh recovery) sees the same stable rpcId.
+    const second = new AbortController()
+    const secondMux = openMux(api, second)
+    const replayed = requestedOf(await secondMux.waitFor('approval/requested'))
+    const secondEnvelope = secondMux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    expect(secondEnvelope.rpcId).toBe(firstEnvelope.rpcId)
+    expect(replayed.approvalId).toBe(requested.approvalId)
+
+    const receipt = await api.respond(answer(secondEnvelope.rpcId, replayed.sessionId, replayed.approvalId, 'rejected'))
+    expect(receipt).toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('rejected')
+    second.abort()
+  })
+
+  it('rejects malformed and mismatched answers as bad-response, unknown ids as not-pending', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    void ctx.approval.request({ agent, toolName: 'bash' })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+
+    // Unknown rpcId: not routed to any pending entry.
+    expect(await api.respond(answer(mintRpcId('ghost'), requested.sessionId, requested.approvalId, 'rejected')))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    // Error-branch result: the client can only answer with a value.
+    expect(await api.respond({ type: 'client-response', rpcId: envelope.rpcId, result: { ok: false, error: { code: 'internal', message: 'x', details: {} } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // Wrong audit correlation: the rpcId routed, but the payload disagrees.
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, 'other-approval' as ApprovalRequestId, 'rejected')))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    // Malformed payload shape.
+    expect(await api.respond({ type: 'client-response', rpcId: envelope.rpcId, result: { ok: true, value: { nonsense: 1 } } }))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    abort.abort()
+  })
+
+  it('withdraws the question on the ask signal: cancelled outcome, resolved broadcast, late answer not-pending', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const cancel = new AbortController()
+    const asked = ctx.approval.request({ agent, toolName: 'bash', signal: cancel.signal })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+
+    cancel.abort()
+    await expect(asked).resolves.toBe('cancelled')
+    const resolved = await mux.waitFor('approval/resolved')
+    expect(resolved).toMatchObject({ approvalId: requested.approvalId, outcome: 'cancelled' })
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once')))
+      .toEqual({ accepted: false, reason: 'not-pending' })
+    abort.abort()
+  })
+
+  it('carries callId on the frame and ignores a late abort after the answer settled', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const cancel = new AbortController()
+    const asked = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-9' as never, signal: cancel.signal })
+    const requested = requestedOf(await mux.waitFor('approval/requested'))
+    expect(requested.callId).toBe('call-9')
+    const envelope = mux.envelopes.find(e => e.payload.type === 'approval/requested') as RpcRequest<MuxFrame>
+    expect(await api.respond(answer(envelope.rpcId, requested.sessionId, requested.approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    await expect(asked).resolves.toBe('allowed-once')
+    // Late abort: the pending entry is gone; settle's delete-guard returns.
+    cancel.abort()
+    expect(mux.frames.filter(f => f.type === 'approval/resolved')).toHaveLength(1)
+    abort.abort()
+  })
+
+  it('pairs parallel asks by callId: each requested frame carries its own audit id', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    // Both asks append their approval/asked audit events before either
+    // answerer's microtask dispatch runs — the parallel tool-call window.
+    const askA = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-a' as never })
+    const askB = ctx.approval.request({ agent, toolName: 'bash', callId: 'call-b' as never })
+    await waitForCount(mux, 'approval/requested', 2)
+    const frames = mux.envelopes.filter(e => e.payload.type === 'approval/requested')
+    const frameA = frames.find(e => requestedOf(e.payload).callId === 'call-a') as RpcRequest<MuxFrame>
+    const frameB = frames.find(e => requestedOf(e.payload).callId === 'call-b') as RpcRequest<MuxFrame>
+    // Each frame claimed the asked event with its own callId, not merely the newest.
+    const askedIdByCall = new Map(agent.session.events
+      .filter(event => event.type === 'approval/asked')
+      .map(event => [String(event.data.callId), event.data.id]))
+    expect(requestedOf(frameA.payload).approvalId).toBe(askedIdByCall.get('call-a'))
+    expect(requestedOf(frameB.payload).approvalId).toBe(askedIdByCall.get('call-b'))
+    // Answers route back to the right ask through the pairing.
+    expect(await api.respond(answer(frameB.rpcId, agent.session.id, requestedOf(frameB.payload).approvalId, 'rejected')))
+      .toEqual({ accepted: true })
+    expect(await api.respond(answer(frameA.rpcId, agent.session.id, requestedOf(frameA.payload).approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    await expect(askA).resolves.toBe('allowed-once')
+    await expect(askB).resolves.toBe('rejected')
+    abort.abort()
+  })
+
+  it('gives parallel callId-less asks distinct audit ids (claimed-entry skip); both stay answerable', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const agent = agentOf(ctx)
+    const askA = ctx.approval.request({ agent, toolName: 'alpha' })
+    const askB = ctx.approval.request({ agent, toolName: 'beta' })
+    await waitForCount(mux, 'approval/requested', 2)
+    const frames = mux.envelopes.filter(e => e.payload.type === 'approval/requested')
+    const frameA = frames.find(e => requestedOf(e.payload).toolName === 'alpha') as RpcRequest<MuxFrame>
+    const frameB = frames.find(e => requestedOf(e.payload).toolName === 'beta') as RpcRequest<MuxFrame>
+    // Without a callId the pairing is heuristic, but never shared: the second
+    // dispatch skips the id the first pending entry already claimed.
+    expect(requestedOf(frameA.payload).approvalId).not.toBe(requestedOf(frameB.payload).approvalId)
+    expect(await api.respond(answer(frameA.rpcId, agent.session.id, requestedOf(frameA.payload).approvalId, 'allowed-once')))
+      .toEqual({ accepted: true })
+    expect(await api.respond(answer(frameB.rpcId, agent.session.id, requestedOf(frameB.payload).approvalId, 'rejected')))
+      .toEqual({ accepted: true })
+    await expect(askA).resolves.toBe('allowed-once')
+    await expect(askB).resolves.toBe('rejected')
+    abort.abort()
+  })
+
+  it('delegates a dispatch whose only asked candidate is already decided (stale re-dispatch)', async () => {
+    const { ctx, api } = await harness()
+    void api // the answerer is registered; the fake below bypasses the service
+    // Bypass ApprovalService: a log whose sole asked event already has its
+    // decided partner must not be re-claimed — the answerer delegates.
+    const session = ctx.sessions.create()
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    session.append('approval/asked', { id: 'stale-ask' as ApprovalRequestId, toolName: 'bash' })
+    session.append('approval/decided', { id: 'stale-ask' as ApprovalRequestId, outcome: 'rejected' })
+    const agent = { session } as unknown as Agent
+    const outcome = await ctx.waterfall('approval/request', { agent, toolName: 'bash' }, () => Promise.resolve('unavailable' as const))
+    expect(outcome).toBe('unavailable')
+  })
+
+  it('delegates an ask whose session log carries no asked audit event (foreign channel)', async () => {
+    const { ctx, api } = await harness()
+    void api // the answerer is registered; the fake below bypasses the audit path
+    // Bypass ApprovalService: dispatch the waterfall directly with a session
+    // that has no approval/asked event — the proxy answerer must call next().
+    const session = ctx.sessions.create()
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const agent = { session } as unknown as Agent
+    const outcome = await ctx.waterfall('approval/request', { agent, toolName: 'x' }, () => Promise.resolve('unavailable' as const))
+    expect(outcome).toBe('unavailable')
+  })
+})
--- a/packages/host/runtime/tests/api-proxy-permission.spec.ts
+++ b/packages/host/runtime/tests/api-proxy-permission.spec.ts
@@ -0,0 +1,152 @@
+/**
+ * Permission select over the proxy: permissions() projects the preset table
+ * plus the derived current value (custom shown only when derived),
+ * setPermission() validates against the table and anchors idle switches to
+ * the next prompted turn (the ACP bridge's pendingSwitches pattern), and a
+ * permission-less composition serves an empty select instead of an error.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
+import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
+import ApprovalService from '@deepseek-ai/dsh-user-approval'
+import PermissionService from '@deepseek-ai/dsh-permission'
+import type { ApiProxy, RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api'
+import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import type { SessionId } from '@deepseek-ai/dsh-session'
+import { createApiProxy } from '../src/api-proxy.ts'
+
+let nextRpc = 1
+function request<P>(payload: P): RpcRequest<P> {
+  return { rpcId: RpcId(`req-${String(nextRpc++)}`), payload }
+}
+
+async function harness(options: { permission?: boolean } = {}): Promise<{ ctx: Context; api: ApiProxy; sessionId: SessionId }> {
+  const ctx = new Context()
+  await ctx.plugin(SessionStore)
+  await ctx.plugin(SystemPrompt, { persona: '' })
+  await ctx.plugin(UserInteractionService)
+  await ctx.plugin(AgentRegistry)
+  if (options.permission !== false) {
+    // The permission service requires a confining executor fact + approval.
+    ctx.provide('bash', {
+      sandboxMode: 'workspace-write',
+      resolve() { throw new Error('permission proxy tests do not execute bash') },
+      run() { throw new Error('permission proxy tests do not execute bash') },
+      start() { throw new Error('permission proxy tests do not execute bash') },
+    })
+    await ctx.plugin(ApprovalService)
+    await ctx.plugin(PermissionService, {})
+  }
+  const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp' })
+  // No agent-loop in this harness: register a bare live agent directly (the
+  // proxy only reaches `.session`); api-proxy-view.spec.ts precedent.
+  const session = ctx.sessions.create()
+  ctx.agents.register({ id: session.id, session, status: 'idle', ctx } as Agent)
+  return { ctx, api, sessionId: session.id }
+}
+
+function expectOk<T>(response: { result: { ok: true; value: T } | { ok: false } }): T {
+  expect(response.result.ok).toBe(true)
+  if (!response.result.ok) throw new Error('unreachable')
+  return response.result.value
+}
+
+describe('session.permissions', () => {
+  it('projects the preset table with the effective current value; custom is absent when a preset matches', async () => {
+    const { api, sessionId } = await harness()
+    const value = expectOk<{ options: { value: string }[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value.currentValue).toBe('workspace-write')
+    expect(value.options.map(o => o.value)).toEqual(['workspace-write', 'danger-full-access'])
+  })
+
+  it('serves an empty select (custom) on a permission-less composition', async () => {
+    const { api, sessionId } = await harness({ permission: false })
+    const value = expectOk<{ options: unknown[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value).toEqual({ options: [], currentValue: 'custom' })
+  })
+
+  it('appends the derived custom option when the knobs match no preset', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('sandbox/mode', { mode: 'read-only' })
+    const value = expectOk<{ options: { value: string }[]; currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(value.currentValue).toBe('custom')
+    expect(value.options.map(o => o.value)).toEqual(['workspace-write', 'danger-full-access', 'custom'])
+  })
+
+  it('propagates the agentFor error for a ghost session (persistence-less harness: internal)', async () => {
+    // The not-found/internal split is agentFor's documented gate and already
+    // covered by the history specs; here only the pass-through matters.
+    const { api } = await harness()
+    const response = await api.sessions.permissions(request({ sessionId: 'session-void' as SessionId }))
+    expect(response.result.ok).toBe(false)
+  })
+})
+
+describe('session.setPermission', () => {
+  it('holds an idle switch pending (visible in permissions()) and flushes it into the next prompted turn', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    expect(agent).toBeDefined()
+    const switched = expectOk<{ currentValue: string }>(
+      await api.sessions.setPermission(request({ sessionId, value: 'danger-full-access' })))
+    expect(switched.currentValue).toBe('danger-full-access')
+    // No turn open: nothing appended yet; the pending value masks the fold.
+    expect(agent?.session.events.some(e => e.type === 'permission/preset')).toBe(false)
+    const echoed = expectOk<{ currentValue: string }>(
+      await api.sessions.permissions(request({ sessionId })))
+    expect(echoed.currentValue).toBe('danger-full-access')
+
+    // The waterfall flush path: prompt-submit inside the new turn writes through.
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    await ctx.waterfall('agent/prompt-submit', agent as never, [], { kind: 'user' } as never, new AbortController().signal, () => Promise.resolve({ kind: 'allow' as const }))
+    expect(agent?.session.events.map(e => e.type)).toContain('permission/preset')
+    expect(agent?.session.events.map(e => e.type)).toContain('sandbox/mode')
+    expect(agent?.session.events.map(e => e.type)).toContain('approval/policy')
+  })
+
+  it('writes through immediately inside an open turn', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    expectOk(await api.sessions.setPermission(request({ sessionId, value: 'danger-full-access' })))
+    expect(agent?.session.events.map(e => e.type)).toContain('permission/preset')
+  })
+
+  it('acknowledges a current-value echo without recording a switch', async () => {
+    const { ctx, api, sessionId } = await harness()
+    const agent = ctx.agents.get(sessionId)
+    agent?.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const echoed = expectOk<{ currentValue: string }>(
+      await api.sessions.setPermission(request({ sessionId, value: 'workspace-write' })))
+    expect(echoed.currentValue).toBe('workspace-write')
+    expect(agent?.session.events.some(e => e.type === 'permission/preset')).toBe(false)
+  })
+
+  it('propagates the agentFor error for a ghost session', async () => {
+    const { api } = await harness()
+    const response = await api.sessions.setPermission(request({ sessionId: 'session-void' as SessionId, value: 'workspace-write' }))
+    expect(response.result.ok).toBe(false)
+  })
+
+  it('rejects unknown values (custom included) and a permission-less composition as bad-request', async () => {
+    const { api, sessionId } = await harness()
+    for (const value of ['custom', 'nope']) {
+      const response = await api.sessions.setPermission(request({ sessionId, value }))
+      expect(response.result.ok).toBe(false)
+      if (!response.result.ok) expect(response.result.error.code).toBe('bad-request')
+    }
+    const bare = await harness({ permission: false })
+    const response = await bare.api.sessions.setPermission(request({ sessionId: bare.sessionId, value: 'workspace-write' }))
+    expect(response.result.ok).toBe(false)
+    if (!response.result.ok) expect(response.result.error.code).toBe('bad-request')
+  })
+})
--- a/packages/host/runtime/tsconfig.json
+++ b/packages/host/runtime/tsconfig.json
@@ -48,16 +48,31 @@
      "path": "../../session-persistence/session-persistence-jsonl"
    },
    {
-      "path": "../../bash/bash-local"
+      "path": "../../bash/bash-sandbox"
    },
    {
      "path": "../../bash/tool-bash"
    },
+    {
+      "path": "../../sandbox/sandbox"
+    },
+    {
+      "path": "../../sandbox/sandbox-local"
+    },
+    {
+      "path": "../../sandbox/sandbox-policy"
+    },
+    {
+      "path": "../../ui/user-approval"
+    },
+    {
+      "path": "../../ui/permission"
+    },
    {
      "path": "../../compact/compact-basic"
    },
    {
-      "path": "../../fs/fs-local"
+      "path": "../../fs/fs-sandbox"
    },
    {
      "path": "../../fs/fs-policy"
--- a/packages/ui/acp/src/index.ts
+++ b/packages/ui/acp/src/index.ts
@@ -60,7 +60,7 @@ import {
 } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-commands'
 import { encodeSessionReferenceUri } from '@deepseek-ai/dsh-session-reference'
-import { displayPromptContent, SessionId, type JsonValue } from '@deepseek-ai/dsh-session'
+import { displayPromptContent, hasOpenTurn, SessionId, type JsonValue } from '@deepseek-ai/dsh-session'
 // Side-effect type import: resolves `ctx.get('permission')` to the service.
 import type {} from '@deepseek-ai/dsh-permission'
 import type { SessionEvent, TodoItem, TurnEndReason } from '@deepseek-ai/dsh-session'
@@ -708,17 +708,6 @@ export function apply(ctx: Context, config: AcpConfig): void {
    }]
  }

-  /** Whether the log has an open turn in which a config switch can be enclosed. */
-  const isTurnOpen = (agent: Agent): boolean => {
-    const events = agent.session.events
-    for (let index = events.length - 1; index >= 0; index -= 1) {
-      const type = (events[index] as SessionEvent).type
-      if (type === 'turn/start') return true
-      if (type === 'turn/end') return false
-    }
-    return false
-  }
-
  /** Anchor last-write-wins idle switches into a just-opened turn. */
  const flushPendingSwitches = (rec: SessionRecord): void => {
    const pending = rec.pendingSwitches
@@ -1159,7 +1148,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
            if (!presets.names.includes(params.value)) {
              throw invalidParams(`unknown permission value ${JSON.stringify(params.value)}`)
            }
-            if (isTurnOpen(rec.agent)) presets.set(rec.agent.session, params.value)
+            if (hasOpenTurn(rec.agent.session.events)) presets.set(rec.agent.session, params.value)
            else rec.pendingSwitches.preset = params.value
            break
          }
--- a/packages/ui/user-approval/src/index.ts
+++ b/packages/ui/user-approval/src/index.ts
@@ -11,6 +11,7 @@ import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { CallId } from '@deepseek-ai/dsh-llm'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
+import { hasOpenTurn } from '@deepseek-ai/dsh-session'
 import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-system-prompt'

@@ -138,22 +139,6 @@ export function effectiveApprovalPolicy(events: readonly SessionEvent[]): Approv
  return undefined
 }

-/**
- * Whether the log currently sits inside an open turn (a `turn/start` not yet
- * closed by a `turn/end`) — the {@link ApprovalService.request} precondition.
- * The audit pair must be turn-enclosed: the turn is the durable log's
- * commit/replay boundary, so a bare event appended between turns is
- * indistinguishable from a crash tail and silently dropped on reload.
- */
-function hasOpenTurn(events: readonly SessionEvent[]): boolean {
-  for (let index = events.length - 1; index >= 0; index -= 1) {
-    const type = (events[index] as SessionEvent).type
-    if (type === 'turn/start') return true
-    if (type === 'turn/end') return false
-  }
-  return false
-}
-
 /**
 * Append the sole durable representation of a session policy override. Invalid
 * values throw before the log changes; consumers fold the new value on each read.