3f663c9154
effective(session) = findLast(the session own knob events)?.value ?? the composition-config default. One log-only event per knob, owned by its domain (bash/sandbox-mode in dsh-bash, approval/policy in dsh-approval), each exporting the same three-piece kit: the event declaration, a pure fold, and THE write path — a switch IS its event; no owner service, no facts map. Restart immunity and multi-session isolation fall out of the log replay by construction. Execution follows the fold on both sides: the bash tool stamps escalation grant > session override > executor default, and the approval seam prepends the never-gate that auto-rejects before any interactive answerer. Visibility is two layers per knob: a per-agent prompt section states the effective value on every request (logged through request/header*, so what-the-model-was-told replays from the log), and an agent/pre-step narrator injects at most one coalesced delta notice with positional attribution (user switch vs operator/config drift). The ACP bridge advertises one capability-gated select per composable knob with currentValue folded per session, validates set_config_option against the closed vocabularies, and anchors idle switches at the next turn prompt-submit under the turn-enclosure contract.
approval/ — approval family
The asking half of permission handling: one seam through which the harness puts a one-shot question — "may this specific action proceed?" — to whatever answerers a deployment composes, with a closed outcome vocabulary and a fail-closed default. The full design: the approval-seam RFC. All product packages.
| Package | Role | ctx key |
|---|---|---|
approval/ |
The ApprovalService mechanism (waterfall dispatch, cancellation, audit events) + the vocabulary (ApprovalRequest, ApprovalOutcome, ApprovalRequestId) + the per-session policy tier (ApprovalPolicy 'ask'/'never', the 'approval/policy' event fold, the prepend gate — sandbox RFC § Per-session mode switching) |
ctx.approval |
Answerers live with their owners, not here: the ACP bridge (ui/acp) answers for the editor sessions it owns (and switches each session's policy over ACP config options); tests answer with inline scripted listeners. Consumers today: core/tools routes tools/pre-execute's ask through the seam (degrading to deny when it is not mounted), and the bash tool's sandbox escalation gate (bash/tool-bash, sandbox RFC § Escalation).