99650a201b
A ModeDefinition may declare access: the widest sandbox access shell commands run under while the mode holds, on the SANDBOX_MODES ladder. The bash seam gains the resolution point to hang it on: BashExecutor. resolveMode(session) folds override ?? default and dispatches the new bash/resolve-mode waterfall; dsh-tool-bash consults it at both the stamping site and the escalation baseline; dsh-mode's clamp listener takes the ladder minimum per call. Two independent log folds compose at read time — the mode never writes the sandbox knob, so the two switch in any order and the knob re-emerges intact on exit. The built-in plan definition ships access: read-only with the bash trio allowlisted CONDITIONALLY: both policy layers admit bash/bash_output/ bash_kill only while a confining executor is mounted (an unconfinable shell cannot honor the cap), and a bash call carrying sandbox_permissions under a cap is denied at the gate — no widening mid-mode; the widened step belongs in the plan. examples/plan-acp-agent swaps bash-local for sandbox-local + bash-sandbox (workspace-write default, clamped read-only inside plan) plus the approval seam; the re-recorded plan-mode arc runs a real cat inside plan under the clamped sandbox, and modes-advertise now pins the sandbox-mode and approval config options. RFC amended to the landed shape (access cap section, orthogonality FAQ, deferred item resolved into effects self-declaration).
29 lines
1001 B
JSON
29 lines
1001 B
JSON
{
|
|
"steps": [
|
|
{
|
|
"op": "initialize"
|
|
},
|
|
{
|
|
"op": "newSession"
|
|
},
|
|
{
|
|
"op": "setMode",
|
|
"modeId": "plan"
|
|
},
|
|
{
|
|
"op": "prompt",
|
|
"text": "The typo is on line 2 of notes.txt itself; the workspace contains no other file. Inspect it with the bash tool: run exactly `cat notes.txt` (relative path, no other command; plan mode keeps the sandbox read-only, and a plain cat succeeds). Then present a one-step plan titled '# Fix the greeting typo' via exit_plan_mode: the single step is editing line 2 of notes.txt to say hello world. After the review approves, apply exactly that one edit to notes.txt with the edit tool and stop — no other commands, do not look for any other file."
|
|
},
|
|
{
|
|
"op": "prompt",
|
|
"text": "Read notes.txt (relative path notes.txt) and reply with the single word DONE if line 2 now says hello world."
|
|
}
|
|
],
|
|
"elicitationAnswers": [
|
|
{
|
|
"action": "accept",
|
|
"choice": "Approve"
|
|
}
|
|
]
|
|
}
|