@addozhang/dsh-discord 0.5.0-rc.2 → 0.5.0-rc.3

package/README.md

@@ -23,6 +23,7 @@ No extra process: the adapter is a DSH plugin that mounts straight onto your `ds
 - **Approvals & questions** — DSH asks become buttons, select menus, and a free-text modal. Ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
 - **Session control** — `/steer`, `/stop`, and `/queue list|remove` with turn-ownership checks; `/project bind|list|info` and `/session resume` for guild↔workspace binding and history; `/guild forget` for operator cleanup.
 - **Model selection** — `/model show` reads the session's live model directory; `/model select` walks an interactive provider → model → reasoning cascade, or applies a typed `provider/model` directly. Open to any authorized member by default; restrictable to Host operators.
+- **Permission switching** — `/permission show` / `set` read and switch the session's permission preset (bundled sandbox + approval tiers) through the Host's own `/permission` command path, inheriting its journal audit pair; `danger-full-access` requires a button confirmation.
 - **Settings card, bilingual out of the box** — token onboarding and connect/disconnect (stored in the Host credential service, never in settings or logs), guild allowlist, auto-archive, and language. Every Discord-visible string ships in Chinese and English; the bot follows the DSH language preference or a pinned choice.
 - **Hardened by design** — deny-first authorization inside an explicit guild allowlist. Mentions are suppressed twice: `allowed_mentions` on every request, plus byte-level neutralization of the wire body. DSH submission is at-most-once with unknown-preserving reconciliation — an ambiguous delivery is never blindly resent. Bindings survive restarts, and the READY sweep rebuilds deleted category/control channels while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
 
@@ -70,6 +71,7 @@ All keys live in the `dsh-discord` settings namespace and can be set either from
 | `deniedUserIds` / `deniedRoleIds` | `[]` | Deny entries; they win over every grant above. |
 | `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`; `/model select` when `modelSelectOperatorOnly` is enabled). |
 | `modelSelectOperatorOnly` | `false` | Restrict `/model select` to Host operators (`settings.yaml` only; the card does not expose it). Default `false`: any authorized member may switch, and the switch still updates the Host default. |
+| `permissionSelectOperatorOnly` | `true` | Restrict `/permission set` to Host operators (`settings.yaml` only). Default `true` — stricter than `/model` because `danger-full-access` disables both sandbox and approval; loosen to let any authorized member switch. |
 | `defaultVerbosity` | `essential-tools` | Tool-activity row granularity: `text-only`, `essential-tools`, or `full-tools`. |
 | `language` | `auto` | Bot-visible copy language: `auto` follows the DSH language preference (non-Chinese renders English), or pin `zh`/`en`. |
 | `streamUpdateIntervalMs` | `800` | Coalescing budget for stream edits (250–10000). |
@@ -110,10 +112,11 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
 | `/session resume` | project channel | pick one of this workspace's past sessions (autocomplete: title and age, newest first) and resume it into a new thread of this channel; blank, already-bound, subagent, and archived sessions are never offered. The thread renders the session's history — answers and tool summaries plus the user's inputs as quoted echo lines (plugin/system injections are never echoed). After an adapter restart, threads catch up only what they missed: a persisted render watermark suppresses already-delivered history, and bound sessions re-subscribe on reconnect so turns prompted from the web UI still land in their thread |
 | `/guild forget` | any channel | operator-only removal of adapter records |
+| `/permission show` / `set` | session thread | read or switch the session's permission preset (view only / workspace edit / full access — bundled sandbox + approval tiers, catalog read live from the Host). `set danger-full-access` asks for a button confirmation first; presets autocomplete; Host operators only by default (`permissionSelectOperatorOnly` can loosen it). Every switch — from Discord or the web UI — renders one system line in the thread |
 
 ## Design notes
 
-- The adapter is a function/namespace plugin (`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`) that mounts the Discord Gateway, command surface, stream renderer, and the settings card onto the DSH web profile.
+- The adapter is a function/namespace plugin (`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection', 'commands', 'permissionPresets']`) that mounts the Discord Gateway, command surface, stream renderer, and the settings card onto the DSH web profile.
 - The settings card is the first-run onboarding surface: the token entry writes the credential service's `DSH_DISCORD_BOT_TOKEN` ref over the plugin management channel, then triggers the start chain. Disconnect keeps the credential; an empty reconnect uses it.
 - The publish workflow authenticates to npm via trusted publishing (OIDC) — no publish token is stored anywhere.
 - The adapter start chain is generation-counted, so Connect/Disconnect races with the initial boot yield exactly one gateway.

package/README.zh.md

@@ -23,6 +23,7 @@
 - **审批与提问** — DSH 的 ask 渲染为按钮、下拉菜单与自由文本弹窗。所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
 - **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 与 `/session resume` 管理 Guild↔工作区绑定与历史会话；`/guild forget` 供操作员清理。
 - **模型切换** — `/model show` 读取会话的实时模型目录；`/model select` 走交互式 provider → 模型 → 推理强度级联，也可直接填写 `provider/model` 应用。默认对所有授权成员开放，可收紧为仅 Host 操作员。
+- **权限切换** — `/permission show` / `set` 读写会话权限预设（沙箱 + 审批捆绑档位），走宿主自己的 `/permission` 命令路径，journal 自动记审计；`danger-full-access` 需按钮二次确认。
 - **设置卡片，开箱双语** — Token 引导与连接/断开（存入 Host 凭据服务，绝不写入设置或日志）、服务器白名单、自动归档与语言。所有 Discord 可见文案提供中英双语；Bot 默认跟随 DSH 语言偏好，也可从卡片固定。
 - **安全设计** — 显式服务器白名单内的 deny-first 授权。提及抑制双保险：每条请求携带 `allowed_mentions`，外加 wire body 的字节级提及中和。DSH 提交至多一次，并做保留 unknown 的对账——结果不明的投递绝不盲目重发。绑定重启后持久；READY 扫描会重建被删除的 category/控制频道，而把被删除的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
 
@@ -70,6 +71,7 @@ dsh plugin --profile web rm @addozhang/dsh-discord   # 卸载；先执行 /guild
 | `deniedUserIds` / `deniedRoleIds` | `[]` | 拒绝名单；优先级高于上述一切授权。 |
 | `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`；启用 `modelSelectOperatorOnly` 后也包括 `/model select`）。 |
 | `modelSelectOperatorOnly` | `false` | 将 `/model select` 限制为 Host 操作员（仅 `settings.yaml`，卡片不展示）。默认 `false`：任何授权成员均可切换，且切换仍会更新 Host 默认。 |
+| `permissionSelectOperatorOnly` | `true` | 将 `/permission set` 限制为 Host 操作员（仅 `settings.yaml`）。默认 `true`——比 `/model` 更严，因为「完全权限」会同时解除沙箱与审批；可放开为任何授权成员可切换。 |
 | `defaultVerbosity` | `essential-tools` | 工具活动行粒度：`text-only`、`essential-tools`、`full-tools`。 |
 | `language` | `auto` | Bot 可见文案语言：`auto` 跟随 DSH 语言偏好（非中文渲染英文），或固定 `zh`/`en`。 |
 | `streamUpdateIntervalMs` | `800` | 流式编辑合并间隔（250–10000）。 |
@@ -110,11 +112,12 @@ dsh-discord:
 | `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
 | `/session resume` | 项目频道 | 自动补全选择本工作区的历史会话（显示标题与时间，最新优先），恢复为当前频道的新线程；空白、已挂线程、subagent、已归档的会话不会出现。线程会渲染会话历史——回答与工具摘要之外，用户输入以引用行回显（插件/系统注入永不回显）。适配器重启后线程只补齐错过部分：持久化的渲染水位抑制已投递过的历史，已绑定会话在重连时自动重订阅，因此从 web UI 发起的回合也会落进对应线程 |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
+| `/permission show` / `set` | 会话线程 | 查看或切换会话权限预设（仅可查看 / 工作区内修改 / 完全权限——沙箱与审批的捆绑档位，目录取自宿主实时配置）。`set danger-full-access` 先要求按钮确认；预设自动补全；默认仅 Host 操作员可切换（`permissionSelectOperatorOnly` 可放开）。任何入口（含 web UI）的切换都会在线程渲染一行系统消息 |
 
 
 ## 设计说明
 
-- 适配器为 function/namespace 插件（`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`），将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile。
+- 适配器为 function/namespace 插件（`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection', 'commands', 'permissionPresets']`），将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile。
 - 设置卡片是首次使用的引导面：Token 输入通过插件管理通道写入凭据服务的 `DSH_DISCORD_BOT_TOKEN` 引用，然后触发启动链。断开连接保留凭据；留空重连直接使用已存 Token。
 - 发布工作流通过 npm trusted publishing (OIDC) 认证——任何地方都不保存发布凭证。
 - 适配器启动链带代际计数，Connect/Disconnect 与初始启动竞争时只会产生一个 Gateway。

package/cordis.patch.yml

@@ -11,4 +11,4 @@
 - insert:
     - id: dsh-discord
       name: '@addozhang/dsh-discord'
-      inject: [sessionController, workspaceController, sessionQuery, webServer, credentials, settings, storageDomain, connection]
+      inject: [sessionController, workspaceController, sessionQuery, webServer, credentials, settings, storageDomain, connection, commands, permissionPresets]

package/lib/discord/commands.js

@@ -44,6 +44,12 @@ export const MILESTONE_ONE_COMMANDS = [
     grouped('guild', 'Guild-scoped adapter operations', [
         { name: 'forget' },
     ]),
+    grouped('permission', 'Show or switch the session permission preset', [
+        { name: 'show' },
+        // The preset autocompletes from the live Host catalog (16.61);
+        // danger-full-access goes through a button confirmation first.
+        { name: 'set', options: [{ name: 'preset', required: true, autocomplete: true }] },
+    ]),
 ];
 const DISCORD_APPLICATION_COMMAND = 1;
 const DISCORD_SUBCOMMAND = 1;

package/lib/dsh/host-face.d.ts

@@ -19,6 +19,7 @@
 import type { ProjectListPort } from '../features/project-list.js';
 import type { WorkspaceResolver } from '../features/project-bind.js';
 import type { DshModelPort } from '../features/model-control.js';
+import type { DshPermissionPort } from '../features/permission-control.js';
 /** The workspace rows the catalog port needs (subset of WorkspaceView). */
 export interface WorkspaceCatalogEntry {
     workspaceId: string;
@@ -93,6 +94,18 @@ export interface DshSessionControllerFace {
     }, signal: AbortSignal): AsyncIterable<unknown>;
     /** Host-wide live state stream (queue/jobs/projection frames over one baseline). */
     control(signal: AbortSignal): AsyncIterable<unknown>;
+    /**
+     * Resolve or resume one Session's live Agent (0.1.6 probe-verified shape
+     * `{agent} | {error}`); the agent object stays opaque — it exists only to
+     * feed `commands.execute` for the Host-native `/permission` command path.
+     */
+    resolveAgent(sessionId: string): Promise<{
+        agent?: unknown;
+        error?: {
+            code?: string;
+            message?: string;
+        };
+    }>;
 }
 /**
  * Narrow slice of the 0.1.6 `workspaceController` cordis service. The
@@ -118,6 +131,30 @@ export interface DshSessionQueryFace {
         };
     } & Partial<AsyncDisposable>>;
 }
+/**
+ * Narrow slice of the `commands` cordis service (dsh-commands). `execute`
+ * runs one registered slash command against an exact agent WITHOUT sending
+ * it to the model, logging the command/run + command/done journal pair; the
+ * signal is owned by the caller. Signatures 2026-09-19 real-host verified.
+ */
+export interface DshCommandsFace {
+    execute(agent: unknown, line: string, submittedAttachments: readonly unknown[], signal: AbortSignal): Promise<{
+        commandId: string;
+        result?: {
+            kind?: unknown;
+            text?: unknown;
+        };
+    } | undefined>;
+}
+/**
+ * Narrow slice of the `permissionPresets` cordis service
+ * (dsh-permission-presets): the deployment's configured preset table.
+ */
+export interface DshPermissionPresetsFace {
+    catalog(): Promise<{
+        options?: unknown;
+    }>;
+}
 /** The host-generation model catalog (`session/modelCatalog`, host-wide). */
 export interface ModelCatalogWireShape {
     default: ModelSelectionShape;
@@ -134,6 +171,8 @@ export interface DshHostFace {
     session: DshSessionControllerFace;
     workspace: DshWorkspaceControllerFace;
     sessionQuery: DshSessionQueryFace;
+    commands: DshCommandsFace;
+    permissionPresets: DshPermissionPresetsFace;
 }
 /**
  * Resolve the 0.1.6 controller services off the Cordis context. Throws one
@@ -416,3 +455,37 @@ export declare function selectSessionModel(dsh: DshHostFace, request: {
  * reasons about.
  */
 export declare function createModelPort(dsh: DshHostFace, options?: ApiProxyFaceOptions): DshModelPort;
+/** One normalized preset row off the catalog's `options` array. */
+export interface PermissionCatalogEntry {
+    value: string;
+    name?: string;
+}
+export type PermissionCatalogOutcome = {
+    outcome: 'completed';
+    entries: PermissionCatalogEntry[];
+} | {
+    outcome: 'failed';
+};
+/** Read the deployment's preset table (`permissionPresets.catalog`). */
+export declare function permissionCatalog(dsh: DshHostFace, options?: ApiProxyFaceOptions): Promise<PermissionCatalogOutcome>;
+export type SwitchSessionPermissionOutcome = {
+    outcome: 'completed';
+    preset: string;
+} | {
+    outcome: 'rejected';
+    reason: string;
+} | {
+    outcome: 'unknown';
+};
+/**
+ * Switch the session's preset through the Host's OWN `/permission` command
+ * path (resolveAgent → commands.execute) — the same entry the web UI uses,
+ * inheriting its journal audit pair and admission checks. An execute throw
+ * is unknown (the command may have run): callers never retry blindly.
+ */
+export declare function switchSessionPermission(dsh: DshHostFace, request: {
+    sessionId: string;
+    preset: string;
+}, options?: ApiProxyFaceOptions): Promise<SwitchSessionPermissionOutcome>;
+/** The /permission surface over the controller, command, and preset services. */
+export declare function createPermissionPort(dsh: DshHostFace, options?: ApiProxyFaceOptions): DshPermissionPort;

package/lib/dsh/host-face.js

@@ -24,7 +24,7 @@ import { parseWorkspaceReference } from '../policy/disclosure.js';
  */
 export function resolveHostFace(ctx) {
     const missing = [];
-    for (const name of ['sessionController', 'workspaceController', 'sessionQuery']) {
+    for (const name of ['sessionController', 'workspaceController', 'sessionQuery', 'commands', 'permissionPresets']) {
         if (ctx.get(name) === undefined || ctx.get(name) === null)
             missing.push(name);
     }
@@ -35,6 +35,8 @@ export function resolveHostFace(ctx) {
         session: ctx.get('sessionController'),
         workspace: ctx.get('workspaceController'),
         sessionQuery: ctx.get('sessionQuery'),
+        commands: ctx.get('commands'),
+        permissionPresets: ctx.get('permissionPresets'),
     };
 }
 /** Raised when the Host did not answer within the bounded window. */
@@ -596,3 +598,124 @@ export function createModelPort(dsh, options = {}) {
         selectModel: request => selectSessionModel(dsh, request, options),
     };
 }
+/** Read the deployment's preset table (`permissionPresets.catalog`). */
+export async function permissionCatalog(dsh, options = {}) {
+    const log = options.log;
+    try {
+        const catalog = await withRpcTimeout(dsh.permissionPresets.catalog(), options.timeoutMs ?? CATALOG_TIMEOUT_MS);
+        if (!isRecord(catalog) || !Array.isArray(catalog['options'])) {
+            log?.('discord_permission_catalog_malformed', {});
+            return { outcome: 'failed' };
+        }
+        const entries = [];
+        for (const row of catalog['options']) {
+            if (!isRecord(row) || typeof row['value'] !== 'string')
+                continue;
+            entries.push({
+                value: row['value'],
+                ...(typeof row['name'] === 'string' ? { name: row['name'] } : {}),
+            });
+        }
+        return { outcome: 'completed', entries };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_permission_catalog_timeout', {});
+            return { outcome: 'failed' };
+        }
+        log?.('discord_permission_catalog_failed', { cause: String(cause) });
+        return { outcome: 'failed' };
+    }
+}
+/**
+ * Read the session's current preset off the `permissions` projection view
+ * (`{currentValue}`, stateVersion 2). Any read failure resolves failed —
+ * show degrades to "current unknown", never a hard failure.
+ */
+async function readSessionPermission(dsh, sessionId, options) {
+    const log = options.log;
+    let observation;
+    try {
+        observation = await withRpcTimeout(dsh.sessionQuery.observeSession(sessionId), options.timeoutMs ?? CATALOG_TIMEOUT_MS);
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const projections = isRecord(observation) && isRecord(observation['projections'])
+            ? observation['projections']
+            : undefined;
+        const values = projections !== undefined && isRecord(projections['values'])
+            ? projections['values']
+            : undefined;
+        const permission = values !== undefined ? values['permissions'] : undefined;
+        const current = isRecord(permission) ? permission['currentValue'] : undefined;
+        return typeof current === 'string' ? current : undefined;
+    }
+    finally {
+        const dispose = observation?.[Symbol.asyncDispose]
+            ?? observation?.dispose;
+        if (typeof dispose === 'function') {
+            try {
+                void dispose.call(observation);
+            }
+            catch (cause) {
+                log?.('discord_session_permission_dispose_threw', { cause: String(cause) });
+            }
+        }
+    }
+}
+/**
+ * Switch the session's preset through the Host's OWN `/permission` command
+ * path (resolveAgent → commands.execute) — the same entry the web UI uses,
+ * inheriting its journal audit pair and admission checks. An execute throw
+ * is unknown (the command may have run): callers never retry blindly.
+ */
+export async function switchSessionPermission(dsh, request, options = {}) {
+    const log = options.log;
+    const controller = new AbortController();
+    try {
+        const resolved = await withRpcTimeout(dsh.session.resolveAgent(request.sessionId), options.timeoutMs ?? PROMPT_TIMEOUT_MS);
+        if (!isRecord(resolved) || resolved['agent'] === undefined) {
+            const message = isRecord(resolved['error']) && typeof resolved['error']['message'] === 'string'
+                ? resolved['error']['message']
+                : 'session unavailable';
+            log?.('discord_permission_agent_unresolved', { sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: message };
+        }
+        const agent = resolved['agent'];
+        const execution = await withRpcTimeout(dsh.commands.execute(agent, `/permission ${request.preset}`, [], controller.signal), options.timeoutMs ?? PROMPT_TIMEOUT_MS);
+        if (execution === undefined) {
+            // Unmatched command: this Host has no /permission registered.
+            log?.('discord_permission_command_missing', { sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: 'the Host has no /permission command' };
+        }
+        const result = isRecord(execution) && isRecord(execution['result']) ? execution['result'] : undefined;
+        const kind = result !== undefined ? result['kind'] : undefined;
+        const text = result !== undefined && typeof result['text'] === 'string' ? result['text'] : '';
+        if (kind === 'success') {
+            return { outcome: 'completed', preset: request.preset };
+        }
+        log?.('discord_permission_command_error', { sessionId: request.sessionId, text });
+        return { outcome: 'rejected', reason: text === '' ? 'the Host rejected the switch' : text };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_permission_switch_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_permission_switch_threw', { sessionId: request.sessionId, cause: String(cause) });
+        return { outcome: 'unknown' };
+    }
+}
+/** The /permission surface over the controller, command, and preset services. */
+export function createPermissionPort(dsh, options = {}) {
+    return {
+        catalog: () => permissionCatalog(dsh, options),
+        current: async (sessionId) => {
+            const preset = await readSessionPermission(dsh, sessionId, options);
+            return preset === undefined ? { outcome: 'failed' } : { outcome: 'completed', preset };
+        },
+        set: (sessionId, preset) => switchSessionPermission(dsh, { sessionId, preset }, options),
+    };
+}

package/lib/features/interaction-router.d.ts

@@ -15,6 +15,7 @@ import type { CancelOutcome, PromptOutcome, QueueRemoveOutcome, WorkspaceDetailO
 import type { TurnTracker } from './turn-ownership.js';
 import { type DshApprovalRespondPort } from './approval-routing.js';
 import { type DshModelPort } from './model-control.js';
+import { type DshPermissionPort } from './permission-control.js';
 import type { QuestionInteractionOutcome } from './question-routing.js';
 import type { ApprovalStore } from './approval-store.js';
 import type { ChannelBinding } from '../state/records.js';
@@ -132,6 +133,13 @@ export interface InteractionRouterDeps {
      * deployments flip this so any authorized member can switch (16.42).
      */
     modelSelectOperatorOnly: () => boolean;
+    /**
+     * Whether /permission set stays Host-operator-only (default true — the
+     * danger-full-access preset strips sandbox AND approval; 16.60).
+     */
+    permissionSelectOperatorOnly: () => boolean;
+    /** The live permission-preset catalog + guarded switch (/permission surface). */
+    permission: DshPermissionPort;
     log: (event: string, detail?: unknown) => void;
     warn: (event: string, detail?: unknown) => void;
 }

package/lib/features/interaction-router.js

@@ -14,6 +14,8 @@ import { planSteer } from './steer-control.js';
 import { planStop } from './stop-control.js';
 import { handleApprovalClick } from './approval-routing.js';
 import { applyModelSelection } from './model-control.js';
+import { applyPermissionPreset, requiresConfirmation, showPermission, } from './permission-control.js';
+import { permissionPresetLabel } from '../i18n.js';
 /** Discord interactive-component id for string select menus. */
 const SELECT_MENU = 3;
 /** `provider/model` — or `provider/model (effort)` when an effort is set. */
@@ -40,7 +42,32 @@ function renderModelApply(copy, result) {
                     : copy.modelNotInCatalog;
     }
 }
+/** The ephemeral outcome line for a /permission switch attempt. */
+function renderPermissionApply(copy, result) {
+    switch (result.outcome) {
+        case 'applied': return copy.permissionApplied(permissionPresetLabel(result.preset, copy));
+        case 'rejected': return copy.permissionRejected(result.reason);
+        case 'unknown': return copy.permissionUnknown;
+        case 'refused':
+            return result.reason === 'not-host-operator' ? copy.permissionSelectOperatorOnly : copy.permissionNotInCatalog;
+    }
+}
+/** Buttons live while the registry entry does; entries sweep past one extra TTL. */
+const PERMISSION_PROMPT_SWEEP_MS = 20 * 60 * 1000;
 export function createInteractionRouter(deps) {
+    /**
+     * Posted /permission confirmation prompts by custom_id. In-memory only —
+     * a restart forgets both halves together (the registry is memory too),
+     * so a resolved-but-unretired prompt is impossible to click anyway.
+     */
+    const permissionPrompts = new Map();
+    /** Drop prompt records past their sweep window (never-clicked prompts). */
+    function sweepPermissionPrompts(nowMs) {
+        for (const [customId, record] of permissionPrompts) {
+            if (nowMs - record.createdAtMs > PERMISSION_PROMPT_SWEEP_MS)
+                permissionPrompts.delete(customId);
+        }
+    }
     /** Authorize one interaction against the live policy table. */
     function authorize(event) {
         return evaluateAuthorization(deps.policy(), {
@@ -52,7 +79,7 @@ export function createInteractionRouter(deps) {
         });
     }
     async function routeAutocomplete(event, interactionToken) {
-        if (event.commandName !== 'project' && event.commandName !== 'session')
+        if (event.commandName !== 'project' && event.commandName !== 'session' && event.commandName !== 'permission')
             return;
         // Autocomplete has no deferred-ack form: whatever happens below, Discord
         // must receive exactly one type-8 answer, even if only empty choices.
@@ -98,6 +125,27 @@ export function createInteractionRouter(deps) {
                     deps.warn('discord_autocomplete_catalog_failed', String(cause));
                 }
             }
+            else if (decision.allowed && event.commandName === 'permission') {
+                // /permission set: live catalog entries, labeled in the current
+                // language; the raw preset key is the value (custom deployments
+                // define their own tables, so nothing is hardcoded).
+                try {
+                    const catalog = await deps.permission.catalog();
+                    if (catalog.outcome === 'completed') {
+                        const lowered = query.trim().toLowerCase();
+                        choices.push(...catalog.entries
+                            .filter(entry => entry.value !== lowered)
+                            .filter(entry => lowered === ''
+                            || entry.value.toLowerCase().includes(lowered)
+                            || permissionPresetLabel(entry.value, deps.copy).toLowerCase().includes(lowered))
+                            .slice(0, 25)
+                            .map(entry => ({ name: permissionPresetLabel(entry.value, deps.copy), value: entry.value })));
+                    }
+                }
+                catch (cause) {
+                    deps.warn('discord_autocomplete_permission_failed', String(cause));
+                }
+            }
             const rest = await deps.rest();
             if (rest === undefined) {
                 deps.warn('discord_autocomplete_failed', 'missing-token');
@@ -135,7 +183,8 @@ export function createInteractionRouter(deps) {
         }
         // Deferred-ack followups must never fail silently: the REST client
         // resolves (never rejects) 4xx outcomes, so a void'ed call would drop
-        // the failure without a trace.
+        // the failure without a trace. Returns the created message id so
+        // callers can retire controls on the posted message later.
         const followUp = async (content, components) => {
             const posted = await rest.request('POST', `/webhooks/${deps.applicationId()}/${interactionToken}`, {
                 content,
@@ -144,7 +193,10 @@ export function createInteractionRouter(deps) {
             });
             if (posted.outcome !== 'completed') {
                 deps.log('discord_followup_failed', posted.outcome === 'rejected' ? `HTTP ${String(posted.status)}` : posted.reason);
+                return undefined;
             }
+            const messageId = posted.body?.['id'];
+            return typeof messageId === 'string' ? messageId : undefined;
         };
         const buttonRow = (confirmId, cancelId) => [{
                 type: 1,
@@ -505,6 +557,94 @@ export function createInteractionRouter(deps) {
                 await followUp(content);
                 return;
             }
+            if (event.commandName === 'permission') {
+                // /permission show|set (16.59–16.61): the bound Session's preset —
+                // the Host bundle of sandbox mode + approval policy. The switch
+                // rides the Host's own /permission command path.
+                const options = event.data['options'];
+                const subcommand = Array.isArray(options) ? options[0] : undefined;
+                const subName = subcommand?.name;
+                const sessionId = deps.sessionForThread(event.guildId, event.channelId);
+                if (sessionId === undefined) {
+                    await followUp(deps.copy.permissionNeedsThread);
+                    return;
+                }
+                if (subName === 'show') {
+                    const view = await showPermission(deps.permission, { sessionId });
+                    if (view.outcome === 'failed') {
+                        await followUp(deps.copy.permissionShowUnavailable);
+                        return;
+                    }
+                    const current = view.current === undefined
+                        ? deps.copy.permissionShowUnknownCurrent
+                        : permissionPresetLabel(view.current, deps.copy);
+                    const entries = view.entries.map(preset => permissionPresetLabel(preset, deps.copy)).join(' · ');
+                    await followUp(deps.copy.permissionShowHeader(current, entries));
+                    return;
+                }
+                if (subName === 'set') {
+                    // Host-operator authority by default — danger-full-access strips
+                    // sandbox AND approval at once (16.60); deployments may loosen.
+                    const requireOperator = deps.permissionSelectOperatorOnly();
+                    const decision = authorize(event);
+                    if (!decision.allowed || (requireOperator && decision.level !== 'host-operator')) {
+                        await followUp(deps.copy.permissionSelectOperatorOnly);
+                        return;
+                    }
+                    const wireOptions = Array.isArray(subcommand?.options) ? subcommand.options : [];
+                    const typedPreset = wireOptions.find(option => option.name === 'preset')?.value;
+                    if (typeof typedPreset !== 'string' || typedPreset === '') {
+                        await followUp(deps.copy.permissionNotInCatalog);
+                        return;
+                    }
+                    if (requiresConfirmation(typedPreset)) {
+                        // The dangerous preset(s) go through an explicit risk
+                        // confirmation — the web UI shows the same gate (16.61).
+                        const nowMs = Date.now();
+                        const expiresAtMs = nowMs + 15 * 60 * 1000;
+                        const base = { kind: 'permission-confirm', sessionId, preset: typedPreset, guildId: event.guildId, actorId: event.actorId, expiresAtMs };
+                        const confirmId = deps.registry.register({ ...base, action: 'confirm' });
+                        const cancelId = deps.registry.register({ ...base, action: 'cancel' });
+                        const label = permissionPresetLabel(typedPreset, deps.copy);
+                        const content = `${deps.copy.permissionConfirmHeader(label)}\n${deps.copy.permissionConfirmBody}`;
+                        const promptMessageId = await followUp(content, [{
+                                type: 1,
+                                components: [
+                                    { type: 2, style: 3, label: deps.copy.permissionConfirmButton, custom_id: confirmId },
+                                    { type: 2, style: 4, label: deps.copy.permissionConfirmCancelButton, custom_id: cancelId },
+                                ],
+                            }]);
+                        // Remember the posted prompt so a settle can gray the buttons
+                        // out — an unsettled-looking live control invites second clicks.
+                        sweepPermissionPrompts(nowMs);
+                        if (promptMessageId !== undefined) {
+                            const record = {
+                                messageId: promptMessageId,
+                                interactionToken,
+                                content,
+                                confirmCustomId: confirmId,
+                                cancelCustomId: cancelId,
+                                confirmLabel: deps.copy.permissionConfirmButton,
+                                cancelLabel: deps.copy.permissionConfirmCancelButton,
+                                createdAtMs: nowMs,
+                            };
+                            permissionPrompts.set(confirmId, record);
+                            permissionPrompts.set(cancelId, record);
+                        }
+                        return;
+                    }
+                    const result = await applyPermissionPreset(deps.permission, {
+                        decision,
+                        sessionId,
+                        preset: typedPreset,
+                        requireHostOperator: requireOperator,
+                    });
+                    await followUp(renderPermissionApply(deps.copy, result));
+                    return;
+                }
+                await followUp(deps.copy.unknownSubcommand);
+                return;
+            }
             if (event.commandName === 'session') {
                 // /session resume: cold-adopt an existing DSH session into a new
                 // thread of the bound project channel (16.44). /session new is
@@ -664,6 +804,92 @@ export function createInteractionRouter(deps) {
         if (posted.outcome !== 'completed')
             deps.log('discord_followup_failed', posted.outcome);
     }
+    /**
+     * The danger-full-access risk confirmation (16.61): ack, then re-authorize
+     * the clicker (deny-first — the initiating command's grant proves nothing
+     * at click time), settle as confirm-then-switch or cancel.
+     */
+    async function routePermissionConfirmComponent(event, interactionToken) {
+        const customId = event.data['custom_id'];
+        if (typeof customId !== 'string')
+            return;
+        const resolved = deps.registry.resolve(customId, Date.now());
+        const context = resolved.found ? resolved.context : undefined;
+        if (context?.['kind'] !== 'permission-confirm')
+            return;
+        const rest = await deps.rest();
+        if (rest === undefined) {
+            deps.log('discord_ack_failed', 'missing-token');
+            return;
+        }
+        const clicked = await rest.request('POST', `/interactions/${event.interactionId}/${interactionToken}/callback`, { type: 6 });
+        if (clicked.outcome !== 'completed') {
+            deps.log('discord_ack_failed', clicked.outcome);
+            return;
+        }
+        const owner = context['actorId'];
+        const sessionId = context['sessionId'];
+        const preset = context['preset'];
+        if (owner !== event.actorId || typeof sessionId !== 'string' || typeof preset !== 'string') {
+            const denied = await rest.request('POST', `/webhooks/${deps.applicationId()}/${interactionToken}`, { content: deps.copy.confirmNotOwner, flags: OUTBOUND_EPHEMERAL_FLAGS });
+            if (denied.outcome !== 'completed')
+                deps.log('discord_followup_failed', denied.outcome);
+            return;
+        }
+        const respond = async (content) => {
+            const posted = await rest.request('POST', `/webhooks/${deps.applicationId()}/${interactionToken}`, { content, flags: OUTBOUND_EPHEMERAL_FLAGS });
+            if (posted.outcome !== 'completed')
+                deps.log('discord_followup_failed', posted.outcome);
+        };
+        /**
+         * Retire the posted prompt: both buttons gray out so the settled
+         * control never looks live again. The prompt was posted by the SLASH
+         * interaction's webhook, so only that token can edit it; a late click
+         * past the webhook token's lifetime fails the edit loudly but the
+         * outcome followup still reaches the clicker (the registry TTL already
+         * bounds double-clicks well inside the window).
+         */
+        const retirePrompt = async () => {
+            const record = permissionPrompts.get(customId);
+            permissionPrompts.delete(record?.confirmCustomId ?? customId);
+            permissionPrompts.delete(record?.cancelCustomId ?? customId);
+            if (record === undefined)
+                return;
+            const patched = await rest.request('PATCH', `/webhooks/${deps.applicationId()}/${record.interactionToken}/messages/${record.messageId}`, {
+                content: record.content,
+                flags: OUTBOUND_EPHEMERAL_FLAGS,
+                components: [{
+                        type: 1,
+                        components: [
+                            { type: 2, style: 3, label: record.confirmLabel, custom_id: record.confirmCustomId, disabled: true },
+                            { type: 2, style: 4, label: record.cancelLabel, custom_id: record.cancelCustomId, disabled: true },
+                        ],
+                    }],
+            });
+            if (patched.outcome !== 'completed') {
+                deps.warn('discord_permission_prompt_retire_failed', patched.outcome === 'rejected' ? `HTTP ${String(patched.status)}` : patched.reason);
+            }
+        };
+        if (context['action'] !== 'confirm') {
+            await retirePrompt();
+            await respond(deps.copy.permissionCancelled);
+            return;
+        }
+        // Re-run the full authorization + catalog validation at click time; the
+        // settings flag may have flipped since the prompt was posted.
+        const decision = authorize(event);
+        await retirePrompt();
+        const result = await applyPermissionPreset(deps.permission, {
+            decision,
+            sessionId,
+            preset,
+            requireHostOperator: deps.permissionSelectOperatorOnly(),
+        });
+        deps.log('discord_permission_confirm', { outcome: result.outcome, preset });
+        await respond(result.outcome === 'applied'
+            ? `${deps.copy.permissionConfirmed(permissionPresetLabel(preset, deps.copy))}\n${renderPermissionApply(deps.copy, result)}`
+            : renderPermissionApply(deps.copy, result));
+    }
     /** One cascade stage: ack, re-authorize, then advance or apply (16.35). */
     async function routeModelComponent(event, interactionToken) {
         const customId = event.data['custom_id'];
@@ -900,6 +1126,10 @@ export function createInteractionRouter(deps) {
                 await routeModelComponent(event, interactionToken);
                 return;
             }
+            if (bindContext?.['kind'] === 'permission-confirm') {
+                await routePermissionConfirmComponent(event, interactionToken);
+                return;
+            }
             // A not-found custom_id means the control was never registered or has
             // been retired by its TTL (approval/question registry entries stay
             // resolvable until expiry; claimed-vs-resolved state lives in the

package/lib/features/permission-control.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `/permission show` and the guarded `/permission set` (design.md §7, tasks
+ * 16.59–16.61). A permission preset is the Host's bundle of sandbox mode +
+ * approval policy; the switch goes through the Host's own `/permission`
+ * command path (the same entry the web UI uses), so the journal records the
+ * command/run + command/done audit pair and the Host runs its own admission
+ * (unknown preset → error text). The adapter validates against the live
+ * catalog first — deployments configure their own preset tables.
+ *
+ * The default gate is stricter than /model's: `danger-full-access` disables
+ * sandbox AND approval at once, so only the explicit Host-operator allowlist
+ * may switch (`permissionSelectOperatorOnly: true`); single-user deployments
+ * may loosen it, and a member-level decision still never authorizes.
+ */
+import type { AccessDecision } from '../policy/authorization.js';
+export interface DshPermissionPort {
+    /** The deployment's live preset catalog (read from `permissionPresets`). */
+    catalog(): Promise<{
+        outcome: 'completed';
+        entries: ReadonlyArray<{
+            value: string;
+            name?: string;
+        }>;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+    /** The session's current preset off the `permissions` projection view. */
+    current(sessionId: string): Promise<{
+        outcome: 'completed';
+        preset: string;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+    /** Switch through the Host `/permission` command path. */
+    set(sessionId: string, preset: string): Promise<{
+        outcome: 'completed';
+        preset: string;
+    } | {
+        outcome: 'rejected';
+        reason: string;
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export type PermissionShowResult = {
+    outcome: 'ok';
+    current: string | undefined;
+    entries: ReadonlyArray<string>;
+} | {
+    outcome: 'failed';
+};
+/** `/permission show`: the current preset plus the switchable catalog. */
+export declare function showPermission(port: DshPermissionPort, request: {
+    sessionId: string;
+}): Promise<PermissionShowResult>;
+export type PermissionApplyResult = {
+    outcome: 'applied';
+    preset: string;
+} | {
+    outcome: 'rejected';
+    reason: string;
+} | {
+    outcome: 'unknown';
+} | {
+    outcome: 'refused';
+    reason: 'not-host-operator' | 'preset-not-in-catalog';
+};
+/**
+ * The presets that strip BOTH confinement layers at once; switching to one
+ * requires an explicit risk confirmation (the web UI shows the same gate).
+ */
+export declare const CONFIRM_REQUIRED_PRESETS: readonly string[];
+export declare function requiresConfirmation(preset: string): boolean;
+export declare function applyPermissionPreset(port: DshPermissionPort, request: {
+    decision: AccessDecision;
+    sessionId: string;
+    preset: string;
+    /**
+     * Keep the Host-operator restriction (default, stricter than /model).
+     * Single-user deployments may drop it so administrators of the
+     * allowlisted guild can switch (16.60); members are denied either way.
+     */
+    requireHostOperator?: boolean | undefined;
+}): Promise<PermissionApplyResult>;

package/lib/features/permission-control.js

@@ -0,0 +1,59 @@
+/**
+ * `/permission show` and the guarded `/permission set` (design.md §7, tasks
+ * 16.59–16.61). A permission preset is the Host's bundle of sandbox mode +
+ * approval policy; the switch goes through the Host's own `/permission`
+ * command path (the same entry the web UI uses), so the journal records the
+ * command/run + command/done audit pair and the Host runs its own admission
+ * (unknown preset → error text). The adapter validates against the live
+ * catalog first — deployments configure their own preset tables.
+ *
+ * The default gate is stricter than /model's: `danger-full-access` disables
+ * sandbox AND approval at once, so only the explicit Host-operator allowlist
+ * may switch (`permissionSelectOperatorOnly: true`); single-user deployments
+ * may loosen it, and a member-level decision still never authorizes.
+ */
+/** `/permission show`: the current preset plus the switchable catalog. */
+export async function showPermission(port, request) {
+    const [catalog, current] = await Promise.all([port.catalog(), port.current(request.sessionId)]);
+    if (catalog.outcome !== 'completed')
+        return { outcome: 'failed' };
+    return {
+        outcome: 'ok',
+        ...(current.outcome === 'completed' ? { current: current.preset } : { current: undefined }),
+        entries: catalog.entries.map(entry => entry.value),
+    };
+}
+/**
+ * The presets that strip BOTH confinement layers at once; switching to one
+ * requires an explicit risk confirmation (the web UI shows the same gate).
+ */
+export const CONFIRM_REQUIRED_PRESETS = ['danger-full-access'];
+export function requiresConfirmation(preset) {
+    return CONFIRM_REQUIRED_PRESETS.includes(preset);
+}
+export async function applyPermissionPreset(port, request) {
+    const requireOperator = request.requireHostOperator ?? true;
+    if (requireOperator) {
+        // Host-operator authority ONLY: a Guild administrator is not enough —
+        // the switch can strip sandbox and approval from the Session.
+        if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+            return { outcome: 'refused', reason: 'not-host-operator' };
+        }
+    }
+    if (!request.decision.allowed) {
+        return { outcome: 'refused', reason: 'not-host-operator' };
+    }
+    const catalog = await port.catalog();
+    if (catalog.outcome !== 'completed') {
+        return { outcome: 'refused', reason: 'preset-not-in-catalog' };
+    }
+    if (!catalog.entries.some(entry => entry.value === request.preset)) {
+        return { outcome: 'refused', reason: 'preset-not-in-catalog' };
+    }
+    const applied = await port.set(request.sessionId, request.preset);
+    if (applied.outcome === 'completed')
+        return { outcome: 'applied', preset: applied.preset };
+    if (applied.outcome === 'rejected')
+        return { outcome: 'rejected', reason: applied.reason };
+    return { outcome: 'unknown' };
+}

package/lib/i18n.d.ts

@@ -118,6 +118,26 @@ declare const zh: {
     modelNotInCatalog: string;
     modelInvalidReasoning: string;
     modelTypedParseFailed: string;
+    permissionNeedsThread: string;
+    permissionShowUnavailable: string;
+    permissionShowHeader: (current: string, entries: string) => string;
+    permissionShowUnknownCurrent: string;
+    permissionPresetReadOnly: string;
+    permissionPresetWorkspaceWrite: string;
+    permissionPresetFullAccess: string;
+    permissionApplied: (label: string) => string;
+    permissionRejected: (reason: string) => string;
+    permissionUnknown: string;
+    permissionSelectOperatorOnly: string;
+    permissionNotInCatalog: string;
+    permissionConfirmHeader: (label: string) => string;
+    permissionConfirmBody: string;
+    permissionConfirmButton: string;
+    permissionConfirmCancelButton: string;
+    permissionConfirmed: (label: string) => string;
+    permissionCancelled: string;
+    permissionConfirmExpired: string;
+    permissionSystemLine: (label: string) => string;
     sessionResumeNeedsBoundChannel: string;
     sessionResumeStarted: (threadId: string) => string;
     sessionResumeAlreadyBound: (threadId: string) => string;
@@ -136,4 +156,10 @@ declare const zh: {
 export type CopyTable = typeof zh;
 /** Discord-visible copy for the configured language. */
 export declare function createCopy(language: Language): CopyTable;
+/**
+ * Localize one permission-preset key for display. The dsh-base canonical
+ * three map to Discord copy; deployment-custom keys fall back to the raw
+ * host key (never invented labels).
+ */
+export declare function permissionPresetLabel(preset: string, copy: CopyTable): string;
 export {};

package/lib/i18n.js

@@ -129,6 +129,27 @@ const zh = {
     modelNotInCatalog: '⚠️ 该 provider/模型不在当前会话的目录中。',
     modelInvalidReasoning: '⚠️ 该推理强度对此模型无效。',
     modelTypedParseFailed: '⚠️ 模型需按 `provider/model` 格式填写，或留空进入交互式选择。',
+    // ── /permission show / set（16.59–16.61）─────────────────────────────
+    permissionNeedsThread: '⚠️ /permission 需要在已绑定 Session 的任务线程中使用（先在项目频道 @ 机器人）。',
+    permissionShowUnavailable: '⚠️ 权限目录暂时不可用，请稍后重试。',
+    permissionShowHeader: (current, entries) => `**当前权限模式：** ${current}\n**可切换：** ${entries}`,
+    permissionShowUnknownCurrent: '未知（投影暂不可读）',
+    permissionPresetReadOnly: '仅可查看',
+    permissionPresetWorkspaceWrite: '工作区内修改',
+    permissionPresetFullAccess: '完全权限',
+    permissionApplied: (label) => `✅ 权限模式已切换：${label}（沙箱与审批策略随预设生效）。`,
+    permissionRejected: (reason) => `⚠️ DSH 拒绝了此次切换：${reason}`,
+    permissionUnknown: '⚠️ 切换结果未知（命令可能已执行），请用 /permission show 确认。',
+    permissionSelectOperatorOnly: '⚠️ 只有 Host 操作员可以切换权限模式（完全权限会同时解除沙箱与审批）。',
+    permissionNotInCatalog: '⚠️ 该预设不在当前部署的权限目录中。',
+    permissionConfirmHeader: (label) => `⚠️ 确认启用「${label}」？`,
+    permissionConfirmBody: '启用后本会话将减少确认步骤，可直接执行敏感操作、文件修改或外部命令。仅建议在你信任后续任务时使用。',
+    permissionConfirmButton: '我已了解风险，启用',
+    permissionConfirmCancelButton: '取消',
+    permissionConfirmed: (label) => `✅ 已确认，正在切换到「${label}」……`,
+    permissionCancelled: '已取消，权限模式未变更。',
+    permissionConfirmExpired: '⚠️ 该确认已过期，请重新运行 /permission set。',
+    permissionSystemLine: (label) => `🔧 权限模式 → ${label}`,
     // ── /session resume ──────────────────────────────────────────────────
     sessionResumeNeedsBoundChannel: '⚠️ /session resume 需要在已绑定工作区的项目频道中使用。',
     sessionResumeStarted: (threadId) => `✅ 会话已恢复到 <#${threadId}>——历史在 Web 界面查看，线程内直接续聊。`,
@@ -261,6 +282,27 @@ const en = {
     modelNotInCatalog: "⚠️ That provider/model is not in this session's catalog.",
     modelInvalidReasoning: '⚠️ That reasoning effort is not valid for this model.',
     modelTypedParseFailed: '⚠️ The model must be `provider/model`, or left empty for the interactive cascade.',
+    // ── /permission show / set (16.59–16.61) ─────────────────────────────
+    permissionNeedsThread: '⚠️ /permission needs a task Thread bound to a Session (mention the bot in a project channel first).',
+    permissionShowUnavailable: '⚠️ The permission catalog is temporarily unavailable; try again shortly.',
+    permissionShowHeader: (current, entries) => `**Current permission mode:** ${current}\n**Switchable:** ${entries}`,
+    permissionShowUnknownCurrent: 'unknown (projection unreadable)',
+    permissionPresetReadOnly: 'View only',
+    permissionPresetWorkspaceWrite: 'Workspace edit',
+    permissionPresetFullAccess: 'Full access',
+    permissionApplied: (label) => `✅ Permission mode switched: ${label} (sandbox and approval follow the preset).`,
+    permissionRejected: (reason) => `⚠️ DSH rejected this switch: ${reason}`,
+    permissionUnknown: '⚠️ The switch outcome is unknown (the command may have run); confirm with /permission show.',
+    permissionSelectOperatorOnly: '⚠️ Only Host operators can switch the permission mode (full access disables both sandbox and approval).',
+    permissionNotInCatalog: "⚠️ That preset is not in this deployment's permission catalog.",
+    permissionConfirmHeader: (label) => `⚠️ Enable "${label}"?`,
+    permissionConfirmBody: 'After enabling, this Session will require fewer confirmations and can directly perform sensitive operations, file changes, or external commands. Only recommended when you trust the upcoming work.',
+    permissionConfirmButton: 'I understand the risk, enable',
+    permissionConfirmCancelButton: 'Cancel',
+    permissionConfirmed: (label) => `✅ Confirmed — switching to "${label}"…`,
+    permissionCancelled: 'Cancelled; the permission mode is unchanged.',
+    permissionConfirmExpired: '⚠️ That confirmation expired; run /permission set again.',
+    permissionSystemLine: (label) => `🔧 Permission mode → ${label}`,
     // ── /session resume ──────────────────────────────────────────────────
     sessionResumeNeedsBoundChannel: '⚠️ /session resume must run in a bound project channel.',
     sessionResumeStarted: threadId => `✅ Session resumed into <#${threadId}> — full history lives in the web UI; continue in the thread.`,
@@ -282,3 +324,17 @@ const en = {
 export function createCopy(language) {
     return language === 'en' ? en : zh;
 }
+/**
+ * Localize one permission-preset key for display. The dsh-base canonical
+ * three map to Discord copy; deployment-custom keys fall back to the raw
+ * host key (never invented labels).
+ */
+export function permissionPresetLabel(preset, copy) {
+    if (preset === 'read-only')
+        return copy.permissionPresetReadOnly;
+    if (preset === 'workspace-write')
+        return copy.permissionPresetWorkspaceWrite;
+    if (preset === 'danger-full-access')
+        return copy.permissionPresetFullAccess;
+    return preset;
+}

package/lib/index.js

@@ -9,14 +9,14 @@ import { createRestThreadPort } from './discord/thread-port.js';
 import { createComponentRegistry } from './discord/components.js';
 import { buildCommandRegistrations } from './discord/commands.js';
 import { startDiscordAdapter } from './compose.js';
-import { createModelPort, createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy, resolveHostFace } from './dsh/host-face.js';
+import { createModelPort, createPermissionPort, createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy, resolveHostFace } from './dsh/host-face.js';
 import { createApprovalStore } from './features/approval-store.js';
 import { createAskWiring } from './features/ask-wiring.js';
 import { sweepExpiredApprovals } from './features/approval-expiry.js';
 import { sweepExpiredQuestions } from './features/question-expiry.js';
 import { createQuestionStore } from './features/question-store.js';
 import { handleSelectInput, handleModalSubmit } from './features/question-routing.js';
-import { createCopy } from './i18n.js';
+import { createCopy, permissionPresetLabel } from './i18n.js';
 import { createInteractionRouter } from './features/interaction-router.js';
 import { channelBindingKey, parseChannelBindingKey, threadBindingKey, parseThreadBindingKey, discordDomainSpec, CHANNEL_BINDINGS_TABLE, THREAD_BINDINGS_TABLE, INTENTS_TABLE } from './state/domain.js';
 import { planBindingReconciliation } from './features/reconcile-bindings.js';
@@ -855,6 +855,8 @@ export function apply(ctx, config = DEFAULT_DISCORD_SETTINGS) {
                 rpcLog('discord_reconcile_channel_retired', { channelId, reason: 'discord-deleted' });
             },
             model: createModelPort(dsh, { log: rpcLog }),
+            permission: createPermissionPort(dsh, { log: rpcLog }),
+            permissionSelectOperatorOnly: () => current.permissionSelectOperatorOnly,
             modelSelectOperatorOnly: () => current.modelSelectOperatorOnly,
             resumeCandidates: createResumeCandidatesPort({
                 listSessions: () => listSessionSummaries(dsh, { log: rpcLog }),
@@ -1154,6 +1156,7 @@ export function apply(ctx, config = DEFAULT_DISCORD_SETTINGS) {
                 nonText: copy.userInputNonText,
                 truncated: copy.userInputTruncated,
             }),
+            permissionLineCopy: () => ({ line: presetKey => copy.permissionSystemLine(permissionPresetLabel(presetKey, copy)) }),
             onQueueSnapshot: (sessionId, items) => { queueSnapshots.set(sessionId, items); },
             onTurnEnded: (sessionId, info) => {
                 const turn = turnTracker.active(sessionId);

package/lib/settings.d.ts

@@ -30,6 +30,14 @@ export interface DiscordSettings {
      * re-tighten to the operator allowlist.
      */
     modelSelectOperatorOnly: boolean;
+    /**
+     * Restrict /permission set to the explicit Host-operator allowlist.
+     * Defaults to true — stricter than /model because the danger-full-access
+     * preset disables BOTH sandbox and approval (16.60); single-user
+     * deployments may loosen it so any authorized member can switch, mirroring
+     * the loosened /model select vocabulary.
+     */
+    permissionSelectOperatorOnly: boolean;
 }
 /** The archive durations Discord's API accepts (minutes). */
 export type ThreadAutoArchiveMinutes = 60 | 1440 | 4320 | 10080;

package/lib/settings.js

@@ -20,6 +20,7 @@ export const DEFAULT_DISCORD_SETTINGS = Object.freeze({
     questionTimeoutMs: 30 * 60_000,
     threadAutoArchiveMinutes: 1440,
     modelSelectOperatorOnly: false,
+    permissionSelectOperatorOnly: true,
 });
 const discordIdList = z.array(z.string()).default([]);
 export const DiscordSettingsSchema = z.object({
@@ -42,6 +43,7 @@ export const DiscordSettingsSchema = z.object({
     approvalTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(600_000),
     questionTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(1_800_000),
     modelSelectOperatorOnly: z.boolean().default(false),
+    permissionSelectOperatorOnly: z.boolean().default(true),
 });
 const DISCORD_SNOWFLAKE = /^\d{17,20}$/u;
 const ID_FIELDS = [

package/lib/startup.d.ts

@@ -6,7 +6,7 @@
  * with a single actionable diagnostic naming every gap.
  */
 /** The exact Host service roster the adapter requires (design decision 1). */
-export declare const REQUIRED_HOST_SERVICES: readonly ["sessionController", "workspaceController", "sessionQuery", "webServer", "credentials", "settings", "storageDomain", "connection"];
+export declare const REQUIRED_HOST_SERVICES: readonly ["sessionController", "workspaceController", "sessionQuery", "webServer", "credentials", "settings", "storageDomain", "connection", "commands", "permissionPresets"];
 export type HostServiceName = (typeof REQUIRED_HOST_SERVICES)[number];
 /**
  * Validate every required Host capability through `resolveService`, which

package/lib/startup.js

@@ -15,6 +15,10 @@ export const REQUIRED_HOST_SERVICES = [
     'settings',
     'storageDomain',
     'connection',
+    // The /permission surface (16.59): the Host command runtime and the
+    // permission-preset catalog (both ship in dsh-base).
+    'commands',
+    'permissionPresets',
 ];
 /**
  * Minimum contract members per service, confirmed against the 0.1.6
@@ -23,7 +27,7 @@ export const REQUIRED_HOST_SERVICES = [
  * the startup probe should have refused; refuse rather than probe at runtime.
  */
 const REQUIRED_CONTRACT_MEMBERS = {
-    sessionController: ['prompt', 'create', 'list', 'cancel', 'updateQueue', 'selectModel', 'modelCatalog', 'follow', 'control'],
+    sessionController: ['prompt', 'create', 'list', 'cancel', 'updateQueue', 'selectModel', 'modelCatalog', 'follow', 'control', 'resolveAgent'],
     workspaceController: ['follow'],
     sessionQuery: ['observeSession'],
     webServer: [],
@@ -31,6 +35,8 @@ const REQUIRED_CONTRACT_MEMBERS = {
     settings: ['installSection'],
     storageDomain: ['open'],
     connection: ['rpc'],
+    commands: ['execute'],
+    permissionPresets: ['catalog'],
 };
 /** Actionable remediation hint appended to every activation failure. */
 const REMEDIATION = 'install @addozhang/dsh-discord into a dsh web profile providing the 0.1.6 host controller services';

package/lib/stream/live.d.ts

@@ -120,6 +120,13 @@ export interface LiveRenderDeps {
         nonText: string;
         truncated: string;
     };
+    /**
+     * Localized permission system-line copy, resolved live (language can
+     * change). Unset: permission/preset records never render (16.62).
+     */
+    permissionLineCopy?: () => {
+        line: (presetLabel: string) => string;
+    };
     /** Turn ownership release on turn/end; `info` carries the consumed watermark. */
     onTurnEnded?: (sessionId: string, info?: {
         threadId: string;

package/lib/stream/live.js

@@ -344,6 +344,27 @@ export function startLiveRender(deps) {
                 echoUserInput(threadId, runtime, data, event);
                 return;
             }
+            case 'permission/preset': {
+                // Durable preset intent (16.62): one audit line per switch, from
+                // ANY surface (web UI or Discord). The knob events that follow
+                // (sandbox/mode, approval/policy) stay unrendered — the preset
+                // table already implies them.
+                const copy = deps.permissionLineCopy?.();
+                if (copy === undefined)
+                    return;
+                const preset = data['preset'];
+                if (typeof preset !== 'string' || preset === '')
+                    return;
+                const payload = buildOutboundMessage({ kind: 'tool', content: copy.line(preset) });
+                void deps.delivery.send({ channelId: threadId, content: payload.content }).then(sent => {
+                    if (sent.outcome !== 'completed') {
+                        deps.log?.('discord_live_permission_line_failed', { threadId, outcome: sent.outcome });
+                    }
+                }).catch((cause) => {
+                    deps.log?.('discord_live_permission_line_threw', { threadId, cause: String(cause) });
+                });
+                return;
+            }
             case 'turn/start': {
                 if (typeof turnId !== 'string')
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addozhang/dsh-discord",
-  "version": "0.5.0-rc.2",
+  "version": "0.5.0-rc.3",
   "description": "Discord adapter for DeepSeek Harness · DeepSeek Harness 的 Discord 适配器",
   "license": "MIT",
   "type": "module",