@addozhang/dsh-discord 0.5.0-rc.2 → 0.5.0-rc.4

package/README.md

@@ -23,18 +23,32 @@ No extra process: the adapter is a DSH plugin that mounts straight onto your `ds
 - **Approvals & questions** — DSH asks become buttons, select menus, and a free-text modal. Ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
 - **Session control** — `/steer`, `/stop`, and `/queue list|remove` with turn-ownership checks; `/project bind|list|info` and `/session resume` for guild↔workspace binding and history; `/guild forget` for operator cleanup.
 - **Model selection** — `/model show` reads the session's live model directory; `/model select` walks an interactive provider → model → reasoning cascade, or applies a typed `provider/model` directly. Open to any authorized member by default; restrictable to Host operators.
+- **Permission switching** — `/permission show` / `set` read and switch the session's permission preset (bundled sandbox + approval tiers) through the Host's own `/permission` command path, inheriting its journal audit pair; `danger-full-access` requires a button confirmation.
 - **Settings card, bilingual out of the box** — token onboarding and connect/disconnect (stored in the Host credential service, never in settings or logs), guild allowlist, auto-archive, and language. Every Discord-visible string ships in Chinese and English; the bot follows the DSH language preference or a pinned choice.
 - **Hardened by design** — deny-first authorization inside an explicit guild allowlist. Mentions are suppressed twice: `allowed_mentions` on every request, plus byte-level neutralization of the wire body. DSH submission is at-most-once with unknown-preserving reconciliation — an ambiguous delivery is never blindly resent. Bindings survive restarts, and the READY sweep rebuilds deleted category/control channels while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
 
 ## Requirements
 
-- The [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.6-alpha.1` or a compatible newer release, running a web profile. Adapter `0.5.x` uses the 0.1.6 controller services and is not compatible with the former `apiProxy` host surface.
+- The [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh), running a web profile. Match the dsh and adapter channels — see [Versions](#versions).
 - Node.js `^22.19.0 || >=24`
 - A Discord application with a bot user and the **MESSAGE CONTENT** privileged intent enabled (Developer Portal → your application → Bot → Privileged Gateway Intents)
 
+## Versions
+
+Two channels ship in parallel, each pinned to the dsh host surface it was verified against. Pick the adapter and the dsh CLI from the same row:
+
+| Channel | Adapter | dsh CLI | Install |
+|---|---|---|---|
+| **stable** | `0.4.x` — npm `latest` | `0.1.5` — npm `latest` | `dsh plugin --profile web add @addozhang/dsh-discord` |
+| **next** | `>=0.5.0-rc.4` — npm `next` | `0.1.7-alpha` — npm `alpha` | `dsh plugin --profile web add @addozhang/dsh-discord@next` |
+
+- **The rows do not mix.** Adapter `>=0.5.0-rc.4` speaks the 0.1.7 profile-backed settings forms and controller services and will not load on older hosts (the startup probe refuses with one actionable diagnostic); `0.5.0-rc.1`–`rc.3` target dsh `0.1.6-alpha`; adapter `0.4.x` talks to the former `apiProxy` surface, which `0.1.6-alpha` removed. A mismatched pair fails at startup.
+- To switch the dsh CLI line: `npm install -g @deepseek-ai/dsh` (stable) or `npm install -g @deepseek-ai/dsh@alpha` (next).
+- Right after a `next` release, the `@next` spec can resolve to a stale cached version. If the installed copy looks old, install by exact version instead (e.g. `@addozhang/dsh-discord@0.5.0-rc.4`) and verify the `version` field inside the profile's `node_modules`.
+
 ## Install
 
-Install with the dsh CLI — it installs the package into the profile and registers the bundle for you:
+Install with the dsh CLI — it installs the package into the profile and registers the bundle for you. The stable channel is shown below; for the next channel use the `@next` command from the [Versions](#versions) table (`up` / `rm` take the same spec):
 
 ```sh
 dsh plugin --profile web add @addozhang/dsh-discord
@@ -70,6 +84,7 @@ All keys live in the `dsh-discord` settings namespace and can be set either from
 | `deniedUserIds` / `deniedRoleIds` | `[]` | Deny entries; they win over every grant above. |
 | `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`; `/model select` when `modelSelectOperatorOnly` is enabled). |
 | `modelSelectOperatorOnly` | `false` | Restrict `/model select` to Host operators (`settings.yaml` only; the card does not expose it). Default `false`: any authorized member may switch, and the switch still updates the Host default. |
+| `permissionSelectOperatorOnly` | `true` | Restrict `/permission set` to Host operators (`settings.yaml` only). Default `true` — stricter than `/model` because `danger-full-access` disables both sandbox and approval; loosen to let any authorized member switch. |
 | `defaultVerbosity` | `essential-tools` | Tool-activity row granularity: `text-only`, `essential-tools`, or `full-tools`. |
 | `language` | `auto` | Bot-visible copy language: `auto` follows the DSH language preference (non-Chinese renders English), or pin `zh`/`en`. |
 | `streamUpdateIntervalMs` | `800` | Coalescing budget for stream edits (250–10000). |
@@ -110,10 +125,11 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
 | `/session resume` | project channel | pick one of this workspace's past sessions (autocomplete: title and age, newest first) and resume it into a new thread of this channel; blank, already-bound, subagent, and archived sessions are never offered. The thread renders the session's history — answers and tool summaries plus the user's inputs as quoted echo lines (plugin/system injections are never echoed). After an adapter restart, threads catch up only what they missed: a persisted render watermark suppresses already-delivered history, and bound sessions re-subscribe on reconnect so turns prompted from the web UI still land in their thread |
 | `/guild forget` | any channel | operator-only removal of adapter records |
+| `/permission show` / `set` | session thread | read or switch the session's permission preset (view only / workspace edit / full access — bundled sandbox + approval tiers, catalog read live from the Host). `set danger-full-access` asks for a button confirmation first; presets autocomplete; Host operators only by default (`permissionSelectOperatorOnly` can loosen it). Every switch — from Discord or the web UI — renders one system line in the thread |
 
 ## Design notes
 
-- The adapter is a function/namespace plugin (`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`) that mounts the Discord Gateway, command surface, stream renderer, and the settings card onto the DSH web profile.
+- The adapter is a function/namespace plugin (`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection', 'commands', 'permissionPresets']`) that mounts the Discord Gateway, command surface, stream renderer, and the settings card onto the DSH web profile.
 - The settings card is the first-run onboarding surface: the token entry writes the credential service's `DSH_DISCORD_BOT_TOKEN` ref over the plugin management channel, then triggers the start chain. Disconnect keeps the credential; an empty reconnect uses it.
 - The publish workflow authenticates to npm via trusted publishing (OIDC) — no publish token is stored anywhere.
 - The adapter start chain is generation-counted, so Connect/Disconnect races with the initial boot yield exactly one gateway.

package/README.zh.md

@@ -23,18 +23,32 @@
 - **审批与提问** — DSH 的 ask 渲染为按钮、下拉菜单与自由文本弹窗。所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
 - **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 与 `/session resume` 管理 Guild↔工作区绑定与历史会话；`/guild forget` 供操作员清理。
 - **模型切换** — `/model show` 读取会话的实时模型目录；`/model select` 走交互式 provider → 模型 → 推理强度级联，也可直接填写 `provider/model` 应用。默认对所有授权成员开放，可收紧为仅 Host 操作员。
+- **权限切换** — `/permission show` / `set` 读写会话权限预设（沙箱 + 审批捆绑档位），走宿主自己的 `/permission` 命令路径，journal 自动记审计；`danger-full-access` 需按钮二次确认。
 - **设置卡片，开箱双语** — Token 引导与连接/断开（存入 Host 凭据服务，绝不写入设置或日志）、服务器白名单、自动归档与语言。所有 Discord 可见文案提供中英双语；Bot 默认跟随 DSH 语言偏好，也可从卡片固定。
 - **安全设计** — 显式服务器白名单内的 deny-first 授权。提及抑制双保险：每条请求携带 `allowed_mentions`，外加 wire body 的字节级提及中和。DSH 提交至多一次，并做保留 unknown 的对账——结果不明的投递绝不盲目重发。绑定重启后持久；READY 扫描会重建被删除的 category/控制频道，而把被删除的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
 
 ## 环境要求
 
-- [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.6-alpha.1` 或兼容的更新版本（web profile）。适配器 `0.5.x` 使用 0.1.6 的控制器服务，与旧版 `apiProxy` 宿主面不兼容。
+- [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh)（web profile）。dsh 与适配器的通道需匹配——见[版本支持](#版本支持)。
 - Node.js `^22.19.0 || >=24`
 - 一个 Discord 应用（含 Bot 用户），并在开发者门户启用 **MESSAGE CONTENT** 特权 intent（Developer Portal → 你的应用 → Bot → Privileged Gateway Intents）
 
+## 版本支持
+
+两条通道并行发布，各自钉在经过真机验证的 dsh 宿主面上。适配器与 dsh CLI 请取同一行：
+
+| 通道 | 适配器 | dsh CLI | 安装命令 |
+|---|---|---|---|
+| **stable** | `0.4.x` — npm `latest` | `0.1.5` — npm `latest` | `dsh plugin --profile web add @addozhang/dsh-discord` |
+| **next** | `>=0.5.0-rc.4` — npm `next` | `0.1.7-alpha` — npm `alpha` | `dsh plugin --profile web add @addozhang/dsh-discord@next` |
+
+- **两行不可混搭。** 适配器 `>=0.5.0-rc.4` 使用 0.1.7 的 profile-backed settings forms 与控制器服务，在更旧的宿主上无法加载（startup 探针会给出一条可操作的诊断后拒绝激活）；`0.5.0-rc.1`–`rc.3` 对应 dsh `0.1.6-alpha`；适配器 `0.4.x` 使用旧版 `apiProxy` 宿主面，而该面已在 `0.1.6-alpha` 中移除。错配会在启动时失败。
+- 切换 dsh CLI 通道：`npm install -g @deepseek-ai/dsh`（stable）或 `npm install -g @deepseek-ai/dsh@alpha`（next 线）。
+- `next` 刚发版后，`@next` 规格可能解析到过期的缓存版本。若装到的版本偏旧，请改用精确版本号安装（如 `@addozhang/dsh-discord@0.5.0-rc.4`），并核对 profile `node_modules` 中的 `version` 字段。
+
 ## 安装
 
-使用 dsh CLI 安装——它会自动把包装进 profile 并注册 bundle：
+使用 dsh CLI 安装——它会自动把包装进 profile 并注册 bundle。下面是 stable 通道；next 通道使用[版本支持](#版本支持)表中的 `@next` 命令（`up` / `rm` 同规格）：
 
 ```sh
 dsh plugin --profile web add @addozhang/dsh-discord
@@ -70,6 +84,7 @@ dsh plugin --profile web rm @addozhang/dsh-discord   # 卸载；先执行 /guild
 | `deniedUserIds` / `deniedRoleIds` | `[]` | 拒绝名单；优先级高于上述一切授权。 |
 | `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`；启用 `modelSelectOperatorOnly` 后也包括 `/model select`）。 |
 | `modelSelectOperatorOnly` | `false` | 将 `/model select` 限制为 Host 操作员（仅 `settings.yaml`，卡片不展示）。默认 `false`：任何授权成员均可切换，且切换仍会更新 Host 默认。 |
+| `permissionSelectOperatorOnly` | `true` | 将 `/permission set` 限制为 Host 操作员（仅 `settings.yaml`）。默认 `true`——比 `/model` 更严，因为「完全权限」会同时解除沙箱与审批；可放开为任何授权成员可切换。 |
 | `defaultVerbosity` | `essential-tools` | 工具活动行粒度：`text-only`、`essential-tools`、`full-tools`。 |
 | `language` | `auto` | Bot 可见文案语言：`auto` 跟随 DSH 语言偏好（非中文渲染英文），或固定 `zh`/`en`。 |
 | `streamUpdateIntervalMs` | `800` | 流式编辑合并间隔（250–10000）。 |
@@ -110,11 +125,12 @@ dsh-discord:
 | `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
 | `/session resume` | 项目频道 | 自动补全选择本工作区的历史会话（显示标题与时间，最新优先），恢复为当前频道的新线程；空白、已挂线程、subagent、已归档的会话不会出现。线程会渲染会话历史——回答与工具摘要之外，用户输入以引用行回显（插件/系统注入永不回显）。适配器重启后线程只补齐错过部分：持久化的渲染水位抑制已投递过的历史，已绑定会话在重连时自动重订阅，因此从 web UI 发起的回合也会落进对应线程 |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
+| `/permission show` / `set` | 会话线程 | 查看或切换会话权限预设（仅可查看 / 工作区内修改 / 完全权限——沙箱与审批的捆绑档位，目录取自宿主实时配置）。`set danger-full-access` 先要求按钮确认；预设自动补全；默认仅 Host 操作员可切换（`permissionSelectOperatorOnly` 可放开）。任何入口（含 web UI）的切换都会在线程渲染一行系统消息 |
 
 
 ## 设计说明
 
-- 适配器为 function/namespace 插件（`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`），将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile。
+- 适配器为 function/namespace 插件（`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection', 'commands', 'permissionPresets']`），将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile。
 - 设置卡片是首次使用的引导面：Token 输入通过插件管理通道写入凭据服务的 `DSH_DISCORD_BOT_TOKEN` 引用，然后触发启动链。断开连接保留凭据；留空重连直接使用已存 Token。
 - 发布工作流通过 npm trusted publishing (OIDC) 认证——任何地方都不保存发布凭证。
 - 适配器启动链带代际计数，Connect/Disconnect 与初始启动竞争时只会产生一个 Gateway。

package/cordis.patch.yml

@@ -11,4 +11,4 @@
 - insert:
     - id: dsh-discord
       name: '@addozhang/dsh-discord'
-      inject: [sessionController, workspaceController, sessionQuery, webServer, credentials, settings, storageDomain, connection]
+      inject: [sessionController, workspaceController, sessionQuery, webServer, credentials, settings, storageDomain, connection, commands, permissionPresets]

package/lib/client/card-controller.d.ts

@@ -4,14 +4,14 @@
  * hands to the component: the edit actions plus the `discordCard` snapshot
  * store the framework binds as the `useDiscordCard` selector hook.
  */
-import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { AdapterStatusView } from '../features/adapter-status.js';
 import type { DiscordSettings } from '../settings.js';
 import { type CardManagement, type DiscordCardFace, type DiscordCardState } from './card-form.js';
 export declare class DiscordCardController {
     private readonly form;
     private management;
-    constructor(scope: SettingsScope<DiscordSettings>);
+    constructor(form: ConfigForm<DiscordSettings>);
     /** Attach the token write/connect path once the RPC face is known. */
     setManagement(management: CardManagement): void;
     /** Publish the Host's sanitized connection status onto the card. */

package/lib/client/card-form.d.ts

@@ -7,7 +7,7 @@
  * is not a list of Discord IDs, which blocks the save rather than dropping it.
  */
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
-import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { AdapterStatusView } from '../features/adapter-status.js';
 import type { DiscordSettings } from '../settings.js';
 import { type AdapterStatusPresentation } from './settings-model.js';
@@ -88,7 +88,7 @@ export declare class DiscordCardForm {
     private saving;
     private failed;
     private status;
-    constructor(scope: SettingsScope<DiscordSettings>);
+    constructor(scope: ConfigForm<DiscordSettings>);
     /**
      * Publish the Host's sanitized status view. Edits, saves, and failures
      * never touch it — connection state is the Host's report, not form state.

package/lib/client.js

@@ -1022,8 +1022,8 @@ var DiscordCardForm = class {
 var DiscordCardController = class {
   form;
   management;
-  constructor(scope) {
-    this.form = new DiscordCardForm(scope);
+  constructor(form) {
+    this.form = new DiscordCardForm(form);
   }
   /** Attach the token write/connect path once the RPC face is known. */
   setManagement(management) {
@@ -1469,7 +1469,7 @@ function DiscordSettingsCard(props) {
 
 // src/client/index.ts
 var name = "dsh-discord-client";
-var inject = ["settingsScope", "slots", "connection", "locale"];
+var inject = ["configForms", "slots", "connection", "locale"];
 var STATUS_POLL_MS = 3e4;
 function isStatusView(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -1477,8 +1477,8 @@ function isStatusView(value) {
   return typeof candidate["token"] === "string" && typeof candidate["connection"] === "string";
 }
 function apply(ctx) {
-  const scope = ctx.settingsScope.bind({ namespace: DISCORD_SETTINGS_NAMESPACE });
-  const controller = new DiscordCardController(scope);
+  const form = ctx.configForms.get(DISCORD_SETTINGS_NAMESPACE);
+  const controller = new DiscordCardController(form);
   ctx.locale.register("dsh-discord", {
     en: DISCORD_CARD_LOCALE_EN,
     zh: DISCORD_CARD_LOCALE_ZH

package/lib/discord/commands.js

@@ -44,6 +44,12 @@ export const MILESTONE_ONE_COMMANDS = [
     grouped('guild', 'Guild-scoped adapter operations', [
         { name: 'forget' },
     ]),
+    grouped('permission', 'Show or switch the session permission preset', [
+        { name: 'show' },
+        // The preset autocompletes from the live Host catalog (16.61);
+        // danger-full-access goes through a button confirmation first.
+        { name: 'set', options: [{ name: 'preset', required: true, autocomplete: true }] },
+    ]),
 ];
 const DISCORD_APPLICATION_COMMAND = 1;
 const DISCORD_SUBCOMMAND = 1;

package/lib/dsh/host-face.d.ts

@@ -19,6 +19,7 @@
 import type { ProjectListPort } from '../features/project-list.js';
 import type { WorkspaceResolver } from '../features/project-bind.js';
 import type { DshModelPort } from '../features/model-control.js';
+import type { DshPermissionPort } from '../features/permission-control.js';
 /** The workspace rows the catalog port needs (subset of WorkspaceView). */
 export interface WorkspaceCatalogEntry {
     workspaceId: string;
@@ -93,6 +94,18 @@ export interface DshSessionControllerFace {
     }, signal: AbortSignal): AsyncIterable<unknown>;
     /** Host-wide live state stream (queue/jobs/projection frames over one baseline). */
     control(signal: AbortSignal): AsyncIterable<unknown>;
+    /**
+     * Resolve or resume one Session's live Agent (0.1.6 probe-verified shape
+     * `{agent} | {error}`); the agent object stays opaque — it exists only to
+     * feed `commands.execute` for the Host-native `/permission` command path.
+     */
+    resolveAgent(sessionId: string): Promise<{
+        agent?: unknown;
+        error?: {
+            code?: string;
+            message?: string;
+        };
+    }>;
 }
 /**
  * Narrow slice of the 0.1.6 `workspaceController` cordis service. The
@@ -118,6 +131,30 @@ export interface DshSessionQueryFace {
         };
     } & Partial<AsyncDisposable>>;
 }
+/**
+ * Narrow slice of the `commands` cordis service (dsh-commands). `execute`
+ * runs one registered slash command against an exact agent WITHOUT sending
+ * it to the model, logging the command/run + command/done journal pair; the
+ * signal is owned by the caller. Signatures 2026-09-19 real-host verified.
+ */
+export interface DshCommandsFace {
+    execute(agent: unknown, line: string, submittedAttachments: readonly unknown[], signal: AbortSignal): Promise<{
+        commandId: string;
+        result?: {
+            kind?: unknown;
+            text?: unknown;
+        };
+    } | undefined>;
+}
+/**
+ * Narrow slice of the `permissionPresets` cordis service
+ * (dsh-permission-presets): the deployment's configured preset table.
+ */
+export interface DshPermissionPresetsFace {
+    catalog(): Promise<{
+        options?: unknown;
+    }>;
+}
 /** The host-generation model catalog (`session/modelCatalog`, host-wide). */
 export interface ModelCatalogWireShape {
     default: ModelSelectionShape;
@@ -134,6 +171,8 @@ export interface DshHostFace {
     session: DshSessionControllerFace;
     workspace: DshWorkspaceControllerFace;
     sessionQuery: DshSessionQueryFace;
+    commands: DshCommandsFace;
+    permissionPresets: DshPermissionPresetsFace;
 }
 /**
  * Resolve the 0.1.6 controller services off the Cordis context. Throws one
@@ -416,3 +455,37 @@ export declare function selectSessionModel(dsh: DshHostFace, request: {
  * reasons about.
  */
 export declare function createModelPort(dsh: DshHostFace, options?: ApiProxyFaceOptions): DshModelPort;
+/** One normalized preset row off the catalog's `options` array. */
+export interface PermissionCatalogEntry {
+    value: string;
+    name?: string;
+}
+export type PermissionCatalogOutcome = {
+    outcome: 'completed';
+    entries: PermissionCatalogEntry[];
+} | {
+    outcome: 'failed';
+};
+/** Read the deployment's preset table (`permissionPresets.catalog`). */
+export declare function permissionCatalog(dsh: DshHostFace, options?: ApiProxyFaceOptions): Promise<PermissionCatalogOutcome>;
+export type SwitchSessionPermissionOutcome = {
+    outcome: 'completed';
+    preset: string;
+} | {
+    outcome: 'rejected';
+    reason: string;
+} | {
+    outcome: 'unknown';
+};
+/**
+ * Switch the session's preset through the Host's OWN `/permission` command
+ * path (resolveAgent → commands.execute) — the same entry the web UI uses,
+ * inheriting its journal audit pair and admission checks. An execute throw
+ * is unknown (the command may have run): callers never retry blindly.
+ */
+export declare function switchSessionPermission(dsh: DshHostFace, request: {
+    sessionId: string;
+    preset: string;
+}, options?: ApiProxyFaceOptions): Promise<SwitchSessionPermissionOutcome>;
+/** The /permission surface over the controller, command, and preset services. */
+export declare function createPermissionPort(dsh: DshHostFace, options?: ApiProxyFaceOptions): DshPermissionPort;

package/lib/dsh/host-face.js

@@ -24,7 +24,7 @@ import { parseWorkspaceReference } from '../policy/disclosure.js';
  */
 export function resolveHostFace(ctx) {
     const missing = [];
-    for (const name of ['sessionController', 'workspaceController', 'sessionQuery']) {
+    for (const name of ['sessionController', 'workspaceController', 'sessionQuery', 'commands', 'permissionPresets']) {
         if (ctx.get(name) === undefined || ctx.get(name) === null)
             missing.push(name);
     }
@@ -35,6 +35,8 @@ export function resolveHostFace(ctx) {
         session: ctx.get('sessionController'),
         workspace: ctx.get('workspaceController'),
         sessionQuery: ctx.get('sessionQuery'),
+        commands: ctx.get('commands'),
+        permissionPresets: ctx.get('permissionPresets'),
     };
 }
 /** Raised when the Host did not answer within the bounded window. */
@@ -596,3 +598,124 @@ export function createModelPort(dsh, options = {}) {
         selectModel: request => selectSessionModel(dsh, request, options),
     };
 }
+/** Read the deployment's preset table (`permissionPresets.catalog`). */
+export async function permissionCatalog(dsh, options = {}) {
+    const log = options.log;
+    try {
+        const catalog = await withRpcTimeout(dsh.permissionPresets.catalog(), options.timeoutMs ?? CATALOG_TIMEOUT_MS);
+        if (!isRecord(catalog) || !Array.isArray(catalog['options'])) {
+            log?.('discord_permission_catalog_malformed', {});
+            return { outcome: 'failed' };
+        }
+        const entries = [];
+        for (const row of catalog['options']) {
+            if (!isRecord(row) || typeof row['value'] !== 'string')
+                continue;
+            entries.push({
+                value: row['value'],
+                ...(typeof row['name'] === 'string' ? { name: row['name'] } : {}),
+            });
+        }
+        return { outcome: 'completed', entries };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_permission_catalog_timeout', {});
+            return { outcome: 'failed' };
+        }
+        log?.('discord_permission_catalog_failed', { cause: String(cause) });
+        return { outcome: 'failed' };
+    }
+}
+/**
+ * Read the session's current preset off the `permissions` projection view
+ * (`{currentValue}`, stateVersion 2). Any read failure resolves failed —
+ * show degrades to "current unknown", never a hard failure.
+ */
+async function readSessionPermission(dsh, sessionId, options) {
+    const log = options.log;
+    let observation;
+    try {
+        observation = await withRpcTimeout(dsh.sessionQuery.observeSession(sessionId), options.timeoutMs ?? CATALOG_TIMEOUT_MS);
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const projections = isRecord(observation) && isRecord(observation['projections'])
+            ? observation['projections']
+            : undefined;
+        const values = projections !== undefined && isRecord(projections['values'])
+            ? projections['values']
+            : undefined;
+        const permission = values !== undefined ? values['permissions'] : undefined;
+        const current = isRecord(permission) ? permission['currentValue'] : undefined;
+        return typeof current === 'string' ? current : undefined;
+    }
+    finally {
+        const dispose = observation?.[Symbol.asyncDispose]
+            ?? observation?.dispose;
+        if (typeof dispose === 'function') {
+            try {
+                void dispose.call(observation);
+            }
+            catch (cause) {
+                log?.('discord_session_permission_dispose_threw', { cause: String(cause) });
+            }
+        }
+    }
+}
+/**
+ * Switch the session's preset through the Host's OWN `/permission` command
+ * path (resolveAgent → commands.execute) — the same entry the web UI uses,
+ * inheriting its journal audit pair and admission checks. An execute throw
+ * is unknown (the command may have run): callers never retry blindly.
+ */
+export async function switchSessionPermission(dsh, request, options = {}) {
+    const log = options.log;
+    const controller = new AbortController();
+    try {
+        const resolved = await withRpcTimeout(dsh.session.resolveAgent(request.sessionId), options.timeoutMs ?? PROMPT_TIMEOUT_MS);
+        if (!isRecord(resolved) || resolved['agent'] === undefined) {
+            const message = isRecord(resolved['error']) && typeof resolved['error']['message'] === 'string'
+                ? resolved['error']['message']
+                : 'session unavailable';
+            log?.('discord_permission_agent_unresolved', { sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: message };
+        }
+        const agent = resolved['agent'];
+        const execution = await withRpcTimeout(dsh.commands.execute(agent, `/permission ${request.preset}`, [], controller.signal), options.timeoutMs ?? PROMPT_TIMEOUT_MS);
+        if (execution === undefined) {
+            // Unmatched command: this Host has no /permission registered.
+            log?.('discord_permission_command_missing', { sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: 'the Host has no /permission command' };
+        }
+        const result = isRecord(execution) && isRecord(execution['result']) ? execution['result'] : undefined;
+        const kind = result !== undefined ? result['kind'] : undefined;
+        const text = result !== undefined && typeof result['text'] === 'string' ? result['text'] : '';
+        if (kind === 'success') {
+            return { outcome: 'completed', preset: request.preset };
+        }
+        log?.('discord_permission_command_error', { sessionId: request.sessionId, text });
+        return { outcome: 'rejected', reason: text === '' ? 'the Host rejected the switch' : text };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_permission_switch_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_permission_switch_threw', { sessionId: request.sessionId, cause: String(cause) });
+        return { outcome: 'unknown' };
+    }
+}
+/** The /permission surface over the controller, command, and preset services. */
+export function createPermissionPort(dsh, options = {}) {
+    return {
+        catalog: () => permissionCatalog(dsh, options),
+        current: async (sessionId) => {
+            const preset = await readSessionPermission(dsh, sessionId, options);
+            return preset === undefined ? { outcome: 'failed' } : { outcome: 'completed', preset };
+        },
+        set: (sessionId, preset) => switchSessionPermission(dsh, { sessionId, preset }, options),
+    };
+}

package/lib/features/interaction-router.d.ts

@@ -15,6 +15,7 @@ import type { CancelOutcome, PromptOutcome, QueueRemoveOutcome, WorkspaceDetailO
 import type { TurnTracker } from './turn-ownership.js';
 import { type DshApprovalRespondPort } from './approval-routing.js';
 import { type DshModelPort } from './model-control.js';
+import { type DshPermissionPort } from './permission-control.js';
 import type { QuestionInteractionOutcome } from './question-routing.js';
 import type { ApprovalStore } from './approval-store.js';
 import type { ChannelBinding } from '../state/records.js';
@@ -132,6 +133,13 @@ export interface InteractionRouterDeps {
      * deployments flip this so any authorized member can switch (16.42).
      */
     modelSelectOperatorOnly: () => boolean;
+    /**
+     * Whether /permission set stays Host-operator-only (default true — the
+     * danger-full-access preset strips sandbox AND approval; 16.60).
+     */
+    permissionSelectOperatorOnly: () => boolean;
+    /** The live permission-preset catalog + guarded switch (/permission surface). */
+    permission: DshPermissionPort;
     log: (event: string, detail?: unknown) => void;
     warn: (event: string, detail?: unknown) => void;
 }