@norman-else/dsh-claude 0.1.53 → 0.1.54

package/lib/index.mjs

@@ -1,6 +1,6 @@
-import { A as CLAUDE_REPOSITORY_FILE_PATH, C as CLAUDE_PROMPTS_PATH, D as CLAUDE_RENDER_MODES, E as CLAUDE_PROSE_MODES, F as CLAUDE_UPDATE_CHECK_PATH, H as isClaudeAlertMode, I as CLAUDE_UPDATE_PATH, L as CLAUDE_USAGE_PATH, M as CLAUDE_REPOSITORY_STATUS_PATH, N as CLAUDE_REVIEW_COMMENT_PATH, O as CLAUDE_REPOSITORY_ACTION_PATH, P as CLAUDE_REWIND_PATH, R as DEFAULT_CLAUDE_PROSE_MODE, S as CLAUDE_PROJECTION_PATH, T as CLAUDE_PROMPT_REFINE_PATH, U as isClaudeProseMode, V as TASK_TOOL_NAMES, W as isClaudeRenderMode, _ as CLAUDE_CODE_PROVIDER_IDS, a as latestClaudeTasks, b as CLAUDE_JIRA_PATH, c as normalizeTasksEvent, d as CLAUDE_ACTIVITY_EVENT, f as CLAUDE_ALERT_MODES, g as CLAUDE_CODE_PROVIDER, h as CLAUDE_CODE_PRESET_ID, i as latestClaudeSessionBinding, j as CLAUDE_REPOSITORY_SETUP_PATH, k as CLAUDE_REPOSITORY_FEEDBACK_PATH, l as redactText, m as CLAUDE_CLIENT_DIAGNOSTICS_PATH, n as currentClaudeActivityCursor, o as normalizeActivity, p as CLAUDE_ASK_PATH, r as latestClaudeContextUsage, s as normalizeContextUsage, t as boundText, u as safeDetail, v as CLAUDE_DOCTOR_PATH, w as CLAUDE_PROMPT_NAME_PATH, x as CLAUDE_PLAN_FEEDBACK_PATH, y as CLAUDE_GLOBAL_SETTINGS_PATH, z as DEFAULT_CLAUDE_RENDER_MODE } from "./events-B498uofA.mjs";
-import { a as projectClaudeCommands, i as CLAUDE_COMMANDS_SERVICE, r as dynamicPresenterDefinition, t as CLAUDE_PRESENTER_NAMES } from "./presenters-CRFcjLSC.mjs";
-import { a as resolveClaudeExecutable, n as ensureManagedPreset, o as runClaudeDoctor, t as ManagedPresetConflictError } from "./preset-installer-Cj637ucf.mjs";
+import { A as CLAUDE_REPOSITORY_FEEDBACK_PATH, B as DEFAULT_CLAUDE_RENDER_MODE, C as CLAUDE_PROJECTION_PATH, D as CLAUDE_PROSE_MODES, E as CLAUDE_PROMPT_REFINE_PATH, F as CLAUDE_REWIND_PATH, G as isClaudeRenderMode, H as TASK_TOOL_NAMES, I as CLAUDE_UPDATE_CHECK_PATH, L as CLAUDE_UPDATE_PATH, M as CLAUDE_REPOSITORY_SETUP_PATH, N as CLAUDE_REPOSITORY_STATUS_PATH, O as CLAUDE_RENDER_MODES, P as CLAUDE_REVIEW_COMMENT_PATH, R as CLAUDE_USAGE_PATH, S as CLAUDE_PLAN_FEEDBACK_PATH, T as CLAUDE_PROMPT_NAME_PATH, U as isClaudeAlertMode, W as isClaudeProseMode, _ as CLAUDE_CODE_PROVIDER_IDS, a as latestClaudeTasks, b as CLAUDE_JIRA_PATH, c as normalizeTasksEvent, d as CLAUDE_ACTIVITY_EVENT, f as CLAUDE_ALERT_MODES, g as CLAUDE_CODE_PROVIDER, h as CLAUDE_CODE_PRESET_ID, i as latestClaudeSessionBinding, j as CLAUDE_REPOSITORY_FILE_PATH, k as CLAUDE_REPOSITORY_ACTION_PATH, l as redactText, m as CLAUDE_CLIENT_DIAGNOSTICS_PATH, n as currentClaudeActivityCursor, o as normalizeActivity, p as CLAUDE_ASK_PATH, r as latestClaudeContextUsage, s as normalizeContextUsage, t as boundText, u as safeDetail, v as CLAUDE_DOCTOR_PATH, w as CLAUDE_PROMPTS_PATH, x as CLAUDE_PERMISSION_MODE_PATH, y as CLAUDE_GLOBAL_SETTINGS_PATH, z as DEFAULT_CLAUDE_PROSE_MODE } from "./events-QGz0a_LH.mjs";
+import { a as projectClaudeCommands, i as CLAUDE_COMMANDS_SERVICE, r as dynamicPresenterDefinition, t as CLAUDE_PRESENTER_NAMES } from "./presenters-BaZaq9rR.mjs";
+import { a as resolveClaudeExecutable, n as ensureManagedPreset, o as runClaudeDoctor, t as ManagedPresetConflictError } from "./preset-installer-3CuT5Lrc.mjs";
 import { basename, dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomUUID } from "node:crypto";
@@ -14,6 +14,74 @@ import { DSH_ENV_PREFIX, SENSITIVE_ENV_PATTERN } from "@deepseek-ai/dsh-subproce
 import { fileURLToPath } from "node:url";
 import { deadline } from "@deepseek-ai/dsh-timeout";
 import { StringDecoder } from "node:string_decoder";
+//#region src/permission-mode.ts
+/** Every mode the selector offers, in the order it lists them: tightest
+*  first. `auto` hands each ask to Claude Code's own classifier and is a
+*  per-model capability, so the selector greys it out where the catalog says
+*  the session's model lacks it. */
+const CLAUDE_PERMISSION_MODES = [
+	"plan",
+	"default",
+	"acceptEdits",
+	"dontAsk",
+	"auto",
+	"bypassPermissions"
+];
+function isClaudePermissionMode(value) {
+	return typeof value === "string" && CLAUDE_PERMISSION_MODES.includes(value);
+}
+/** The DSH sandbox mode a Claude mode is carried on. The Host's preset table
+*  names its presets after these modes, so the same string selects the preset. */
+const SANDBOX_BY_CLAUDE_MODE = {
+	plan: "read-only",
+	default: "workspace-write",
+	acceptEdits: "workspace-write",
+	dontAsk: "workspace-write",
+	auto: "workspace-write",
+	bypassPermissions: "danger-full-access"
+};
+/** The closest Claude mode for a sandbox mode chosen without this plugin's
+*  selector: what the session runs under until the selector is used. */
+const CLAUDE_MODE_BY_SANDBOX = {
+	"read-only": "plan",
+	"workspace-write": "acceptEdits",
+	"danger-full-access": "bypassPermissions"
+};
+function isSandboxMode(value) {
+	return value === "read-only" || value === "workspace-write" || value === "danger-full-access";
+}
+/** The session's effective sandbox mode: the newest `sandbox/mode` event,
+*  undefined when there is none, and `null` for a newest event this plugin
+*  cannot read (which fails safe rather than falling back to an older one). */
+function sandboxModeOf(events) {
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (event?.type !== "sandbox/mode") continue;
+		const mode = event.data.mode;
+		return isSandboxMode(mode) ? mode : null;
+	}
+}
+/** The Claude mode a session runs its next turn under.
+*
+*  `chosen` is what the plugin's selector recorded; it stands for as long as
+*  the session's sandbox mode is the one it needs. A session that never chose
+*  runs the sandbox's closest mode, and one with no sandbox at all, or an
+*  unreadable one, runs `plan`: the mode that can do the least. */
+function claudePermissionMode(events, chosen) {
+	const sandbox = sandboxModeOf(events);
+	if (chosen !== void 0 && (sandbox === void 0 || sandbox === SANDBOX_BY_CLAUDE_MODE[chosen])) return chosen;
+	return sandbox === void 0 || sandbox === null ? "plan" : CLAUDE_MODE_BY_SANDBOX[sandbox];
+}
+/** Which access control a Claude session shows and obeys: the Host's own
+*  three-preset selector with the sandbox mapping alone (`native`), or this
+*  plugin's selector over Claude Code's modes with the default mode and the
+*  creation-time alignment (`plugin`). */
+const CLAUDE_PERMISSION_SELECTORS = ["plugin", "native"];
+const DEFAULT_CLAUDE_PERMISSION_SELECTOR = "plugin";
+function isClaudePermissionSelector(value) {
+	return value === "plugin" || value === "native";
+}
+//#endregion
 //#region src/rewind.ts
 const EMPTY_REWIND_STATE = {
 	ranges: [],
@@ -107,7 +175,7 @@ function emptyProjection() {
 		activities: []
 	};
 }
-function record$14(value) {
+function record$15(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function finiteInteger(value) {
@@ -117,7 +185,7 @@ function string$4(value, max) {
 	return typeof value === "string" && value.length > 0 && value.length <= max;
 }
 function binding(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || !string$4(input.claudeSessionId, 512) || !string$4(input.sdkVersion, 128) || !string$4(input.cwd, 4096) || input.cliVersion !== void 0 && !string$4(input.cliVersion, 128)) return void 0;
 	return {
 		claudeSessionId: input.claudeSessionId,
@@ -148,21 +216,21 @@ const ACTIVITY_PHASES = /* @__PURE__ */ new Set([
 	"failed"
 ]);
 function activity(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || !finiteInteger(input.turn) || !finiteInteger(input.step) || !finiteInteger(input.ordinal) || typeof input.kind !== "string" || !ACTIVITY_KINDS.has(input.kind) || input.phase !== void 0 && (typeof input.phase !== "string" || !ACTIVITY_PHASES.has(input.phase))) return void 0;
 	return normalizeActivity(input);
 }
 function contextUsage(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || !Array.isArray(input.categories)) return void 0;
 	return normalizeContextUsage(input);
 }
 function rewind(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || !Array.isArray(input.ranges) || input.ranges.length > 200 || !Array.isArray(input.anchors) || input.anchors.length > 2e3) return void 0;
 	const ranges = [];
 	for (const item of input.ranges) {
-		const range = record$14(item);
+		const range = record$15(item);
 		if (range === void 0 || !finiteInteger(range.start) || !finiteInteger(range.end) || range.end < range.start) return void 0;
 		ranges.push({
 			start: range.start,
@@ -171,7 +239,7 @@ function rewind(value) {
 	}
 	const anchors = [];
 	for (const item of input.anchors) {
-		const anchor = record$14(item);
+		const anchor = record$15(item);
 		if (anchor === void 0 || !finiteInteger(anchor.turn) || !string$4(anchor.uuid, 128)) return void 0;
 		anchors.push({
 			turn: anchor.turn,
@@ -182,7 +250,7 @@ function rewind(value) {
 	if (input.snapshots !== void 0) {
 		if (!Array.isArray(input.snapshots) || input.snapshots.length > 100) return void 0;
 		for (const item of input.snapshots) {
-			const snapshot = record$14(item);
+			const snapshot = record$15(item);
 			if (snapshot === void 0 || !finiteInteger(snapshot.turn) || !string$4(snapshot.tree, 64)) return void 0;
 			snapshots.push({
 				turn: snapshot.turn,
@@ -190,7 +258,7 @@ function rewind(value) {
 			});
 		}
 	}
-	const pending = record$14(input.pending);
+	const pending = record$15(input.pending);
 	if (input.pending !== void 0 && pending === void 0) return void 0;
 	if (pending === void 0) return {
 		ranges,
@@ -212,12 +280,12 @@ function rewind(value) {
 	};
 }
 function tasks(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || !Array.isArray(input.tasks)) return void 0;
 	return normalizeTasksEvent(input.tasks);
 }
 function parseClaudeSidecar(value) {
-	const input = record$14(value);
+	const input = record$15(value);
 	if (input === void 0 || input.schemaVersion !== SIDECAR_SCHEMA_VERSION || !finiteInteger(input.revision) || !Array.isArray(input.activities) || input.activities.length > MAX_ACTIVITIES) throw new Error("dsh-claude: invalid sidecar document");
 	const activities = input.activities.map(activity);
 	if (activities.some((item) => item === void 0)) throw new Error("dsh-claude: invalid sidecar activity");
@@ -225,6 +293,7 @@ function parseClaudeSidecar(value) {
 	const parsedUsage = input.contextUsage === void 0 ? void 0 : contextUsage(input.contextUsage);
 	const parsedTasks = input.tasks === void 0 ? void 0 : tasks(input.tasks);
 	const parsedRewind = input.rewind === void 0 ? void 0 : rewind(input.rewind);
+	if (input.permissionMode !== void 0 && !isClaudePermissionMode(input.permissionMode)) throw new Error("dsh-claude: invalid sidecar permission mode");
 	if (input.binding !== void 0 && parsedBinding === void 0 || input.contextUsage !== void 0 && parsedUsage === void 0 || input.tasks !== void 0 && parsedTasks === void 0 || input.rewind !== void 0 && parsedRewind === void 0) throw new Error("dsh-claude: invalid sidecar projection");
 	return {
 		schemaVersion: SIDECAR_SCHEMA_VERSION,
@@ -233,7 +302,8 @@ function parseClaudeSidecar(value) {
 		...parsedBinding === void 0 ? {} : { binding: parsedBinding },
 		...parsedUsage === void 0 ? {} : { contextUsage: parsedUsage },
 		...parsedTasks === void 0 ? {} : { tasks: parsedTasks },
-		...parsedRewind === void 0 ? {} : { rewind: parsedRewind }
+		...parsedRewind === void 0 ? {} : { rewind: parsedRewind },
+		...input.permissionMode === void 0 ? {} : { permissionMode: input.permissionMode }
 	};
 }
 function compareActivity(left, right) {
@@ -434,6 +504,14 @@ var ClaudeSidecarRepository = class {
 			value: normalized
 		});
 	}
+	/** Record the mode the selector picked. No delta: the projection carries
+	*  it as metadata, which the carrier refreshes on its own cadence. */
+	writePermissionMode(sessionId, mode) {
+		return this.#update(sessionId, (current) => ({
+			...current,
+			permissionMode: mode
+		}), true);
+	}
 	writeTasks(sessionId, value) {
 		const normalized = normalizeTasksEvent(value);
 		return this.#update(sessionId, (current) => ({
@@ -796,7 +874,9 @@ const SILENT_POLICY = "never";
 const ASKING_POLICY = "ask";
 function permissionReason(toolName, input, options) {
 	if (planText(toolName, input) !== void 0) return PLAN_APPROVAL_PROMPT;
-	const prompt = options.title ?? options.description ?? options.decisionReason ?? `Claude Code wants to use ${toolName}.`;
+	const title = options.title ?? options.description;
+	const reason = options.decisionReason?.trim();
+	const prompt = title === void 0 ? reason ?? `Claude Code wants to use ${toolName}.` : reason === void 0 || reason === title ? title : `${title}\n${reason}`;
 	const detail = safeDetail(input);
 	return boundText(detail === void 0 ? prompt : `${prompt}\nInput: ${detail}`, MAX_REASON_CHARS);
 }
@@ -1041,7 +1121,7 @@ function createUserQuestionBridge(userQuestions, activeContext) {
 }
 //#endregion
 //#region src/sdk-messages.ts
-function record$13(value) {
+function record$14(value) {
 	return value !== null && typeof value === "object" ? value : void 0;
 }
 function string$3(value) {
@@ -1073,12 +1153,12 @@ function hasUsageCounts(usage) {
 	return usage.inputTokens !== void 0 || usage.outputTokens !== void 0 || usage.cacheReadTokens !== void 0 || usage.cacheCreationTokens !== void 0;
 }
 function resultUsage(message) {
-	const normalized = usageOf(record$13(message.usage));
+	const normalized = usageOf(record$14(message.usage));
 	if (typeof message.total_cost_usd === "number") normalized.cumulativeCostUsd = message.total_cost_usd;
 	return normalized;
 }
 function normalizeAssistant(message) {
-	const envelope = record$13(message.message);
+	const envelope = record$14(message.message);
 	const content = envelope?.content;
 	if (!Array.isArray(content)) return [{
 		kind: "protocol-error",
@@ -1088,7 +1168,7 @@ function normalizeAssistant(message) {
 	const parentToolUseId = string$3(message.parent_tool_use_id);
 	const normalized = [];
 	for (const item of content) {
-		const block = record$13(item);
+		const block = record$14(item);
 		if (block === void 0) continue;
 		if (block.type === "text") {
 			const text = string$3(block.text);
@@ -1117,7 +1197,7 @@ function normalizeAssistant(message) {
 			});
 		}
 	}
-	const usage = usageOf(record$13(envelope?.usage));
+	const usage = usageOf(record$14(envelope?.usage));
 	if (hasUsageCounts(usage)) normalized.push({
 		kind: "request-usage",
 		usage,
@@ -1127,7 +1207,7 @@ function normalizeAssistant(message) {
 }
 function normalizeUser(message) {
 	if (message.isReplay === true) return [];
-	const content = record$13(message.message)?.content;
+	const content = record$14(message.message)?.content;
 	if (typeof content === "string") return [];
 	if (!Array.isArray(content)) return [{
 		kind: "protocol-error",
@@ -1137,7 +1217,7 @@ function normalizeUser(message) {
 	const parentToolUseId = string$3(message.parent_tool_use_id);
 	const normalized = [];
 	for (const item of content) {
-		const block = record$13(item);
+		const block = record$14(item);
 		if (block?.type !== "tool_result") continue;
 		const toolUseId = string$3(block.tool_use_id);
 		if (toolUseId === void 0) continue;
@@ -1218,7 +1298,7 @@ function normalizeSystem(message) {
 		const summary = string$3(message.summary);
 		const subagentType = string$3(message.subagent_type);
 		const lastToolName = string$3(message.last_tool_name);
-		const usage = taskUsageOf(record$13(message.usage));
+		const usage = taskUsageOf(record$14(message.usage));
 		return [{
 			kind: "subagent",
 			title: summary ?? description ?? "Claude subagent update",
@@ -1234,7 +1314,7 @@ function normalizeSystem(message) {
 		}];
 	}
 	if (subtype === "task_updated") {
-		const patch = record$13(message.patch);
+		const patch = record$14(message.patch);
 		const status = string$3(patch?.status);
 		const taskId = string$3(message.task_id);
 		const description = string$3(patch?.description);
@@ -1257,7 +1337,7 @@ function normalizeSystem(message) {
 		const taskId = string$3(message.task_id);
 		const summary = string$3(message.summary);
 		const taskStatus = failed ? "failed" : stopped ? "stopped" : "completed";
-		const usage = taskUsageOf(record$13(message.usage));
+		const usage = taskUsageOf(record$14(message.usage));
 		return [{
 			kind: "subagent",
 			title: summary ?? taskId ?? "Claude subagent finished",
@@ -1272,7 +1352,7 @@ function normalizeSystem(message) {
 	if (subtype === "background_tasks_changed") return [{
 		kind: "background-tasks",
 		tasks: (Array.isArray(message.tasks) ? message.tasks : []).flatMap((item) => {
-			const entry = record$13(item);
+			const entry = record$14(item);
 			const taskId = string$3(entry?.task_id);
 			const description = string$3(entry?.description);
 			const taskType = string$3(entry?.task_type);
@@ -1290,7 +1370,7 @@ function normalizeSystem(message) {
 		detail: message
 	}];
 	if (subtype === "compact_boundary") {
-		const metadata = record$13(message.compact_metadata);
+		const metadata = record$14(message.compact_metadata);
 		const trigger = metadata?.trigger === "auto" || metadata?.trigger === "manual" ? metadata.trigger : void 0;
 		const preTokens = finiteNumber(metadata?.pre_tokens);
 		const postTokens = finiteNumber(metadata?.post_tokens);
@@ -1329,10 +1409,10 @@ const RESULT_ERROR_SUBTYPES = /* @__PURE__ */ new Set([
 function normalizeSdkMessage(message) {
 	const value = message;
 	if (value.type === "stream_event") {
-		const event = record$13(value.event);
+		const event = record$14(value.event);
 		const parentToolUseId = string$3(value.parent_tool_use_id);
 		if (event?.type === "content_block_delta") {
-			const delta = record$13(event.delta);
+			const delta = record$14(event.delta);
 			if (delta?.type === "text_delta") {
 				const text = string$3(delta.text);
 				return text === void 0 ? [] : [{
@@ -1367,7 +1447,7 @@ function normalizeSdkMessage(message) {
 		const errors = Array.isArray(value.errors) ? value.errors.filter((item) => typeof item === "string") : void 0;
 		const terminalReason = string$3(value.terminal_reason);
 		const userMessageUuid = string$3(value.user_message_uuid);
-		const permissionDenials = Array.isArray(value.permission_denials) ? value.permission_denials.map((item) => record$13(item)).filter((item) => item !== void 0).map((item) => {
+		const permissionDenials = Array.isArray(value.permission_denials) ? value.permission_denials.map((item) => record$14(item)).filter((item) => item !== void 0).map((item) => {
 			const toolName = string$3(item.tool_name);
 			const toolUseId = string$3(item.tool_use_id);
 			return toolName === void 0 || toolUseId === void 0 ? void 0 : {
@@ -1393,7 +1473,7 @@ function normalizeSdkMessage(message) {
 		detail: value.error ?? value.output
 	}];
 	if (value.type === "rate_limit_event") {
-		const status = string$3(record$13(value.rate_limit_info)?.status);
+		const status = string$3(record$14(value.rate_limit_info)?.status);
 		return [{
 			kind: "status",
 			title: status !== void 0 && status !== "allowed" ? "Claude rate limit is blocking requests" : "Claude rate limit status changed",
@@ -1505,7 +1585,8 @@ function projectModel(row, id) {
 		value: row.value,
 		name: row.displayName,
 		description: row.description,
-		...contextWindow === void 0 ? {} : { contextWindow }
+		...contextWindow === void 0 ? {} : { contextWindow },
+		...row.supportsAutoMode === void 0 ? {} : { supportsAutoMode: row.supportsAutoMode }
 	};
 }
 let latest$1;
@@ -1634,7 +1715,7 @@ const FIXED_WINDOWS = [
 	"seven_day_opus",
 	"seven_day_sonnet"
 ];
-function record$12(value) {
+function record$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 /** Utilization is documented as 0-100; clamp so a server glitch cannot render
@@ -1646,7 +1727,7 @@ function resetsAt(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function window(id, source, label) {
-	const entry = record$12(source);
+	const entry = record$13(source);
 	if (entry === void 0) return void 0;
 	const used = utilization(entry.utilization);
 	const reset = resetsAt(entry.resets_at);
@@ -1660,9 +1741,9 @@ function window(id, source, label) {
 }
 /** Project the SDK's `/usage` response onto the windows the settings card shows. */
 function normalizePlanUsage(value, fetchedAt) {
-	const response = record$12(value);
+	const response = record$13(value);
 	const subscription = typeof response?.subscription_type === "string" ? response.subscription_type : void 0;
-	const limits = record$12(response?.rate_limits);
+	const limits = record$13(response?.rate_limits);
 	if (response?.rate_limits_available !== true || limits === void 0) return {
 		available: false,
 		...subscription === void 0 ? {} : { subscription },
@@ -1670,7 +1751,7 @@ function normalizePlanUsage(value, fetchedAt) {
 		fetchedAt
 	};
 	const windows = [...FIXED_WINDOWS.map((id) => window(id, limits[id])), ...(Array.isArray(limits.model_scoped) ? limits.model_scoped : []).map((entry, index) => {
-		const name = record$12(entry)?.display_name;
+		const name = record$13(entry)?.display_name;
 		return window(`model:${typeof name === "string" ? name : index}`, entry, typeof name === "string" ? name : void 0);
 	})].filter((entry) => entry !== void 0);
 	return {
@@ -1918,11 +1999,6 @@ async function restoreWorktreeTree(runtime, cwd, tree) {
 const CLAUDE_INITIALIZATION_TIMEOUT_MS = 3e4;
 /** Control requests must settle; a wedged one must not clog the metadata chain. */
 const CLAUDE_METADATA_TIMEOUT_MS = 15e3;
-const CLAUDE_MODE_BY_SANDBOX = {
-	"read-only": "plan",
-	"workspace-write": "acceptEdits",
-	"danger-full-access": "bypassPermissions"
-};
 /** Appended to the Claude Code system prompt on every session.
 *
 *  The plan panel opens on exactly one signal: an `ExitPlanMode` call, whose
@@ -1935,16 +2011,6 @@ const CLAUDE_MODE_BY_SANDBOX = {
 *  conflict in favour of the handoff, so the plan reaches the panel the moment
 *  it is done rather than one message later. */
 const PLAN_MODE_HANDOFF_PROMPT = "When you are in plan mode and the plan is written, end the turn by calling ExitPlanMode with the plan. Do not end a plan-mode turn by asking the user for confirmation in prose: the user reads and approves the plan through ExitPlanMode, and a turn that stops short of that call shows them nothing.";
-/** Fold DSH's native access selector into Claude Code's closest permission mode. */
-function claudePermissionMode(events) {
-	for (let index = events.length - 1; index >= 0; index -= 1) {
-		const event = events[index];
-		if (event?.type !== "sandbox/mode") continue;
-		const mode = event.data.mode;
-		return typeof mode === "string" && mode in CLAUDE_MODE_BY_SANDBOX ? CLAUDE_MODE_BY_SANDBOX[mode] : "plan";
-	}
-	return "plan";
-}
 var ClaudeTurnBusyError = class extends Error {
 	constructor(sessionId) {
 		super(`Claude Code session ${sessionId} already has an active or interrupting turn`);
@@ -2054,6 +2120,8 @@ var ClaudeSupervisor = class {
 	#queryFactory;
 	#runDetached;
 	#sidecar;
+	#defaultPermissionMode;
+	#permissionSelector;
 	#dynamicPresenterNames = /* @__PURE__ */ new WeakMap();
 	#contextWindows = /* @__PURE__ */ new Map();
 	#disposed = false;
@@ -2075,6 +2143,8 @@ var ClaudeSupervisor = class {
 		this.#queryFactory = dependencies.queryFactory ?? ((params) => query(params));
 		this.#runDetached = dependencies.runDetached ?? ((operation) => operation());
 		this.#sidecar = dependencies.sidecar ?? new ClaudeSidecarRepository();
+		this.#defaultPermissionMode = dependencies.defaultPermissionMode ?? (async () => void 0);
+		this.#permissionSelector = dependencies.permissionSelector ?? (async () => "plugin");
 	}
 	snapshots() {
 		return [...this.#entries.values()].map((entry) => ({
@@ -2454,8 +2524,16 @@ var ClaudeSupervisor = class {
 			throw error;
 		}
 	}
+	/** The mode a turn runs under: the session's choice, else the configured
+	*  default, folded against the DSH sandbox; and `auto` only on a model the
+	*  catalog does not rule out, since the CLI refuses it elsewhere. */
+	async #permissionModeFor(events, chosen, model) {
+		const mode = claudePermissionMode(events, await this.#permissionSelector() === "native" ? void 0 : chosen ?? await this.#defaultPermissionMode());
+		return mode === "auto" && claudeModelRow(model)?.supportsAutoMode === false ? "default" : mode;
+	}
 	async #syncPermissionMode(entry) {
-		const mode = claudePermissionMode(entry.ownerAgent.session.snapshotEvents());
+		const projection = await this.#sidecar.read(entry.sessionId);
+		const mode = await this.#permissionModeFor(entry.ownerAgent.session.snapshotEvents(), projection.permissionMode, entry.model);
 		if (mode === entry.permissionMode) return;
 		await this.#control(entry, entry.query.setPermissionMode(mode), "Claude Code permission mode switch");
 		entry.permissionMode = mode;
@@ -2555,7 +2633,7 @@ var ClaudeSupervisor = class {
 		const pendingRewind = projection.rewind?.pending;
 		const forkAt = pendingRewind !== void 0 && "resumeAt" in pendingRewind ? pendingRewind.resumeAt : void 0;
 		const startFresh = pendingRewind !== void 0 && "fresh" in pendingRewind;
-		const permissionMode = claudePermissionMode(agent.session.snapshotEvents());
+		const permissionMode = await this.#permissionModeFor(agent.session.snapshotEvents(), projection.permissionMode, model);
 		const entry = {
 			sessionId,
 			ownerAgent: agent,
@@ -2657,7 +2735,7 @@ var ClaudeSupervisor = class {
 		if (message.kind === "init") {
 			const firstInitialization = !entry.initialized;
 			if (entry.expectedResume !== void 0 && message.sessionId !== entry.expectedResume) throw new ClaudeProtocolError(`Claude Code resumed unexpected session ${message.sessionId}; expected ${entry.expectedResume}`);
-			if (message.cwd !== entry.cwd) throw new ClaudeProtocolError(`Claude Code initialized in unexpected cwd ${message.cwd}; expected ${entry.cwd}`);
+			if (entry.expectedResume === void 0 && message.cwd !== entry.cwd) throw new ClaudeProtocolError(`Claude Code initialized in unexpected cwd ${message.cwd}; expected ${entry.cwd}`);
 			entry.initialized = true;
 			entry.claudeSessionId = message.sessionId;
 			entry.state = entry.active === void 0 ? "idle" : "running";
@@ -4214,7 +4292,7 @@ function registerClaudeDoctorRoutes(ctx, runtime, supervisor, config, resolution
 }
 //#endregion
 //#region src/projection-routes.ts
-const MAX_SESSION_ID_CHARS$6 = 1024;
+const MAX_SESSION_ID_CHARS$7 = 1024;
 /** Slow-moving metadata refresh and stream heartbeat cadence; deliberately off
 *  the transcript hot path so git/gh latency never delays visible text. */
 const META_REFRESH_MS = 5e3;
@@ -4222,7 +4300,7 @@ const META_REFRESH_MS = 5e3;
 *  so this cannot collide with one. */
 const MULTI_SEGMENT = "multi";
 function validSessionId(value) {
-	return value.length > 0 && value.length <= MAX_SESSION_ID_CHARS$6;
+	return value.length > 0 && value.length <= MAX_SESSION_ID_CHARS$7;
 }
 function targetFromUrl(url) {
 	const prefix = `${CLAUDE_PROJECTION_PATH}/`;
@@ -4262,6 +4340,8 @@ function envelope(projection, meta) {
 		...meta.repository === void 0 ? {} : { repository: meta.repository },
 		...meta.repositories === void 0 ? {} : { repositories: meta.repositories },
 		reviewComments: meta.reviewComments,
+		...meta.permissionMode === void 0 ? {} : { permissionMode: meta.permissionMode },
+		...meta.permissionSelector === void 0 ? {} : { permissionSelector: meta.permissionSelector },
 		...projection.rewind === void 0 ? {} : { rewind: { ranges: projection.rewind.ranges } }
 	};
 }
@@ -4276,7 +4356,7 @@ function envelope(projection, meta) {
 *  session spent it in proportion to how many Claude sessions existed — which
 *  is what left the settings panel unable to get a connection at all. One
 *  carrier is one connection, whatever the session count. */
-function registerClaudeProjectionRoute(ctx, sidecar, ownsSession, commandsForSession = () => [], repositoryForSession = async () => void 0, reviewCommentsForSession = () => [], extraRepositoriesForSession = async () => []) {
+function registerClaudeProjectionRoute(ctx, sidecar, ownsSession, commandsForSession = () => [], repositoryForSession = async () => void 0, reviewCommentsForSession = () => [], extraRepositoriesForSession = async () => [], permissionModeForSession = async () => void 0, permissionSelector = () => "plugin") {
 	const info = (message) => {
 		ctx.logger?.info?.(message);
 	};
@@ -4286,17 +4366,23 @@ function registerClaudeProjectionRoute(ctx, sidecar, ownsSession, commandsForSes
 		return {
 			owned,
 			commands: commandsForSession(sessionId),
-			reviewComments: owned ? reviewCommentsForSession(sessionId) : []
+			reviewComments: owned ? reviewCommentsForSession(sessionId) : [],
+			...owned ? { permissionSelector: permissionSelector() } : {}
 		};
 	};
 	const assembleMeta = async (sessionId, activities) => {
 		const meta = localMeta(sessionId);
 		if (!meta.owned) return meta;
-		const [repository, repositories] = await Promise.all([repositoryForSession(sessionId), extraRepositoriesForSession(sessionId, activities ?? (await sidecar.read(sessionId)).activities)]);
+		const [repository, repositories, permissionMode] = await Promise.all([
+			repositoryForSession(sessionId),
+			extraRepositoriesForSession(sessionId, activities ?? (await sidecar.read(sessionId)).activities),
+			permissionModeForSession(sessionId)
+		]);
 		return {
 			...meta,
 			...repository === void 0 ? {} : { repository },
-			...repositories.length === 0 ? {} : { repositories }
+			...repositories.length === 0 ? {} : { repositories },
+			...permissionMode === void 0 ? {} : { permissionMode }
 		};
 	};
 	const streamMulti = async (res, io, sessionIds) => {
@@ -4328,6 +4414,8 @@ function registerClaudeProjectionRoute(ctx, sidecar, ownsSession, commandsForSes
 				owned: meta.owned,
 				commands: meta.commands,
 				...meta.repository === void 0 ? {} : { repository: meta.repository },
+				...meta.permissionMode === void 0 ? {} : { permissionMode: meta.permissionMode },
+				...meta.permissionSelector === void 0 ? {} : { permissionSelector: meta.permissionSelector },
 				...meta.repositories === void 0 ? {} : { repositories: meta.repositories },
 				reviewComments: meta.reviewComments
 			});
@@ -4715,14 +4803,14 @@ function parseGitHubRemote(value) {
 	if (match?.[1] === void 0 || match[2] === void 0) return void 0;
 	return `${match[1]}/${match[2]}`;
 }
-function record$11(value) {
+function record$12(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function aggregateChecks(value) {
 	if (!Array.isArray(value) || value.length === 0) return "none";
 	let pending = false;
 	for (const item of value) {
-		const check = record$11(item);
+		const check = record$12(item);
 		if (check === void 0) continue;
 		const conclusion = typeof check.conclusion === "string" ? check.conclusion.toUpperCase() : void 0;
 		const status = typeof check.status === "string" ? check.status.toUpperCase() : void 0;
@@ -4746,7 +4834,7 @@ function reviewState(value) {
 	return "none";
 }
 function parsePullRequest(value) {
-	const input = record$11(value);
+	const input = record$12(value);
 	if (input === void 0 || !Number.isSafeInteger(input.number) || Number(input.number) <= 0 || typeof input.title !== "string" || typeof input.url !== "string") return void 0;
 	let url;
 	try {
@@ -4768,7 +4856,7 @@ function parsePullRequest(value) {
 		checks: aggregateChecks(input.statusCheckRollup),
 		...typeof input.mergeStateStatus === "string" ? { mergeState: bounded(input.mergeStateStatus) } : {},
 		...typeof input.headRefName === "string" && input.headRefName.length > 0 ? { headBranch: bounded(input.headRefName) } : {},
-		...typeof record$11(input.author)?.login === "string" ? { author: bounded(String(record$11(input.author)?.login)) } : {},
+		...typeof record$12(input.author)?.login === "string" ? { author: bounded(String(record$12(input.author)?.login)) } : {},
 		...typeof input.createdAt === "string" && Number.isFinite(Date.parse(input.createdAt)) ? { createdAt: new Date(input.createdAt).toISOString() } : {},
 		...typeof input.mergedAt === "string" && Number.isFinite(Date.parse(input.mergedAt)) ? { mergedAt: new Date(input.mergedAt).toISOString() } : {},
 		...typeof input.baseRefName === "string" && bounded(input.baseRefName).length > 0 ? { baseBranch: bounded(input.baseRefName) } : {}
@@ -4838,7 +4926,7 @@ var RepositoryStatusService = class {
 				status: "unavailable",
 				cwd
 			};
-			const counts = record$11(raw);
+			const counts = record$12(raw);
 			const count = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
 			const patch = await run(this.#runtime, gh, [
 				"pr",
@@ -5900,6 +5988,9 @@ const MAX_UNPUSHED_COMMITS = 20;
 *  head of it otherwise, and the prompt says which. */
 const MAX_GENERATE_PATCH_CHARS = 49152;
 const MAX_SUBJECT_CHARS = 72;
+/** A body is for the reader skimming `git log`, not a change list: past this
+*  many bullets it stops being read, so the rest are dropped. */
+const MAX_BODY_BULLETS = 4;
 /** Past this the first line is not a subject at all; under it, a subject a
 *  few characters over what the prompt asked for is the user's to trim. */
 const MAX_SUBJECT_KEPT_CHARS = 120;
@@ -6021,10 +6112,12 @@ function normalizeCommitMessage(value, fallback) {
 	const kept = [subject];
 	if (body.length > 0) kept.push("");
 	let previousBlank = false;
+	let bullets = 0;
 	for (const line of body) {
 		const blank = line.trim() === "";
 		if (blank && previousBlank) continue;
 		previousBlank = blank;
+		if (/^\s*[-*]\s/u.test(line) && ++bullets > MAX_BODY_BULLETS) continue;
 		if ([...kept, line].join("\n").length > MAX_MESSAGE_CHARS) break;
 		kept.push(line);
 	}
@@ -6122,10 +6215,10 @@ var RepositoryActionService = class {
 		const subjects = recent.exitCode === 0 && !recent.lossy ? recent.stdout.split(/\r?\n/u).map((line) => line.trim()).filter((line) => line.length > 0) : [];
 		const patch = boundedPatch(preview.patch);
 		const prompt = [
-			"Write a git commit message for the changes below, in English.",
-			`Line 1 is the subject: imperative mood, at most ${MAX_SUBJECT_CHARS} characters, saying what the change does rather than which files it touches.`,
-			"If the diff contains more than one independent change, leave line 2 blank and then list each change on its own line starting with \"- \", one sentence each, describing what changed as the diff shows it.",
-			"A change with a single purpose gets the subject line only.",
+			"Write a git commit message for the changes below, in English, for someone skimming git log.",
+			`Line 1 is the subject: imperative mood, at most ${MAX_SUBJECT_CHARS} characters, saying what the change does for the user or the code's behaviour, not which files it touches.`,
+			"Most changes get the subject line only. Add a body only when the diff carries more than one change a reader would want to know about separately: leave line 2 blank, then one line per such change starting with \"- \", a short sentence about what now behaves differently.",
+			`Never more than ${MAX_BODY_BULLETS} bullets. Do not list tests, documentation, README, translations, type or wiring plumbing, or the propagation of one change through several layers: those are part of the change they serve, not changes of their own. Do not name files or identifiers unless nothing else identifies the change.`,
 			"Describe only what the diff shows. Do not invent motivation, do not summarise the file list, and do not mention that the diff is truncated.",
 			"Return only the message: no quotes, no markdown fences, no explanation before or after it.",
 			...subjects.length > 0 ? [`Recent commit subjects of this repository, as a style reference only:\n${subjects.map((subject) => `- ${subject}`).join("\n")}`] : [],
@@ -6191,7 +6284,7 @@ var RepositoryActionService = class {
 			"Changes:",
 			"- <one line per independent change, describing what changed in the code>",
 			"",
-			"List every independent change the diff contains as its own bullet. Do not merge unrelated changes into one bullet, and do not describe anything the diff does not show.",
+			`One bullet per change a reviewer would want to know about separately, at most 6; a change with a single purpose gets one bullet. Tests, documentation, translations, and the plumbing that carries a change through several layers belong to the change they serve, not to bullets of their own. Do not describe anything the diff does not show.`,
 			"No markdown headings, no quotes, no fences, no text before \"Title:\" or after the last bullet.",
 			...commits.length > 0 ? [`Commits on this branch, newest first:\n${commits.map((commit) => commit.body.length > 0 ? `- ${commit.subject}\n${commit.body}` : `- ${commit.subject}`).join("\n")}`] : [],
 			...preview.files.length > 0 ? [`Uncommitted files that will go into the same pull request: ${preview.files.map((file) => file.path).join(", ")}`] : [],
@@ -6638,19 +6731,19 @@ var RepositoryActionService = class {
 };
 //#endregion
 //#region src/repository-setup-routes.ts
-const MAX_BODY_BYTES$7 = 16384;
-function record$10(value) {
+const MAX_BODY_BYTES$8 = 16384;
+function record$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$6(io) {
+async function readJson$7(io) {
 	let parsed;
 	try {
-		parsed = await io.body(MAX_BODY_BYTES$7);
+		parsed = await io.body(MAX_BODY_BYTES$8);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new RepositorySetupError("body-too-large", "The request body is too large.");
 	}
-	const value = record$10(parsed);
+	const value = record$11(parsed);
 	if (value === void 0) throw new RepositorySetupError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -6719,7 +6812,7 @@ function registerRepositorySetupRoute(ctx, service, sweep, cleaned) {
 			try {
 				if (pathname === `/plugins/dsh-claude/repository/setup/branches/refresh`) {
 					if (io.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$6(io);
+					const input = await readJson$7(io);
 					return json(res, 200, await service.refreshBranches(string$2(input, "cwd")));
 				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/branches`) {
@@ -6730,14 +6823,14 @@ function registerRepositorySetupRoute(ctx, service, sweep, cleaned) {
 				}
 				if (pathname === "/plugins/dsh-claude/repository/setup") {
 					if (io.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$6(io);
+					const input = await readJson$7(io);
 					if (typeof input.worktree !== "boolean") throw new RepositorySetupError("invalid-request", "The worktree field is required.");
 					await streamSetup(res, service, input);
 					return;
 				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/cleanup`) {
 					if (io.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$6(io);
+					const input = await readJson$7(io);
 					const path = string$2(input, "path");
 					const branch = typeof input.branch === "string" && input.branch.length > 0 ? input.branch : void 0;
 					const baseBranch = typeof input.baseBranch === "string" && input.baseBranch.length > 0 ? input.baseBranch : void 0;
@@ -6752,7 +6845,7 @@ function registerRepositorySetupRoute(ctx, service, sweep, cleaned) {
 				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/bind`) {
 					if (io.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$6(io);
+					const input = await readJson$7(io);
 					await service.bindLease(string$2(input, "leaseId"), string$2(input, "sessionId"));
 					return json(res, 200, { ok: true });
 				}
@@ -6770,8 +6863,8 @@ function registerRepositorySetupRoute(ctx, service, sweep, cleaned) {
 }
 //#endregion
 //#region src/repository-action-routes.ts
-const MAX_BODY_BYTES$6 = 16384;
-const MAX_SESSION_ID_CHARS$5 = 1024;
+const MAX_BODY_BYTES$7 = 16384;
+const MAX_SESSION_ID_CHARS$6 = 1024;
 const MAX_ROOT_CHARS = 4096;
 const ACTIONS = /* @__PURE__ */ new Set([
 	"commit",
@@ -6791,24 +6884,24 @@ const MESSAGELESS = /* @__PURE__ */ new Set([
 	"resolve-continue",
 	"resolve-abort"
 ]);
-function record$9(value) {
+function record$10(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$5(io) {
+async function readJson$6(io) {
 	let parsed;
 	try {
-		parsed = await io.body(MAX_BODY_BYTES$6);
+		parsed = await io.body(MAX_BODY_BYTES$7);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new RepositoryActionError("body-too-large", "The request body is too large.");
 	}
-	const value = record$9(parsed);
+	const value = record$10(parsed);
 	if (value === void 0) throw new RepositoryActionError("invalid-request", "The request body is invalid.");
 	return value;
 }
 function sessionId$1(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$5) throw new RepositoryActionError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$6) throw new RepositoryActionError("invalid-session", "The session is invalid.");
 	return value;
 }
 function requestedRoot(url) {
@@ -6885,7 +6978,7 @@ function registerRepositoryActionRoute(ctx, service, cwdForSession) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$5(io);
+					const input = await readJson$6(io);
 					return {
 						status: 200,
 						value: { message: await service.generateMessage(cwd, string$1(input, "fingerprint")) }
@@ -6896,7 +6989,7 @@ function registerRepositoryActionRoute(ctx, service, cwdForSession) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$5(io);
+					const input = await readJson$6(io);
 					return {
 						status: 200,
 						value: await service.generatePullRequest(cwd, string$1(input, "fingerprint"), optionalString(input, "baseBranch"))
@@ -6909,7 +7002,7 @@ function registerRepositoryActionRoute(ctx, service, cwdForSession) {
 					};
 					return {
 						status: 200,
-						value: await service.execute(cwd, actionRequest(await readJson$5(io)))
+						value: await service.execute(cwd, actionRequest(await readJson$6(io)))
 					};
 				}
 				return {
@@ -7363,7 +7456,7 @@ async function collect(handle) {
 		lossy: stdout?.lossy === true
 	};
 }
-function record$8(value) {
+function record$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Read `repository.pullRequest.reviewThreads.nodes` out of a GraphQL response.
@@ -7371,12 +7464,12 @@ function record$8(value) {
 *  throwing: the caller distinguishes "no threads" from "call failed" by the
 *  process exit code. */
 function parseReviewThreads(value) {
-	const nodes = record$8(record$8(record$8(record$8(record$8(value)?.data)?.repository)?.pullRequest)?.reviewThreads)?.nodes;
+	const nodes = record$9(record$9(record$9(record$9(record$9(value)?.data)?.repository)?.pullRequest)?.reviewThreads)?.nodes;
 	if (!Array.isArray(nodes)) return [];
 	const threads = [];
 	let total = 0;
 	for (const item of nodes) {
-		const input = record$8(item);
+		const input = record$9(item);
 		if (input === void 0 || typeof input.id !== "string" || input.id.length === 0) continue;
 		const path = typeof input.path === "string" ? input.path : "";
 		if (path.length === 0) continue;
@@ -7388,14 +7481,14 @@ function parseReviewThreads(value) {
 			side
 		};
 		const comments = [];
-		const commentNodes = record$8(input.comments)?.nodes;
+		const commentNodes = record$9(input.comments)?.nodes;
 		for (const node of Array.isArray(commentNodes) ? commentNodes : []) {
 			if (total >= MAX_COMMENTS) break;
-			const comment = record$8(node);
+			const comment = record$9(node);
 			if (comment === void 0 || !Number.isSafeInteger(comment.databaseId)) continue;
 			const body = typeof comment.body === "string" ? comment.body.trim() : "";
 			if (body.length === 0) continue;
-			const author = record$8(comment.author);
+			const author = record$9(comment.author);
 			const avatarUrl = githubAvatarUrl(author?.avatarUrl);
 			const login = typeof author?.login === "string" ? author.login : "unknown";
 			comments.push({
@@ -7424,11 +7517,11 @@ function parseReviewThreads(value) {
 }
 /** One posted reply, shaped like the thread comments it joins. */
 function parseReplyComment(value, anchor) {
-	const input = record$8(value);
+	const input = record$9(value);
 	if (input === void 0 || !Number.isSafeInteger(input.id)) return void 0;
 	const body = typeof input.body === "string" ? input.body.trim() : "";
 	if (body.length === 0) return void 0;
-	const user = record$8(input.user);
+	const user = record$9(input.user);
 	const avatarUrl = githubAvatarUrl(user?.avatar_url);
 	const login = typeof user?.login === "string" ? user.login : "unknown";
 	return {
@@ -7443,11 +7536,11 @@ function parseReplyComment(value, anchor) {
 	};
 }
 function parseMentionableUsers(value) {
-	const nodes = record$8(record$8(record$8(record$8(value)?.data)?.repository)?.mentionableUsers)?.nodes;
+	const nodes = record$9(record$9(record$9(record$9(value)?.data)?.repository)?.mentionableUsers)?.nodes;
 	if (!Array.isArray(nodes)) return [];
 	const users = [];
 	for (const item of nodes) {
-		const input = record$8(item);
+		const input = record$9(item);
 		if (input === void 0 || typeof input.login !== "string" || input.login.length === 0) continue;
 		const avatarUrl = githubAvatarUrl(input.avatarUrl);
 		users.push({
@@ -7467,7 +7560,7 @@ function parseFailingChecks(value) {
 	if (!Array.isArray(value)) return [];
 	const failing = [];
 	for (const item of value) {
-		const input = record$8(item);
+		const input = record$9(item);
 		if (input === void 0 || input.bucket !== "fail" || typeof input.name !== "string") continue;
 		failing.push({
 			name: input.name,
@@ -7530,12 +7623,12 @@ var PullRequestFeedbackService = class {
 		let posted;
 		try {
 			const parsed = JSON.parse(result.stdout);
-			const path = typeof record$8(parsed)?.path === "string" ? String(record$8(parsed)?.path) : "";
-			const line = Number.isSafeInteger(record$8(parsed)?.line) ? Number(record$8(parsed)?.line) : void 0;
+			const path = typeof record$9(parsed)?.path === "string" ? String(record$9(parsed)?.path) : "";
+			const line = Number.isSafeInteger(record$9(parsed)?.line) ? Number(record$9(parsed)?.line) : void 0;
 			posted = parseReplyComment(parsed, {
 				path,
 				...line === void 0 ? {} : { line },
-				side: record$8(parsed)?.side === "LEFT" ? "old" : "new"
+				side: record$9(parsed)?.side === "LEFT" ? "old" : "new"
 			});
 		} catch {
 			posted = void 0;
@@ -7556,7 +7649,7 @@ var PullRequestFeedbackService = class {
 		], cwd, GH_TIMEOUT_MS);
 		if (result.exitCode !== 0) throw new PullRequestFeedbackError("resolve-failed", "The thread could not be updated.");
 		try {
-			const thread = record$8(record$8(record$8(record$8(JSON.parse(result.stdout))?.data)?.[resolved ? "resolveReviewThread" : "unresolveReviewThread"])?.thread);
+			const thread = record$9(record$9(record$9(record$9(JSON.parse(result.stdout))?.data)?.[resolved ? "resolveReviewThread" : "unresolveReviewThread"])?.thread);
 			if (typeof thread?.isResolved !== "boolean") throw new Error("missing state");
 			return thread.isResolved;
 		} catch {
@@ -7679,23 +7772,23 @@ var PullRequestFeedbackService = class {
 };
 //#endregion
 //#region src/pr-feedback-routes.ts
-const MAX_SESSION_ID_CHARS$4 = 1024;
-const MAX_BODY_BYTES$5 = 16384;
+const MAX_SESSION_ID_CHARS$5 = 1024;
+const MAX_BODY_BYTES$6 = 16384;
 const MAX_REPLY_CHARS = 2e3;
 const MAX_THREAD_ID_CHARS = 512;
 const MAX_MENTION_QUERY_CHARS = 64;
-function record$7(value) {
+function record$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$4(io) {
+async function readJson$5(io) {
 	let parsed;
 	try {
-		parsed = await io.body(MAX_BODY_BYTES$5);
+		parsed = await io.body(MAX_BODY_BYTES$6);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new PullRequestFeedbackError("body-too-large", "The request body is too large.");
 	}
-	const value = record$7(parsed);
+	const value = record$8(parsed);
 	if (value === void 0) throw new PullRequestFeedbackError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -7716,7 +7809,7 @@ function threadId(input) {
 }
 function sessionId(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$4) throw new PullRequestFeedbackError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$5) throw new PullRequestFeedbackError("invalid-session", "The session is invalid.");
 	return value;
 }
 function pullNumber(url) {
@@ -7775,7 +7868,7 @@ function registerPullRequestFeedbackRoute(ctx, service, cwdForSession) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$4(io);
+					const input = await readJson$5(io);
 					return {
 						status: 200,
 						value: { comment: await service.reply(cwd, pullNumber(url), commentId(input), replyBody(input)) }
@@ -7786,7 +7879,7 @@ function registerPullRequestFeedbackRoute(ctx, service, cwdForSession) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$4(io);
+					const input = await readJson$5(io);
 					if (typeof input.resolved !== "boolean") throw new PullRequestFeedbackError("invalid-request", "The resolved field is required.");
 					return {
 						status: 200,
@@ -7932,7 +8025,7 @@ var JiraError = class extends Error {
 		this.code = code;
 	}
 };
-function record$6(value) {
+function record$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Jira Cloud sites are origins; Data Center may carry a context path. */
@@ -7956,14 +8049,14 @@ function ticketKeyOf(query) {
 *  search and does match keys; its hits become the key filter the normal
 *  search then reads the display fields from. */
 function pickerKeys(value, number) {
-	const sections = record$6(value)?.sections;
+	const sections = record$7(value)?.sections;
 	if (!Array.isArray(sections)) return [];
 	const keys = [];
 	for (const section of sections) {
-		const issues = record$6(section)?.issues;
+		const issues = record$7(section)?.issues;
 		if (!Array.isArray(issues)) continue;
 		for (const issue of issues) {
-			const raw = record$6(issue)?.key;
+			const raw = record$7(issue)?.key;
 			const key = ticketKeyOf(typeof raw === "string" ? raw : "");
 			if (key !== void 0 && key.endsWith(`-${number}`) && !keys.includes(key)) keys.push(key);
 		}
@@ -7982,15 +8075,15 @@ function buildJql(query) {
 	return `text ~ "${trimmed.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}*" ORDER BY updated DESC`;
 }
 function parseTickets(value, siteUrl) {
-	const issues = record$6(value)?.issues;
+	const issues = record$7(value)?.issues;
 	if (!Array.isArray(issues)) return [];
 	const tickets = [];
 	for (const item of issues) {
-		const issue = record$6(item);
-		const fields = record$6(issue?.fields);
+		const issue = record$7(item);
+		const fields = record$7(issue?.fields);
 		if (issue === void 0 || typeof issue.key !== "string" || fields === void 0) continue;
-		const status = record$6(fields.status)?.name;
-		const type = record$6(fields.issuetype)?.name;
+		const status = record$7(fields.status)?.name;
+		const type = record$7(fields.issuetype)?.name;
 		tickets.push({
 			key: issue.key,
 			summary: typeof fields.summary === "string" ? fields.summary.slice(0, 256) : "",
@@ -8032,7 +8125,7 @@ var JiraService = class {
 			email,
 			apiToken
 		};
-		const myself = record$6(await this.#json(connection, "/rest/api/3/myself"));
+		const myself = record$7(await this.#json(connection, "/rest/api/3/myself"));
 		const displayName = typeof myself?.displayName === "string" ? myself.displayName : void 0;
 		const accountId = typeof myself?.accountId === "string" ? myself.accountId : void 0;
 		const store = {
@@ -8051,7 +8144,7 @@ var JiraService = class {
 		if (ticket === void 0) throw new JiraError("invalid-request", "The ticket key is invalid.");
 		let accountId = store.accountId;
 		if (accountId === void 0) {
-			const myself = record$6(await this.#json(store, "/rest/api/3/myself"));
+			const myself = record$7(await this.#json(store, "/rest/api/3/myself"));
 			if (typeof myself?.accountId !== "string") throw new JiraError("jira-failed", "The Jira account id is unavailable.");
 			accountId = myself.accountId;
 			await this.#write({
@@ -8127,7 +8220,7 @@ var JiraService = class {
 			throw error;
 		}
 		if (Buffer.byteLength(text) > MAX_STORE_BYTES) return void 0;
-		const input = record$6(JSON.parse(text));
+		const input = record$7(JSON.parse(text));
 		if (input === void 0 || typeof input.siteUrl !== "string" || typeof input.email !== "string" || typeof input.apiToken !== "string") return void 0;
 		return {
 			siteUrl: input.siteUrl,
@@ -8158,21 +8251,21 @@ var JiraService = class {
 };
 //#endregion
 //#region src/jira-routes.ts
-const MAX_BODY_BYTES$4 = 8192;
-function record$5(value) {
+const MAX_BODY_BYTES$5 = 8192;
+function record$6(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** The wrapper enforces the byte cap; its plain rejection is translated back
 *  into the JiraError shape the panel already knows how to render. */
-async function readJson$3(io) {
+async function readJson$4(io) {
 	let body;
 	try {
-		body = await io.body(MAX_BODY_BYTES$4);
+		body = await io.body(MAX_BODY_BYTES$5);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new JiraError("body-too-large", "The request body is too large.");
 	}
-	const value = record$5(body);
+	const value = record$6(body);
 	if (value === void 0) throw new JiraError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -8206,7 +8299,7 @@ function registerJiraRoute(ctx, service) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$3(io);
+					const input = await readJson$4(io);
 					return {
 						status: 200,
 						value: await service.connect({
@@ -8232,7 +8325,7 @@ function registerJiraRoute(ctx, service) {
 						status: 405,
 						value: { error: "method not allowed" }
 					};
-					const input = await readJson$3(io);
+					const input = await readJson$4(io);
 					await service.assignToMe(string(input, "key"));
 					return {
 						status: 200,
@@ -8351,12 +8444,12 @@ function askArguments(preferences) {
 		...READ_ONLY_TOOLS
 	];
 }
-function record$4(value) {
+function record$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** One-line description of a tool call, mirroring the main window's step titles. */
 function toolSummary(input) {
-	const fields = record$4(input);
+	const fields = record$5(input);
 	if (fields === void 0) return void 0;
 	const candidate = [
 		fields.command,
@@ -8370,7 +8463,7 @@ function toolSummary(input) {
 function eventsOfStreamLine(line) {
 	let parsed;
 	try {
-		parsed = record$4(JSON.parse(line));
+		parsed = record$5(JSON.parse(line));
 	} catch {
 		return [];
 	}
@@ -8380,9 +8473,9 @@ function eventsOfStreamLine(line) {
 		text: "ready"
 	}];
 	if (parsed.type === "stream_event") {
-		const event = record$4(parsed.event);
+		const event = record$5(parsed.event);
 		if (event?.type === "content_block_start") {
-			const block = record$4(event.content_block);
+			const block = record$5(event.content_block);
 			if (block?.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") return [{
 				type: "tool",
 				id: block.id,
@@ -8391,7 +8484,7 @@ function eventsOfStreamLine(line) {
 			}];
 			return [];
 		}
-		const delta = record$4(event?.delta);
+		const delta = record$5(event?.delta);
 		if (event?.type !== "content_block_delta" || delta === void 0) return [];
 		if (delta.type === "text_delta" && typeof delta.text === "string") return [{
 			type: "text",
@@ -8404,11 +8497,11 @@ function eventsOfStreamLine(line) {
 		return [];
 	}
 	if (parsed.type === "assistant" || parsed.type === "user") {
-		const content = record$4(parsed.message)?.content;
+		const content = record$5(parsed.message)?.content;
 		if (!Array.isArray(content)) return [];
 		const events = [];
 		for (const item of content) {
-			const block = record$4(item);
+			const block = record$5(item);
 			if (block?.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") {
 				const summary = toolSummary(block.input);
 				events.push({
@@ -8500,11 +8593,11 @@ var AskService = class {
 };
 //#endregion
 //#region src/ask-routes.ts
-const MAX_BODY_BYTES$3 = 131072;
-const MAX_SESSION_ID_CHARS$3 = 1024;
+const MAX_BODY_BYTES$4 = 131072;
+const MAX_SESSION_ID_CHARS$4 = 1024;
 /** Two sessions may await an answer at once; a third evicts the oldest. */
 const MAX_CONCURRENT_ASKS = 2;
-function record$3(value) {
+function record$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function askRequest(input) {
@@ -8536,12 +8629,12 @@ function registerAskRoute(ctx, service, cwdForSession, preferencesFor) {
 			let sessionId;
 			try {
 				const value = io.url.searchParams.get("sessionId");
-				if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$3) throw new AskError("invalid-session", "The session is invalid.");
+				if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$4) throw new AskError("invalid-session", "The session is invalid.");
 				sessionId = value;
 				const resolved = cwdForSession(sessionId);
 				if (resolved === void 0) throw new AskError("session-unavailable", "The Claude session is unavailable.");
 				cwd = resolved;
-				const body = record$3(await io.body(MAX_BODY_BYTES$3));
+				const body = record$4(await io.body(MAX_BODY_BYTES$4));
 				if (body === void 0) throw new AskError("invalid-request", "The request body is invalid.");
 				request = askRequest(body);
 			} catch (error) {
@@ -8581,26 +8674,26 @@ function registerAskRoute(ctx, service, cwdForSession, preferencesFor) {
 }
 //#endregion
 //#region src/review-comment-routes.ts
-const MAX_BODY_BYTES$2 = 16384;
-const MAX_SESSION_ID_CHARS$2 = 1024;
-function record$2(value) {
+const MAX_BODY_BYTES$3 = 16384;
+const MAX_SESSION_ID_CHARS$3 = 1024;
+function record$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$2(io) {
+async function readJson$3(io) {
 	let parsed;
 	try {
-		parsed = await io.body(MAX_BODY_BYTES$2);
+		parsed = await io.body(MAX_BODY_BYTES$3);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new ReviewCommentError("body-too-large", "The request body is too large.");
 	}
-	const value = record$2(parsed);
+	const value = record$3(parsed);
 	if (value === void 0) throw new ReviewCommentError("invalid-request", "The request body is invalid.");
 	return value;
 }
 function sessionIdFromUrl(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$2) throw new ReviewCommentError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$3) throw new ReviewCommentError("invalid-session", "The session is invalid.");
 	return value;
 }
 function registerReviewCommentRoute(ctx, store, ownsSession) {
@@ -8616,7 +8709,7 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 				if (!ownsSession(sessionId)) throw new ReviewCommentError("session-unavailable", "The Claude session is unavailable.");
 				const pathname = io.url.pathname;
 				if (pathname === "/plugins/dsh-claude/review-comments") {
-					const input = await readJson$2(io);
+					const input = await readJson$3(io);
 					return {
 						status: 200,
 						value: { comment: store.add(sessionId, {
@@ -8633,7 +8726,7 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 					value: { removed: store.drain(sessionId).length }
 				};
 				if (pathname === `/plugins/dsh-claude/review-comments/remove`) {
-					const input = await readJson$2(io);
+					const input = await readJson$3(io);
 					if (typeof input.id !== "string" || input.id.length === 0 || input.id.length > 128) throw new ReviewCommentError("invalid-request", "The comment id is invalid.");
 					return {
 						status: 200,
@@ -8669,21 +8762,21 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 }
 //#endregion
 //#region src/plan-feedback-routes.ts
-const MAX_BODY_BYTES$1 = 65536;
-const MAX_SESSION_ID_CHARS$1 = 1024;
+const MAX_BODY_BYTES$2 = 65536;
+const MAX_SESSION_ID_CHARS$2 = 1024;
 const MAX_TOOL_USE_ID_CHARS = 256;
-function record$1(value) {
+function record$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$1(io) {
+async function readJson$2(io) {
 	let parsed;
 	try {
-		parsed = await io.body(MAX_BODY_BYTES$1);
+		parsed = await io.body(MAX_BODY_BYTES$2);
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		throw new PlanFeedbackError("body-too-large", "The request body is too large.");
 	}
-	const value = record$1(parsed);
+	const value = record$2(parsed);
 	if (value === void 0) throw new PlanFeedbackError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -8703,7 +8796,7 @@ function registerPlanFeedbackRoute(ctx, gate, ownsSession) {
 		handler: async (io) => {
 			try {
 				const sessionId = io.url.searchParams.get("sessionId");
-				if (sessionId === null || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS$1) return {
+				if (sessionId === null || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS$2) return {
 					status: 400,
 					value: { error: "invalid-session" }
 				};
@@ -8711,7 +8804,7 @@ function registerPlanFeedbackRoute(ctx, gate, ownsSession) {
 					status: 409,
 					value: { error: "session-unavailable" }
 				};
-				const body = await readJson$1(io);
+				const body = await readJson$2(io);
 				const toolUseId = body.toolUseId;
 				if (typeof toolUseId !== "string" || toolUseId.length === 0 || toolUseId.length > MAX_TOOL_USE_ID_CHARS) return {
 					status: 400,
@@ -8796,16 +8889,16 @@ function registerClaudeClientDiagnosticsRoute(ctx) {
 }
 //#endregion
 //#region src/rewind-routes.ts
-const MAX_BODY_BYTES = 4096;
-const MAX_SESSION_ID_CHARS = 1024;
-function record(value) {
+const MAX_BODY_BYTES$1 = 4096;
+const MAX_SESSION_ID_CHARS$1 = 1024;
+function record$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** An oversized body fails the same field checks as a missing one; only
 *  malformed JSON is worth reporting separately. */
-async function readJson(io) {
+async function readJson$1(io) {
 	try {
-		return record(await io.body(MAX_BODY_BYTES));
+		return record$1(await io.body(MAX_BODY_BYTES$1));
 	} catch (error) {
 		if (error instanceof SyntaxError) throw error;
 		return;
@@ -8829,10 +8922,10 @@ function registerClaudeRewindRoute(ctx, sidecar, access) {
 		budget: "git",
 		handler: async (io) => {
 			try {
-				const input = await readJson(io);
+				const input = await readJson$1(io);
 				const sessionId = input?.sessionId;
 				const seq = input?.seq;
-				if (typeof sessionId !== "string" || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS || typeof seq !== "number" || !Number.isSafeInteger(seq) || seq < 0) return {
+				if (typeof sessionId !== "string" || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS$1 || typeof seq !== "number" || !Number.isSafeInteger(seq) || seq < 0) return {
 					status: 400,
 					value: { error: "invalid-request" }
 				};
@@ -8876,6 +8969,100 @@ function registerClaudeRewindRoute(ctx, sidecar, access) {
 	});
 }
 //#endregion
+//#region src/permission-mode-routes.ts
+const MAX_BODY_BYTES = 4096;
+const MAX_SESSION_ID_CHARS = 1024;
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+async function readJson(io) {
+	try {
+		return record(await io.body(MAX_BODY_BYTES));
+	} catch (error) {
+		if (error instanceof SyntaxError) throw error;
+		return;
+	}
+}
+/** `POST <path>` with `{ sessionId, mode }`: make `mode` the session's Claude
+*  permission mode from its next turn, and move the Host's access preset
+*  with it. The plugin's record lands first: it is what the next turn reads,
+*  and a Host that declines the preset changes nothing about that. */
+function registerClaudePermissionModeRoute(ctx, sidecar, access) {
+	registerPluginRoute(ctx, {
+		mode: "unary",
+		kind: "exact",
+		path: CLAUDE_PERMISSION_MODE_PATH,
+		methods: ["POST"],
+		budget: "fast",
+		handler: async (io) => {
+			try {
+				const input = await readJson(io);
+				const sessionId = input?.sessionId;
+				const mode = input?.mode;
+				if (typeof sessionId !== "string" || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS || !isClaudePermissionMode(mode)) return {
+					status: 400,
+					value: { error: "invalid-request" }
+				};
+				if (!access.ownsSession(sessionId)) return {
+					status: 409,
+					value: { error: "session-unavailable" }
+				};
+				if (access.busy(sessionId)) return {
+					status: 409,
+					value: { error: "session-busy" }
+				};
+				await sidecar.writePermissionMode(sessionId, mode);
+				const sandbox = SANDBOX_BY_CLAUDE_MODE[mode];
+				return {
+					status: 200,
+					value: {
+						mode,
+						sandbox,
+						hostSynced: await access.applyHostPreset(sessionId, sandbox).catch((error) => {
+							ctx.logger?.warn?.(`dsh-claude: Host preset ${sandbox} not applied for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+							return false;
+						})
+					}
+				};
+			} catch (error) {
+				if (error instanceof SyntaxError) return {
+					status: 400,
+					value: { error: "invalid-json" }
+				};
+				throw error;
+			}
+		}
+	});
+}
+//#endregion
+//#region src/permission-mode-host.ts
+/** Put the Host on the preset named after `sandbox`. Answers whether it took:
+*  a Host with no preset service, or whose table lacks that entry, leaves
+*  Claude to enforce the mode on its own. */
+function applyHostPreset(access, agent, sandbox) {
+	const presets = access.presets();
+	if (presets === void 0 || !presets.names.includes(sandbox)) return false;
+	presets.apply(agent.session, sandbox, (policy) => {
+		access.setPolicy(agent, policy);
+	});
+	return true;
+}
+/** Put a session that has not chosen a mode on the sandbox its default needs.
+*
+*  The fold in permission-mode.ts lets the sandbox win over a mode it cannot
+*  carry, which is right for a sandbox the user switched deliberately -- and
+*  wrong for the one a fresh session merely inherited from the Host's default
+*  preset, where it would quietly turn a configured `auto` into whatever that
+*  preset means. So a new Claude session is moved onto its default's sandbox
+*  once, at creation; a session that already chose its own mode is left alone.
+*  @returns the sandbox the Host was put on, or undefined when nothing moved. */
+function alignSessionWithDefault(access, agent, chosen, defaultMode) {
+	if (chosen !== void 0) return void 0;
+	const wanted = SANDBOX_BY_CLAUDE_MODE[defaultMode];
+	if (sandboxModeOf(agent.session.snapshotEvents()) === wanted) return void 0;
+	return applyHostPreset(access, agent, wanted) ? wanted : void 0;
+}
+//#endregion
 //#region src/touched-repositories.ts
 /** Which other repositories a session has written into.
 *
@@ -9569,6 +9756,65 @@ const WORKTREE_BRANCH_PREFIX = {
 		else document.worktreeBranchPrefix = value;
 	}
 };
+/** Which access control Claude sessions get. `native` is the Host's own
+*  selector and nothing else: the sandbox alone decides the mode, as it did
+*  before this plugin grew a selector; the default-mode setting and the
+*  creation-time alignment stand down. The Client reads this to decide which
+*  selector to draw, so the switch shows at once; a turn already running
+*  keeps the mode it started under. */
+const PERMISSION_SELECTOR = {
+	key: "permissionSelector",
+	kind: "select",
+	document: "plugin",
+	effect: "immediate",
+	async options() {
+		return CLAUDE_PERMISSION_SELECTORS.map((value) => ({
+			value,
+			label: value,
+			source: "built-in"
+		}));
+	},
+	read(document) {
+		const value = document.permissionSelector;
+		return isClaudePermissionSelector(value) ? value : DEFAULT_CLAUDE_PERMISSION_SELECTOR;
+	},
+	apply(document, value) {
+		if (!isClaudePermissionSelector(value)) throw new Error("Invalid value for global setting permissionSelector");
+		if (value === "plugin") delete document.permissionSelector;
+		else document.permissionSelector = value;
+	}
+};
+/** `auto` unless the user says otherwise: Claude Code's classifier approves the
+*  routine and asks about the rest, which is the mode a fresh session should
+*  start in when nobody has thought about it yet. */
+const DEFAULT_CLAUDE_PERMISSION_MODE = "auto";
+/** The Claude permission mode a session runs under until its own selector
+*  is used. Plugin settings: a new Claude session is moved onto the DSH
+*  sandbox this mode needs as it is created (permission-mode-host.ts); a
+*  session whose sandbox was switched since yields to that sandbox's own
+*  mode (permission-mode.ts). */
+const PERMISSION_MODE = {
+	key: "permissionMode",
+	kind: "select",
+	document: "plugin",
+	effect: "new-session",
+	async options() {
+		return CLAUDE_PERMISSION_MODES.map((value) => ({
+			value,
+			label: value,
+			source: "built-in"
+		}));
+	},
+	read(document) {
+		const value = document.permissionMode;
+		return isClaudePermissionMode(value) ? value : DEFAULT_CLAUDE_PERMISSION_MODE;
+	},
+	apply(document, value) {
+		if (!isClaudePermissionMode(value)) throw new Error("Invalid value for global setting permissionMode");
+		if (value === "auto") delete document.permissionMode;
+		else document.permissionMode = value;
+	}
+};
 /** Which renderer draws Claude's visible output. Plugin settings, not Claude's:
 *  the CLI has no opinion about how DSH paints a turn. The option labels stay
 *  machine-readable ids; the Client translates the two known values. */
@@ -9668,6 +9914,8 @@ function integerSetting(key, min, max, defaultFor, effect = "new-session") {
 }
 const DESCRIPTORS = [
 	OUTPUT_STYLE,
+	PERMISSION_SELECTOR,
+	PERMISSION_MODE,
 	RENDERER,
 	PROSE,
 	ALERTS,
@@ -9743,6 +9991,27 @@ async function readRenderMode(deps = {}) {
 	}
 	return isClaudeRenderMode(document.renderer) ? document.renderer : DEFAULT_CLAUDE_RENDER_MODE;
 }
+/** Which selector Claude sessions use; unreadable settings mean this plugin's. */
+async function readPermissionSelector(deps = {}) {
+	let document;
+	try {
+		document = await readDocument(pathsFor(deps).pluginSettingsFile);
+	} catch {
+		return DEFAULT_CLAUDE_PERMISSION_SELECTOR;
+	}
+	return isClaudePermissionSelector(document.permissionSelector) ? document.permissionSelector : DEFAULT_CLAUDE_PERMISSION_SELECTOR;
+}
+/** The mode a session runs under until it chooses one. A missing, unreadable,
+*  or malformed plugin settings file means Claude Code's classifier decides. */
+async function readDefaultPermissionMode(deps = {}) {
+	let document;
+	try {
+		document = await readDocument(pathsFor(deps).pluginSettingsFile);
+	} catch {
+		return DEFAULT_CLAUDE_PERMISSION_MODE;
+	}
+	return isClaudePermissionMode(document.permissionMode) ? document.permissionMode : DEFAULT_CLAUDE_PERMISSION_MODE;
+}
 async function readWorktreeBranchPrefix(deps = {}) {
 	const paths = pathsFor(deps);
 	return WORKTREE_BRANCH_PREFIX.read(await readDocument(paths.pluginSettingsFile));
@@ -9966,6 +10235,7 @@ async function apply(ctx, config) {
 		supervisorConfig.maxProcesses = overrides.maxProcesses ?? defaultLimits.maxProcesses;
 	};
 	await applySettingsOverrides();
+	let permissionSelector = await readPermissionSelector();
 	const sidecar = new ClaudeSidecarRepository();
 	const repositoryStatus = new RepositoryStatusService(subprocess);
 	const repositorySetup = new RepositorySetupService(subprocess, {
@@ -9974,13 +10244,22 @@ async function apply(ctx, config) {
 	});
 	const reviewComments = new ReviewCommentStore();
 	const commandCatalogs = /* @__PURE__ */ new Map();
+	/** The Host's access knobs, driven from a Claude mode; see permission-mode-host.ts. */
+	const hostPresets = {
+		presets: () => ctx.get("permissionPresets"),
+		setPolicy: (agent, policy) => {
+			ctx.approval.setPolicy(agent, policy);
+		}
+	};
 	const supervisor = new ClaudeSupervisor({
 		runtime: subprocess,
 		approval: ctx.approval,
 		userQuestions: ctx.userQuestions,
 		config: supervisorConfig,
 		runDetached: (operation) => ctx.agents.withoutInitiator(operation),
-		sidecar
+		sidecar,
+		defaultPermissionMode: () => readDefaultPermissionMode(),
+		permissionSelector: async () => permissionSelector
 	});
 	let resolutionError;
 	try {
@@ -9991,9 +10270,24 @@ async function apply(ctx, config) {
 			const pending = /* @__PURE__ */ new Set();
 			const MOUNT_RETRY_MS = 200;
 			const MOUNT_RETRY_LIMIT = 50;
-			const mount = (agent) => {
+			/** A session this plugin just met (created, or switched to the Claude
+			*  preset) is put on the sandbox its default mode needs, so a Host whose
+			*  default preset is full access does not turn a configured `auto` into
+			*  bypass. Sessions found on boot keep whatever they were on. */
+			const align = async (agent) => {
+				if (permissionSelector === "native") return;
+				const sessionId = agent.id;
+				try {
+					const [projection, defaultMode] = await Promise.all([sidecar.read(sessionId), readDefaultPermissionMode()]);
+					alignSessionWithDefault(hostPresets, agent, projection.permissionMode, defaultMode);
+				} catch (error) {
+					ctx.logger.warn(`dsh-claude: default permission mode not applied for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+				}
+			};
+			const mount = (agent, fresh) => {
 				if (mounted.has(agent)) return;
 				const sessionId = agent.id;
+				if (fresh) align(agent);
 				const dispose = mountClaudeMetadata(ctx, supervisor, agent, supervisorConfig.defaultModel, sidecar, (commands) => {
 					if (commands.length === 0) commandCatalogs.delete(sessionId);
 					else commandCatalogs.set(sessionId, commands);
@@ -10001,10 +10295,10 @@ async function apply(ctx, config) {
 				if (dispose !== void 0) mounted.set(agent, dispose);
 				pending.delete(agent);
 			};
-			const mountWhenPresetSettles = (agent) => {
+			const mountWhenPresetSettles = (agent, fresh) => {
 				if (mounted.has(agent) || pending.has(agent)) return;
 				if (ctx.agentPresets.composedPreset(agent.ctx) !== void 0) {
-					mount(agent);
+					mount(agent, fresh);
 					return;
 				}
 				pending.add(agent);
@@ -10012,7 +10306,7 @@ async function apply(ctx, config) {
 				const retry = () => {
 					if (mounted.has(agent) || !pending.has(agent)) return;
 					if (ctx.agentPresets.composedPreset(agent.ctx) !== void 0) {
-						mount(agent);
+						mount(agent, fresh);
 						return;
 					}
 					attempts += 1;
@@ -10025,15 +10319,15 @@ async function apply(ctx, config) {
 				setTimeout(retry, MOUNT_RETRY_MS).unref?.();
 			};
 			const stopCreated = ctx.on("agent/created", ({ agent }) => {
-				mountWhenPresetSettles(agent);
+				mountWhenPresetSettles(agent, true);
 			});
 			const onPresetSelected = ctx.on;
 			const stopSelected = onPresetSelected("agent-preset/selected", (sessionId, preset) => {
 				if (preset !== "claude") return;
 				const agent = ctx.agents.get(sessionId);
-				if (agent !== void 0) mountWhenPresetSettles(agent);
+				if (agent !== void 0) mountWhenPresetSettles(agent, true);
 			});
-			for (const agent of ctx.agents.list()) mountWhenPresetSettles(agent);
+			for (const agent of ctx.agents.list()) mountWhenPresetSettles(agent, false);
 			return async () => {
 				stopCreated();
 				stopSelected();
@@ -10091,6 +10385,7 @@ async function apply(ctx, config) {
 			defaultLimits,
 			onUpdated: async () => {
 				await applySettingsOverrides();
+				permissionSelector = await readPermissionSelector();
 				supervisor.limitsChanged();
 			}
 		});
@@ -10185,12 +10480,34 @@ async function apply(ctx, config) {
 			}
 		});
 		registerPlanUsageRoute(webCtx, (fetchedAt) => probePlanUsage(supervisorConfig.executablePath, fetchedAt));
+		const claudeSessionBusy = (sessionId) => supervisor.snapshots().some((item) => item.sessionId === sessionId && (item.state === "running" || item.state === "interrupting"));
+		registerClaudePermissionModeRoute(webCtx, sidecar, {
+			ownsSession: ownsClaudeSession,
+			busy: claudeSessionBusy,
+			applyHostPreset: async (sessionId, sandbox) => {
+				const agent = webCtx.agents.get(sessionId);
+				return agent !== void 0 && applyHostPreset(hostPresets, agent, sandbox);
+			}
+		});
+		const permissionModeForClaudeSession = async (sessionId) => {
+			const agent = webCtx.agents.get(sessionId);
+			if (agent === void 0 || webCtx.agentPresets.composedPreset(agent.ctx) !== "claude") return void 0;
+			const projection = await sidecar.read(sessionId);
+			const folded = claudePermissionMode(agent.session.snapshotEvents(), permissionSelector === "native" ? void 0 : projection.permissionMode ?? await readDefaultPermissionMode());
+			const live = supervisor.snapshots().find((item) => item.sessionId === sessionId);
+			const autoSupported = live === void 0 ? void 0 : claudeModelRow(live.model)?.supportsAutoMode;
+			return {
+				mode: folded === "auto" && autoSupported === false ? "default" : folded,
+				locked: claudeSessionBusy(sessionId),
+				...autoSupported === void 0 ? {} : { autoSupported }
+			};
+		};
 		registerClaudeProjectionRoute(webCtx, sidecar, ownsClaudeSession, (sessionId) => commandCatalogs.get(sessionId) ?? [], async (sessionId) => {
 			const agent = webCtx.agents.get(sessionId);
 			if (agent === void 0 || webCtx.agentPresets.composedPreset(agent.ctx) !== "claude") return void 0;
 			const cwd = agent.session.header.cwd;
 			return cwd === void 0 ? void 0 : repositoryStatus.inspect(cwd);
-		}, (sessionId) => reviewComments.list(sessionId), extraRepositoriesForClaudeSession);
+		}, (sessionId) => reviewComments.list(sessionId), extraRepositoriesForClaudeSession, permissionModeForClaudeSession, () => permissionSelector);
 	});
 }
 //#endregion