@stackstackstack/dsh-permission-presets 0.1.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/interaction/permission-presets/README.md
+README.md: 7bd2b285693f1fc0c3acb8d0c4cb0e2e890feba3
+README.zh.md: b1aeeeaf14d80e79fda9a9e80c34b1445edb2fff

package/README.md

@@ -0,0 +1,28 @@
+# @stackstackstack/dsh-permission-presets
+
+English | [中文](README.zh.md)
+
+User-facing permission presets through `ctx.permissionPresets` ([`PermissionPresetService`](src/index.ts)). Each configured name bundles `sandbox/mode` with `approval/policy`; the defaults are `workspace-write` (`workspace-write` + `ask`) and `danger-full-access` (`danger-full-access` + `never`). UI adapters may expose the table as one selector, while sandbox execution and approval continue to consume their own knobs.
+
+`set(session, name)` records a changed selection in a log-only `permissionPresets/preset` event, then calls each knob's setter only when its effective value changes. The selection event precedes the knob events and preserves user intent when presets share a bundle; a net-zero selection appends nothing. `current(events)` prefers a still-matching recorded selection, then the first matching table entry, and otherwise returns `custom`. Clients may display `custom` as the current value, but cannot select it.
+
+The service owns the `permissionPresets` Settings namespace. Its `defaultPreset` is the default for future sessions: the composition entry uses `Config.defaultPreset`, or infers the preset matching the composed sandbox and approval defaults when omitted. A committed Settings change is read when the next session is created; creation pins `permissionPresets/preset`, `sandbox/mode`, and `approval/policy` into that session, so later changes never alter an existing session. A resumed seed, including an explicitly empty one marked by `session/end-seed`, preserves its effective permission and receives only missing durable facts rather than the latest user default. Mounting the service also sweeps already-live sessions, so an HMR replacement pins any session created while the plugin was absent.
+
+The service requires a confining `ctx.shell` executor and `ctx.approval`. A table entry named `custom` throws at load. When composition defaults match no preset, the plugin requires an explicit `defaultPreset`; an independently constructed zero-event session may still derive `custom`. See the [sandbox switching design](../../../.agents/notes/implemented/feature/2026-07-06-sandbox.md).
+
+Two optional children ship the product surfaces over the same service: a `permissions` session-projection unit (`src/types.ts` declares the key; the unit folds the three whole-value knob events and views the select — table options plus a current-only `custom` — over the composition defaults) and the `/permissionPresets` command (bare invocation reports the current preset and the table; a preset argument switches through `set`). Each child activates only when its registry (`ctx.sessionProjections` / `ctx.commands`) is composed.
+
+## Model Experience
+
+Indirectly, through `dsh-user-approval` and `dsh-tool-bash`, which render the approval-policy prompt, switch notice, and sandboxed tool outcomes selected by this service's knob events; `permissionPresets/preset` itself is log-only.
+
+#### KV Cache effect
+
+No direct invalidation; the named consumer owns any request-prefix changes.
+
+## Known Limitations and Deferred Work
+
+- **Only two mechanism knobs are bundled** — presets select sandbox mode and approval policy; an agent/profile choice is not part of `PresetSpec` yet.
+- **`custom` is derived-only** — callers can switch away from an unmatched knob combination but cannot target or persist a named custom preset through this service.
+- **The preset table is process-level** — configuration is fixed for the plugin lifetime; changing available presets requires reloading the plugin.
+- **Stored defaults must remain in the preset table** — removing the referenced preset makes Permission settings registration fail until the `permissionPresets` section in `settings.yaml` is updated or reset.

package/README.zh.md

@@ -0,0 +1,28 @@
+# @stackstackstack/dsh-permission-presets
+
+[English](README.md) | 中文
+
+通过 `ctx.permissionPresets`（[`PermissionPresetService`](src/index.ts)）提供面向用户的权限预设。每个配置名称都会将 `sandbox/mode` 与 `approval/policy` 组成一组；默认项为 `workspace-write`（`workspace-write` + `ask`）和 `danger-full-access`（`danger-full-access` + `never`）。UI 适配器可以将该表作为单个选择器公开，而沙箱执行与审批仍分别消费各自的调节项。
+
+`set(session, name)` 会先在仅写日志的 `permissionPresets/preset` 事件中记录已变更的选择，再仅对实际值发生变化的调节项调用 setter。选择事件先于调节项事件，并在多个预设共享同一组取值时保留用户意图；净变化为零的选择不会追加任何内容。`current(events)` 优先返回仍与当前调节项匹配的已记录选择，其次返回表中第一个匹配项，否则返回 `custom`。客户端可以把 `custom` 显示为当前值，但不能选择它。
+
+该服务拥有 `permissionPresets` Settings namespace。其 `defaultPreset` 是未来会话的默认值：组合项使用 `Config.defaultPreset`；省略时，则推断与组合后的沙箱和审批默认值匹配的 preset。已提交的 Settings 变更会在下一个会话创建时读取；创建过程将 `permissionPresets/preset`、`sandbox/mode` 和 `approval/policy` 固定到该会话中，因此后续变更绝不会改变现有会话。恢复的 seed，包括由 `session/end-seed` 标记的显式空 seed，都会保留其有效权限，只补齐缺失的持久事实，而不会采用最新的用户默认值。挂载服务时还会遍历所有已存活会话，因此 HMR（热模块替换）会固定插件缺席期间创建的所有会话。
+
+该服务要求存在具有约束能力的 `ctx.shell` 执行器和 `ctx.approval`。表中名为 `custom` 的条目会在加载时抛出异常。当组合默认值与任何 preset 都不匹配时，插件要求显式配置 `defaultPreset`；独立构造的零事件会话仍可能推导出 `custom`。详见[沙箱切换设计](../../../.agents/notes/implemented/feature/2026-07-06-sandbox.md)。
+
+两个可选子功能在同一服务之上提供产品界面：`permissions` 会话投影单元（`src/types.ts` 声明该 key；单元以组合默认值为基础折叠三个全量值可调参数事件，并生成选择器视图，其中包含表内选项和仅作当前值的 `custom`）与 `/permissionPresets` 命令（不带参数调用时报告当前预设与表；预设参数经 `set` 切换）。每个子功能仅在其注册表（`ctx.sessionProjections` / `ctx.commands`）被组合时激活。
+
+## 模型体验
+
+间接地，通过 `dsh-user-approval` 和 `dsh-tool-bash`：二者会渲染由此服务的可调参数事件所选择的审批策略提示词、切换通知和沙箱工具结果；`permissionPresets/preset` 本身只写入日志。
+
+#### KV Cache 影响
+
+不会直接使缓存失效；具名消费方拥有所有请求前缀变更。
+
+## 已知限制与暂缓事项
+
+- **只组合两个机制级可调参数**：预设选择沙箱模式和审批策略；agent（智能体）／profile 选择尚未纳入 `PresetSpec`。
+- **`custom` 只能推导得出**：调用方可以从不匹配的调节项组合切换出去，但无法通过此服务选中或持久化一个名为 custom 的预设。
+- **预设表是进程级配置**：配置在插件生命周期内固定；更改可用预设必须重新加载插件。
+- **已存储的默认值必须保留在 preset 表中**：移除被引用的 preset 会导致权限设置注册失败，直到更新或重置 `settings.yaml` 中的 `permissionPresets` 分节。

package/lib/index.js

@@ -0,0 +1,311 @@
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+import { z as z$1 } from "zod";
+import { SANDBOX_MODES, effectiveSandboxMode, setSandboxMode } from "@stackstackstack/dsh-sandbox-policy";
+import { APPROVAL_POLICIES, effectiveApprovalPolicy, setApprovalPolicy } from "@stackstackstack/dsh-user-approval";
+import { installSettingsSection, settingsNamespace } from "@stackstackstack/dsh-settings";
+//#region lib/types/index.js
+/**
+* User-facing permission presets over the independent sandbox-mode and
+* approval-policy knobs. A switch records the selected preset, then writes
+* changed knobs through their canonical setters. Execution, prompt narration,
+* and replay keep reading their knob folds. The preset event preserves user
+* intent when two presets share a bundle. The read side ships as the
+* `permissions` session projection; the write side ships as the
+* `/permission` command — both optional children over the same service.
+*
+* @module dsh-permission-presets
+*/
+/**
+* Returned when effective knob values match no table entry. Clients may show
+* it as the current value, but it is never a switch target or event payload.
+*/
+const CUSTOM_PRESET = "custom";
+/** Settings namespace carrying the default for future sessions. */
+const PERMISSION_SETTINGS_NAMESPACE = settingsNamespace("permission");
+/**
+* Fold the last selected preset from the durable log; replay needs no catch-up
+* state.
+* @param events - session events in log order; other event types are ignored.
+* @returns the last selected preset, or undefined when none was recorded.
+*/
+function effectivePermissionPreset(events) {
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (event.type === "permission/preset") return event.data.preset;
+	}
+}
+/** State for the empty log: every knob at its composition default. */
+const EMPTY_KNOBS = {
+	preset: null,
+	sandbox: null,
+	approval: null
+};
+/**
+* One-event knob transition (the projection unit's `apply`). Uninterested
+* events return the same reference — the registry's change gate.
+* @param state - the folded knob state before `event`.
+* @param event - one committed session event.
+* @returns the next state; the same reference when the event is not a knob.
+*/
+function applyKnobEvent(state, event) {
+	switch (event.type) {
+		case "permission/preset": return {
+			...state,
+			preset: event.data.preset
+		};
+		case "sandbox/mode": return {
+			...state,
+			sandbox: event.data.mode
+		};
+		case "approval/policy": return {
+			...state,
+			approval: event.data.policy
+		};
+		default: return state;
+	}
+}
+/** Whole-log knob fold (the cold-read parallel of {@link applyKnobEvent}). */
+function foldKnobs(events) {
+	let state = EMPTY_KNOBS;
+	for (const event of events) state = applyKnobEvent(state, event);
+	return state;
+}
+/**
+* Owns the deployment's permission presets and their write path. Requires a
+* confining `ctx.shell` executor and `ctx.approval`; unmatched knob values are
+* reported as {@link CUSTOM_PRESET}, not an error.
+*/
+var PermissionPresetService = class extends Service {
+	static Config = z.object({
+		presets: z.dict(z.object({
+			sandbox: z.union(SANDBOX_MODES).required(),
+			approval: z.union(APPROVAL_POLICIES).required(),
+			name: z.string(),
+			description: z.string()
+		})).default({
+			"workspace-write": {
+				sandbox: "workspace-write",
+				approval: "ask",
+				name: "workspace-write",
+				description: "Write inside the workspace and permitted temporary directories; wider retries require approval."
+			},
+			"danger-full-access": {
+				sandbox: "danger-full-access",
+				approval: "never",
+				name: "danger-full-access",
+				description: "Full file access without approval prompts."
+			}
+		}),
+		defaultPreset: z.string()
+	});
+	static inject = [
+		"shell",
+		"approval",
+		"sessions"
+	];
+	presets;
+	defaultSettings;
+	constructor(ctx, config) {
+		super(ctx, "permissionPresets");
+		this.presets = config.presets;
+		if ("custom" in this.presets) throw new Error(`permission: "${CUSTOM_PRESET}" is reserved for the derived not-a-preset state and cannot name a table entry`);
+		if (ctx.shell.sandboxMode === void 0) throw new Error("permission: the mounted bash executor does not confine (no sandboxMode) — presets bundle a sandbox mode, so composing this plugin over an unconfined executor is a misconfiguration");
+		const inferredDefault = this.derive(EMPTY_KNOBS);
+		const defaultPreset = config.defaultPreset ?? inferredDefault;
+		if (defaultPreset === "custom") throw new Error("permission: composed sandbox and approval defaults match no preset; configure defaultPreset explicitly");
+		this.resolve(defaultPreset);
+		const baseSettings = { defaultPreset };
+		this.defaultSettings = () => baseSettings;
+		const presetChoices = this.names.map((name) => {
+			const choice = z.const(name);
+			const label = this.presets[name]?.name;
+			return label === void 0 ? choice : choice.description(label);
+		});
+		installSettingsSection(ctx, PERMISSION_SETTINGS_NAMESPACE, z.object({ defaultPreset: z.union(presetChoices).required() }), baseSettings, {
+			setSource: (current) => {
+				this.defaultSettings = current;
+			},
+			onChange: () => {}
+		});
+		ctx.on("session/created", (session) => {
+			this.pinInitialPermission(session);
+		});
+		for (const session of ctx.sessions.list()) this.pinInitialPermission(session);
+		const selectSchema = z$1.object({
+			options: z$1.array(z$1.object({
+				value: z$1.string().min(1),
+				name: z$1.string().min(1),
+				description: z$1.string().optional()
+			})),
+			currentValue: z$1.string().min(1)
+		});
+		ctx.inject(["sessionProjections"], (projectionCtx) => {
+			projectionCtx.sessionProjections.register({
+				key: "permissions",
+				schema: selectSchema,
+				init: () => EMPTY_KNOBS,
+				apply: applyKnobEvent,
+				view: (state) => this.selectFor(state),
+				stateVersion: 1
+			});
+		});
+		ctx.inject(["commands"], (commandCtx) => {
+			commandCtx.commands.register({
+				name: "permission",
+				description: "Switch the permission preset (sandbox mode + approval policy)",
+				input: { hint: "<preset>" },
+				handler: ({ agent, rawInput }) => {
+					const name = rawInput.trim();
+					if (name === "") return {
+						kind: "success",
+						text: `current preset ${this.current(agent.session.events)} (available: ${this.names.join(", ")})`
+					};
+					if (!this.names.includes(name)) return {
+						kind: "error",
+						text: `unknown preset "${name}" (available: ${this.names.join(", ")})`
+					};
+					this.apply(agent.session, name, (policy) => {
+						this.ctx.approval.setPolicy(agent, policy);
+					});
+					return {
+						kind: "success",
+						text: `preset ${name}`
+					};
+				}
+			});
+		});
+	}
+	/**
+	* The advertised preset names, in the preset table's declaration order.
+	* @returns every switchable preset name.
+	*/
+	get names() {
+		return Object.keys(this.presets);
+	}
+	/**
+	* The preset currently selected as the default for future sessions.
+	* @returns the resolved settings value, or the composition default without
+	* a mounted settings provider.
+	*/
+	get defaultPreset() {
+		return this.defaultSettings().defaultPreset;
+	}
+	/**
+	* Resolve the preset matching the effective knob values. A still-matching
+	* last selection wins shared-bundle ties; otherwise the first table match
+	* wins, or {@link CUSTOM_PRESET} when no entry matches.
+	* @param events - the session's events in log order.
+	* @returns the effective preset name, or `custom` when nothing matches.
+	*/
+	current(events) {
+		return this.derive(foldKnobs(events));
+	}
+	/** Resolve the preset for one folded knob state (the shared mathematics of `current` and the projection unit). */
+	derive(state) {
+		const sandbox = state.sandbox ?? this.ctx.shell.sandboxMode;
+		const approval = state.approval ?? this.ctx.approval.config.policy ?? "ask";
+		const matches = (spec) => spec.sandbox === sandbox && spec.approval === approval;
+		if (state.preset !== null) {
+			const spec = this.presets[state.preset];
+			if (spec !== void 0 && matches(spec)) return state.preset;
+		}
+		for (const [name, spec] of Object.entries(this.presets)) if (matches(spec)) return name;
+		return CUSTOM_PRESET;
+	}
+	/**
+	* Build the whole select value for one folded knob state: every table
+	* option in declaration order, `custom` appended exactly while derived.
+	* @param state - the folded knob overrides.
+	* @returns the `permissions` projection payload.
+	*/
+	selectFor(state) {
+		const currentValue = this.derive(state);
+		return {
+			options: [...this.names.map((name) => this.optionOf(name)), ...currentValue === "custom" ? [this.optionOf(CUSTOM_PRESET)] : []],
+			currentValue
+		};
+	}
+	/**
+	* Resolve a preset's knob bundle.
+	* @param name - the preset name to resolve.
+	* @returns the configured bundle.
+	* @throws when `name` is not in the table.
+	*/
+	resolve(name) {
+		const spec = this.presets[name];
+		if (spec === void 0) throw new Error(`permission: unknown preset "${name}" (known: ${Object.keys(this.presets).join(", ")})`);
+		return spec;
+	}
+	/**
+	* Build the client option for a table entry or {@link CUSTOM_PRESET}. A
+	* missing label falls back to the table key.
+	* @param name - a table key, or `custom`.
+	* @returns the option a client renders.
+	* @throws when `name` is neither a table key nor `custom`.
+	*/
+	optionOf(name) {
+		if (name === "custom") return {
+			value: CUSTOM_PRESET,
+			name: "Custom",
+			description: "Current sandbox and approval settings do not match a preset."
+		};
+		const spec = this.resolve(name);
+		return {
+			value: name,
+			name: spec.name ?? name,
+			...spec.description !== void 0 ? { description: spec.description } : {}
+		};
+	}
+	/**
+	* Record a changed preset, then update each changed knob through its own
+	* setter. Selecting the effective preset again appends nothing.
+	* @param session - the session the switch belongs to.
+	* @param name - the preset to switch to; unknown names throw.
+	*/
+	set(session, name) {
+		this.apply(session, name, (policy) => {
+			setApprovalPolicy(session, policy);
+		});
+	}
+	/** Apply one preset with the caller-selected live or initialization policy writer. */
+	apply(session, name, setApproval) {
+		const spec = this.resolve(name);
+		if (this.current(session.events) !== name) session.append("permission/preset", { preset: name });
+		const events = session.events;
+		if (spec.sandbox !== (effectiveSandboxMode(events) ?? this.ctx.shell.sandboxMode)) setSandboxMode(session, spec.sandbox);
+		if (spec.approval !== (effectiveApprovalPolicy(events) ?? this.ctx.approval.config.policy ?? "ask")) setApproval(spec.approval);
+	}
+	/**
+	* Fill every missing permission fact before a session is published. A
+	* genuinely fresh session uses the current user default; seeded or partially
+	* initialized sessions preserve their effective knob values and only gain
+	* the missing durable facts.
+	*/
+	pinInitialPermission(session) {
+		const events = session.events;
+		const selected = effectivePermissionPreset(events);
+		const sandbox = effectiveSandboxMode(events);
+		const approval = effectiveApprovalPolicy(events);
+		const seeded = events.some((event) => event.type === "session/end-seed");
+		if (selected === void 0 && sandbox === void 0 && approval === void 0 && !seeded) {
+			const name = this.defaultPreset;
+			const spec = this.resolve(name);
+			session.append("permission/preset", { preset: name });
+			setSandboxMode(session, spec.sandbox);
+			setApprovalPolicy(session, spec.approval);
+			return;
+		}
+		const state = {
+			preset: selected ?? null,
+			sandbox: sandbox ?? null,
+			approval: approval ?? null
+		};
+		const effective = this.derive(state);
+		if (selected === void 0 && effective !== "custom") session.append("permission/preset", { preset: effective });
+		if (sandbox === void 0) setSandboxMode(session, this.ctx.shell.sandboxMode);
+		if (approval === void 0) setApprovalPolicy(session, this.ctx.approval.config.policy ?? "ask");
+	}
+};
+//#endregion
+export { CUSTOM_PRESET, PERMISSION_SETTINGS_NAMESPACE, PermissionPresetService, PermissionPresetService as default, applyKnobEvent, effectivePermissionPreset };

package/lib/invariant.js

@@ -0,0 +1,28 @@
+//#region lib/types/invariant.js
+/** Package-owned permission-preset event invariants. @module @stackstackstack/dsh-permission-presets/invariant */
+const PACKAGE_NAME = "@stackstackstack/dsh-permission-presets";
+/** Cordis companion plugin name. */
+const name = "permission-presets-invariant";
+/** Service required before the companion can reserve package ownership. */
+const inject = ["invariants"];
+/** Validate the package-owned event fields and ignore unrelated events. */
+function validateEvent(ctx, event, fail) {
+	if (event.type === "permission/preset" && !ctx.permissionPresets.names.includes(event.data.preset)) fail(`permission/preset names unknown preset ${JSON.stringify(event.data.preset)}`);
+}
+/** Install validation that loaded and newly appended preset events remain resolvable. */
+const install = Object.assign((ctx, fail) => {
+	for (const session of ctx.sessions.list()) for (const event of session.events) validateEvent(ctx, event, fail);
+	ctx.on("internal/dispatch", (_mode, eventName, args) => {
+		if (eventName !== "session/event") return;
+		const event = args[1];
+		validateEvent(ctx, event, fail);
+	}, { global: true });
+}, { inject: ["permissionPresets", "sessions"] });
+/**
+* Register the permission invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/client.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Client-namespace projection of the permission domain: a pure re-export of
+ * the package's types outlet. Client code imports ONLY the client namespace
+ * (repo discipline), so `./client` projects the same single-source content
+ * `./types` serves to host consumers — zero duplication.
+ *
+ * @module @stackstackstack/dsh-permission-presets/client
+ */
+export type * from './types.ts';
+//# sourceMappingURL=client.d.ts.map

package/lib/types/client.js

@@ -0,0 +1,10 @@
+/**
+ * Client-namespace projection of the permission domain: a pure re-export of
+ * the package's types outlet. Client code imports ONLY the client namespace
+ * (repo discipline), so `./client` projects the same single-source content
+ * `./types` serves to host consumers — zero duplication.
+ *
+ * @module @stackstackstack/dsh-permission-presets/client
+ */
+export {};
+//# sourceMappingURL=client.js.map

package/lib/types/index.d.ts

@@ -0,0 +1,174 @@
+/**
+ * User-facing permission presets over the independent sandbox-mode and
+ * approval-policy knobs. A switch records the selected preset, then writes
+ * changed knobs through their canonical setters. Execution, prompt narration,
+ * and replay keep reading their knob folds. The preset event preserves user
+ * intent when two presets share a bundle. The read side ships as the
+ * `permissions` session projection; the write side ships as the
+ * `/permission` command — both optional children over the same service.
+ *
+ * @module dsh-permission-presets
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import type { Session, SessionEvent } from '@stackstackstack/dsh-session';
+import type { SandboxMode } from '@stackstackstack/dsh-sandbox';
+import type { ApprovalPolicy } from '@stackstackstack/dsh-user-approval';
+import type { PermissionSelect, PresetOption } from './types.ts';
+export type * from './types.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        permissionPresets: PermissionPresetService;
+    }
+}
+declare module '@stackstackstack/dsh-session/types' {
+    interface SessionEventMap {
+        /**
+         * Records the selected preset as durable, log-only user intent. The knob
+         * events follow in the same turn and control execution; this event stays
+         * out of the model transcript and lets {@link effectivePermissionPreset}
+         * preserve a selection when bundles match.
+         */
+        'permission/preset': {
+            preset: string;
+        };
+    }
+}
+/** One preset's sandbox/approval bundle and optional client presentation. */
+export interface PresetSpec {
+    /** The `sandbox/mode` value the preset writes through. */
+    sandbox: SandboxMode;
+    /** The `approval/policy` value the preset writes through. */
+    approval: ApprovalPolicy;
+    /** The display label a client shows for this preset; the raw table key when omitted. */
+    name?: string;
+    /** One user-facing sentence on what the preset means; omitted when not configured. */
+    description?: string;
+}
+/**
+ * Returned when effective knob values match no table entry. Clients may show
+ * it as the current value, but it is never a switch target or event payload.
+ */
+export declare const CUSTOM_PRESET = "custom";
+/** Settings namespace carrying the default for future sessions. */
+export declare const PERMISSION_SETTINGS_NAMESPACE: import("@stackstackstack/dsh-settings").SettingsNamespace;
+/**
+ * Fold the last selected preset from the durable log; replay needs no catch-up
+ * state.
+ * @param events - session events in log order; other event types are ignored.
+ * @returns the last selected preset, or undefined when none was recorded.
+ */
+export declare function effectivePermissionPreset(events: readonly SessionEvent[]): string | undefined;
+/**
+ * The projection unit's state: the last seen value of each knob event, null
+ * before an override (composition defaults apply at view time). Plain JSON
+ * (persisted-cache precondition).
+ */
+export interface KnobState {
+    /** Last `permission/preset` payload, or null. */
+    preset: string | null;
+    /** Last `sandbox/mode` payload, or null. */
+    sandbox: SandboxMode | null;
+    /** Last `approval/policy` payload, or null. */
+    approval: ApprovalPolicy | null;
+}
+/**
+ * One-event knob transition (the projection unit's `apply`). Uninterested
+ * events return the same reference — the registry's change gate.
+ * @param state - the folded knob state before `event`.
+ * @param event - one committed session event.
+ * @returns the next state; the same reference when the event is not a knob.
+ */
+export declare function applyKnobEvent(state: KnobState, event: SessionEvent): KnobState;
+/** User setting resolved when a new session receives its initial permission. */
+export interface PermissionSettings {
+    /** Preset pinned into a newly created session. */
+    defaultPreset: string;
+}
+/** The {@link PermissionPresetService} config: preset table and composition default. */
+export interface Config {
+    /**
+     * The preset table: name → knob bundle. Defaults to `workspace-write`
+     * (workspace-write + ask) and `danger-full-access` (danger-full-access +
+     * never). The name `custom` is reserved for the derived not-a-preset state.
+     */
+    presets?: Record<string, PresetSpec>;
+    /**
+     * Default for new sessions. When omitted, the preset matching the composed
+     * sandbox and approval defaults is used.
+     */
+    defaultPreset?: string;
+}
+/**
+ * Owns the deployment's permission presets and their write path. Requires a
+ * confining `ctx.shell` executor and `ctx.approval`; unmatched knob values are
+ * reported as {@link CUSTOM_PRESET}, not an error.
+ */
+export declare class PermissionPresetService extends Service {
+    static Config: z<Config>;
+    static inject: string[];
+    private readonly presets;
+    private defaultSettings;
+    constructor(ctx: Context, config: Config);
+    /**
+     * The advertised preset names, in the preset table's declaration order.
+     * @returns every switchable preset name.
+     */
+    get names(): readonly string[];
+    /**
+     * The preset currently selected as the default for future sessions.
+     * @returns the resolved settings value, or the composition default without
+     * a mounted settings provider.
+     */
+    get defaultPreset(): string;
+    /**
+     * Resolve the preset matching the effective knob values. A still-matching
+     * last selection wins shared-bundle ties; otherwise the first table match
+     * wins, or {@link CUSTOM_PRESET} when no entry matches.
+     * @param events - the session's events in log order.
+     * @returns the effective preset name, or `custom` when nothing matches.
+     */
+    current(events: readonly SessionEvent[]): string;
+    /** Resolve the preset for one folded knob state (the shared mathematics of `current` and the projection unit). */
+    private derive;
+    /**
+     * Build the whole select value for one folded knob state: every table
+     * option in declaration order, `custom` appended exactly while derived.
+     * @param state - the folded knob overrides.
+     * @returns the `permissions` projection payload.
+     */
+    selectFor(state: KnobState): PermissionSelect;
+    /**
+     * Resolve a preset's knob bundle.
+     * @param name - the preset name to resolve.
+     * @returns the configured bundle.
+     * @throws when `name` is not in the table.
+     */
+    resolve(name: string): PresetSpec;
+    /**
+     * Build the client option for a table entry or {@link CUSTOM_PRESET}. A
+     * missing label falls back to the table key.
+     * @param name - a table key, or `custom`.
+     * @returns the option a client renders.
+     * @throws when `name` is neither a table key nor `custom`.
+     */
+    optionOf(name: string): PresetOption;
+    /**
+     * Record a changed preset, then update each changed knob through its own
+     * setter. Selecting the effective preset again appends nothing.
+     * @param session - the session the switch belongs to.
+     * @param name - the preset to switch to; unknown names throw.
+     */
+    set(session: Session, name: string): void;
+    /** Apply one preset with the caller-selected live or initialization policy writer. */
+    private apply;
+    /**
+     * Fill every missing permission fact before a session is published. A
+     * genuinely fresh session uses the current user default; seeded or partially
+     * initialized sessions preserve their effective knob values and only gain
+     * the missing durable facts.
+     */
+    private pinInitialPermission;
+}
+export default PermissionPresetService;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,331 @@
+/**
+ * User-facing permission presets over the independent sandbox-mode and
+ * approval-policy knobs. A switch records the selected preset, then writes
+ * changed knobs through their canonical setters. Execution, prompt narration,
+ * and replay keep reading their knob folds. The preset event preserves user
+ * intent when two presets share a bundle. The read side ships as the
+ * `permissions` session projection; the write side ships as the
+ * `/permission` command — both optional children over the same service.
+ *
+ * @module dsh-permission-presets
+ */
+import { Service } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { z as zod } from 'zod';
+import { SANDBOX_MODES, effectiveSandboxMode, setSandboxMode } from '@stackstackstack/dsh-sandbox-policy';
+import { APPROVAL_POLICIES, effectiveApprovalPolicy, setApprovalPolicy } from '@stackstackstack/dsh-user-approval';
+import { installSettingsSection, settingsNamespace } from '@stackstackstack/dsh-settings';
+/**
+ * Returned when effective knob values match no table entry. Clients may show
+ * it as the current value, but it is never a switch target or event payload.
+ */
+export const CUSTOM_PRESET = 'custom';
+/** Settings namespace carrying the default for future sessions. */
+export const PERMISSION_SETTINGS_NAMESPACE = settingsNamespace('permission');
+/**
+ * Fold the last selected preset from the durable log; replay needs no catch-up
+ * state.
+ * @param events - session events in log order; other event types are ignored.
+ * @returns the last selected preset, or undefined when none was recorded.
+ */
+export function effectivePermissionPreset(events) {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type === 'permission/preset')
+            return event.data.preset;
+    }
+    return undefined;
+}
+/** State for the empty log: every knob at its composition default. */
+const EMPTY_KNOBS = { preset: null, sandbox: null, approval: null };
+/**
+ * One-event knob transition (the projection unit's `apply`). Uninterested
+ * events return the same reference — the registry's change gate.
+ * @param state - the folded knob state before `event`.
+ * @param event - one committed session event.
+ * @returns the next state; the same reference when the event is not a knob.
+ */
+export function applyKnobEvent(state, event) {
+    switch (event.type) {
+        case 'permission/preset':
+            return { ...state, preset: event.data.preset };
+        case 'sandbox/mode':
+            return { ...state, sandbox: event.data.mode };
+        case 'approval/policy':
+            return { ...state, approval: event.data.policy };
+        default:
+            return state;
+    }
+}
+/** Whole-log knob fold (the cold-read parallel of {@link applyKnobEvent}). */
+function foldKnobs(events) {
+    let state = EMPTY_KNOBS;
+    for (const event of events)
+        state = applyKnobEvent(state, event);
+    return state;
+}
+/**
+ * Owns the deployment's permission presets and their write path. Requires a
+ * confining `ctx.shell` executor and `ctx.approval`; unmatched knob values are
+ * reported as {@link CUSTOM_PRESET}, not an error.
+ */
+export class PermissionPresetService extends Service {
+    // Inline schema call: the config catalog walks `static Config` statically.
+    static Config = z.object({
+        presets: z.dict(z.object({
+            sandbox: z.union(SANDBOX_MODES).required(),
+            approval: z.union(APPROVAL_POLICIES).required(),
+            name: z.string(),
+            description: z.string(),
+        })).default({
+            'workspace-write': {
+                sandbox: 'workspace-write', approval: 'ask',
+                name: 'workspace-write', description: 'Write inside the workspace and permitted temporary directories; wider retries require approval.',
+            },
+            'danger-full-access': {
+                sandbox: 'danger-full-access', approval: 'never',
+                name: 'danger-full-access', description: 'Full file access without approval prompts.',
+            },
+        }),
+        defaultPreset: z.string(),
+    });
+    static inject = ['shell', 'approval', 'sessions'];
+    presets;
+    defaultSettings;
+    constructor(ctx, config) {
+        super(ctx, 'permissionPresets');
+        // The schema defaulted the table — the cast records that runtime fact.
+        this.presets = config.presets;
+        if (CUSTOM_PRESET in this.presets) {
+            throw new Error(`permission: "${CUSTOM_PRESET}" is reserved for the derived not-a-preset state and cannot name a table entry`);
+        }
+        if (ctx.shell.sandboxMode === undefined) {
+            throw new Error('permission: the mounted bash executor does not confine (no sandboxMode) — presets bundle a sandbox mode, so composing this plugin over an unconfined executor is a misconfiguration');
+        }
+        const inferredDefault = this.derive(EMPTY_KNOBS);
+        const defaultPreset = config.defaultPreset ?? inferredDefault;
+        if (defaultPreset === CUSTOM_PRESET) {
+            throw new Error('permission: composed sandbox and approval defaults match no preset; configure defaultPreset explicitly');
+        }
+        this.resolve(defaultPreset);
+        const baseSettings = { defaultPreset };
+        this.defaultSettings = () => baseSettings;
+        const presetChoices = this.names.map((name) => {
+            const choice = z.const(name);
+            const label = this.presets[name]?.name;
+            return label === undefined ? choice : choice.description(label);
+        });
+        const settingsSchema = z.object({
+            defaultPreset: z.union(presetChoices).required(),
+        });
+        installSettingsSection(ctx, PERMISSION_SETTINGS_NAMESPACE, settingsSchema, baseSettings, {
+            setSource: (current) => {
+                this.defaultSettings = current;
+            },
+            // The source thunk reads the latest scope snapshot at session creation;
+            // no process-level registration needs replacement on change.
+            onChange: () => { },
+        });
+        ctx.on('session/created', (session) => {
+            this.pinInitialPermission(session);
+        });
+        for (const session of ctx.sessions.list()) {
+            this.pinInitialPermission(session);
+        }
+        // The permissions projection unit: fold the three whole-value knob
+        // events; view derives the select over the composition defaults this
+        // service already owns. The unit child activates only when a projection
+        // registry is composed (headless assemblies stay unaffected).
+        // zod `.optional()` types the key `string | undefined` while the domain
+        // says `description?: string`; on the JSON wire the two serialize
+        // identically (absent), so the cast records exactly that
+        // exactOptionalPropertyTypes widening (the Wire<T> precedent).
+        const selectSchema = zod.object({
+            options: zod.array(zod.object({
+                value: zod.string().min(1),
+                name: zod.string().min(1),
+                description: zod.string().optional(),
+            })),
+            currentValue: zod.string().min(1),
+        });
+        ctx.inject(['sessionProjections'], (projectionCtx) => {
+            projectionCtx.sessionProjections.register({
+                key: 'permissions',
+                schema: selectSchema,
+                init: () => EMPTY_KNOBS,
+                apply: applyKnobEvent,
+                view: state => this.selectFor(state),
+                stateVersion: 1,
+            });
+        });
+        // The /permission command: the one write path a web client uses (the
+        // popup contribution submits the picked preset as this line). The child
+        // activates only when a command registry is composed.
+        ctx.inject(['commands'], (commandCtx) => {
+            commandCtx.commands.register({
+                name: 'permission',
+                description: 'Switch the permission preset (sandbox mode + approval policy)',
+                input: { hint: '<preset>' },
+                // No settlement text labels its value with this command's own name: a
+                // surface that renders `name · text` (the web command row) would
+                // otherwise read `permission · Permission preset: workspace-write.`
+                handler: ({ agent, rawInput }) => {
+                    const name = rawInput.trim();
+                    if (name === '') {
+                        return { kind: 'success', text: `current preset ${this.current(agent.session.events)} (available: ${this.names.join(', ')})` };
+                    }
+                    if (!this.names.includes(name)) {
+                        return { kind: 'error', text: `unknown preset "${name}" (available: ${this.names.join(', ')})` };
+                    }
+                    this.apply(agent.session, name, (policy) => { this.ctx.approval.setPolicy(agent, policy); });
+                    return { kind: 'success', text: `preset ${name}` };
+                },
+            });
+        });
+    }
+    /**
+     * The advertised preset names, in the preset table's declaration order.
+     * @returns every switchable preset name.
+     */
+    get names() {
+        return Object.keys(this.presets);
+    }
+    /**
+     * The preset currently selected as the default for future sessions.
+     * @returns the resolved settings value, or the composition default without
+     * a mounted settings provider.
+     */
+    get defaultPreset() {
+        return this.defaultSettings().defaultPreset;
+    }
+    /**
+     * Resolve the preset matching the effective knob values. A still-matching
+     * last selection wins shared-bundle ties; otherwise the first table match
+     * wins, or {@link CUSTOM_PRESET} when no entry matches.
+     * @param events - the session's events in log order.
+     * @returns the effective preset name, or `custom` when nothing matches.
+     */
+    current(events) {
+        return this.derive(foldKnobs(events));
+    }
+    /** Resolve the preset for one folded knob state (the shared mathematics of `current` and the projection unit). */
+    derive(state) {
+        const sandbox = state.sandbox ?? this.ctx.shell.sandboxMode;
+        const approval = state.approval ?? this.ctx.approval.config.policy ?? 'ask';
+        const matches = (spec) => spec.sandbox === sandbox && spec.approval === approval;
+        if (state.preset !== null) {
+            const spec = this.presets[state.preset];
+            if (spec !== undefined && matches(spec))
+                return state.preset;
+        }
+        for (const [name, spec] of Object.entries(this.presets)) {
+            if (matches(spec))
+                return name;
+        }
+        return CUSTOM_PRESET;
+    }
+    /**
+     * Build the whole select value for one folded knob state: every table
+     * option in declaration order, `custom` appended exactly while derived.
+     * @param state - the folded knob overrides.
+     * @returns the `permissions` projection payload.
+     */
+    selectFor(state) {
+        const currentValue = this.derive(state);
+        return {
+            options: [
+                ...this.names.map(name => this.optionOf(name)),
+                ...currentValue === CUSTOM_PRESET ? [this.optionOf(CUSTOM_PRESET)] : [],
+            ],
+            currentValue,
+        };
+    }
+    /**
+     * Resolve a preset's knob bundle.
+     * @param name - the preset name to resolve.
+     * @returns the configured bundle.
+     * @throws when `name` is not in the table.
+     */
+    resolve(name) {
+        const spec = this.presets[name];
+        if (spec === undefined) {
+            throw new Error(`permission: unknown preset "${name}" (known: ${Object.keys(this.presets).join(', ')})`);
+        }
+        return spec;
+    }
+    /**
+     * Build the client option for a table entry or {@link CUSTOM_PRESET}. A
+     * missing label falls back to the table key.
+     * @param name - a table key, or `custom`.
+     * @returns the option a client renders.
+     * @throws when `name` is neither a table key nor `custom`.
+     */
+    optionOf(name) {
+        if (name === CUSTOM_PRESET) {
+            return { value: CUSTOM_PRESET, name: 'Custom', description: 'Current sandbox and approval settings do not match a preset.' };
+        }
+        const spec = this.resolve(name);
+        return { value: name, name: spec.name ?? name, ...spec.description !== undefined ? { description: spec.description } : {} };
+    }
+    /**
+     * Record a changed preset, then update each changed knob through its own
+     * setter. Selecting the effective preset again appends nothing.
+     * @param session - the session the switch belongs to.
+     * @param name - the preset to switch to; unknown names throw.
+     */
+    set(session, name) {
+        this.apply(session, name, (policy) => { setApprovalPolicy(session, policy); });
+    }
+    /** Apply one preset with the caller-selected live or initialization policy writer. */
+    apply(session, name, setApproval) {
+        const spec = this.resolve(name);
+        if (this.current(session.events) !== name) {
+            session.append('permission/preset', { preset: name });
+        }
+        const events = session.events;
+        if (spec.sandbox !== (effectiveSandboxMode(events) ?? this.ctx.shell.sandboxMode)) {
+            setSandboxMode(session, spec.sandbox);
+        }
+        if (spec.approval !== (effectiveApprovalPolicy(events) ?? this.ctx.approval.config.policy ?? 'ask')) {
+            setApproval(spec.approval);
+        }
+    }
+    /**
+     * Fill every missing permission fact before a session is published. A
+     * genuinely fresh session uses the current user default; seeded or partially
+     * initialized sessions preserve their effective knob values and only gain
+     * the missing durable facts.
+     */
+    pinInitialPermission(session) {
+        const events = session.events;
+        const selected = effectivePermissionPreset(events);
+        const sandbox = effectiveSandboxMode(events);
+        const approval = effectiveApprovalPolicy(events);
+        const seeded = events.some(event => event.type === 'session/end-seed');
+        if (selected === undefined && sandbox === undefined && approval === undefined && !seeded) {
+            const name = this.defaultPreset;
+            const spec = this.resolve(name);
+            session.append('permission/preset', { preset: name });
+            setSandboxMode(session, spec.sandbox);
+            setApprovalPolicy(session, spec.approval);
+            return;
+        }
+        const state = {
+            preset: selected ?? null,
+            sandbox: sandbox ?? null,
+            approval: approval ?? null,
+        };
+        const effective = this.derive(state);
+        if (selected === undefined && effective !== CUSTOM_PRESET) {
+            session.append('permission/preset', { preset: effective });
+        }
+        if (sandbox === undefined) {
+            setSandboxMode(session, this.ctx.shell.sandboxMode);
+        }
+        if (approval === undefined) {
+            setApprovalPolicy(session, this.ctx.approval.config.policy ?? 'ask');
+        }
+    }
+}
+export default PermissionPresetService;
+//# sourceMappingURL=index.js.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,13 @@
+/** Package-owned permission-preset event invariants. @module @stackstackstack/dsh-permission-presets/invariant */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "permission-presets-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register the permission invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -0,0 +1,32 @@
+/** Package-owned permission-preset event invariants. @module @stackstackstack/dsh-permission-presets/invariant */
+const PACKAGE_NAME = '@stackstackstack/dsh-permission-presets';
+/** Cordis companion plugin name. */
+export const name = 'permission-presets-invariant';
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants'];
+/** Validate the package-owned event fields and ignore unrelated events. */
+function validateEvent(ctx, event, fail) {
+    if (event.type === 'permission/preset' && !ctx.permissionPresets.names.includes(event.data.preset)) {
+        fail(`permission/preset names unknown preset ${JSON.stringify(event.data.preset)}`);
+    }
+}
+/** Install validation that loaded and newly appended preset events remain resolvable. */
+const install = Object.assign((ctx, fail) => {
+    for (const session of ctx.sessions.list()) {
+        for (const event of session.events)
+            validateEvent(ctx, event, fail);
+    }
+    ctx.on('internal/dispatch', (_mode, eventName, args) => {
+        if (eventName !== 'session/event')
+            return;
+        const event = args[1];
+        validateEvent(ctx, event, fail);
+    }, { global: true });
+}, { inject: ['permissionPresets', 'sessions'] });
+/**
+ * Register the permission invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/lib/types/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure types of the permission domain: the ONE home of the `permissions`
+ * projection-key declaration plus its payload types, free of this package's
+ * host-side value imports (cordis, schemastery). Two namespace projections
+ * serve it — the package root re-export for host consumers, `./client` (the
+ * browser half-entry's re-export) for client aggregates — with zero content
+ * duplication.
+ *
+ * @module @stackstackstack/dsh-permission-presets/types
+ */
+/** The select-option shape a presentation layer advertises for one preset (or for the derived `custom` state). */
+export interface PresetOption {
+    /** Stable option value: the table key, or `custom`. */
+    value: string;
+    /** The display label. */
+    name: string;
+    /** One user-facing sentence on what the value means; omitted when not configured. */
+    description?: string;
+}
+/**
+ * Whole `permissions` projection value: every switchable preset in table
+ * order (plus the derived current-only `custom` when the knobs match no
+ * entry) and the effective current value.
+ */
+export interface PermissionSelect {
+    /** Switchable presets, plus `custom` appended exactly while it is current. */
+    options: PresetOption[];
+    /** The effective current value: a preset table key, or `custom`. */
+    currentValue: string;
+}
+declare module '@stackstackstack/dsh-session-projection/types' {
+    interface SessionProjectionMap {
+        /**
+         * The session's permission select, folded from the three whole-value
+         * knob events (`permission/preset`, `sandbox/mode`, `approval/policy`)
+         * over the composition defaults. Key absence means no permission service
+         * is composed — clients hide the control.
+         */
+        permissions: PermissionSelect;
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types/types.js

@@ -0,0 +1,12 @@
+/**
+ * Pure types of the permission domain: the ONE home of the `permissions`
+ * projection-key declaration plus its payload types, free of this package's
+ * host-side value imports (cordis, schemastery). Two namespace projections
+ * serve it — the package root re-export for host consumers, `./client` (the
+ * browser half-entry's re-export) for client aggregates — with zero content
+ * duplication.
+ *
+ * @module @stackstackstack/dsh-permission-presets/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@stackstackstack/dsh-permission-presets",
+  "description": "User-facing permission presets (ctx.permissionPresets) for the DeepSeek Harness: one product-level Permissions select bundling the sandbox-mode and approval-policy knobs, written through to their own session events",
+  "version": "0.1.5",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/interaction/permission-presets"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./client": {
+      "types": "./lib/types/client.d.ts",
+      "default": "./lib/types/client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@stackstackstack/dsh-shell": "^0.1.5",
+    "@stackstackstack/dsh-commands": "^0.1.5",
+    "@stackstackstack/dsh-sandbox": "^0.1.5",
+    "@stackstackstack/dsh-sandbox-policy": "^0.1.5",
+    "@stackstackstack/dsh-session": "^0.1.5",
+    "@stackstackstack/dsh-session-projection": "^0.1.5",
+    "@stackstackstack/dsh-settings": "^0.1.5",
+    "@stackstackstack/dsh-invariants": "^0.1.5",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@stackstackstack/dsh-user-approval": "^0.1.5"
+  },
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@stackstackstack/dsh-shell": "^0.1.5",
+    "@stackstackstack/dsh-invariants": "^0.1.5",
+    "@stackstackstack/dsh-commands": "^0.1.5",
+    "@stackstackstack/dsh-sandbox": "^0.1.5",
+    "@stackstackstack/dsh-sandbox-policy": "^0.1.5",
+    "@stackstackstack/dsh-session": "^0.1.5",
+    "@stackstackstack/dsh-session-projection": "^0.1.5",
+    "@stackstackstack/dsh-settings": "^0.1.5",
+    "@stackstackstack/dsh-user-approval": "^0.1.5",
+    "@deepseek-ai/cordis": "^4.0.1"
+  }
+}