@x1a0f3n9/dsh-sandbox-policy 0.1.5-alpha.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/sandbox/sandbox-policy/README.md
+README.md: c29908937eb2b2cdae4ced5224d441d8fef3df34
+README.zh.md: 2285360ea9c7f7e18b367e02636eb71601f475c1

package/README.md

@@ -0,0 +1,159 @@
+---
+description: "The shared per-call sandbox policy resolver and current model context for users and maintainers composing, configuring, or debugging file-effect policy across enforcing capabilities."
+kind: "package-reference"
+---
+
+# @x1a0f3n9/dsh-sandbox-policy
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Use this package to apply one file-effect policy to every confined bash, filesystem, and terminal call. Deployments choose a default mode and fallback workspace root, while each session can switch modes independently. Session choices survive restart, and all enforcing capabilities use the same mode and workspace for a call. Before each model request, the model receives the effective policy and workspace without an inventory of mounted capabilities.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Mount this package in any composition where sandbox-enforcing capabilities run: it owns the deployment default and the per-session overrides those capabilities consume, and it contributes the current policy to the model's runtime-context snapshot.
+
+### When to choose it
+
+Choose it for every composition with confined capabilities (bash, filesystem, terminal) so one policy home keeps them from drifting into different modes or workspace roots. Skip it only when nothing enforces sandbox policy — with no consumers, the resolved policy has no effect.
+
+### Minimal configuration
+
+Load the package with a default mode; the fail-safe default is `read-only`, and a deployment that wants a workspace-writable agent opts into `workspace-write` explicitly.
+
+```yaml
+- name: '@x1a0f3n9/dsh-sandbox-policy'
+  config:
+    mode: workspace-write
+    workspaceRoot: /absolute/path/to/workspace
+```
+
+| Field | Default | Meaning |
+|---|---|---|
+| `mode` | `read-only` | The deployment default mode a session starts from, validated at load |
+| `workspaceRoot` | `process.cwd()` | The fallback root `workspace-write` may write under for agentless calls or sessions without a cwd; normal agent calls use the session's immutable cwd instead |
+
+The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-sandbox-policy) is the exhaustive source for every accepted field and its JSDoc.
+
+### Switching a session's mode
+
+A session's mode can be switched at runtime through a UI policy control or an explicit switch; the switch is recorded in the session log and takes effect on the session's next confined call. The switch survives restart through replay, and each session keeps its own mode — two sessions never see each other's state. A switched session keeps its immutable workspace cwd as the writable boundary.
+
+### Failures and recovery
+
+An invalid configured mode is rejected when the plugin loads, so a typo fails loud instead of silently changing policy. A session without a cwd, and agentless calls, fall back to the configured workspace root; a call with an approved explicit mode uses that mode for exactly that call.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+This section explains policy resolution, the per-session store, and the model-visible contribution; the observable behavior is fully covered in [Use this package](#use-this-package).
+
+### Resolution precedence
+
+`resolve({ session, mode })` returns one complete per-call policy: an approved explicit mode outranks the session's last `sandbox/mode` event, which outranks the deployment default. The session's immutable `cwd` is canonicalized with filesystem semantics before becoming the workspace root, so `symlink/..` agrees with process working-directory resolution; otherwise the configured fallback applies.
+
+### The per-session store
+
+A runtime switch is one log-only `sandbox/mode` event on the session it applies to — the switch IS its event, and nothing mutates mode state out of band. `effective = explicit grant ?? fold(events) ?? deployment default`, so an override survives restart by replay and two sessions never see each other's state. Workspace identity needs no event: the immutable `SessionHeader.cwd` recorded at creation is the root for every call in that session. The event stays log-only; before each request, the owner contributes the current fact to the full runtime-context snapshot, and the agent loop logs that snapshot as a sourced `user/message`.
+
+### Model-visible text
+
+The `sandbox:policy` contribution states the mode's capability-neutral file-effect contract and the canonical session workspace under `workspace-write`. It does not enumerate mounted capabilities; tool plugins retain operation-specific denial and escalation guidance, approval policy contributes separately to the same snapshot, and plan guidance remains `dsh-plan-mode`'s system section. The optional `./invariant` companion rejects a forged durable `sandbox/mode` event whose value falls outside the closed mode vocabulary.
+
+### Source map
+
+| File | Role |
+|---|---|
+| [`src/index.ts`](src/index.ts) | Plugin entry: `SandboxPolicyService`, `Config` schema, policy resolution and context contribution |
+| [`src/session-mode.ts`](src/session-mode.ts) | The `sandbox/mode` event, its fold, and the write path |
+| [`src/invariant.ts`](src/invariant.ts) | Invariant companion: rejects `sandbox/mode` values outside the closed vocabulary |
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+Start with the subsystem reference for the shared vocabulary, then the seam contract and the cross-family decision.
+
+- [Process sandbox subsystem](../../../docs/subsystems/sandbox.md) — modes, per-call policy, and enforcement semantics.
+- [Sandbox seam package](../sandbox/README.md) — the confinement contract every enforcing capability implements.
+- [Cross-family file sandbox decision](../../../.agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.md) — why one shared policy home exists.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Current file sandbox policy
+
+#### What the model sees
+
+One `sandbox:policy` contribution in the current runtime-context snapshot for every agent session. It does not enumerate mounted capabilities. Tool plugins retain operation and escalation guidance, approval policy contributes separately to the same snapshot, and plan guidance remains `dsh-plan-mode`'s system section.
+
+##### Read-only
+
+```markdown
+Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.
+```
+
+##### Workspace-write
+
+```markdown
+Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: "<workspace root>". Some platform temporary areas may also be writable.
+```
+
+##### Danger-full-access
+
+```markdown
+Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.
+```
+
+#### Token effect
+
+One concise durable context message on the first request and each effective policy change; unchanged requests add nothing. `workspace-write` carries only the canonical session workspace path; platform-specific temporary paths are summarized without adding host-dependent bytes.
+
+#### KV Cache effect
+
+The stable system prompt remains byte-identical across mode changes. A changed full context snapshot is appended after retained history, preserving the prior cached prefix; subsequent unchanged requests reuse that retained snapshot.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+
+These limits define the policy surface this package provides. They are current package constraints, not a general sandbox comparison or a task backlog.
+
+- **One primary workspace root per session** — policy resolves `SessionHeader.cwd`; extra writable roots are not part of `SandboxExecutionPolicy`.
+- **File-effect modes only** — `SandboxMode` governs file effects; network and process policy are outside its vocabulary, so no knob here restricts them.
+- **Temporary areas are deliberately summarized** — enforcing backends grant different platform temporary areas, which are selected after policy resolution and therefore cannot be enumerated truthfully in the current context.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>

package/README.zh.md

@@ -0,0 +1,159 @@
+---
+description: "面向组合、配置或排查跨执行能力文件效果策略的用户与维护者的共享逐调用沙箱策略解析器与当前模型上下文。"
+kind: "package-reference"
+---
+
+# @x1a0f3n9/dsh-sandbox-policy
+
+[English](README.md) | 中文
+
+## 概述
+
+使用本包可以让每次受限的 bash、文件系统和终端调用遵循同一份文件操作策略。部署方选择默认模式和回退工作区根目录，每个会话则可以独立切换模式。会话选择可跨重启保留，所有强制执行能力在一次调用中使用相同的模式和工作区。每次模型请求前，模型都会收到有效策略和工作区说明，但不会收到已挂载能力的清单。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [进一步探索](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+在任何运行沙箱强制执行能力的组合中挂载此包：它拥有这些能力消费的部署默认值与逐会话覆盖，并把当前策略贡献给模型的运行时上下文快照。
+
+### 何时选择
+
+为每个带受限能力（bash、文件系统、终端）的组合选择它，让单一策略归属位置防止它们漂移到不同的模式或工作区根目录。只有没有任何沙箱策略强制执行时才跳过它——没有消费方时，解析出的策略不起作用。
+
+### 最小配置
+
+用默认模式加载本包；故障安全默认值是 `read-only`，想要可写工作区 agent 的部署需要显式选择 `workspace-write`。
+
+```yaml
+- name: '@x1a0f3n9/dsh-sandbox-policy'
+  config:
+    mode: workspace-write
+    workspaceRoot: /absolute/path/to/workspace
+```
+
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `mode` | `read-only` | 会话起始的部署默认模式，加载时验证 |
+| `workspaceRoot` | `process.cwd()` | 无 agent（智能体）调用或没有 cwd 的会话在 `workspace-write` 下可写入的回退根目录；普通 agent 调用改用会话的不可变 cwd |
+
+生成的[配置目录](../../../docs/config-catalog.zh.md#deepseek-aidsh-sandbox-policy)是每个受支持字段及其 JSDoc 的穷尽式真源。
+
+### 切换会话模式
+
+会话的模式可以在运行时通过 UI 策略控件或显式切换来更改；切换记录在会话日志中，并在该会话的下一次受限调用时生效。切换通过回放跨重启保留，每个会话保持自己的模式——两个会话绝不会看到彼此状态。切换后的会话继续以不可变的工作区 cwd 作为写入边界。
+
+### 失败与恢复
+
+无效的配置模式会在插件加载时被拒绝，因此拼写错误会大声失败，而不是静默改变策略。没有 cwd 的会话与无 agent 调用回退到配置的工作区根目录；带已批准显式模式的调用只在该次调用中使用该模式。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>实现细节——点击展开</summary>
+
+本节解释策略解析、逐会话存储与模型可见贡献；可观察行为已在[使用本包](#use-this-package)中完整说明。
+
+### 解析优先级
+
+`resolve({ session, mode })` 返回一份完整的逐调用策略：已批准的显式模式优先于会话最后一条 `sandbox/mode` 事件，后者又优先于部署默认值。会话的不可变 `cwd` 先按文件系统语义规范化，再成为工作区根目录，因此 `symlink/..` 与进程工作目录解析一致；否则使用配置的回退值。
+
+### 逐会话存储
+
+运行时切换是在对应会话日志中追加的一条仅记录 `sandbox/mode` 事件——切换本身就是事件，任何机制都不会在带外修改模式状态。`effective = explicit grant ?? fold(events) ?? deployment default`，因此覆盖通过回放跨重启保留，两个会话也绝不会看到彼此状态。工作区标识无需事件：创建时记录的不可变 `SessionHeader.cwd` 是该会话每次调用使用的根。事件仍只进入日志；在每次请求前，归属方会把当前事实贡献给完整运行时上下文快照，agent loop（智能体循环）将该快照记录为一条带来源的 `user/message`。
+
+### 模型可见文本
+
+`sandbox:policy` 贡献说明模式的与具体能力无关的文件操作约定，以及 `workspace-write` 下规范化的会话工作区。它不枚举已挂载能力；工具插件保留特定于操作的拒绝与升权引导，批准策略单独贡献给同一份快照，计划引导仍由 `dsh-plan-mode` 的系统段落管理。可选的 `./invariant` 配套组件会拒绝值超出封闭模式词汇的伪造持久 `sandbox/mode` 事件。
+
+### 源码地图
+
+| 文件 | 职责 |
+|---|---|
+| [`src/index.ts`](src/index.ts) | 插件入口：`SandboxPolicyService`、`Config` schema、策略解析与上下文贡献 |
+| [`src/session-mode.ts`](src/session-mode.ts) | `sandbox/mode` 事件、其 fold 与写入路径 |
+| [`src/invariant.ts`](src/invariant.ts) | 不变式伴生插件：拒绝超出封闭词汇的 `sandbox/mode` 值 |
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 进一步探索
+
+先从子系统参考文档了解共享词汇，再看 seam 约定与跨家族决策。
+
+- [进程沙箱子系统](../../../docs/subsystems/sandbox.zh.md)——模式、逐调用策略与强制执行语义。
+- [沙箱 seam 包](../sandbox/README.zh.md)——每个强制执行能力实现的隔离约定。
+- [跨家族文件沙箱决策](../../../.agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.zh.md)——为何存在统一的共享策略归属位置。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+### 当前文件沙箱策略
+
+#### 模型看到什么
+
+每个 agent 会话的当前运行时上下文快照中都有一项 `sandbox:policy` 贡献。它不枚举已挂载的能力。工具插件继续负责操作与升权引导，批准策略单独贡献给同一份快照，计划引导仍由 `dsh-plan-mode` 的系统段落管理。
+
+##### 只读
+
+```markdown
+Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.
+```
+
+##### 工作区写入
+
+```markdown
+Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: "<workspace root>". Some platform temporary areas may also be writable.
+```
+
+##### 完全访问
+
+```markdown
+Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.
+```
+
+#### Token 影响
+
+首次请求和有效策略每次变化时增加一条简洁的持久上下文消息；未变化的请求不增加内容。`workspace-write` 只携带规范化的会话工作区路径；平台特定的临时路径会以摘要表述，不会加入依赖主机的字节。
+
+#### KV Cache 影响
+
+模式切换时，稳定的系统提示词仍逐字节相同。变化后的完整上下文快照会追加到保留的历史之后，从而保留此前已缓存的前缀；后续未变化的请求会复用该保留快照。
+
+## 已知限制与延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+
+这些限制定义了本包提供的策略表面。它们是当前包约束，不是通用沙箱对比或任务积压。
+
+- **每个会话只有一个主要工作区根目录**——策略解析 `SessionHeader.cwd`；额外可写根目录不属于 `SandboxExecutionPolicy`。
+- **仅限文件操作模式**——`SandboxMode` 管控文件操作；网络和进程策略不在其词汇中，因此这里没有限制它们的旋钮。
+- **有意概述临时区域**——强制执行后端会授予不同的平台临时区域，这些区域在策略解析后才会选定，因此无法在当前上下文中如实枚举。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者的工作上下文——点击展开</summary>
+
+无。
+
+</details>

package/lib/index.js

@@ -0,0 +1,159 @@
+import { resolve } from "node:path";
+import { Service } from "@deepseek-ai/cordis";
+import { z } from "zod";
+import z$1 from "@deepseek-ai/schemastery";
+import { canonicalPath } from "@x1a0f3n9/dsh-sandbox";
+//#region lib/types/session-mode.js
+/**
+* Per-session sandbox-mode override: the session log as the store. A runtime
+* switch (a UI policy control or test scenario) is recorded as one
+* `sandbox/mode` event on the session it applies to;
+* `effective = projection state ?? the deployment default`, so an override
+* survives restart by replay, two sessions can never see each other's state,
+* and there is no external config store. The event is log-only (the
+* `approval/*` precedent): the policy owner projects the fold into each model
+* request, while enforcing tools report operation-specific boundary markers.
+* EXECUTION honors the same fold through `ctx.sandboxPolicy.resolve()` — it
+* stamps the mode together with the calling session's workspace root onto each
+* capability call, weakest-precedence beneath an escalation grant.
+*
+* The override is policy state shared by every enforcing family (bash and
+* filesystem alike), so it lives here in the policy package rather than in any
+* one capability's seam.
+*
+* @module dsh-sandbox-policy/session-mode
+*/
+/** Every {@link SandboxMode}, for option advertisement and runtime validation of untrusted mode strings. */
+const SANDBOX_MODES = [
+	"read-only",
+	"workspace-write",
+	"danger-full-access"
+];
+/**
+* THE write path for a session's sandbox-mode override: appends exactly one
+* `sandbox/mode` event — the switch IS its event; nothing mutates mode state
+* out of band. Takes effect on the session's next confined call (bash or fs)
+* — consumers read the shared projection state.
+* @param session - the session the override belongs to.
+* @param mode - the mode every subsequent confined call in this session runs
+*   under (until the next switch).
+*/
+function setSandboxMode(session, mode) {
+	session.append("sandbox/mode", { mode });
+}
+//#endregion
+//#region lib/types/index.js
+/**
+* The sandbox POLICY home (`ctx.sandboxPolicy`): the single owner of the
+* deployment's sandbox fallbacks plus per-session resolution: the file-effect
+* {@link SandboxMode}, the `workspace-write` root, and the override kit (the
+* `sandbox/mode` event, its fold, and its write path; the fold is the
+* `sandboxMode` session-projection unit registered here, while the event and
+* write path come from `./session-mode.ts`).
+* Before each agent request, the owner also contributes the resolved policy to
+* the cache-safe runtime-context snapshot. The agent loop logs that snapshot as
+* model history, so replay reconstructs the same mode and root the enforcing
+* consumers resolve without rewriting the stable system prompt.
+*
+* Enforcing filesystem, one-shot bash, and terminal backends read the SAME
+* resolved policy here. The context describes that policy without inventorying
+* capabilities, while each backend retains its own enforcement dialect and each
+* tool owns its operation-specific denial and escalation guidance. The service
+* reads session state once at each operation boundary; executors and providers
+* remain session-free.
+*
+* @module @x1a0f3n9/dsh-sandbox-policy
+*/
+/** Resolve filesystem identity before lexical normalization can erase symlink-sensitive components. */
+function resolveWorkspaceRoot(path) {
+	return resolve(canonicalPath(path));
+}
+/** Render the policy without claiming which capabilities are mounted. */
+function renderPolicyContext(policy) {
+	switch (policy.mode) {
+		case "read-only": return "Current DSH file policy: read-only. Any available operation enforced by the DSH file sandbox cannot modify files in the standing mode. Do not refuse a required modification from this policy alone: try an available tool normally and follow any denial and escalation guidance it returns.";
+		case "workspace-write": return `Current DSH file policy: workspace-write. Any available operation enforced by the DSH file sandbox may modify files under the session workspace: ${JSON.stringify(policy.workspaceRoot)}. Some platform temporary areas may also be writable.`;
+		case "danger-full-access": return "Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.";
+		/* v8 ignore next 4 -- SandboxMode is a typed same-process closed union; this branch is only the static exhaustiveness guard. */
+		default: {
+			const mode = policy.mode;
+			throw new Error(`unreachable sandbox mode: ${String(mode)}`);
+		}
+	}
+}
+/** The sandbox-mode projection's state schema (state equals the public shape). */
+const sandboxModeStateSchema = z.union([
+	z.literal("read-only"),
+	z.literal("workspace-write"),
+	z.literal("danger-full-access")
+]).nullable();
+/**
+* The sandbox-policy service (`ctx.sandboxPolicy`). Owns the deployment
+* default mode, fallback workspace root, and current request-time policy
+* section. Tool layers call {@link resolve} for each execution so a session's
+* mode log and immutable cwd travel together to every enforcing capability.
+*/
+var SandboxPolicyService = class extends Service {
+	static Config = z$1.object({
+		mode: z$1.union([
+			"read-only",
+			"workspace-write",
+			"danger-full-access"
+		]).default("read-only"),
+		workspaceRoot: z$1.string()
+	});
+	static inject = ["sessionProjections"];
+	/** The deployment default mode — the fallback beneath a session override. */
+	defaultMode;
+	/** The absolute `workspace-write` fallback root for calls without a session cwd. */
+	workspaceRoot;
+	constructor(ctx, config) {
+		super(ctx, "sandboxPolicy");
+		this.defaultMode = config.mode;
+		this.workspaceRoot = resolveWorkspaceRoot(config.workspaceRoot ?? process.cwd());
+		ctx.sessionProjections.register({
+			key: "sandboxMode",
+			stateVersion: 1,
+			stateSchema: sandboxModeStateSchema,
+			init: () => null,
+			apply: (state, event) => event.type === "sandbox/mode" ? event.data.mode : state
+		});
+		ctx.inject(["systemPrompt"], (scope) => {
+			scope.systemPrompt.context({
+				name: "sandbox:policy",
+				order: scope.systemPrompt.getContextOrder("SANDBOX_POLICY"),
+				text: (context) => {
+					const session = context.agent?.session;
+					return session === void 0 ? "" : renderPolicyContext(this.resolve({ session }));
+				}
+			});
+		});
+	}
+	/**
+	* Resolve the complete policy for one capability call. An approved explicit
+	* mode outranks the session's last `sandbox/mode` event, which outranks the
+	* deployment default. A session cwd is its workspace-write boundary; the
+	* configured root is the fallback for agentless calls and sessions without a
+	* cwd.
+	* @param request - optional session and approved mode override.
+	* @returns the fully resolved per-call mode and absolute workspace root.
+	*/
+	resolve(request = {}) {
+		const { session } = request;
+		return {
+			mode: request.mode ?? (session === void 0 ? void 0 : this.overrideOf(session)) ?? this.defaultMode,
+			workspaceRoot: resolveWorkspaceRoot(session?.header.cwd ?? this.workspaceRoot),
+			...session === void 0 ? {} : { sessionId: session.id }
+		};
+	}
+	/**
+	* Read the session override without applying the deployment default.
+	* @param session - session whose log supplies the override.
+	* @returns the last logged mode, or `undefined` without one.
+	*/
+	overrideOf(session) {
+		return this.ctx.sessionProjections.stateOf(session, "sandboxMode") ?? void 0;
+	}
+};
+//#endregion
+export { SANDBOX_MODES, SandboxPolicyService, SandboxPolicyService as default, setSandboxMode };

package/lib/invariant.js

@@ -0,0 +1,55 @@
+//#region lib/types/session-mode.js
+/**
+* Per-session sandbox-mode override: the session log as the store. A runtime
+* switch (a UI policy control or test scenario) is recorded as one
+* `sandbox/mode` event on the session it applies to;
+* `effective = projection state ?? the deployment default`, so an override
+* survives restart by replay, two sessions can never see each other's state,
+* and there is no external config store. The event is log-only (the
+* `approval/*` precedent): the policy owner projects the fold into each model
+* request, while enforcing tools report operation-specific boundary markers.
+* EXECUTION honors the same fold through `ctx.sandboxPolicy.resolve()` — it
+* stamps the mode together with the calling session's workspace root onto each
+* capability call, weakest-precedence beneath an escalation grant.
+*
+* The override is policy state shared by every enforcing family (bash and
+* filesystem alike), so it lives here in the policy package rather than in any
+* one capability's seam.
+*
+* @module dsh-sandbox-policy/session-mode
+*/
+/** Every {@link SandboxMode}, for option advertisement and runtime validation of untrusted mode strings. */
+const SANDBOX_MODES = [
+	"read-only",
+	"workspace-write",
+	"danger-full-access"
+];
+//#endregion
+//#region lib/types/invariant.js
+/** Package-owned session-event invariants for sandbox policy. @module @x1a0f3n9/dsh-sandbox-policy/invariant */
+const PACKAGE_NAME = "@x1a0f3n9/dsh-sandbox-policy";
+/** Cordis companion plugin name. */
+const name = "sandbox-policy-invariant";
+/** Service required before the companion can reserve package ownership. */
+const inject = ["invariants"];
+/** Validate the package-owned event fields and ignore unrelated events. */
+function validateEvent(event, fail) {
+	if (event.type === "sandbox/mode" && !SANDBOX_MODES.includes(event.data.mode)) fail(`sandbox/mode carries unknown mode ${JSON.stringify(event.data.mode)}`);
+}
+/** Install validation for loaded and newly appended sandbox modes. */
+const install = Object.assign((ctx, fail) => {
+	for (const session of ctx.sessions.list()) for (const event of session.snapshotEvents()) validateEvent(event, fail);
+	ctx.on("internal/dispatch", (_mode, eventName, args) => {
+		if (eventName !== "session/event") return;
+		const event = args[1];
+		validateEvent(event, fail);
+	}, { global: true });
+}, { inject: ["sessions"] });
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The sandbox POLICY home (`ctx.sandboxPolicy`): the single owner of the
+ * deployment's sandbox fallbacks plus per-session resolution: the file-effect
+ * {@link SandboxMode}, the `workspace-write` root, and the override kit (the
+ * `sandbox/mode` event, its fold, and its write path; the fold is the
+ * `sandboxMode` session-projection unit registered here, while the event and
+ * write path come from `./session-mode.ts`).
+ * Before each agent request, the owner also contributes the resolved policy to
+ * the cache-safe runtime-context snapshot. The agent loop logs that snapshot as
+ * model history, so replay reconstructs the same mode and root the enforcing
+ * consumers resolve without rewriting the stable system prompt.
+ *
+ * Enforcing filesystem, one-shot bash, and terminal backends read the SAME
+ * resolved policy here. The context describes that policy without inventorying
+ * capabilities, while each backend retains its own enforcement dialect and each
+ * tool owns its operation-specific denial and escalation guidance. The service
+ * reads session state once at each operation boundary; executors and providers
+ * remain session-free.
+ *
+ * @module @x1a0f3n9/dsh-sandbox-policy
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+import { z as zod } from 'zod';
+import z from '@deepseek-ai/schemastery';
+import { type SandboxExecutionPolicy, type SandboxMode } from '@x1a0f3n9/dsh-sandbox';
+import type { Session } from '@x1a0f3n9/dsh-session';
+export { SANDBOX_MODES, setSandboxMode } from './session-mode.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        sandboxPolicy: SandboxPolicyService;
+    }
+}
+/**
+ * Plugin config: the deployment's sandbox default. All optional — `Config`
+ * supplies the defaults (`mode: 'read-only'` is the fail-safe default; a
+ * deployment that wants a workspace-writable agent opts in explicitly). The
+ * runner choice is NOT here (it is the `ctx.sandbox` provider's config), nor
+ * is any per-family knob: this is the one shared policy home.
+ */
+export interface Config {
+    /** File-sandbox mode a session starts from (default: `read-only`). */
+    mode?: SandboxMode;
+    /**
+     * Fallback root for agentless calls and sessions without a cwd (default:
+     * `process.cwd()`). Normal agent calls use their session cwd instead.
+     */
+    workspaceRoot?: string;
+}
+/** Inputs that select the sandbox policy for one capability call. */
+export interface SandboxPolicyRequest {
+    /** Calling session; its immutable cwd becomes the workspace boundary. */
+    session?: Session;
+    /** Explicit approved mode override, which outranks session policy. */
+    mode?: SandboxMode;
+}
+/** The sandbox-mode projection's state schema (state equals the public shape). */
+declare const sandboxModeStateSchema: zod.ZodNullable<zod.ZodUnion<readonly [zod.ZodLiteral<"read-only">, zod.ZodLiteral<"workspace-write">, zod.ZodLiteral<"danger-full-access">]>>;
+type SandboxModeState = zod.infer<typeof sandboxModeStateSchema>;
+declare module '@x1a0f3n9/dsh-session-projection/types' {
+    interface SessionProjectionStateMap {
+        /** Last logged sandbox-mode override, or null before one (deployment default applies at resolve time). */
+        sandboxMode: SandboxModeState;
+    }
+}
+/**
+ * The sandbox-policy service (`ctx.sandboxPolicy`). Owns the deployment
+ * default mode, fallback workspace root, and current request-time policy
+ * section. Tool layers call {@link resolve} for each execution so a session's
+ * mode log and immutable cwd travel together to every enforcing capability.
+ */
+export declare class SandboxPolicyService extends Service {
+    static Config: z<Config>;
+    static inject: string[];
+    /** The deployment default mode — the fallback beneath a session override. */
+    readonly defaultMode: SandboxMode;
+    /** The absolute `workspace-write` fallback root for calls without a session cwd. */
+    readonly workspaceRoot: string;
+    constructor(ctx: Context, config: Config);
+    /**
+     * Resolve the complete policy for one capability call. An approved explicit
+     * mode outranks the session's last `sandbox/mode` event, which outranks the
+     * deployment default. A session cwd is its workspace-write boundary; the
+     * configured root is the fallback for agentless calls and sessions without a
+     * cwd.
+     * @param request - optional session and approved mode override.
+     * @returns the fully resolved per-call mode and absolute workspace root.
+     */
+    resolve(request?: SandboxPolicyRequest): SandboxExecutionPolicy;
+    /**
+     * Read the session override without applying the deployment default.
+     * @param session - session whose log supplies the override.
+     * @returns the last logged mode, or `undefined` without one.
+     */
+    overrideOf(session: Session): SandboxMode | undefined;
+}
+export default SandboxPolicyService;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,13 @@
+/** Package-owned session-event invariants for sandbox policy. @module @x1a0f3n9/dsh-sandbox-policy/invariant */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "sandbox-policy-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/session-mode.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Per-session sandbox-mode override: the session log as the store. A runtime
+ * switch (a UI policy control or test scenario) is recorded as one
+ * `sandbox/mode` event on the session it applies to;
+ * `effective = projection state ?? the deployment default`, so an override
+ * survives restart by replay, two sessions can never see each other's state,
+ * and there is no external config store. The event is log-only (the
+ * `approval/*` precedent): the policy owner projects the fold into each model
+ * request, while enforcing tools report operation-specific boundary markers.
+ * EXECUTION honors the same fold through `ctx.sandboxPolicy.resolve()` — it
+ * stamps the mode together with the calling session's workspace root onto each
+ * capability call, weakest-precedence beneath an escalation grant.
+ *
+ * The override is policy state shared by every enforcing family (bash and
+ * filesystem alike), so it lives here in the policy package rather than in any
+ * one capability's seam.
+ *
+ * @module dsh-sandbox-policy/session-mode
+ */
+import type { Session } from '@x1a0f3n9/dsh-session';
+import type { SandboxMode } from '@x1a0f3n9/dsh-sandbox';
+declare module '@x1a0f3n9/dsh-session/types' {
+    interface SessionEventMap {
+        /**
+         * The session's sandbox mode was switched — log-only (like `approval/*`;
+         * NOT a surface event, carries no `surfaceOp`): durable and replayable,
+         * never in the model transcript. The LAST such event is the session's
+         * override (folded by the sandboxMode projection unit). `source: 'delegation'` marks
+         * an override seeded into a child; an absent source is a runtime switch.
+         */
+        'sandbox/mode': {
+            mode: SandboxMode;
+            /** Marks an override seeded into a child at delegation. */
+            source?: 'delegation';
+        };
+    }
+}
+/** Every {@link SandboxMode}, for option advertisement and runtime validation of untrusted mode strings. */
+export declare const SANDBOX_MODES: readonly SandboxMode[];
+/**
+ * THE write path for a session's sandbox-mode override: appends exactly one
+ * `sandbox/mode` event — the switch IS its event; nothing mutates mode state
+ * out of band. Takes effect on the session's next confined call (bash or fs)
+ * — consumers read the shared projection state.
+ * @param session - the session the override belongs to.
+ * @param mode - the mode every subsequent confined call in this session runs
+ *   under (until the next switch).
+ */
+export declare function setSandboxMode(session: Session, mode: SandboxMode): void;
+//# sourceMappingURL=session-mode.d.ts.map

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@x1a0f3n9/dsh-sandbox-policy",
+  "description": "Per-call sandbox policy resolver and current model context: deployment fallbacks plus each session's mode and workspace root, shared by every enforcing capability family",
+  "version": "0.1.5-alpha.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/sandbox/sandbox-policy"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@x1a0f3n9/dsh-agent": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-invariants": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-sandbox": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-session": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-system-prompt": "^0.1.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@x1a0f3n9/dsh-session-projection": "^0.1.5-alpha.2"
+  },
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@deepseek-ai/schemastery": "^3.18.2"
+  },
+  "devDependencies": {
+    "@x1a0f3n9/dsh-agent": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-invariants": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-sandbox": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-session": "^0.1.5-alpha.2",
+    "@x1a0f3n9/dsh-system-prompt": "^0.1.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@x1a0f3n9/dsh-session-projection": "^0.1.5-alpha.2"
+  }
+}