dsh-home-hosted 0.1.3 → 0.1.4

package/docs/DESIGN.md

@@ -31,6 +31,16 @@ node_modules (flat or pnpm), then PATH — and forwards its argv, so the entry
 survives plugin upgrades and profile reinstalls. The plugin preflights the
 launcher the way the unit invokes it and shows the version it answers.
 
+## Approvals follow the session's sandbox
+
+A mutating agent tool asks the approval service only when the calling session is
+*not* already `danger-full-access` (`ctx.sandboxPolicy.resolve({ session })`).
+Asking anyway made a Full-access run fail whenever the deployment's approvals
+auto-reject — the session had already granted exactly what the tool was asking
+about. Below full access the tool still asks and still fails closed, and the
+refusal names the mode and the remedy (Full access, or an answerable approval
+channel).
+
 ## Config compatibility
 
 `onPortConflict: kill` did not exist before home-hosted 0.6.0, and an older panel

package/lib/index.js

@@ -3591,6 +3591,17 @@ var SettingsStore = class {
 
 // src/tools.ts
 import { defineTool } from "@deepseek-ai/dsh-tools";
+function sandboxMode(ctx, exec) {
+  const policy = ctx.get("sandboxPolicy");
+  if (policy?.resolve === void 0)
+    return null;
+  const session = exec?.agent?.session;
+  try {
+    return policy.resolve({ ...session === void 0 ? {} : { session } })?.mode ?? null;
+  } catch {
+    return null;
+  }
+}
 var TOOL_SPECS = {
   status: {
     endpoint: "status",
@@ -3663,17 +3674,20 @@ function registerOne(ctx, service, name2) {
     },
     async execute(args, exec) {
       const input = args ?? {};
-      if (mutating) {
+      const mode = sandboxMode(ctx, exec);
+      const fullAccess = mode === "danger-full-access";
+      if (mutating && !fullAccess) {
         const approval = ctx.get("approval");
+        const remedy = "Set the session to Full access (danger-full-access), or use a session where approvals can be answered.";
         if (approval?.request === void 0)
-          return "refused: this deployment has no approval service, so a mutating home-hosted tool cannot run.";
+          return `refused: this session runs in ${mode ?? "an unknown"} sandbox and the deployment has no approval service. ${remedy}`;
         const outcome = await approval.request({
           agent: exec?.agent,
           toolName,
           reason: `${spec.description} (${JSON.stringify(input)})`
         });
         if (outcome !== "allowed-once")
-          return `refused: approval answered "${outcome}".`;
+          return `refused: approval answered "${outcome}" (session sandbox: ${mode ?? "unknown"}). ${remedy}`;
       }
       try {
         const payload = name2 === "servers_create" ? { entry: input.entry } : name2 === "servers_update" ? { id: input.id, patch: input.patch } : name2 === "status" || name2 === "servers_list" ? {} : { id: input.id, mechanism: input.mechanism };