|
|
@@ -1,15 +1,19 @@
|
|
|
/**
|
|
|
- * Per-session sandbox-mode override: the session log as the store. A runtime
|
|
|
- * switch (a UI policy control or test scenario) is recorded as one
|
|
|
- * `sandbox/mode` event on the session it applies to;
|
|
|
- * `effective = fold(events) ?? the deployment default`, so an override
|
|
|
- * survives restart by replay, two sessions can never see each other's state,
|
|
|
- * and there is no external config store. The event is log-only (the
|
|
|
- * `approval/*` precedent): the model learns the mode from the boundary
|
|
|
- * markers in the enforcing tools, never from the event itself. EXECUTION
|
|
|
- * honors the fold through `ctx.sandboxPolicy.resolve()` — it stamps the mode
|
|
|
- * together with the calling session's workspace root onto each capability
|
|
|
- * call, weakest-precedence beneath an escalation grant.
|
|
|
+ * Per-session sandbox-mode override: the session log as the store, layered
|
|
|
+ * over the header's delegation baseline. A runtime switch (a UI policy
|
|
|
+ * control or test scenario) is recorded as one `sandbox/mode` event on the
|
|
|
+ * session it applies to; `effective = override chain ?? the deployment
|
|
|
+ * default`, where the override chain ({@link sandboxOverrideOf}) is the fold
|
|
|
+ * of the session's OWN post-seed switches, else the inherited
|
|
|
+ * `SessionHeader.sandboxMode` baseline. An override survives restart by
|
|
|
+ * replay, a delegation child starts under its parent's captured policy, two
|
|
|
+ * sessions can never see each other's state, and there is no external config
|
|
|
+ * store. The event is log-only (the `approval/*` precedent): the model
|
|
|
+ * learns the mode from the boundary markers in the enforcing tools, never
|
|
|
+ * from the event itself. EXECUTION honors the chain through
|
|
|
+ * `ctx.sandboxPolicy.resolve()` — it stamps the mode together with the
|
|
|
+ * calling session's workspace root onto each capability call,
|
|
|
+ * weakest-precedence beneath an escalation grant.
|
|
|
*
|
|
|
* The override is policy state shared by every enforcing family (bash and
|
|
|
* filesystem alike), so it lives here in the policy package rather than in any
|
|
|
@@ -26,10 +30,11 @@ declare module '@deepseek-ai/dsh-session' {
|
|
|
/**
|
|
|
* The session's sandbox mode was switched — log-only (like `approval/*`;
|
|
|
* NOT a surface event, carries no `surfaceOp`): durable and replayable,
|
|
|
- * never in the model transcript. The LAST such event is the session's
|
|
|
- * override ({@link effectiveSandboxMode}); who asked for it is derivable
|
|
|
- * from position (an event after the log's last `request/header*` was a
|
|
|
- * runtime switch by the user; see the tool layer's narrator).
|
|
|
+ * never in the model transcript. The last such OWN (post-seed) event is
|
|
|
+ * the session's override ({@link sandboxOverrideOf}); who asked for it is
|
|
|
+ * derivable from position (an event after the log's last
|
|
|
+ * `request/header*` was a runtime switch by the user; see the tool
|
|
|
+ * layer's narrator).
|
|
|
*/
|
|
|
'sandbox/mode': { mode: SandboxMode }
|
|
|
}
|
|
|
@@ -39,10 +44,11 @@ declare module '@deepseek-ai/dsh-session' {
|
|
|
export const SANDBOX_MODES: readonly SandboxMode[] = ['read-only', 'workspace-write', 'danger-full-access']
|
|
|
|
|
|
/**
|
|
|
- * The session's sandbox-mode override: the last `sandbox/mode` event in the
|
|
|
- * log, or undefined when the session never switched (callers apply the
|
|
|
- * deployment default). The pure fold — resume needs no catch-up machinery
|
|
|
- * because replaying the log IS the state.
|
|
|
+ * The pure fold of a slice of `sandbox/mode` events: the last switch wins,
|
|
|
+ * or undefined without one. The building block {@link sandboxOverrideOf}
|
|
|
+ * composes with the seed boundary and the header baseline — consumers
|
|
|
+ * resolving a SESSION's policy go through that chain, not this raw fold.
|
|
|
+ * Resume needs no catch-up machinery because replaying the log IS the state.
|
|
|
* @param events - session events in log order (other event types are skipped).
|
|
|
* @returns the mode of the last switch event, or undefined without one.
|
|
|
*/
|
kingwl