dsh-plan-preset

DSH Web UI ships a read-only permission preset whose name is vague and whose behavioral contract is left implicit. Which calls are allowed, which are denied, and whether permission escalation is even possible are all left to the user to figure out. dsh-plan-preset does one focused job: it renames that preset to Plan and pins down the contract explicitly. Files are readable across the entire workspace but every write, delete, or modify call is rejected. Web search stays fully available because it is decoupled from the file sandbox. The approval policy is set to never, so any permission-escalation request is auto-denied and the denial is final. In short, the agent can read code, search the web, and draft a plan, but it cannot touch files or request more access.

The entire patch is a pure configuration overlay with zero runtime code. It works through Cordis patching, overwriting the permission-preset line in dsh-base with sandbox set to read-only, approval set to never, and the display name set to Plan. The sibling presets workspace-write and danger-full-access are re-stated verbatim and remain untouched. Because no runtime dependency is introduced, upgrading DSH only requires a quick config dump to confirm that upstream defaults on the permission line have not shifted.

This preset is aimed at developers and platform administrators who orchestrate agent workflows through DSH Web UI and want a safe, read-only research phase: the agent reads the codebase, searches the web, and produces an exit_plan_mode plan; you review it, manually switch to an execution permission mode, and then let the agent get to work.