[Bug / Sandbox]: Inconsistent mode escalation vs path whitelist, silent permission drift, and write side-effects in --dump-config

[hoangngochuong24947-gif]

[Bug / Sandbox]: Inconsistent Mode Escalation vs Path Whitelist, Silent Permission Drift, and Unintended Write Side-Effects in --dump-config

Description / 简述

While developing and wiring bundle plugins (e.g., @luliuyuan/dsh-anydoc) in DeepSeek Harness, we observed three critical issues regarding the sandbox permission subsystem and configuration tooling:
在为 DeepSeek Harness 开发并接入 bundle 插件时，我们在沙箱权限子系统与配置诊断工具中观察到三个关键异常：

1. Self-contradictory Sandbox Escalation: The system rejects escalation claiming "current mode is already at this level", but subsequent filesystem writes to non-workspace paths are still rejected with EPERM.
   沙箱模式升级逻辑自相矛盾：系统提示“当前已处于该模式”，但后续对非工作区路径的写入仍被底层拒绝（Operation not permitted）。
2. Silent Permission Drift: Access permissions to restricted directories (e.g., ~/.dsh/profiles/web/) transitioned from rejected to allowed mid-session without visible approval dialogs or event logs.
   运行时权限静默漂移：原本被拒绝的目录在会话中途突然变得可写，缺少显式审批流或变更事件。
3. --dump-config Write Side-Effect Crash: --dump-config crashes with unhandled EPERM in read-only profiles due to eager writeFileSync in prepareProfile.
   --dump-config 意外写盘崩溃：诊断命令在只读配置下因尝试写回 cordis.yml 而直接崩溃。

---

Environment / 环境信息

• DeepSeek Harness Version: 0.1.0-rc.5 / 0.1.0-rc.6
• Node.js: v24.x / v22.x
• OS: macOS (Darwin arm64) / Linux x86_64
• Profile: web / standard preset

---

Detailed Observations & Reproduction / 详细复现与现象

1. Escalation Self-Contradiction / 模式升级自相矛盾

Observed behavior / 现象:
When a tool / subagent attempts to escalate permissions to workspace-write or danger-full-access to write configuration into ~/.dsh/profiles/web/ or adjacent project roots:

Error: sandbox escalation to 'workspace-write' is not strictly wider than this call's current 'workspace-write' mode

or

Error: sandbox escalation to 'danger-full-access' is not strictly wider than this call's current 'danger-full-access' mode

However, executing write operations (e.g. touch ~/.dsh/profiles/web/package.json or fs.writeFile) immediately afterwards still fails with:
Error: EPERM: operation not permitted

Root Cause Analysis / 根因推测:
The lattice permission comparator checks if requestedLevel <= currentLevel and rejects the request as redundant. However, the underlying FS proxy / path whitelist (AllowedPathsSet) is not expanded or synchronized with the real physical paths required, creating a deadlock where the agent cannot request escalation because it's "already escalated", yet cannot write because the path is not whitelisted.

---

2. Silent Permission Drift / 会话中途权限静默漂移

Observed behavior / 现象:
During an ongoing session:

1. At Step T1: Writes to ~/.dsh/profiles/web/ and custom plugin root are blocked with EPERM.
2. Several tool calls later (without manual approval prompts or mode switch events), the same write operations suddenly succeeded.

Recommendation / 建议:
Permission states and path whitelists should follow strict, deterministic Cordis lifecycle state machines, emitting structured events (e.g. sandbox/escalation-granted) to ensure auditability and prevent non-deterministic race conditions.

---

3. --dump-config Unhandled Crash in Read-Only Environments / 只读环境下 --dump-config 崩溃

Observed behavior / 现象:
When inspecting configuration via dsh --profile web --dump-config, prepareProfile internally calls writeFileSync(join(profileDir, 'cordis.yml')). If the profile folder is read-only or running under a sandboxed read-only permission level, --dump-config crashes:

Error: EPERM: operation not permitted, open '/Users/.../.dsh/profiles/web/cordis.yml'
    at Object.writeFileSync (node:fs:...)
    at prepareProfile (...)
    at runDumpConfig (...)

Recommendation / 建议:
--dump-config and diagnostic commands should operate purely in-memory (dry-run mode) without writing temporary synthesized files to disk.

---

Suggested Fixes / 修复建议

1. Decouple Mode Lattice from Path Whitelists: Ensure that when a broader mode is granted (or confirmed), the path resolution layer dynamically syncs allowed root directories.
2. Pure In-Memory Config Synthesis: Remove disk write side-effects from prepareProfile when invoked via --dump-config.
3. Structured Audit Events: Emit explicit lifecycle events whenever sandbox boundaries or approval policies change.