Permission Presets

Permission Presets

Edge adaptation of the upstream permission preset and tool approval system.

Upstream reference: Permission Presets

What Upstream Provides

The permission presets layer (ctx.permissionPresets) bundles two independent enforcement controls — sandbox mode and approval policy — into named presets that clients present as a single permission selector.

• PermissionPresetService — resolves the effective preset from actual knob values, switches presets by writing through each knob's canonical setter.
• Built-in presets — workspace-write (default, restricted to workspace writes) and danger-full-access (unrestricted).
• Approval policy — per-tool approval gates where the user confirms or denies tool execution before it runs.
• Sandbox mode — restricts filesystem writes to the workspace directory.

The service is optional — it doesn't affect the agent loop. Preset switching logs intent via permission/preset events; actual behavior changes flow through sandbox and approval services independently.

Current Edge Status

Not Implemented No permission presets

PermissionPresetService is not installed. Edge has no interactive permission UI — all tools are auto-approved. There is no sandbox mode enforcement, approval gates, or preset selector in the client.

This is a deliberate simplification for the single-user self-hosted deployment model: the user who deployed Edge is the same user running tools, so interactive approval adds friction without security benefit. The workspace is already isolated within the Durable Object's Computer VFS.

Related: dsh-sandbox patch

dsh-sandbox is in dependencies and has a patch (removes node:fs/node:os imports), but it's used by the file tools for path validation — not for permission enforcement. The sandbox's canonicalPath and writableRoots are used by EdgeFileSystem to resolve and validate file paths within the workspace.

Architecture Summary

Component	Category	Edge Status
PermissionPresetService	Missing	Not installed — all tools auto-approved
Approval policy	Missing	No interactive approval gates
Sandbox mode	Missing	VFS isolation used instead
dsh-sandbox (path validation)	Reuse	Patched for Workers, used by EdgeFileSystem

Key observation: Edge's single-user deployment model makes interactive permission approval unnecessary — the deployer is the sole user. Filesystem isolation is provided at the platform level by Computer VFS, not by the upstream sandbox service. If multi-user or shared deployment scenarios arise, the permission preset system could be installed to provide per-session tool approval control.

TODO

Evaluate permission presets for shared deployments. If Edge supports multi-user access in the future, PermissionPresetService should be installed to let each user control their tool approval level. The client-side permission UI is already in the 33-plugin bundle — the server-side service is the gap.