- id: permission
  name: '@deepseek-ai/dsh-permission-presets'
  config:
    presets:
      workspace-write:
        sandbox: workspace-write
        approval: ask
        name: 请求批准
      danger-full-access:
        sandbox: danger-full-access
        approval: never
        name: 完全访问权限
    # Fresh installations use full access without per-tool approval prompts.
    # Native Settings user overrides take precedence over this composition
    # default. Existing session permission events remain authoritative; a
    # restart or upgrade must not widen a user-selected restrictive session.
    # Owners can switch through the native Web selector or Lark /permission.
    # Policy denials, identity checks, emergency stop and budgets remain active.
    defaultPreset: danger-full-access

- insert:
    - id: dsh-enhanced-personal-assistant
      name: '@dsh-enhanced/personal-assistant'
      config:
        assistantPolicy:
          databasePath: !!js dshHomePath('assistant-policy/policy.sqlite')
          rules:
            - id: dsh-enhanced-foreground-capability-*
              effect: allow
              subject:
                kind: agent
                id: '*'
                workspace: '*'
              actions:
                - '*'
              resource:
                kind: '*'
                id: '*'
              context:
                initiators:
                  - foreground
          budgets: []
        personalMemory:
          databasePath: !!js dshHomePath('personal-memory/memory.sqlite')
          approvalMode: delivery-required
          maxContentBytes: 4096
          maxRecordsPerIdentity: 1000
          searchLimit: 20
          snapshotLimit: 20
          snapshotMaxBytes: 8192
          snapshotMaxTokens: 2048
          defaultProposalTtlMs: 900000
          maxImportRecords: 100
          reconcileIntervalMs: 15000
          reconcileLimit: 50
        personalWiki:
          vaultRoot: !!js dshHomePath('personal-wiki/vault')
          databasePath: !!js dshHomePath('personal-wiki/state.sqlite')
          maxPageBytes: 1048576
          searchLimit: 20
          maxSnippetBytes: 2048
          readMaxBytes: 8192
          readMaxParagraphs: 40
          lintLimit: 200
          defaultProposalTtlMs: 900000
          reconcileIntervalMs: 15000
          reconcileLimit: 50
        assistantAutomations:
          databasePath: !!js dshHomePath('assistant-automations/state.sqlite')
          runsPath: !!js dshHomePath('assistant-automations/runs')
          schedulerEnabled: false
          tickIntervalMs: 5000
          dutyLeaseMs: 15000
          taskLeaseMs: 30000
          misfireGraceMs: 60000
          maxCatchUp: 100
          maxConcurrency: 1
          maxArtifactBytes: 1048576
          defaultProposalTtlMs: 900000
          reconcileIntervalMs: 15000
          reconcileLimit: 50