Merge remote-tracking branch 'origin/master' into codex/truncated-design

# Conflicts:
#	docs/config-catalog.md
#	docs/rfc/INDEX.md
#	examples/acp-agent/README.md
#	packages/bash/tool-bash/tests/tools.spec.ts

packages/cordis/tool-cordis/src/api-catalog.ts

@@ -134,6 +134,16 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
       'stream(options: GenerateOptions): AsyncIterable<StreamChunk>',
     ],
   },
+  {
+    key: 'permission',
+    summary: 'The permission service (`ctx.permission`).',
+    methods: [
+      'current(events: readonly SessionEvent[]): string',
+      'resolve(name: string): PresetSpec',
+      'optionOf(name: string): PresetOption',
+      'set(session: Session, name: string): void',
+    ],
+  },
   {
     key: 'sandbox',
     summary: 'Abstract process-sandbox service.',
@@ -521,6 +531,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'ApprovalOutcome',
     declaration: 'export type ApprovalOutcome = \'allowed-once\' | \'rejected\' | \'cancelled\' | \'unavailable\';',
   },
+  {
+    name: 'ApprovalPolicy',
+    declaration: 'export type ApprovalPolicy = \'ask\' | \'never\';',
+  },
   {
     name: 'ApprovalRequest',
     declaration: 'export interface ApprovalRequest {\n    readonly agent: Agent;\n    readonly toolName: string;\n    readonly callId?: CallId;\n    readonly reason?: string;\n    readonly signal?: AbortSignal;\n}',
@@ -749,6 +763,14 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'OwnerToken',
     declaration: 'export type OwnerToken = Branded<\'OwnerToken\'>;',
   },
+  {
+    name: 'PresetOption',
+    declaration: 'export interface PresetOption {\n    value: string;\n    name: string;\n    description?: string;\n}',
+  },
+  {
+    name: 'PresetSpec',
+    declaration: 'export interface PresetSpec {\n    sandbox: SandboxMode;\n    approval: ApprovalPolicy;\n    name?: string;\n    description?: string;\n}',
+  },
   {
     name: 'PromptAssembly',
     declaration: 'export interface PromptAssembly {\n    sections: AssembledSection[];\n    tools: ToolSchema[];\n    variables: Record<string, string | undefined>;\n}',