Merge remote-tracking branch 'origin/master' into codex/pr-555-ci-fix

# Conflicts:
#	docs/config-catalog.i18n.yaml
#	docs/config-catalog.md
#	docs/config-catalog.zh.md
#	docs/module-graph.i18n.yaml
#	docs/module-graph.md
#	docs/module-graph.zh.md
#	examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
#	packages/client/connection/src/client/fixture.ts
#	packages/host/apiproxy/src/api-proxy.ts

packages/client/connection/src/index.ts

@@ -89,6 +89,24 @@ export const Config: z<ConnectionConfig> = z.object({
  * keys, or key state — and a LAN client's model picker legitimately needs it.
  */
 const PRIVILEGED_METHODS = new Set([
+  // A preset composition names the plugins a session runs, so reading one is
+  // reconnaissance; copy and remove rearrange what the deployment offers, and
+  // openDocument drives the host desktop — all more than the roster beside
+  // them. (Authoring is copy-only, so no method here accepts composition text
+  // or a path; the pin is about who may manage the roster at all.)
+  //
+  // CHOOSING one is not pinned, and `agentPreset.list` is not either. Picking a
+  // preset looks like escalation — one of them mounts the toolset that edits the
+  // live runtime — but `session.create` already takes an `agentPreset`, so
+  // pinning only the switch would leave the same capability one method over.
+  // The deeper reason is that the capability is not the preset's to grant: the
+  // deployment's own default already carries `bash` and the filesystem tools, so
+  // any caller that may start a session at all can already run commands as this
+  // process. Pinning the switch would be a fence beside an open gate.
+  'agentPreset.read',
+  'agentPreset.copy',
+  'agentPreset.openDocument',
+  'agentPreset.remove',
   'host.pickDirectory',
   'host.openPath',
   'settings.describe',