fix(cli): restore shipped surface capabilities

apps/cli/web.cordis.yml

@@ -31,7 +31,49 @@
     apiKey: !!js process.env.DEEPSEEK_API_KEY
     baseURL: !!js process.env.DEEPSEEK_BASE_URL
 
+# The web surface replaces the unrestricted local executors with the shared
+# sandbox policy. Its default preserves the previous unrestricted behavior;
+# DSH_PERMISSION_MODE and the browser permission picker can confine a session.
+- insert:
+    - id: sandbox
+      name: '@deepseek-ai/dsh-sandbox-local'
+
+    - id: sandbox-policy
+      name: '@deepseek-ai/dsh-sandbox-policy'
+      config:
+        mode: !!js process.env.DSH_PERMISSION_MODE ?? 'danger-full-access'
+        workspaceRoot: !!js process.cwd()
+
+    - id: bash-sandbox
+      name: '@deepseek-ai/dsh-bash-sandbox'
+
+    - id: approval
+      name: '@deepseek-ai/dsh-user-approval'
+      config:
+        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'danger-full-access') === 'danger-full-access' ? 'never' : 'ask'"
+
+    - id: permission
+      name: '@deepseek-ai/dsh-permission'
+      config:
+        presets:
+          read-only:
+            sandbox: read-only
+            approval: ask
+          workspace-write:
+            sandbox: workspace-write
+            approval: ask
+          danger-full-access:
+            sandbox: danger-full-access
+            approval: never
+
+    - id: fs-sandbox
+      name: '@deepseek-ai/dsh-fs-sandbox'
+
+- id: bash-local
+  remove: true
+
 - id: fs-local
+  remove: true
 
 # ── web-only host rows, the transport layer, and the browser roster ─────────
 
@@ -72,6 +114,9 @@
     # The API gateway: the transport-agnostic dispatch face every client shape
     # shares. provider/model are the host default routing — the profile json's
     # mapping target (user config overrides these engineering defaults).
+    - id: directory-picker
+      name: '@deepseek-ai/dsh-host-directory-picker-browse'
+
     - id: api-gateway
       name: '@deepseek-ai/dsh-host-apiproxy'
       config:
@@ -156,6 +201,9 @@
     - id: ui-model
       name: '@deepseek-ai/dsh-client-ui-model'
 
+    - id: ui-permission
+      name: '@deepseek-ai/dsh-client-ui-permission'
+
     # Plan control: the composer plan seat over the plan projection + /plan channel.
     - id: ui-plan
       name: '@deepseek-ai/dsh-client-ui-plan'