dsh-workspace-write-extra
English | 简体中文
Adds a fourth permission preset to DeepSeek Harness that grants write access to
configured directories in addition to the session workspace.
The three stock sandbox modes are not modified in any way: read-only,
workspace-write, and danger-full-access keep their exact meaning, their
persisted schemas, and their escalation ladder.
What it adds
One more entry in the permission picker:
| Preset | Sandbox mode | Approval | Writes |
|---|
read-only | read-only | ask | nothing |
workspace-write | workspace-write | ask | workspace + temp areas |
workspace-write-extra | workspace-write | ask | the above + configured directories |
danger-full-access | danger-full-access | never | everything |
The entry carries no label, so the picker derives its text from the preset name
and renders Workspace Write Extra, matching how the built-in entries read. A
label supplied here would be shown verbatim, in English, because the client
localizes only its own built-in presets and the auto preset.
The new preset is a permission preset, not a fourth SandboxMode. That
distinction is the whole point: the sandbox mode vocabulary is a closed
three-value union that is written into sandbox/mode session events and
re-validated by several foreign projections when a session is restored. A fourth
value there would make every session that used it unreadable. Bundling the
existing workspace-write mode with extra behaviour is the same approach the
shipped auto preset takes.
Enablement is per session: the extra directories apply while that session's last
recorded permission preset is workspace-write-extra, which survives a restart
because the choice lives in the session log.
How it stays out of the way
The plugin does not disable, replace, or reorder any stock row. It wraps the two
live enforcement services in place, and unwraps them exactly on unload:
- the mounted filesystem's containment check (
checkedTarget) gains a retry of
its workspace-write denial against the extra directories;
- the sandbox provider's
confine gains the matching --bind pairs in the
bwrap profile.
Two consequences follow, and both matter:
- Failure is safe. If this plugin does not load, the harness keeps the stock
filesystem and sandbox rather than losing them. (The alternative — disabling
the stock rows and inserting replacements — has no such fallback, and Cordis
refuses to register two providers of the same service name, so it cannot be
made safe by shadowing.)
- It is additive. The stock check stays authoritative for every case it
already handled; only its own denial is reconsidered.
Configuration
Both surfaces are supported.
Profile config
- id: workspace-write-extra
name: dsh-workspace-write-extra
config:
extraWritableDirs:
- /srv/shared-assets
- ~/notes
presetName: workspace-write-extra
Entries must be absolute; a leading ~ is expanded. Symlinks are resolved, and
a missing or non-directory entry is ignored with a warning rather than
created — granting a path nobody named would be the unsafe direction. Expansion
is asynchronous, so a directory only becomes writable after its own successful
expansion.
Settings page
extraWritableDirs is a volatile field, so it also appears on the Settings page
and edits apply live to every session in the profile.
Compatibility with the harness
This plugin declares no @deepseek-ai/dsh-* peer range, and the harness checks
only such peers. Its compatibility therefore rests on something narrower and
more exact: the shape of two mounted services. That shape is what the code
actually uses, and it is pinned by test/contract.test.mjs against the real
classes, so a harness upgrade that moves any of it fails the suite immediately
rather than narrowing the preset in production.
| Depends on | Used by |
|---|
fs.checkedTarget(target, policy) rejects with code FS_SANDBOX_DENIED | lib/fs.mjs |
fs.resolve(path) resolves a target carrying targetKey | lib/fs.mjs |
sandbox.confine(argv, policy, signal) resolves to an object carrying argv | lib/provider.mjs |
Policy fields mode and sessionId; result field argv | both wrappers |
permissionPresets.presets and emitCatalogChanged() | lib/service.mjs |
systemPrompt.context() and getContextOrder('SANDBOX_POLICY') | lib/service.mjs |
Two properties keep this robust across upgrades:
- The wrappers call the stock methods through
await, so a stock method that
changes between synchronous and asynchronous keeps working.
- Both wrappers operate on the returned object rather than assuming a bare argv,
so a return value that grows fields keeps working.
When a mounted service does not expose the expected seam at all, the plugin
reports it once per service and leaves the instance untouched. It never
disables a stock row, so the failure mode of any unexpected harness shape is a
logged warning and stock behaviour — never a missing filesystem or sandbox.
Platform support
- Linux with
bwrap — fully supported. The extra directories join the
bubblewrap profile as --bind <dir> <dir>, so confined commands agree with
the write/edit tools.
- Linux with
landlock, and macOS seatbelt — the write/edit tools are
widened, but confined commands are not, because those profiles are built
inside packages this plugin cannot extend. A warning is logged once instead of
pretending otherwise.
- Windows — not supported.
Layout
| File | Role |
|---|
lib/service.mjs | ctx.extraWriteDirs: owns the configured directories, decides per session whether the preset applies, wraps the two enforcement services, publishes the preset, and adds the model-facing note. |
lib/fs.mjs | Wraps the live filesystem's containment check. |
lib/provider.mjs | Wraps the live sandbox provider's confine. |
lib/roots.mjs | Path expansion and containment checks. |
lib/plan.mjs | Pure bwrap argv transformation. |
cordis.patch.yml | Inserts the one plugin row. |
test/contract.test.mjs | Pins the harness seams this plugin extends. |
Tests
node --test test/
roots.mjs, plan.mjs, and the two wrappers are dependency-free and run
anywhere. The contract and integration suites need the DSH packages to be
resolvable, so they run from an installed profile: the contract suite pins the
real stock seams, and the integration suite assembles the real filesystem and
sandbox provider and asserts both the widening and its exact reversal on
unload. Every suite that needs those packages skips with a reason when they are
absent, and never passes vacuously.
