Introduction¶

The sandbox mode of DSH distinguishes different file access strategies, such as read-only, workspace-write, danger-full-access, and auto. These modes can handle permissions like read-only, workspace write, and full access, but sometimes an independent switch is also needed: whenever a file outside the workspace directory is accessed, a popup asking for user confirmation should appear first. Introducing dsh-workspace-only-plugin.

What is it¶

dsh-workspace-only-plugin is maintained by CsBpRd under the MIT license. It adds a “Workspace Only” toggle to DeepSeek Harness (DSH), consolidating file access outside the workspace into user confirmation regardless of the sandbox mode.

GitHub Repository:

https://github.com/CsBpRd/dsh-workspace-only-plugin

Core Features¶

Unified Confirmation for Access Outside Workspace¶

Once the switch is enabled, the following modes are all subject to the same rule:

read-only
workspace-write
danger-full-access
auto

When DSH accesses a file outside the workspace directory, it dispatches a user confirmation request. If the user approves, the call is allowed for this instance; if the user rejects or there is no response channel, the call is denied.

Popups Even in Full Access¶

Confirmation requests are dispatched via the following channel:

approval/request

This bypasses the approval policy gate. Even if the current session is Full access and the approval policy is set to “never”, it will not silently pass; instead, a confirmation popup appears.

Covered File Access Calls¶

The following tool calls will trigger confirmation if they go outside the workspace:

read
write
edit
read_image
glob
grep
bash
pwsh

Embedded paths are also captured by lexical scanning, for example:

node -e
python -c

If an absolute path appears within such strings, a popup will also be triggered.

Coexistence with Auto Plugin¶

If the following plugin is used simultaneously:

@nanmicoder/dsh-auto-mode

It will run normally but will be absorbed by this plugin. Calls within the workspace are decided by its classifier; calls outside the workspace go through this plugin’s user confirmation first.

Preset Display Name¶

The plugin permanently changes the preset display name of the workspace-write permission to:

Write Only

This renaming is independent of the switch state.

Global Switch¶

The switch is a global setting, persisted to:

settings.yaml

There is a switch in the settings page and one in the input bar.

Installation and Enablement¶

One-Line Installation¶

First, execute the installation command:

curl -fsSL https://raw.githubusercontent.com/CsBpRd/dsh-workspace-only-plugin/main/install.sh | bash

The script will automatically install the plugin into the profile’s bundle layer stack, apply two necessary core patches, and restart with the original command line if dsh web is detected running.

Available environment variables to adjust:

DSH_PROFILE
DSH_HOME
DSH_NO_RESTART=1

Where the default value of DSH_PROFILE is:

web

Manual Installation¶

If you are not using the installation script, first edit the web profile’s dependency file:

~/.dsh/profiles/web/package.json

Add to dependencies:

"dsh-workspace-only-plugin": "github:CsBpRd/dsh-workspace-only-plugin"

Then append to the end of dsh.profile.bundles:

dsh-workspace-only-plugin

Then install dependencies:

cd ~/.dsh/profiles/web && pnpm install

Finally, restart the dsh web service.

Node and Dependencies¶

The Node requirement declared in package.json is:

^22.19.0 || >=24.0.0

All peerDependencies listed in package.json are optional.

Core Patches¶

Core patches include adding a namespace to the whitelist of the following component:

@deepseek-ai/dsh-host-apiproxy

The whitelist is named:

WEB_SETTINGS_NAMESPACES

The value added is:

workspace-only

Another patch is for the auto plugin label.

After upgrading DSH, re-run:

node scripts/patch-core.mjs

to reapply the core patches.

If coexisting with the auto plugin, you need to synchronize modifications to:

@nanmicoder/dsh-auto-mode

of:

lib/client.js

Change in:

REQUIRED_PERMISSION_LABELS

from:

Workspace Write

to:

Write Only

Typical Usage¶

Below is a reproducible enablement process.

Open the Workspace Only switch in the settings page or input bar.
In the DSH session, let the agent read and search files within the current workspace. Calls within the workspace are executed according to the original sandbox mode or the auto plugin strategy.
Let the agent access files outside the workspace, such as out-of-bounds reads or writes. The plugin will dispatch a user confirmation request.
After the user approves, this call is allowed; if the user rejects, the call is denied.
In danger-full-access or Full access scenarios, access to files outside the workspace still goes through this confirmation step first.

Applicable Scenarios and Notes¶

This plugin is suitable for scenarios where you want to keep the existing sandbox mode in DSH while delegating file access outside the workspace to user confirmation.

Note the following points:

This is a tool-layer gate. The core is lexical path scanning, not kernel-level isolation. Paths that are fully dynamically calculated still pose residual risks.
In a Write Only (workspace-write) session, an out-of-bounds write after approval will still be intercepted by the kernel fence and confirmed again according to the DSH escalation process. The relevant process is named:

sandbox_permissions

Write operations always require explicit user consent.
Internal DSH mechanisms such as skill loading and session persistence are not affected.
The plugin runs with the current DSH process; the source code and MIT license should be checked before installation.

Links¶