dsh-sandbox-allowlist

DSH ships with a sandbox that confines every write to the workspace directory. The moment a CLI command or the write/edit tool needs to reach a trusted path outside that boundary—such as a shared repository, a build-artifacts tree, or a config folder—you are left with two unappetising options: approve every single operation by hand, or switch the sandbox off entirely. dsh-sandbox-allowlist closes that gap: you declare a set of trusted writable directories and the restricted process writes to them directly, with no per-command prompts and no loss of isolation.

The plugin layers three complementary permission mechanisms on top of the stock sandbox. First, trusted write directories accept glob patterns (** for subtrees, * for one level, ? for a single character). On Windows the plugin materialises an inherited Write ACE for the workspace SID; on Linux it appends a bwrap --bind line. Removing a directory from the config triggers automatic ACL reclamation, so revocation is as close to instant as it gets. Second, a command allow-list matches on shell tool plus pattern and resolves to allow, ask, or deny—modelled after the permission-rule design found in opencode and Claude Code, with wildcards to ignore arguments for prefix-based pass-through. Third, noRead rules let you block or gate the model's file reads by filename or path pattern, with deny for hard blocks and ask for approval, plus built-in guardrails that reject over-broad rules such as anchoring a drive root. Every rule is editable live in a three-card settings UI; changes hot-apply without a restart.

The plugin is built for DSH operators who run AI agents in production but find the default workspace boundary too narrow for real team workflows: you want the agent to write to a handful of authorised project directories, execute common build or test commands without a prompt, and keep sensitive keys out of the model's reading path—all while the sandbox remains fully enabled, with no need to flip between full-trust and full-sandbox mode.