dsh-workspace-only-plugin

In dsh's multi-permission model, once a session enters danger-full-access or auto mode, the agent can quietly read and write files outside the working directory with no user awareness or audit trail. dsh-workspace-only-plugin closes that gap with a global "Workspace Only" toggle: when enabled, any file operation that crosses the working-directory boundary is intercepted and surfaces a confirmation prompt on the approval/request channel, deliberately bypassing the approval-policy gate so that even a never-approve session still gets a dialog rather than a silent pass.

The interception spans every tool call—read, write, edit, read_image, glob, grep, bash, pwsh—and extends to absolute paths embedded in inline script strings (node -e, python -c) via a lexical scanner, so the boundary cannot be bypassed through script arguments. When used alongside dsh-auto-mode, the auto plugin's classifier still governs in-workspace calls while out-of-bound calls are routed through this plugin's user-confirmation step first, keeping the two concerns cleanly separated. The workspace-write preset label is permanently renamed to "Write Only" for clearer menu semantics. The toggle is persisted to settings.yaml and takes effect across all sessions immediately, with quick switches in both the settings page and the input bar.

It is well suited for developers who regularly run auto or full-access sessions in dsh and want the flexibility of broad tool access without giving up the safety net of a mandatory confirmation on every out-of-directory operation, as well as for teams that treat agent file access as a security boundary requiring explicit human sign-off.