dsh-workspace-scope-selection

Harness sessions used to offer only two permission levels: lock writes to the workspace, or open the gate to everything. That binary choice is often too coarse—you either can't reach the directories you actually need, or you hand out more access than intended. dsh-workspace-scope-selection slots in a third mode, Selected Workspace Write, where you tick the exact directories an agent may write to in a tree-based editor. The workspace itself is checked by default; uncheck it to make it read-only, and everything left unchecked is denied or requires your explicit approval. The selection is per-session, survives restarts, and can be reopened anytime with a small Edit scope button. Enforcement spans both the filesystem tools and the shell/terminal sandbox, so any write outside your chosen roots must be escalated through your approval. It suits developers juggling multiple project directories who want agent write access precisely scoped, or anyone wiring Harness into shared or CI environments where per-session, directory-level control makes a real difference.