dsh-codex-project

Working on a real project in DSH often means the main codebase, shared libraries, documentation, and data directories live under different drive letters and path trees. The usual workarounds are either grant the model full access (risky and coarse) or authorize each directory individually (tedious and error-prone). dsh-codex-project borrows the Codex-style project-sharing model: mount any number of shared subdirectories onto a workspace, and the session reads and writes across all of them under a single, predictable workspace-write boundary—no dangerously-full-access, no per-directory ACL juggling.\n\nThe plugin hooks into four points in DSH runtime loop without patching its source. An HTTP route layer exposes config CRUD, file read/write, and directory-listing APIs. The agent/pre-step event injects a collapsed directory-manifest reminder into the model context before every reasoning turn. ctx.tools.register() adds an add-dir tool the model can invoke to request a new directory, effective only after user confirmation. A sandbox.confine wrapper routes shell and subprocess execution through a multi-root restricted-token runner on Windows, where each live root receives a space-scoped SID write ACE backed by a deny list, so no spawn ever degrades to unrestricted access. The sidebar Project Folders tab renders a lazy-loaded multi-root tree with inline preview and editing for images, PDFs, Markdown, HTML, and code, plus right-click to open in the native file manager.\n\nThe security model holds one invariant: permissions never escalate. Every root shares the same workspace-write boundary—shared directories never imply full access. Each workspace config owns a unique space-level SID, so one session token cannot ride another token\u2019s write ACE. Any runner failure exits with code 127 rather than falling back to an unrestricted spawn. Passively vanished directories are narrowed out of the writable set without blocking the remaining roots, and they re-adjoin automatically once the path reappears, with no restart or config edit required.\n\nThis plugin is built for DSH developers whose projects span multiple repositories, drives, or top-level folders—main code in one place, shared libs in another, CI artifacts and datasets elsewhere—who want the session to read and write naturally across all of them while keeping the authorization surface locked at workspace-write, not full access.