dsh-session-scope

In DeepSeek Harness, permissions (read-only, workspace-write, danger-full-access) govern what an agent can do, but there has been no independent mechanism to control which directories it can even see. When a workspace hosts multiple sub-projects or sensitive configuration files, users are forced into an all-or-nothing choice: either full visibility or a hard lockdown, with no middle ground.

dsh-session-scope adds a per-session visibility layer that is orthogonal to permissions. It offers three modes: Full keeps every directory accessible; Focused narrows filesystem reads, glob/grep/search roots, directory listings, and known path-aware tool scope to the directories the user explicitly selects, while the model-facing context exposes only the accessible roots without leaking hidden siblings; Isolated goes further on Linux by confining bash and persistent PTY processes inside a bubblewrap sandbox for true OS-level process isolation. Mode transitions, fork inheritance, LSP calls, and process lifecycle are all guarded by fail-closed semantics, so unknown backends or unsupported platforms refuse loudly instead of silently degrading.

It is well suited to Harness users managing multi-project workspaces who want to trim an agent's field of view per session without altering global permissions; team admins seeking a balance between security and day-to-day usability; and experienced Linux users who demand process-level confinement.