dsh-write-protect

The official DSH sandbox ships only two policies: make the entire workspace writable, or make it entirely read-only. There is no way to shield a single sub-path such as .git or dist/, and there is no way to admit a neighbouring directory into the write allow-list without escalating to danger-full-access. When a model in workspace-write mode rewrites version-control metadata or clobbers a critical config file, developers have had no fine-grained lever to pull.

dsh-write-protect declares read-only paths using gitignore-style patterns (globbing, root-anchoring, negation, POSIX character classes, directory markers) that the write/edit tools enforce on every platform in real time. It also accepts literal path strings as extra writable roots so that bash and write/edit can reach a sibling directory outside the workspace without unlocking the whole host file system. On macOS it appends Seatbelt deny rules that close the launchd broker-escape channel; on Linux it layers bwrap read-only mounts or Landlock rules on top of the official sandbox. Reads are always unaffected. Configuration changes take effect immediately with no dsh web restart, and everything can be edited and previewed in the Web Settings panel.

Built for developers who run multi-step code generation inside DSH and want to keep .git, build artefacts, or system files out of the model's reach, or who need shell commands to touch a specific directory outside the workspace. Policies apply per session or globally, and the plugin coexists cleanly with the official sandbox provider.