Feature request: additional writable roots for the session sandbox

[GhUserLiu]

Use case

My workspace is a multi-project root (D:\4-Workspace\) containing a dozen sibling project repos, plus two global shared exchange directories (inbox\ = user -> per-project sessions, outbox\ = per-project sessions -> user; effectively mail boxes for cross-project file delivery). By design, each project's session starts with its own project directory as the workspace root, giving write isolation between projects - the "one workspace root per session" model works great for this.

The one gap: project sessions need to write directly into those two shared directories, which sit outside their workspace root. Verified on Windows (2026-10-24):

1. A plain write is correctly denied (expected).
2. A junction inside the workspace pointing at a shared directory is also denied - the sandbox resolves the reparse point to the real path and treats it as outside the workspace. That is the right anti-escape behavior, but it also blocks the legitimate use.
3. The only path left is escalating the whole command to danger-full-access with per-call human approval - too coarse (temporarily abandons the entire sandbox), and unattended sessions (approval policy with no answerer) cannot use it at all.

Feature request

Support explicitly configured additional writable roots in SandboxExecutionPolicy (dsh-sandbox-policy / dsh-sandbox-windows-acl), e.g.:

sandbox:
  workspaceRoot: D:\4-Workspace\MyProject      # primary root: isolation subject
  additionalWritableRoots:                     # explicitly allow-listed shared roots
    - D:\4-Workspace\inbox
    - D:\4-Workspace\outbox

Suggested semantics:

• Additional roots must be explicitly configured, never inherited by default; write grants work the same way as for the primary root (ACL provisioning included); read policy unchanged.
• Escalation tiers unchanged - workspace-write simply applies to a set of roots.
• Reparse handling unchanged: additional roots are declared and matched by real path; junctions still cannot smuggle undeclared paths in.

Benefits

• Multi-project + shared-exchange-directory workflows (cross-repo delivery/approval flows) move from "whole-session escalation or external relay copying" to least-privilege direct writes.
• Unattended sessions (headless/scheduled) can safely touch the shared directories.
• Orthogonal to the existing one-primary-root model; isolation semantics untouched.

Environment

DSH npm package (@deepseek-ai/dsh), Windows 11, Windows ACL sandbox backend. Evidence sessions available on request (three reproduced cases: write outside workspace denied, junction traversal denied, headless session cannot escalate).

[Nickxue1234]

You may need to upload it to ideas,not show your plugins.I also have this problem.

[Nickxue1234]

#10931 This is my feature requests.