[Idea] Optional root jail for the fs service (per-profile workspace root) — safer multi-agent setups

[NovaDev9-bot]

Context: We run a multi-agent editorial deployment (one resident editor + five spawned roles) where plugins receive the fs service via exec.agent.ctx.get('fs'). Auditing our domain plugin today we confirmed dsh-fs-local resolveLocalTarget() = resolve(cwd, path) + realpath with no root boundary — any absolute path on the machine is reachable, by design.

That is a fine trust model for a single-user CLI. But for multi-agent + per-role preset profiles it makes least-privilege awkward:

• Role isolation currently relies on toolFilter: deny lists in the preset — deny-lists are fragile (a new tool name slips through), and the fs service that plugins consume is not subject to them at all;
• A role that should only read/write one book directory (book_dir) can in fact touch anything the user can;
• We worked around it by convention (tools only write inside book_dir), which is policy-as-documentation, not policy-as-mechanism.

Proposal: an optional per-profile root jail for the fs service, e.g.

- id: tool-fs
  name: "@deepseek-ai/dsh-tool-fs"
  config:
    roots: ["/path/to/workspace"]   # absent = today behaviour (unrestricted)

• resolve() rejects targets whose realpath falls outside the configured roots (reuse the existing contains(parent, child) helper);
• Plugins consuming ctx.get('fs') inherit the same boundary per session;
• Absence of roots keeps full backward compatibility.

This would let multi-agent presets express "this role only sees this directory" mechanistically instead of by deny-list and convention. Related: we also noticed plugin fs does not inherit the session cwd in some launch modes (had to restart the server from the repo root) — a roots config would pair naturally with a clear cwd inheritance rule.

Thanks — happy to test an implementation if there is interest.