dsh-extra-sandbox-presets

Configuration

Both surfaces are supported.

Profile config

- id: extra-sandbox-presets
  name: dsh-extra-sandbox-presets
  config:
    presets:
      # The session workspace plus a few caches.
      workspace-write-extra:
        writableDirs:
          - /srv/shared-assets
          - ~/notes
      # No workspace write at all; only these two directories.
      scratch:
        sandbox: read-only
        approval: never
        writableDirs:
          - /tmp
          - ~/scratch
      # A relabelled entry: the client shows `name`, falling back to the key.
      rust-tools:
        sandbox: workspace-write
        writableDirs: [~/.cargo, ~/.rustup]
        name: Rust tools
        description: Workspace plus the cargo and rustup caches

Field	Default	Meaning
sandbox	workspace-write	read-only, workspace-write, or danger-full-access
approval	ask	ask or never
writableDirs	[]	Directories writable on top of the selected mode
name	the preset key	Optional display label
description	none	Optional one-line description

Omit name unless you want a specific label: the picker derives its text from the preset key otherwise (workspace-write-extra renders as Workspace Write Extra), while a supplied label is shown verbatim, in English, because the client localizes only its own built-in presets.

Directories must be absolute; a leading ~ is expanded. Symlinks are resolved, and a missing or non-directory entry is ignored with a warning rather than created — granting a path nobody named would be the unsafe direction. Expansion is asynchronous, so a directory only becomes writable after its own successful expansion. A preset whose sandbox or approval is not one of the values above is likewise refused with a warning instead of being published, as are the reserved names custom and auto.

writableDirs only has an effect under a confined mode. A preset selecting danger-full-access may list them — they stay visible in the table — but that mode confines nothing, so they grant nothing extra and the model-facing note is left untouched.

Preset order is configuration order, which is the order the picker offers them.

Settings page

presets is a volatile field, so the whole table also appears on the Settings page and edits apply live to every session in the profile. The page edits it as one document rather than as a nested form, so the profile patch above stays the natural place to write it.