diff --git a/packages/sandbox/sandbox/src/roots.ts b/packages/sandbox/sandbox/src/roots.ts
index 0822d9d7e0..2a2775ff86 100644
--- a/packages/sandbox/sandbox/src/roots.ts
+++ b/packages/sandbox/sandbox/src/roots.ts
@@ -1,7 +1,7 @@
 /**
  * The writable-root derivation shared by every enforcement dialect that
  * expresses a mode as a canonical allow-list: `workspace-write` means "the
- * workspace root plus the platform temp areas", and this module is that
+ * workspace root, explicit extra directories, and platform temp areas", and this module is that
  * meaning's one home. The Seatbelt profile
  * (`@deepseek-ai/dsh-sandbox-local`) and the in-process filesystem fence
  * (`@deepseek-ai/dsh-fs-sandbox`) both derive their allow-list here, so "the
diff --git a/packages/ssh/ssh/tests/helper-boundaries.spec.ts b/packages/ssh/ssh/tests/helper-boundaries.spec.ts
index b233800ba1..a7ce65a14f 100644
--- a/packages/ssh/ssh/tests/helper-boundaries.spec.ts
+++ b/packages/ssh/ssh/tests/helper-boundaries.spec.ts
@@ -236,7 +236,7 @@ describe.skipIf(process.platform === 'win32')('SSH helper wire and lifecycle bou
     await mkdir(outside)
     await symlink(extra, alias, 'dir')
     const target = (path: string) => ({ targetKey: path, displayPath: path })
-    const policy = { mode: 'workspace-write' as const, workspaceRoot: workspace, additionalWritableRoots: [alias, extra] }
+    const policy = { mode: 'workspace-write' as const, workspaceRoot: workspace, additionalWritableRoots: [alias, extra], sessionId: 'ssh-extra-grant' }
     try {
       const written = await test.client.request('fs.write', {
         target: target(join(extra, 'allowed.txt')), content: 'ok', policy,