English | 简体中文
dsh-dotclaude
Run a Claude Code project's .claude/ assets inside DeepSeek Harness — project slash commands that expand their prompt, and permissions.deny rules enforced against the host's tools. No host patches. Nothing is loaded when the host or the project does not have the pieces.
DeepSeek Harness already reads CLAUDE.md, and official bridges already cover Claude Code hooks and plugin mods. This plugin fills the part that is still missing: the command and permission half of a .claude/ directory.
What it does
.claude/ source | Effect in DSH |
|---|
.claude/commands/**/*.md (project) | /claude run <name> [args], plus a /name slash command on new agents |
~/.claude/commands/**/*.md (user) | Same, with the project command shadowing a user command of the same name |
.claude/settings.json → permissions.deny | Denies the matching host tool call before it runs |
.claude/settings.local.json → permissions.deny | Same, merged after the project file |
permissions.allow / ask | Reported only — never used to widen what the user must approve |
Command bodies support the substitution forms that matter without a shell:
$ARGUMENTS — the raw text after the command name$1 … $9 — positional arguments, splitting honouring quotes@path — inlined file contents (size-capped; a missing file is left as literal text and reported)
Front matter read: description, argument-hint. allowed-tools and model are ignored and reported as unsupported.
Install
dsh plugin --profile web add dsh-dotclaude
Restart the host. The bundle mounts one row, dotclaude.
From a checkout:
dsh plugin --profile web add link:/path/to/dsh-dotclaude
Use
/claude # list the resolved commands and where they came from
/claude list # same
/claude run <name> [args]
/claude doctor # provenance, deny rules, and every issue found while reading
/claude reload # drop the read cache and re-resolve
On hosts whose command registry supports agent-scoped registration, each resolved command is also registered as its own slash command on every new agent — /review, /db-migrate — skipping any name the host already exposes. /claude run <name> works everywhere, including hosts that register no scoped commands.
When a host exposes a system-prompt section registry, one stable section names the available commands. When a host exposes the dsh-tui status seam, the aggregate command count appears as claude N cmd.
Configure
Every key has a default, so config: {} is a complete configuration.
| Key | Default | Meaning |
|---|
projectCommands | true | Read .claude/commands from the Session working directory's project root |
userCommands | true | Read ~/.claude/commands |
enforceDeny | true | Enforce permissions.deny |
inlineFiles | true | Inline @path references |
registerCommands | true | Register each command as its own slash command on new agents |
promptSection | true | Add the system-prompt section listing commands |
statusLine | true | Publish the count on the dsh-tui status line when that seam exists |
maxCommandBytes | 65536 | Skip larger command files |
maxInlineBytes | 65536 | Skip larger inlined files |
extraRoots | [] | Reserved; no extra scan roots yet |
Override through the profile patch layer:
- id: dotclaude
config:
promptSection: false
promptSection and statusLine are the two keys with a visible cost: the section adds tokens to every request in that agent, and the status line occupies one dsh-tui status slot.
Project root
The project root is the nearest ancestor containing .git; without one it is the working directory itself. A home directory that carries .claude is treated as the user-level root, never as a project, so ~/.claude is not scanned twice.
Permissions
Rules use Claude Code's grammar — Tool or Tool(specifier) — and the Claude Code tool names, mapped to the host's tools (Bash→bash, Read→read, MultiEdit→edit, WebFetch→web_fetch, Task→subagent, and so on).
Bash(git push:*) denies that command and any argument list under it.Read(./src/**) denies paths under src/, with ** crossing segments and * staying inside one.- An unknown tool name or an unparsable entry is reported by
/claude doctor and does not deny anything.
Only deny is enforced. An allow entry never bypasses the host's approval policy, because widening permission from a file the model could write is not a trade this plugin makes.
What is deliberately out of scope
.claude/agents/*.md, .claude/skills/, .mcp.json — not read.! bash execution inside a command body.- Claude Code hooks and plugin mods — use the official
@deepseek-ai/dsh-hooks-claude-code and @deepseek-ai/dsh-experimental-claude-code-mods bridges.
permissions.allow / ask enforcement.- Rewriting or writing any
.claude/ file.
Compatibility
The plugin depends only on Cordis 4 and probes every host service with ctx.get(name, false). A missing service degrades one feature; it never fails the host.
| Host | Result |
|---|
| DSH 0.2.1-rc.2, Web profile | Boots; project commands, deny rules, prompt section active; no status line |
| dsh-tui 0.16.1 beside it | Composes and boots; status-line seam available |
| dsh-tui 0.14.0 | The host itself refuses it on 0.2.1-rc.2 (incompatible with dsh); nothing this plugin can change |
The version boundary above is checked by scripts/host-smoke.sh under DOTCLAUDE_MATRIX=1.
Test
Four gates, all runnable locally:
npm run typecheck # 1. types
npm run build && npm test # 2. unit + host-double integration (53 tests)
DOTCLAUDE_MATRIX=1 ./scripts/host-smoke.sh # 3. real host compose+boot; 4. dsh-tui matrix
The host smoke test needs a DeepSeek Harness checkout (HARNESS=/path/to/checkout) and installs into a throwaway DSH_HOME; it never touches your real profile.
Security
- The plugin reads
.claude/ and never writes to it.
- Inlined
@path files reach the model, so a command file that inlines a secret sends it. Only run command files you trust, as with Claude Code.
- Deny rules fail open on an unreadable or malformed settings file, and the failure is reported by
/claude doctor instead of being silent. If you need fail-closed behaviour, do not depend on this plugin as your only boundary.
License
MIT.
