dsh-movein-permissions
Fine grained, per tool permission rules for DeepSeek Harness (DSH).
DSH ships three coarse permission presets (read-only, workspace-write, danger-full-access) and its README names the missing piece itself, there is no per tool allowlist. This plugin adds one at the tools/pre-execute gate, using Claude Code's battle tested rule syntax. You do not need to be migrating from Claude Code to use it.
为 DSH 补上按工具粒度的权限规则。DSH 自带的三档权限预设没有细粒度控制，这个插件在 tools/pre-execute 强制执行 deny/ask 规则，规则语法与 Claude Code 相同。不迁移也能单独用。
Install
dsh plugin --profile web add dsh-movein-permissions
Then add a row to ~/.dsh/cordis.patch.yml (or your profile's patch):
- insert:
- id: cc-permissions
name: 'dsh-movein-permissions'
config:
deny:
- 'Bash(rm -rf:*)'
- 'Read(*secrets*)'
- 'mcp__github__delete_repo'
ask:
- 'Write'
- 'Bash(git push:*)'
Restart dsh web. Denied calls return a typed refusal to the model, ask rules force a confirmation.
Compatibility
The plugin requires Node.js 22.13 or newer and supports DSH >=0.1.0-rc.8 <0.2.0 on the Web profile.
| DSH release | Disposable-profile install | Web start | Uninstall |
|---|
0.1.0-rc.8 | tested | tested | tested |
0.1.1-rc.1 | tested | tested | tested |
0.1.1-rc.2 | tested | tested | tested |
0.1.2-alpha.3 | tested | tested | tested |
0.1.2-alpha.4 | tested | tested | tested |
0.1.2-alpha.5 | tested | tested | tested |
CI packs this plugin, installs it into a fresh temporary DSH_HOME, confirms the composed profile contains the plugin-owned entry, starts the Web UI on loopback and receives an HTTP response, removes the package, and confirms the entry is gone. It never touches a user profile or sends a model request. The unit suite separately verifies the permission gate itself on Windows, macOS, and Linux.
Rule syntax
Claude Code permission rule shape, Tool or Tool(specifier).
| Rule | Meaning |
|---|
Bash(npm run test:*) | any shell command starting with npm run test (matched on terminal_* tools) |
Read(*secrets*) | any read whose path contains secrets |
Write | every write |
mcp__server__tool | one exact MCP tool, names are identical in DSH and Claude Code |
Mapped tools. Bash (terminal_open/terminal_send and friends), Read, Write, Edit, and every mcp__* tool. * patterns match as a superset, over-denying is the safe direction for a gate.
Deny wins over ask. Rules that reference tools with no DSH equivalent never match anything, harmless but pointless, the dsh-movein migration report lists them for you.
Coming from Claude Code?
npx dsh-movein --apply generates this row from your existing settings.json automatically, along with the rest of your setup.
License
MIT
