dsh-protect-generated-files
English | 中文
Agents edit files that nobody should edit by hand. They'll patch a version number straight into pnpm-lock.yaml, fix a typo in user.pb.go, or "correct" a type in Prisma's generated client. The edit looks fine until the next pnpm install or protoc run wipes it out, or, worse, leaves the lockfile disagreeing with package.json in a way that takes an afternoon to untangle.
This DeepSeek Harness plugin refuses write and edit calls on generated files and lockfiles. It also refuses in-place shell edits of them (sed -i, perl -pi, > file, tee file). Instead of a bare "no", the model is told how the file is supposed to change:
dsh-protect-generated-files blocked this edit to db/query.sql.go: its header says it is
generated (`// Code generated by sqlc. DO NOT EDIT.`). A hand edit will be overwritten
the next time it is regenerated, or leave it out of sync with its source.
Instead: edit the SQL queries/schema and run `sqlc generate`.
Install
dsh plugin --profile web add dsh-protect-generated-files
That's the web profile, the browser UI you start with dsh web. If you run DSH another way, use headless (scripts and CI) or acp (editor integrations) instead. Each profile keeps its own plugin list, so add it to every profile you use. It's active right after installing. Remove it with dsh plugin --profile web remove dsh-protect-generated-files.
From a clone
To try local changes, build a tarball and install that:
git clone https://github.com/acus9345/dsh-protect-generated-files
cd dsh-protect-generated-files
npm install
npm pack
dsh plugin --profile web add ./dsh-protect-generated-files-0.2.0.tgz
How it decides a file is generated
There are three ways a file gets flagged.
Lockfiles, by name. package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock(b), deno.lock, Cargo.lock, go.sum, poetry.lock, uv.lock, pdm.lock, Pipfile.lock, Gemfile.lock, composer.lock, mix.lock, pubspec.lock, Podfile.lock, flake.lock, gradle.lockfile, packages.lock.json, conan.lock. Each one comes with the right command for its own package manager, for example "change dependencies with cargo add / cargo update -p <crate>".
Known output paths. Protobuf output (*.pb.go, *_pb2.py, ...), Dart build_runner output, .Designer.cs, minified files and source maps, and anything inside node_modules/, __generated__/, .venv/ or site-packages/. Build-output folders (dist/, target/, .next/, vendor/ and so on) only count when they sit next to a project manifest like package.json, Cargo.toml or go.mod, so a source folder that happens to be called target isn't caught.
A header that says so. It reads the first 15 lines of the file and looks for Code generated ... DO NOT EDIT, @generated, DO NOT EDIT, auto-generated, This file was generated, <auto-generated>, or a Generated by <tool> comment. A header that says the file may be edited ("edit freely", "safe to edit"), or a qualified DO NOT EDIT without ..., doesn't count. When the header names a tool it knows, the hint names that tool too: protoc/buf, Prisma, GraphQL Codegen, OpenAPI generators, sqlc, go generate, Drizzle, Alembic, and others. "Generated by hand" and "generated by ChatGPT" don't count.
The header check only applies to files that already exist. The name and path rules also cover new files, because a lockfile written by hand from scratch is just as wrong.
On Windows, where DSH runs commands through PowerShell, it also watches Set-Content, Add-Content, Out-File and Tee-Object.
When a hand edit is right
It happens: resolving a lockfile merge conflict, or a one-line hotfix in vendored code while you wait for upstream. The model is told it can repeat the identical call once to confirm, and that goes through. Use mode: ask if you want to approve these yourself. If a directory is generated-looking but actually hand-maintained, add it to ignore.
Settings
The easy way: open Plugins in DSH's sidebar, click dsh-protect-generated-files, change what you want and press Save. It applies to the next tool call, no restart needed.
Or add a row like this to ~/.dsh/profiles/<profile>/cordis.patch.yml, or to ~/.dsh/cordis.patch.yml for every profile. Keys you leave out keep their defaults.
- id: protect-generated-files
config:
mode: deny # or `ask` for an approval prompt
extraGlobs: # your own generated paths, each with the hint the model gets
'src/api/client/**': 'edit openapi.yaml and run `npm run gen:api`'
ignore: ['vendor/**'] # never treat these as generated
defaultGlobs: true # false: only lockfiles, headers and extraGlobs
headerLines: 15
guardShell: true # also watch sed -i / perl -pi / > / tee
allowIdenticalRetry: true # false: a refusal is final
shellTools: [bash, pwsh] # pwsh is the shell DSH uses on Windows
extraGlobs is the one most worth setting. Telling the model which script regenerates your code saves it from guessing.
Development
npm install
npm test # detector unit tests
npm run test:e2e # real dsh runs against a scripted local model, no API key needed
The install test runs dsh plugin add, which needs pnpm on your PATH.
MIT licensed. Written by acus9345. Bug reports and ideas are welcome in the issues.
