dsh-pwsh-guard
English | 简体中文
A DeepSeek Harness plugin that enforces one rule: read files with read, search with grep,
locate files with glob — not with shell text commands.
It registers a ctx.tools.guard over pwsh, bash and ops_bash. A call whose command line
performs file text I/O is rejected before execution, and the rejection reason names the tool to use
instead. Rejection messages follow the host locale (English or Chinese).
Rules
| id | group | blocks | use instead |
|---|
search.Select-String, search.sls | textSearch | Select-String, sls | grep |
search.findstr, search.grep, search.rg | textSearch | findstr, grep, rg | grep |
read.Get-Content, read.gc, read.cat, read.type | textRead | Get-Content and its aliases | read |
read.more, read.head, read.tail | textRead | more, head, tail | read |
bypass.node-eval, bypass.python-c, bypass.php-r, bypass.dotnet-io | runtimeBypass | node -e, python -c, php -r, [IO.File]::ReadAllText that read files | read, grep |
wait.Start-Sleep, wait.sleep | sleep | Start-Sleep, sleep | probe the port, read the job again later, schedule_create |
pipeline.stderr-merge | stderrMerge | 2>&1 followed by a pipe | $LASTEXITCODE, 2>err.txt |
job.wait | jobWait | job_output called with wait: true | probe the port (Test-NetConnection, curl), or read the job again later |
Two matching rules keep false positives down:
- Short aliases match in command position only (
^, ;, |, &, (, {, $(), so
Get-ChildItem -Type f, git gc and git log --grep=x pass.
- Quoted spans are ignored, so
git commit -m "stop using Select-String" passes. Rules that inspect
a script body (node -e ...) read the raw string.
Configuration
All fields are optional.
- id: pwsh-guard
name: 'dsh-pwsh-guard'
config:
enabled: true
language: auto # zh | en | auto
tools: [pwsh, bash, ops_bash]
disabledGroups: [] # textSearch | textRead | runtimeBypass | sleep | stderrMerge | jobWait
allowPatterns: [] # regexes matched against the raw command; a match allows the call
rules: [] # extra rules, evaluated before the built-ins
language: auto follows DSH_LOCALE, then the host locale, then LANG / LC_ALL.
rules:
- id: no-force-push
pattern: 'git\s+push\s+--force'
title: 'Force push is blocked'
hint: 'Use --force-with-lease instead'
Installation
From npm:
plugin_manager action: install_bundle target: dsh-pwsh-guard
From GitHub:
plugin_manager action: install_bundle target: https://github.com/Steven-Qiang/dsh-pwsh-guard
From a local checkout (link:, for development):
git clone https://github.com/Steven-Qiang/dsh-pwsh-guard
plugin_manager action: install_bundle target: /path/to/dsh-pwsh-guard
After editing code or config, reload without restarting:
plugin_manager action: set_plugin target: include:pwsh-guard enabled: false
plugin_manager action: set_plugin target: include:pwsh-guard enabled: true
Uninstall: plugin_manager action: remove_bundle target: dsh-pwsh-guard.
If install_bundle reports failedAt: registry, the failure came from another dependency of the
profile; the package link, package.json entry and cordis.yml row are usually already written.
Check for node_modules/dsh-pwsh-guard/index.js and the id: pwsh-guard row before retrying.
Limitations
- Command names inside quotes (
& "Select-String", powershell -Command "Get-Content x") are not detected.
-EncodedCommand is not decoded.ops_bash --script_path is checked by path only, not by script content.- Directory listing (
Get-ChildItem, ls, dir) is out of scope.
- Not a sandbox. For destructive commands and secret access use a dedicated guard such as
cc-safety-net; its rule schema cannot express "deny every use of this command", which is why
this plugin exists.
Development
npm test
Builds with tsdown, then runs 36 command fixtures and 11 configuration assertions.
Release
Versions are owned by CI — do not edit version. Pushing to main runs
.github/workflows/release.yml:
| commits | bump |
|---|
fix: | patch |
feat: | minor |
feat!: or BREAKING CHANGE: | major |
| anything else | no release |
Publishing uses npm Trusted Publishing over OIDC, so no NPM_TOKEN is stored. It requires
permissions.id-token: write (configured), Node ≥ 22.14 with npm CLI ≥ 11.5.1 (the workflow uses
Node 24 plus npm install -g npm@latest), and a repository.url that matches this repository.
The Trusted Publisher is configured on npmjs.com for Steven-Qiang / dsh-pwsh-guard /
release.yml. A new package has to be published manually once before that configuration exists,
and a new Trusted Publisher must complete a successful publish within 2 days or it expires.
