dsh-fs-allowlist
白名单目录写入免审批：为 write/edit 封装 ctx.fs.checkedTarget，自动批准涉及白名单路径的 bash 提权操作，并提供设置界面。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:wangzhaonan16/dsh-fs-allowlist#4029a3fcf0fc36c6f2ffcd9a9b2408366253b71eFs Allowlist 以 dsh-fs-allowlist 发布，当前版本为 0.2.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
DSH plugin: approval-free writes into whitelisted directories. Let the write/edit file tools modify configured whitelist directories (e.g. your Obsidian vault) directly — no more "sandbox denial → escalation retry → manual approval" — plus a Settings → Plugins → Directory Allowlist GUI and automatic approval for bash escalations that touch whitelisted paths. Behavior everywhere else stays exactly as before.
| Layer | Mechanism | Covers |
|---|---|---|
| write/edit tools | Wraps the ctx.fs.checkedTarget fence; whitelisted paths pass early | Approval-free vault reads/writes |
| bash commands | approval/request waterfall listener auto-answers allowed-once when the escalation reason mentions a whitelisted path | Approval-free bash writes (text heuristic; misses fall back to manual approval) |
| Settings GUI | settings.plugins.tab section + server-side HTTP management routes | Add/remove directories, toggle bash auto-approve visually |
Configuration is hot-reloaded: GUI edits apply instantly; manual edits to the config file are picked up within 3 seconds. No DSH restart needed.
Every write/edit tool call passes through the ctx.fs.checkedTarget() fence mounted by dsh-fs-sandbox (outside the workspace → FS_SANDBOX_DENIED → model retries with escalation → approval prompt). This plugin wraps that fence:
read-only mode / resolution failure) → delegate to the original fence untouched.File semantics — atomic writes, version guards, read-before-write checks, diff events — live in the parent dsh-fs-local provider below the fence and are not touched. Whitelist matching uses the same realpath (deepest existing ancestor) semantics as the fence, so symlink redirection cannot escape the allowlist.
bash runs under the Seatbelt process sandbox, whose profile cannot be extended from a plugin. Instead the plugin registers an approval/request waterfall listener: when a request comes from the bash tool and the escalation reason (model-written text) mentions a whitelisted path (absolute or ~-abbreviated form), it answers allowed-once automatically. This is a text heuristic: misses always fall back to the human prompt (fail-safe); enabling it means trusting the model's justification. Toggle it off any time in the settings page.
dsh plugin --profile web add /path/to/dsh-fs-allowlist
or from GitHub after release:
dsh plugin --profile web add "github:wangzhaonan16/dsh-fs-allowlist#main"
Installs into $DSH_HOME/profiles/web; restart DSH Desktop to take effect (refreshing the browser is not enough). The profile links the source directory, so editing the source only needs a restart — no reinstall.
$DSH_HOME/fs-allowlist.json (default: ~/Library/Application Support/dsh-desktop/harness/fs-allowlist.json on macOS; the resolver also understands $DSH_HOME, Windows %APPDATA%, Linux XDG paths, and the open-source ~/.dsh layout):
{
"extraWritableRoots": [
"/Users/you/ObsidianVault"
],
"bashAutoApprove": true
}
bashAutoApprove defaults to true when absent.| Scenario | Behavior |
|---|---|
| write/edit inside the workspace | approval-free (native, unchanged) |
| write/edit inside a whitelisted root | approval-free |
| write/edit anywhere else | deny → escalate → approval (unchanged) |
| read-only mode writing a whitelisted root | still denied (stricter knob wins) |
| bash touching a whitelisted root (reason matches) | auto-approved, no prompt |
| any other bash escalation (no match) | normal approval prompt |
checkedTarget is an internal seam of the shipped bundle: if a DSH upgrade refactors it, the plugin degrades loudly to "warn + transparent" (equivalent to today's behavior) without breaking sessions; adapt per release.dsh plugin --profile web remove dsh-fs-allowlist (or empty fs-allowlist.json) + restart DSH.
MIT