dsh-perm-guard
Auto 自动审批插件：DSH 中间档权限——信任目录内自动放行、危险操作人工确认（类别开关可调）
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:a903067276-rgb/dsh-perm-guard#a738506ce2b41f912b634dd8258d134bc8387fc8
Perm Guard 以 dsh-perm-guard 发布，当前版本为 0.2.10。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Auto-approval permission guard for DeepSeek Harness (dsh) web — the "middle tier" between workspace-write (asks too often) and danger-full-access (too open). Common operations like cross-directory edits, git commit/merge and builds run without approval prompts; destructive operations (deletes, disk ops, privilege escalation, curl|sh) always ask for human confirmation.
Unofficial project: independently developed and maintained by a community member, not an official DeepSeek product.
Auto button in the composer tool row
Auto Permissions settings page
~/.dsh/perm-guard.json, survives restarts. Zero host dependencies.dsh plugin --profile web add "github:a903067276-rgb/dsh-perm-guard#main"
Then restart dsh web. Update: dsh plugin --profile web update dsh-perm-guard, restart.
Manual install fallback: see docs/install.md.
| Category | Standard | Aggressive |
|---|---|---|
| File edit (write/edit/cp/mv/mkdir) | auto (in trust dirs) | auto |
| Git local (commit/merge/rebase/checkout) | auto | auto |
| Build / test / install | auto | auto |
| Read-only queries (ls/cat/grep/git status) | auto | auto |
| Delete (rm, reset --hard, clean -fd) | ask | ask |
| Protected paths (.ssh/.aws/secrets/.env/system dirs) | ask | ask |
| Privilege (sudo, services, global installs) | ask | ask |
| Network download-execute (curl|sh) | ask | ask |
| Git push | ask | auto |
| Publish / deploy | ask | auto |
| Disk / partition / device | ask | ask |
Switching modes resets the category switches to that mode's defaults (adjustable afterwards).
rm, rm -rf / or ~ (circuit breaker, even with $(...) variants), git reset --hard, git clean -fd, Remove-Itemdd writing devices, mkfs/fdisk/wipefs/diskutil erase, writes to /dev/sudo/su, service management (launchctl/systemctl), recursive chmod/chown on / or ~curl|sh, wget|shgit push --force / -f (rewrites history)| Platform | Status |
|---|---|
| macOS | ✅ development environment |
| Linux | ⚠️ expected to work |
| Windows | ✅ adapted & field-tested (win32 path handling + PowerShell vocabulary, 2026-08-24) |
C:\…, C:/…, /c/… (MSYS/Git-Bash) — normalized to C:/… on save; invalid entries are reported back by the UI instead of being silently dropped.Select-Object etc.) count as read-only; Invoke-RestMethod/iwr map to network; Stop-Process, reg add, schtasks /create etc. map to privilege (always human-confirmed); vssadmin delete shadows, bcdedit, diskpart are hard red lines.gh CLI read-only subcommands (view/list/status…) auto-approve; write operations fall back to human confirmation.sandbox_permissions) raise exactly one confirmation card instead of two.key+id registration to satisfy both rc.6 (id) and rc.7+ (key); verified locally on rc.6/rc.8/0.1.1-rc.2/0.1.5-rc.1, not guaranteed on every DSH version):
main (default) or v0.2.9 and newer.v0.2.7 (dsh plugin add github:a903067276-rgb/dsh-perm-guard#v0.2.7); DSH 0.1.0-rc.6 → frozen rc6-compat tag (no maintenance).v0.2.8: it imports the removed settingsNamespace export and makes the whole plugin tree fail to load (the web app will not boot). Use main / v0.2.9+ instead.pnpm in PATH — dsh plugin is a pnpm forwarder (needed for install/update)allowed-once (~13ms, no popup), risky ones are forwarded to the human prompt.callId; DSH 0.1.5 removed Session.events, so it now reads the public snapshotEvents() (older hosts keep the events path). When neither is available it always falls back to the human prompt (safe default, never auto-allow).tools/pre-execute) — dangerous categories are intercepted before the sandbox even rejects them.approval/asked + approval/decided event pair.curl|sh) in command text, not block other network traffic."Remove-Item", or scripts embedding rule sources) are conservatively intercepted — expected, rare in practice.approval/asked + approval/decided event pair.bash, pwsh (PowerShell), and the write/edit file tools. MCP tools and other read-only tools have no approval mechanism and are unaffected.a && rm -rf x): pure-word chains are split and evaluated per subcommand, taking the strictest result; chains containing variables/redirection/wildcards are treated conservatively as one unit.| Claude Code | Codex | dsh-perm-guard | |
|---|---|---|---|
| Read-only command set | built-in, not configurable | sandbox | built-in + configurable |
rm -rf / ~ breaker | always prompts | sandbox blocks | always prompts (all modes) |
| Protected paths | yes | .git/.agents/.codex | .ssh/.aws/secrets/system dirs/.git |
| Network isolation | tool-level | OS-level (default off) | not available (DSH has no OS network fence; only curl|sh pattern detection) |
| Approval categories | 3 tool classes | 5 granular switches | 11 explicit switches + 2 modes |
| Auditing | prompts only | logs | in-plugin audit + host approval/asked/decided events |
~/.dsh/perm-guard.json (created on first change):
{
"enabled": true,
"mode": "standard",
"categories": { "fileEdit": "auto", "...": "..." },
"trustedDirs": []
}
trustedDirs: extra absolute paths auto-approved in Standard mode (default: workspace + its sibling directories).# hot-plug testing (no restart)
# 1. define a dynamic Cordis plugin with the same decision logic
# 2. cordis_run → verify → cordis_stop
# static bundle (this repo layout)
# symlink to ~/.dsh/profiles/web/node_modules/dsh-perm-guard
# add "dsh-perm-guard" to ~/.dsh/profiles/web/package.json dsh.profile.bundles
# restart dsh web
Verification matrix: docs/verify-checklist.md