dsh-pr-gate
DeepSeek Harness 的确定性写入门禁：对代理写入的每个文件执行范围策略和残留扫描，并在会话中实时运行——CI 门禁已移至写入时刻
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zhengqiuyang/dsh-pr-gate#7e4e936555da3e1b82bdf5e0d55b90f8962a0a49Pr Gate 以 dsh-pr-gate 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Deterministic write gate for DeepSeek Harness (dsh) — the CI gate moved to the moment of the write.
Every file the agent writes (write / edit / str_replace_editor) passes
the same scope policy and residue rules that
agent-pr-gate applies to PRs
in CI — deny-before-write in tools/pre-execute, residue scan of the written
text in tools/post-execute, and a durable content-hashed JSONL ledger of
every decision. Zero LLM calls in the trust path: the parts of the gate that
must NOT be an LLM live here.
The review/guard lane in the dsh ecosystem is entirely LLM-shaped:
answer-reviewer plugins re-read turns with a second model, dsh-gungnir
verifies goal completion from exit codes, and the closest action-guard
(cc-safety-net, 1.6k★ in the Claude ecosystem) blocks destructive commands.
Nobody gates what the agent writes deterministically — scope policy,
residue markers, or a durable record the CI can consume. That slot is empty,
and this plugin is the agent-pr-gate
engine living inside the runtime instead of waiting for the PR.
| Stage | Hook | Deterministic action |
|---|---|---|
| Before the write | tools/pre-execute | Scope policy: deny globs always win; a non-empty allow list means "only these". Denied writes never touch the disk |
| After the write | tools/post-execute | Residue scan of the written text: injection text aimed at reviewers, skipped tests, debug markers. warn (default) logs + ledgers; block also fails the write with corrective feedback |
| Always | JSONL ledger | One line per decision — tool, path, action, sha256 of content, matched pattern, residue kinds. agent-pr-gate CI can consume it as the session-side record |
Point policyFile at your repo's agent-pr-gate.yaml and the live session
enforces the same allow/deny the CI gate enforces on PRs — all policy entries
are unioned. Inline allow/deny config works without a file.
dsh plugin --profile default add github:zhengqiuyang/dsh-pr-gate
git installs build from source; authorize the build once in the profile's
pnpm-workspace.yaml:
allowBuilds:
dsh-pr-gate: true
- id: dsh-pr-gate
name: dsh-pr-gate
config:
tools: [write, edit, str_replace_editor]
allow: [src/**, docs/**] # non-empty = only these
deny: ["**/*.pem", .github/workflows/**]
policyFile: "" # or e.g. agent-pr-gate.yaml
residueMode: warn # warn | block
ledgerPath: .dsh-pr-gate/session.jsonl
npm install
npm test # syncs the vendored agent-pr-gate core, builds, runs unit tests
The scope glob semantics and residue rules are vendored from the sibling
agent-pr-gate checkout (npm run sync; CI runs sync --check).
bash command write-heuristics (redirect/shell-write detection, warn-only)If dsh ships first-party deterministic write gating, or reviewer plugins converge on deterministic enforcement (they are all LLM-based today), this freezes at its last working version with a postmortem here. The engine stays owned by agent-pr-gate either way.