dsh-pwsh-guard
DSH (DeepSeek Harness) 插件：拒绝在 pwsh/bash/ops_bash 中使用 shell 文本 I/O——Select-String、Get-Content、findstr、rg、cat、node -e——并引导代理使用 read/grep/glob。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-pwsh-guard@0.3.1Pwsh Guard 以 dsh-pwsh-guard 发布，当前版本为 0.3.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
A DeepSeek Harness plugin that enforces one rule: read files with read, search with grep,
locate files with glob — not with shell text commands.
It registers a ctx.tools.guard over pwsh, bash and ops_bash. A call whose command line
performs file text I/O is rejected before execution, and the rejection reason names the tool to use
instead. Rejection messages follow the host locale (English or Chinese).
| id | group | blocks | use instead |
|---|---|---|---|
search.Select-String, search.sls | textSearch | Select-String, sls | grep |
search.findstr, search.grep, search.rg | textSearch | findstr, grep, rg | grep |
read.Get-Content, read.gc, read.cat, read.type | textRead | Get-Content and its aliases | read |
read.more, read.head, read.tail | textRead | more, head, tail | read |
bypass.node-eval, bypass.python-c, bypass.php-r, bypass.dotnet-io | runtimeBypass | node -e, python -c, php -r, [IO.File]::ReadAllText that read files | read, grep |
wait.Start-Sleep, wait.sleep | sleep | Start-Sleep, sleep | probe the port, read the job again later, schedule_create |
pipeline.stderr-merge | stderrMerge | 2>&1 followed by a pipe | $LASTEXITCODE, 2>err.txt |
job.wait | jobWait | job_output called with wait: true | probe the port (Test-NetConnection, curl), or read the job again later |
Two matching rules keep false positives down:
^, ;, |, &, (, {, $(), so
Get-ChildItem -Type f, git gc and git log --grep=x pass.git commit -m "stop using Select-String" passes. Rules that inspect
a script body (node -e ...) read the raw string.All fields are optional.
- id: pwsh-guard
name: 'dsh-pwsh-guard'
config:
enabled: true
language: auto # zh | en | auto
tools: [pwsh, bash, ops_bash]
disabledGroups: [] # textSearch | textRead | runtimeBypass | sleep | stderrMerge | jobWait
allowPatterns: [] # regexes matched against the raw command; a match allows the call
rules: [] # extra rules, evaluated before the built-ins
language: auto follows DSH_LOCALE, then the host locale, then LANG / LC_ALL.
rules:
- id: no-force-push
pattern: 'git\s+push\s+--force'
title: 'Force push is blocked'
hint: 'Use --force-with-lease instead'
From npm:
plugin_manager action: install_bundle target: dsh-pwsh-guard
From GitHub:
plugin_manager action: install_bundle target: https://github.com/Steven-Qiang/dsh-pwsh-guard
From a local checkout (link:, for development):
git clone https://github.com/Steven-Qiang/dsh-pwsh-guard
plugin_manager action: install_bundle target: /path/to/dsh-pwsh-guard
After editing code or config, reload without restarting:
plugin_manager action: set_plugin target: include:pwsh-guard enabled: false
plugin_manager action: set_plugin target: include:pwsh-guard enabled: true
Uninstall: plugin_manager action: remove_bundle target: dsh-pwsh-guard.
If install_bundle reports failedAt: registry, the failure came from another dependency of the
profile; the package link, package.json entry and cordis.yml row are usually already written.
Check for node_modules/dsh-pwsh-guard/index.js and the id: pwsh-guard row before retrying.
& "Select-String", powershell -Command "Get-Content x") are not detected.-EncodedCommand is not decoded.ops_bash --script_path is checked by path only, not by script content.Get-ChildItem, ls, dir) is out of scope.cc-safety-net; its rule schema cannot express "deny every use of this command", which is why
this plugin exists.npm test
Builds with tsdown, then runs 36 command fixtures and 11 configuration assertions.
Versions are owned by CI — do not edit version. Pushing to main runs
.github/workflows/release.yml:
| commits | bump |
|---|---|
fix: | patch |
feat: | minor |
feat!: or BREAKING CHANGE: | major |
| anything else | no release |
Publishing uses npm Trusted Publishing over OIDC, so no NPM_TOKEN is stored. It requires
permissions.id-token: write (configured), Node ≥ 22.14 with npm CLI ≥ 11.5.1 (the workflow uses
Node 24 plus npm install -g npm@latest), and a repository.url that matches this repository.
The Trusted Publisher is configured on npmjs.com for Steven-Qiang / dsh-pwsh-guard /
release.yml. A new package has to be published manually once before that configuration exists,
and a new Trusted Publisher must complete a successful publish within 2 days or it expires.