@goodandready/dsh-approval-gate
仅限主机的 DeepSeek Harness 命令安全防护：阻止已识别的危险操作，并在无法检查命令时请求 DSH 批准。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:GooDAnDReaDY/dsh-approval-gate#87a84c2abd3aa9568c9f849c012c4a98753a4b35Approval Gate 以 @goodandready/dsh-approval-gate 发布，当前版本为 0.1.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →|
⭐ If you like this plugin, please star it on GitHub — it shows me that the plugin is useful to you and motivates me to keep developing it.
🐛 If you find a bug or would like to request a feature, open a GitHub issue in any language — I will review your proposal and implement useful suggestions in a future plugin version. |
DeepSeek Harness can still let an agent run a dangerous tool call when sandbox mode is loose. This host-only plugin registers a monotonic tools.guard and denies the call before the tool body runs.
Commands the guard cannot fully inspect are routed through DSH’s native approval flow. This plugin does not implement a separate approval word.
graph LR
A[bash / file-write tool] --> B[dsh-approval-gate]
B -->|known safe| C[tool runs]
B -->|known dangerous| D[denial string]
B -->|uncertain syntax or target| E[DSH approval request]
lib/inspect.js tokenizes the bash command (quotes, backslashes, pipelines, wrappers) and inspects the real argv. File-write tools are classified by path, not by regex over prose.
| Module | Responsibility |
|---|---|
| lib/index.js | Registers the monotonic tools.guard and pre-execution approval hook; wires the shell and file-write inspectors into DSH. |
| lib/inspect.js | Tokenizes bounded Bash syntax, inspects command argv and expansions, applies destructive-command and protected-write rules, and returns pass, deny, or ask decisions. |
| lib/messages.js | Provides English and Simplified Chinese rule names, explanations, and redacted-result labels. |
| cordis.patch.yml | Declares the host-side plugin bundle and optional tool configuration. |
The guard runs before the tool body. A recognized dangerous action is denied even if a prompt could otherwise be shown. Uncertain syntax or targets are sent to DSH approval; DSH policy still decides whether a prompt is available.
| Call | Result |
|---|---|
rm -rf /tmp/x, sudo rm -r ... | block |
kill / pkill / killall as the command | block |
k''ill -9 1 (quoted fragments) | block |
systemctl restart|stop|disable ... | block |
systemctl is-active dsh-web | pass |
service name stop|restart | block |
sqlite3 ... DROP/ALTER/... | block |
echo x > .env, tee/sed -i on secret files | block |
write/edit to .env, credentials.yaml, settings.yaml, cordis.patch.yml | block |
grep kill-all docs/, echo 'do not rm -rf' | pass |
python3 -c "print('rm -rf')" | pass |
$IFS, $(...), backticks, unclosed quotes, heredoc << | request DSH approval |
bash -c "rm -rf /tmp/x" | block (nested shell) |
empty / missing command | pass (nothing to run) |
non-string command | block (unknown format) |
-c/-e is not a second language parser. Nested bash -c is inspected.tools.guard.bash ./run.sh is not opened and scanned.Install from the public npm registry:
dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3
Keep the guard enabled in profiles that need command-safety protection.
Optional fields on the Cordis patch entry:
| Field | Type | Default | Meaning |
|---|---|---|---|
toolName | string | bash | Tool whose command argument is inspected |
fileWriteTools | string[] | write, edit, Write, Edit, str_replace, apply_patch | Tools classified by path |
Example Cordis patch configuration:
- insert:
- id: dsh-approval-gate
name: @goodandready/dsh-approval-gate
config:
toolName: bash
fileWriteTools:
- write
- edit
- Write
- Edit
- str_replace
- apply_patch
The plugin adds no HTTP routes and no standalone CLI. Install and remove it through the DSH plugin CLI. The plugin only guards supported DSH tool calls; it is not an operating-system sandbox.
MIT © GooDAnDReaDY
This is the first public npmjs release under the canonical @goodandready/dsh-approval-gate identity.
Changed in v0.1.3: earlier internal instructions described a separate operator confirmation word. The public package routes uncertain commands through DSH native approval and does not define its own word. Earlier builds used internal distribution; new installs use the public npmjs identity.
This release adds bounded shell syntax analysis and routes uncertain cases through DSH approval while preserving denies for recognized destructive operations and protected-file writes.
The shell analyzer now understands command substitutions, backticks, process substitutions, common redirects including 2> and &>, pipelines, and here-documents. It recursively checks nested shell commands and executable expansions. Ordinary safe reads can pass. Shell-expanded authorization headers request approval because curl receives the credential as a process argument. This package does not provide a credential-safe API helper; keep tokenized API calls out of command-line arguments.
The locale service is optional; the security hooks remain active with English fallback messages when it is unavailable.
Recognized destructive commands and writes to protected files remain denied. This includes recursive rm, process signals, service stop/restart operations, destructive SQL, protected-file writes, git reset --hard, forced git clean, mkfs, device-targeted dd, and downloaded content piped to a shell.
Unsupported or incomplete syntax, dynamic command names or redirect targets, and script files whose contents cannot be inspected request approval through DSH. If approval is unavailable or approval=never is configured, DSH rejects the request. The plugin does not read script files or implement a separate approval word. Messages identify the rule and include a redacted excerpt. This is a bounded shell analyzer, not a complete Bash grammar.