dsh-allow
Filesystem capability and sandbox permission manager for DeepSeek Harness shell commands using macOS Seatbelt profiles.
Install
No clear install command was found in the current repository evidence.
Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Capability-based filesystem permission evaluation (read, write, create, delete, execute) parsed from shell command ASTs
- macOS Seatbelt (sandbox-exec) compilation and kernel-level confinement for process trees and inline scripts
- Hard-protected rules store and audit files impervious to model writes or agent-level tampering
- Multi-tier permission resolution combining platform baselines, explicit rules, auto-review, and interactive cards
- Audit trail recorded in session trajectory ledgers and local NDJSON logs with decision origin indicators
- Interactive UI approval cards offering deny, allow once, and always allow, plus tool-operation rule management via /allow commands
Useful For
- Restricting agent shell execution to safe workspace bounds without accidentally opening sensitive directories like ~/.ssh or credentials
- Preventing silent deletions or unreviewed write operations during autonomous coding tasks
- Auditing and reviewing every shell command and management tool operation within the DSH conversation interface
Who It Fits
- Developers running DeepSeek Harness on macOS requiring strict sandboxing
- Security-conscious engineers automating local terminal tasks through AI agents
Documented Limitations
- Full read fencing ('enforce: full') causes macOS /bin/sh to abort, necessitating the 'guarded' baseline instead
- Seatbelt enforcement depends on /usr/bin/sandbox-exec and kernel support on macOS
- Metadata and stat operations still leak path existence in fenced areas because Seatbelt allows metadata for resolution
- Concurrent 'allow once' permissions are serialized per session to prevent cross-call capability leakage
- Auto-review mechanism relies on model evaluation within a timeout budget and does not constitute an immutable security boundary
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 2 runtime, 2 development, 2 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as MIT.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- DWJZ/dsh-allow
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 95f2039 · 2026-10-16
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 2GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-10-10
- Last release
- No release detected
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed security.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →Session lifecycle manager for DeepSeek Harness with search, restore, idle cleanup, and diagnosis.
View plugin →Persistent multi-model agent teams with dynamic DAG orchestration, run monitoring, and token insights for DeepSeek Harness.
View plugin →