dsh-permission-rules
Declarative allow/deny/ask permission rules and subprocess network policy proxy for DeepSeek Harness.
Install
$ dsh plugin --profile web add github:PerryLink/dsh-permission-rulesPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Sequential allow/deny/ask rule evaluation on the tools/pre-execute waterfall with fail-closed semantics
- Multi-dimensional rule matching covering tool names, subagents, argument globs/regexes, workspace paths, and environment conditions
- Subprocess-level HTTP/CONNECT proxy enforcing outbound network policies across deny-all, whitelist, and allow-all modes
- Pre-configured baseline ruleset guarding against privilege escalation, destructive commands, and sensitive file paths
- Hot reloading of rule configurations with debounced filesystem watching and WSL polling fallback
- Structured session event audit logging for decisions and intercepted network requests
- Dedicated /rules slash command and web settings panel featuring rule inspection, test simulation, and one-click host allowances
Useful For
- Preventing accidental or unprompted execution of destructive shell commands and Git push operations in protected paths
- Restricting outbound network connectivity from subprocesses during agent tool runs
- Routing sensitive file modification tools to human confirmation or secondary model review workflows
- Auditing and inspecting every tool invocation and network request permitted or denied during Harness sessions
Who It Fits
- Developers deploying autonomous or semi-autonomous DeepSeek Harness workflows on local systems
- Teams requiring fine-grained audit trails and strict execution boundaries for code generation agents
- Security-conscious operators managing outbound network access and tool permissions
Documented Limitations
- Host process fetch-based requests bypass the injected proxy and are not intercepted by the network policy
- Session log audit markers require newer Harness runtime support; older hosts require manual migration scripts or disabling audit
- Path candidate extraction relies on heuristic key inspection rather than comprehensive filesystem-level interception
- Glob matching does not support brace expansion, and regex backtracking protection is structural rather than formal
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 6 runtime, 32 development, 13 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as Apache-2.0.
A root package.json was captured and can be inspected by the registry.
package.json declares a prepare lifecycle script that may run during relevant package installation workflows.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-permission-rules
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 2215d50 · 2026-10-17
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 126GitHub stars
- Forks
- 3
- Open issues
- 10
- Last commit
- 2026-10-12
- Last release
- 2026-10-10
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed security.
View plugin →Persistent multi-model agent teams with dynamic DAG orchestration, run monitoring, and token insights for DeepSeek Harness.
View plugin →Session lifecycle manager for DeepSeek Harness with search, restore, idle cleanup, and diagnosis.
View plugin →