dsh-permission-rules
Declarative Claude Code-style allow/deny/ask permission rules and process-level network policy for DeepSeek Harness.
Install
$ dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main"Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Evaluates ordered allow/deny/ask rules on the tools/pre-execute waterfall
- Provides multi-dimensional rule matching based on tool names, agent selectors, parameter globs/regexes, and workspace paths
- Manages process-level network traffic via a built-in local HTTP/CONNECT proxy and sandbox presets
- Offers hot-module-reload (HMR) watch support for rule files with safe fallback on syntax errors
- Exposes the /rules slash command for listing, testing, and reloading active permission rule sets
- Includes a Web UI settings interface featuring a rule editor, interception logs, and quick host-allow actions
Useful For
- Restricting destructive shell commands and privilege escalation attempts within agent sessions
- Enforcing explicit user approval or auto-review checks for critical file modifications
- Governing subprocess egress network connections with domain, IP CIDR, and port whitelists
- Auditing all tool execution decisions directly to session logs for compliance and debugging
Who It Fits
- DeepSeek Harness developers and administrators requiring strict execution governance
- Security-focused teams operating agent workflows on local workspaces
- Users needing granular network egress control for subshell processes
Documented Limitations
- Subprocess proxy does not intercept the host process's own fetch-based HTTP traffic
- Session log audit markers require compatible harness versions or manual migration repairs
- Path candidate extraction relies on a predefined set of tool argument keys
- Backtracking protection is structural and does not support full brace expansion in glob mode
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 6 runtime, 32 development, 13 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as Apache-2.0.
A root package.json was captured and can be inspected by the registry.
package.json declares a prepare lifecycle script that may run during relevant package installation workflows.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-permission-rules
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 8918ee8 · 2026-10-04
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 117GitHub stars
- Forks
- 3
- Open issues
- 9
- Last commit
- 2026-09-25
- Last release
- 2026-09-25
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed fallback and session audit logging.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →Compatibility bridge running unmodified Pi ecosystem extensions natively on DeepSeek Harness.
View plugin →Persistent multi-model agent teams with dynamic DAG orchestration, run monitoring, and token insights for DeepSeek Harness.
View plugin →