dsh-permission-rules
Declarative allow, deny, and ask permission rules for DeepSeek Harness tool calls.
Install
$ dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main"Repository Intelligence
AI-assisted, source-grounded explanation based on the public repository snapshot. It does not replace compatibility or security verification.
Key Capabilities
- Evaluates first-match ordered allow, deny, and ask rules on the tools/pre-execute waterfall.
- Matches tool-name globs, argument glob or regex patterns, selected workspace-relative path arguments, and environment or platform conditions.
- Supports per-workspace rule files, optional parent-directory rule discovery, and hot reload watching.
- Logs rule hits and passthrough decisions as permissionRules/decision session events.
- Provides /rules commands to inspect rules, reload files, replay decisions, and dry-run a hypothetical tool call.
- Routes ask decisions through ctx.approval and can work alongside dsh-auto-review or human approval.
Useful For
- Block defined shell, editing, or other tool actions before they execute.
- Require approval for sensitive file-write or command operations.
- Maintain repository-specific YAML permission policy with optional hierarchical overrides.
- Audit tool permission decisions within a DeepSeek Harness session.
- Test proposed permission rules without running a tool call.
Who It Fits
- DeepSeek Harness users managing tool-execution policy.
- Teams that need declarative project-level approval and denial rules.
- Plugin users combining deterministic rules with Harness approval workflows.
Documented Limitations
- This is policy enforcement rather than an OS-level sandbox and does not change sandbox policy.
- Path matching is heuristic: it considers only documented argument keys and workspace-relative paths.
- Globs are a conservative subset and do not support brace expansion.
- The regex backtracking guard is structural rather than exhaustive; the README recommends glob mode for untrusted files.
- Some older session logs may require the included repair script before loading on hosts with required-on-read semantics.
- Requires Node.js ^22.19.0 or >=24.0.0.
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 4 runtime, 17 development, 7 peer, and 0 optional dependencies.
package.json declares a prepare lifecycle script that may run during relevant package installation workflows.
package.json declares DSH bundle metadata.
A root package.json was captured and can be inspected by the registry.
GitHub reports the repository license as Apache-2.0.
Public GitHub source metadata is available for this registry snapshot.
package.json declares 4 runtime, 17 development, 7 peer, and 0 optional dependencies.
package.json declares a prepare lifecycle script that may run during relevant package installation workflows.
package.json declares DSH bundle metadata.
A root package.json was captured and can be inspected by the registry.
GitHub reports the repository license as Apache-2.0.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Traceable source and registry metadata for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-permission-rules
- Registry source
- Public GitHub repository
- Source snapshot
- 46830d074d4e
- Artifact type
- plugin
- AI enrichment
- gpt-5.6-terra · 2026-08-14
- Prompt version
- dsh-plugin-enrichment-v3
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 2
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-08-14
- Last release
- 2026-08-14
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Schedule standalone coding tasks in fresh DeepSeek Harness Agent sessions, with workspace-scoped controls and durable run history.
View plugin →一个适用于deepseek-harness的插件，功能是显示当前账户余额以及当前会话预估的费用消耗 | A plugin for deepseek-harness that displays the current account balance and the estimated cost consumption of the current session.
View plugin →DeepSeek Harness Plugin and Agent Profile Package Index - Install dsh-plugin with just one command
View plugin →A curated list of plugins, skills, MCP servers, patch/profile layers, orchestrators & UIs for DeepSeek Harness (DSH). Visualization · PPT · Coding · Agents · Loops (auto-research) and more. #dsh
View plugin →