dsh-wsl-search: Sandboxed Search Tool for WSL

DeepSeek Harness (DSH) uses a plugin-based architecture and supports running in WSL environments. When performing file searches, calling system tools directly can introduce privilege and security risks. This article introduces the dsh-wsl-search plugin, which wraps ripgrep, fd, and ast-grep through a sandboxing mechanism and restricts search behavior to specified directory scopes.

What It Is¶

dsh-wsl-search is a plugin designed for the DeepSeek Harness WSL environment. It provides sandboxed ripgrep, fd, and ast-grep tools, and by default restricts search scope to the $HOME and ~/.dsh directories. The plugin is maintained by user 173787247 and follows the MIT license.

Core Features¶

The plugin mainly provides the following capabilities:

Tool availability check: Confirm whether rg / fd / ast-grep are available in the current environment.
Content search: Supports content-based retrieval, with limits on line count and line length.
Filename lookup: Uses fd logic for fast filename matching.
Structured pattern search: Supports pattern matching of code structure using ast-grep.

Installation and Enablement¶

Before installation, ensure the environment meets the following requirements:

DeepSeek Harness version >= 0.1.2
Node.js >= 18
ripgrep and fd are installed in the WSL environment

Run the following steps to install:

# 1. 安装系统依赖
sudo apt install ripgrep fd-find

# 2. 安装插件
dsh plugin --profile web add github:173787247/dsh-wsl-search

Configuration and Usage¶

The plugin is configured through the config field, mainly controlling search line-count limits, maximum match count, and the root directories allowed for searching. By default, allowRoots is empty, meaning only searches under $HOME and ~/.dsh are allowed.

config:
  enabled: true
  timeoutMs: 30000
  maxMatches: 50
  maxLineChars: 400
  allowRoots: []  # 空数组 = 默认 HOME + ~/.dsh

To search a project directory, add its absolute path to allowRoots, but do not add the root directory / to avoid loss of privilege control.

The plugin provides the following commands:

search_status: Check tool availability.
search_rg: Search content.
search_fd: Look up by filename.
search_astgrep: Structured pattern search.

Use Cases and Caveats¶

The plugin restricts search paths through the allowRoots mechanism. By default, it only allows operations under $HOME and ~/.dsh, which aligns with the principle of secure sandboxing. When using it, note that the plugin runs within the permission context of the current dsh process. Before installation, it is recommended to review the GitHub source code and license (MIT).

dsh-wsl-search provides secure, controllable file search capabilities, making it suitable for agents or toolchains that need to perform file analysis in WSL environments. See the links below for full configuration and source code.