Introduction¶

The philosophy of DSH (DeepSeek Harness) is “everything is a plugin”; plugins can mount tools, sub-agents, and network modules. The problem that arises is: a plugin claims in package.json to only read files, but its preset conveniently mounts bash, web, and sub-agents; sandbox policies are also composed layer by layer within the session. It is too late by the time something goes wrong and you have to sift through dozens of compressed session logs.

feely0208/dsh-agent-permission-audit (npm name @deepwhale-cn/dsh-agent-permission-audit, version 0.1.0, MIT) does exactly this: it reads the declarations of installed local plugins and presets, reads the actual invocations in local session logs, and then lists the difference set—which calls exceed declarations (red), and which are declared but never used (yellow, can be narrowed down). It only reads local data, does not connect to the network, and can be run via CLI without installing the plugin.

Who maintains it and what problem does it solve¶

The repository is maintained by feely0208, the author line is Wenzhou DeepWhale Intelligent Technology Co., Ltd., and the license is MIT. It solves a very specific problem: permissions are composed, and the gap between declaration and reality is unclear. Existing practices involve manually sifting through logs after an incident; this plugin turns it into a single static read plus a text report.

Core Features¶

Declaration side. Reads package.json of installed local plugins (dsh field, peerDependencies, dependencies), modules mounted via cordis.patch.yml, and agent presets and insert lines following packages in .agent-presets/*, extracting the tool whitelist and file scope for each set of declarations.

Actual side. Reads local session logs session.v4.jsonl.zstd (using system zstd to decompress), extracting the actual tool invocations, commands, read/write paths, and accessed domains.

Difference set. Provides “Declared item -> Actual hit -> Out-of-scope call -> Declared but unused” per preset or plugin, and summarizes the total out-of-scope count and highest risk category.

Risk counting. Counts separately four categories: executing commands, writing system paths, accessing external networks, and reading credentials; for workspace-write and read-only sandboxes, it also lists session policy violations.

Output. Two types: text and --json; exit code 0 means no out-of-scope calls, 1 means there are, suitable for integration into scripts or check workflows.

Capability Scope¶

Plugins convert these into eight concept categories, which is sufficient: exec, fs.read, fs.write, net, skill, agent, memory, plan.

Plugin authors can explicitly declare a capability whitelist in package.json, which is an optional field that this plugin recognizes; the host ignores fields it doesn’t recognize. The part with : is the scope, supporting prefixes and * / ** wildcards:

When no explicit declaration is written, the plugin infers capabilities from dependencies and officially mounted modules via patch. The inference result is not a whitelist, so calls mounted by others will not be counted as this plugin’s “out-of-scope”. Actual invocations are precisely attributed to the preset based on the session’s agentPreset; when the preset declaration is not found (e.g., built-in presets), it only performs session policy audit and marks it clearly, without fabricating the difference set.

Installation and Activation¶

Use the installation command in the official directory:

dsh plugin --profile web add @deepwhale-cn/dsh-agent-permission-audit

After installation, a “DeepWhale Permission Audit” icon appears in the sidebar. Requirements: dsh >=0.1.0-rc.6 <0.3.0, Node.js >=18.

The same repository also provides a CLI that can run without installing the plugin:

node bin/cli.mjs --days 7            # Text report
node bin/cli.mjs --days 30 --json    # Machine-readable

The CLI also has parameters like --home <directory>, --sessions <directory>, --no-color, etc.

Common Configuration¶

Defaults to reading ~/Library/Application Support/DeepWhale Desktop/dsh-home, which contains profiles/, plugins/, .agent-presets/, sessions/. Three environment variables can override these:

The plugin is read-only throughout: does not write files, modify logs, connect to the network, or call third-party interfaces. The report masks sk-*, Bearer/Authorization assignments, token/secret values, emails, and username paths.

Suitable Scenarios and Notes¶

Suitable for users who have installed multiple plugins and presets and need to regularly verify actual permissions, and also suitable for plugin authors to self-check for unused capabilities before release. The audit itself only covers the tool invocation layer; behavior where plugins directly read/write files within the host process does not appear in logs and cannot be audited.

Several boundaries to note:

• “Writing system paths” and “Reading credentials” are heuristic identifications (looking at commands and paths), which may produce false positives; the report provides examples, verify against examples before modifying.
• When there is no session log, only declaration-side statistics are performed; the report clearly shows “No actual data” and will not equate “no data” with “no risk”.
• Built-in presets do not have declaration files on the local machine, so preset-level difference sets cannot be done, only session policy audit.
• “Out-of-scope” is determined based on preset composition and plugin explicit whitelist; host-provided global tools may not be in preset declarations; the report includes examples, verify before modifying.

Before installation, check the source code and license to ensure it is applicable to your session log location and zstd executable path. It runs with the permissions of the current dsh process, only reading local files and not modifying anything.

Conclusion¶

The value of this plugin lies not in tightening permissions for you, but in putting “what was declared” and “what was actually used” on the same report, making narrowing down justified and misconfigurations discoverable. It only reads local data, does not connect to the network, does not modify logs, and can be run repeatedly.

Directory page: https://www.skillhub.cn/plugins/feely0208/dsh-agent-permission-audit
Repository: https://github.com/feely0208/dsh-agent-permission-audit

Note: The community directory is an independent site with no official affiliation with DeepSeek / Hypothesis, and is not an official app store.