Introduction¶

DSH advocates “everything is a plugin,” but permissions themselves lack a dedicated interface: Settings → General only contains a single line of permission configuration. To change default values, one must find the configuration item themselves; there is no entry to promote an already open session to “Full access.” dsh-permission-guard is the patch for this gap—it does not invent a new permission model but merely moves DSH’s existing permission presets onto a standalone page, using two buttons to cover the two types of real-world operations: “Create New Session” and “Existing Session.”

Overview¶

This is a DSH plugin maintained by frostnova04, categorized under admin-security. It provides a Permission Settings page, attached under Settings, to solve two problems: first, ensuring that subsequently created sessions start with “Full access” by default; second, adding existing sessions to the allowlist one by one. Current version 0.1.0, MIT license, zero stars in the repository.

It is not a firewall, nor a sandbox. All writes within the page are calls to DSH’s existing presets.

Core Features¶

There are only two types of operations on the page.

1. Default for New Sessions (New-session default)

One button toggles the default permission to “Full access,” so all subsequently created sessions start with that permission; another button restores the safe “Workspace write” default value. Before switching, the page prompts for confirmation and explains the risks in plain language.

2. Existing Session Allowlist (Existing-session allowlist)

Existing sessions retain their respective permissions and will not be changed in bulk. They can be individually elevated to “Full access,” one at a time.

Why a Dedicated Page?¶

DSH natively has only one line of permission setting in General. This plugin creates a dedicated page for the same write path, separating “New Session Switch” and “Existing Session List” into two operations—precisely the two things users actually ask about.

What happens under the hood?¶

• New Session Default: Writes to defaultPreset in the permission settings namespace, which DSH reads when creating a session. Changing this value does not affect any existing sessions.
• Allowlist Entries: Performs the same preset write as the /permission command, so changes are recorded in that session’s own log and remain effective after restart.
• Meaning of Full Access: Sandbox is danger-full-access, and approval policy is never. There is no confirmation popup, and the writable scope is all files accessible by the DSH process.

In other words, this plugin does not introduce a new permission system; it simply provides a new UI for operating on existing presets.

Installation and Activation¶

Plugin Market: Wait for it to be listed, then install from Settings → Plugins within the app. Currently in the repository phase; use a single CLI command to add the package to the profile and register the bundle:

dsh plugin --profile desktop add github:frostnova04/dsh-permission-guard

Replace desktop if the profile name is different. You can also use a locked-version tarball:

dsh plugin --profile desktop add https://github.com/frostnova04/dsh-permission-guard/releases/download/v0.1.0/dsh-permission-guard-0.1.0.tgz

After installation, reload the window; the page appears at Settings → Permissions.

Prerequisites:

• DSH 0.2.1-rc.5 or higher, supported by both desktop app and dsh web.
• Standard settings and permission-presets plugins, included in the standard combination by default.

Typical Usage¶

1. Open Settings → Permissions in DSH.
2. If you want debugging or experiments later without confirming every time: click the default value button to switch to “Full access,” read the risk explanation in the confirmation popup, and confirm.
3. For example, if a long-running session needs write permissions released, select it in the allowlist and elevate it to “Full access”; this change is written to that session’s own log and persists after restart.
4. After debugging is complete, use the second button to restore the default value to “Workspace write.”

Use Cases and Considerations¶

Suitable for developers who need to repeatedly switch default permission values and cannot restart or recreate sessions, especially in scenarios where a team member wants to release write permissions for temporary sessions.

Points to note:

• “Full access” means no confirmation popup and the ability to write to any file the DSH process can access. This plugin warns of risks before enabling, but once the switch is turned on, the line of defense is the user themselves.
• The plugin runs with the permissions of the current dsh process; it does not perform additional privilege escalation or isolation; check the source code and license before installing.
• It does not modify existing sessions in bulk; to release multiple sessions at once, you must click individually.
• The directory site is an independent site with no official affiliation with DeepSeek or Hypersphere; this is simply a community plugin.

Summary¶

The value of dsh-permission-guard lies not in inventing new permission controls, but in wrapping the two existing write points—defaultPreset and /permission—into a page that is clear, allows for individual operations, and prompts for confirmation before switching. It turns “New Session Default” and “Individual Existing Session” into two independent operations, perfectly filling the gap left by that single line of settings in General.

Directory Page: https://www.skillhub.cn/plugins/frostnova04/dsh-permission-guard

GitHub: https://github.com/frostnova04/dsh-permission-guard