dsh-permission-panel：DSH 工作区权限面板
dsh-permission-panel 是 kirito787-neet 维护的 DSH 管理类插件，将各会话权限预设集中为一张可按工作区分组、可搜索、可按等级筛选的表，支持单条与批量修改及新会话默认权限，并从会话入口展示宿主读回的当前生效策略。读写均走宿主原生命令，不自行持久化状态。支持 Web 与 Desktop，npm 安装后于设置或会话头部「权限」打开。当前版本 3.3.0，MIT 许可；产物声明为 AI 生成，使用前请复核源码。
Read Moredsh-tm-guard: A macOS DSH Agent Permission Gating Plugin
dsh-tm-guard is a macOS permission management plugin designed for DeepSeek Harness (DSH) agents. It leverages Time Machine and APFS snapshots to implement “zero-intervention” permission gating, following the principle that reversible operations are allowed to run while irreversible operations are denied. By default, the plugin blocks network access, system administration, and reading of sensitive files, and it supports extending writable directories and trusted tools through configuration. Installation requires macOS, a Time Machine backup, and specific permission requirements. It provides developers who need to run DSH agents locally and securely with a practical and auditable solution.
Read Moredsh-knowledge-bridge: Zero-Configuration Host-Level Knowledge Base Access and Security Protection
`dsh-knowledge-bridge` is a host-level Cordis plugin designed to address the issues of DeepSeek Harness agents being unable to access shared knowledge bases and accidentally executing destructive commands. It provides keyword-scoring-based retrieval tools (supporting search, read, and list operations), zero-configuration discovery, and the ability to intercept destructive Shell commands. By enabling on-demand retrieval, it optimizes token usage, supports Windows, macOS, and Linux, and serves as a solution for improving the security and efficiency of agent knowledge retrieval.
Read Moredsh-workspace-acl-allow: Preset Windows ACL Authorization for Explicitly Declared Workspace Directories
`dsh-workspace-acl-allow` is a Windows plugin designed for DeepSeek Harness (DSH) 0.1.7 and later. The new Low Integrity label in DSH requires higher privileges (WRITE_DAC and WRITE_OWNER), causing write operations to standard directories to be denied and triggering UAC prompts. This plugin resolves the issue by proactively granting full-control Windows ACL permissions for user-declared directories within the host process. It features a declarative design that activates only upon explicit user intent to avoid silent privilege escalation, and supports automatic or manual authorization, status monitoring, and built-in protections, significantly improving the convenience of using the dsh sandbox on Windows.
Read Moredsh-auto-pass: A Model Review-Driven Automated Approval Plugin
The `dsh-auto-pass` plugin introduces an intelligent automatic approval mechanism to DeepSeek Harness (DSH), aiming to resolve the conflict between the low efficiency of manual approval and security risks. Based on a single-pass model review mechanism, it combines blacklist/whitelist management with a denial-list toggle to achieve automated processing while ensuring security. By configuring thresholds, the system can automatically learn and generate a project-level whitelist, significantly improving operational efficiency and supporting a visual approval-record panel. This plugin takes effect only when the “Auto Approval” permission preset is used.
Read Morewxjgit/permission-popup: DeepSeek Harness Permission Approval Aggregation Card
`wxjgit/permission-popup` is a DeepSeek Harness plugin designed to address the cumbersome process of permission approval in background sessions. It aggregates pending approval requests from both the current and background sessions into a card stack in the corner of the page, offering quick “Allow Once” or “Deny” actions. It also supports configuring trigger policies, desktop notifications, and local preferences. By intercepting and displaying permission requests, the plugin lets users handle approvals quickly without frequently switching context windows. After installation, restart the Web UI. It is recommended to use this plugin in a DSH environment, and please review the source code before use.
Read Moredsh-git-forge: A DeepSeek Harness Plugin for Managing Codebase Accounts and Push Policies
`dsh-git-forge` is a DeepSeek Harness community plugin designed to address account management, project isolation, and push policy issues for agents across multiple code hosting platforms. It supports unified management of GitHub, Gitea, and other accounts, and binds authorizations to DSH workspace paths. Models can perform read-only operations through the GitForge tool, while HTTPS requests are handled by the plugin's credential assistant, ensuring tokens are never exposed to the model context. The plugin leverages the Host `tools.guard` to forcibly intercept unauthorized `git push` and `git remote` operations, providing fine-grained security controls suitable for scenarios requiring strict permission management.
Read Moredsh-timeout-auto-reject: Automatic Rejection of Unanswered Permission Requests
The DSH plugin `dsh-timeout-auto-reject` addresses the issue of Agents hanging while waiting for user approval. If a permission request remains unanswered for 180 seconds, the system automatically rejects it and injects a system prompt to let the Agent continue. Maintained by `jiesou`, the plugin is small open-source code that uses a "reject" strategy to prevent indefinite waiting. It is easy to install and released under the MIT license.
Read MoreDeepSeek Harness Plugin dsh-perm-guard: Automatic Permission Approval Middleware
`dsh-perm-guard` is an automated permission approval plugin for DeepSeek Harness (DSH), designed to balance development efficiency with security. It intercepts requests for bash, pwsh, and file operations; through dual-mode (standard/aggressive) and fine-grained controls, it automatically approves routine operations while requiring confirmation for destructive commands. The plugin supports audit logging, persistent configuration, and coverage of all entry points, but be aware of potential compatibility issues with certain DSH versions, and note that it can only detect network download behavior via text patterns.
Read MoreDSH Plugin dsh-auto-approval-plugin: Insert an automatic approval layer between Workspace Write and Full access
Developed by StyxNether, dsh-auto-approval-plugin is a permission approval plugin for DeepSeek Harness (DSH) designed to bridge the gap between Workspace Write and Full access permission levels. The plugin introduces an auto-approval preset and registers listeners along the approval path to perform automatic determination based on actual tool parameters in the session log, rather than model-generated justifications. If the target of the request falls within the user-configured trusted zone (which supports realpath resolution to prevent symbolic link bypass) or matches a harmless pattern, the plugin will automatically approve that specific call (allowed-once); otherwise, the request will be forwarded to human confirmation, and the plugin itself will not execute.
Read MoreDeepSeek Harness Auto-Approval: dsh-auto-mode Bridges the Middle Layer in Permission Modes
Introducing the DSH plugin dsh-auto-mode (@nanmicoder/dsh-auto-mode) maintained by NanmiCoder. It adds an Auto/automatic approval mode on top of the official workspace-write sandbox: routine builds, tests, and dependency installations are automatically allowed, while semantic risks outside the sandbox are reviewed by a classifier, and dangerous operations such as accessing the root directory or credential paths are directly rejected. The article covers a comparison of four permission modes, installation commands, steps to enable it in the Web UI, optional classifier configuration, and an explanation of security boundaries.
Read MoreAdd Secure Automatic Authorization for DeepSeek Harness with dsh-auto-mode
### 正式翻译版本（符合技术文档译法）： dsh-auto-mode is a DeepSeek Harness workflow plugin maintained by NanmiCoder, which inserts an Auto permission tier between Workspace Write and Full access. Daily operations run through the official workspace-write sandbox, with semantic risks classified by the current Session model, and critical path damages will be rejected before execution. This article covers the directory page, GitHub and npm verification of installation commands, decision rules, and security boundaries.
Read MoreLinux Server Security Hardening: Common Issues for Beginners
Linux server security is crucial for beginners. This article summarizes 7 common issues and their solutions: 1. Simple and long - unused passwords: Use strong passwords (8 characters with uppercase, lowercase, numbers, and special symbols), change them regularly, and switch to SSH keys (generate and upload public keys). 2. Disabling the firewall: Only open necessary ports (e.g., Web 80/443, SSH 22), and disable insecure services like Telnet. 3. Exposing SSH ports to the public network: Restrict IP access and use fail2ban to prevent brute - force attacks. 4. Unupdated system/software: Regularly update via yum/apt and enable automatic updates. 5. Permission confusion (777): Follow the principle of least privilege (directories 755, files 644) and avoid root abuse. 6. Ignoring logs: Configure log rotation and regularly check critical logs like auth.log. 7. Redundant services: Uninstall useless services (e.g., vsftpd) and close unused ports. Core principles: least privilege, closing entry points, timely updates, and log auditing. Beginners can start with strong passwords, restricting SSH access, and closing unnecessary services for long - term maintenance.
Read More