dsh-tool-policy: Allow / Ask / Deny Before Tool Execution in DeepSeek Harness

dsh-tool-policy is a community plugin for DeepSeek Harness (DSH) that enforces declarative policy controls on built-in, third-party, and MCP tools before tool execution. It adopts a deny-by-default model and supports matching by tool name and argument patterns, applying allow, ask, or deny actions to individual calls. The plugin runs on Node.js, describes argument conditions using JSON Pointer, and provides decision trace logs that contain no sensitive data for troubleshooting. After installation, rules can be defined via YAML configuration—for example, allowing read-only operations, requiring approval for shell or external MCP tools, or outright blocking delete operations. Note that the plugin serves only as a policy routing layer and does not provide sandbox isolation, argument rewriting, or destructive behavior detection.