dsh-write-gate：DeepSeek Harness 的工具调用前写门控插件
dsh-write-gate是面向AI编程代理的DeepSeek Harness（DSH）插件，旨在解决仅靠提示词或文本过滤缺乏可审计策略检查的问题。该插件在工具调用执行前进行两级策略检查：第一级为确定性结构检查，通过路径通配符、命令正则等限制明确约束；第二级为语义LLM判断，处理如“不修改无关文件”等自然语言承诺。 操作者通过YAML文件定义策略（commitments），配置默认失败模式（默认为closed，即fail-closed）及每步Judge预算。插件具备严格的安全设计：当Judge不可用或超时时，阻塞严重级别的调用；防止提示注入；且若策略文件缺失或无效，部署将直接失败而非静默跳过
Read More@agenticcontrolplane/dsh: Inspecting Tool Calls and Logging Decisions in DeepSeek Harness
@agenticcontrolplane/dsh is a native Cordis plugin for DeepSeek Harness, designed to enhance security controls in agent workflows. By integrating with dsh's typed interception points, this plugin performs policy checks before the execution of tool calls (such as bash, file editing, etc.), supporting three decision modes: allow, deny, and ask, while logging the allowed actions, blocked attempts, and the reasons behind them. Additionally, it offers post-call output scanning functionality to convert server-side blocks into corrective feedback. This plugin is zero-dependency, built on a plain ESM architecture, and supports configuration through profile settings or environment variables (e.g., ACP_BEARER_TOKEN). Installation requires Node 22 and follows
Read More