dsh-approval-gate：DeepSeek Harness 命令审核与阻断插件
`dsh-approval-gate` 是 GooDAnDReaY 维护的 DeepSeek Harness 原生命令审核插件，旨在通过拦截工具调用保障安全。安装后需在 profile 中启用。 该插件通过注册 `tools.guard`，利用两频段预过滤机制进行命令阻断（如 `rm -rf`、敏感文件写入）和危险操作路由。它支持配置文件写入工具、环境变量保护及熔断机制。对于无法完全解析的命令，插件会路由至原生审批流。插件仅拦截 DSH 工具，不处理 cron 和 systemd，适用于需要轻量级命令安全层的场景。
Read MoreDSH-Approval-Gate: DeepSeek Harness Automatic Approval Gating Plugin
dsh-approval-gate is an MIT-licensed plugin for DeepSeek Harness, designed to balance the efficiency of automated approval with security. It leverages Flash models to perform risk pre-assessment on sandbox escape operations, categorizing them into SAFE and RISKY types. For reversible, low-risk operations, the plugin uses a confirmation-based learning mechanism to automatically approve them, reducing repetitive manual confirmations. For the five categories of hard-risk operations—deletions, credential handling, remote/production environments, system paths, and irreversible batch operations—it always routes to manual confirmation to ensure critical security. The plugin provides a manual review UI to display the approval timeline and supports hot-reloading of configurations. Version v0.5.0 introduces file change comparison and one-click revert functionality, allowing users to view unified diffs and restore files based on session snapshots. Users need to install it via the command line.
Read More