DeepSeek Harness Plugin: dsh-fs-deny-policy

The DSH plugin `dsh-fs-deny-policy` is designed to block access to sensitive directories before a model performs reads, searches, or Shell invocations, using a root-directory deny list to fill the read-permission gap in sandboxing mechanisms. It supports full-type interception and can inform the model about the restriction to avoid ineffective interactions. Configuration requires setting absolute paths in `cordis.patch.yml` and supports denying reads only. A process restart is required after installation, and it is recommended to use the plugin together with a sandbox to enhance security.