dsh-guard: Guardrails for dangerous operations in DSH

dsh-guard (npm package dsh-guardrail) is an admin-security plugin for DSH that provides dangerous command interception (22 built-in rules, either deny or ask), sensitive path protection, tool output desensitization (13 built-in rules), local JSONL audit logs, and a daily guard_report. Once installed into a test profile, you can enable dryRun to observe false positives first, and then configure according to the rule table. The plugin operates with the permissions of the current process and relies on regular expression matching; it cannot replace a sandbox and must be used in conjunction with a least-privilege account.