Sensitive Data Guard (dsh-sensitive-data-guard): Adding a backup-and-confirm checkpoint for DSH delete operations

Sensitive Data Guard is a DSH plugin maintained by DreamInsight24 (admin-security, MIT, v0.2.6, compatible with DSH 0.2.2-rc.1). It categorizes each deletion target into three areas: Workspace, .dsh, and Sensitive Zone. It completely bypasses the Workspace, performs silent backups for .dsh, and performs backups followed by a popup confirmation for the Sensitive Zone. Any failure in backup, inability to send the popup, or user timeout results in a fail-closed block. Since v0.2.4, it utilizes the DSH user query/response channel to transmit answers, preventing early 4-digit confirmation codes from being filled back by the model. The plugin also supports unresolved/unknownTool policies, protected directories, backup quotas and restoration, and documentation and CLI (status / restore / dry-run / gc) self-checks. The article also describes the six categories of boundaries it cannot intercept (third-party processes, cmd sub-processes, dynamic code, unloaded code, workspace, and persistent shell), as well as installation and activation methods.