dsh-tool-guard: DeepSeek Harness Global Tool Blocking and Protection Plugin

dsh-tool-guard is a preset-agnostic global tool-blocking plugin for uniformly controlling tool visibility and invocation permissions on the host plane. It implements interception through a three-layer mechanism (presentation-layer filtering, execution-layer hard denial, and a self-protection gate) and provides a WebUI editor with hot-reload configuration support. The plugin is not bound to any specific preset, and core tools (such as read, write, edit, and bash) are protected by the self-protection gate and cannot be blocked. During installation, the repository must be linked into the DSH web profile bundle, supporting either global mounting or scoped mounting.