dsh-write-gate: DeepSeek Harness Tool-Call Pre-Write-Gate Plugin

dsh-write-gate is a DeepSeek Harness (DSH) plugin designed for AI programming agents, aiming to address the issue of insufficient auditable policy checks that stem from relying solely on prompts or text filtering. The plugin performs two levels of policy checks before tool invocation: the first is a deterministic structural check that explicitly constrains actions through path wildcards and command regexes; the second is a semantic LLM judgment that processes natural language commitments, such as "do not modify unrelated files." Operators define policies (commitments) via YAML files and configure the default failure mode (defaulting to closed, i.e., fail-closed) as well as the per-step Judge budget. The plugin features a strict security design: it blocks calls of severe severity when the Judge is unavailable or times out, prevents prompt injection, and ensures deployment failure rather than silent skipping if the policy file is missing or invalid.