dsh-fs-allowlist：白名单目录写入免审批
dsh-fs-allowlist 是 wzn16 维护的 DSH 社区插件（MIT，0.3.0）。它在默认沙箱之上为 extraWritableRoots 配置的可信目录开放 write/edit 免审批，并通过 pre-execute 与 approval/request 对白名单相关的 bash escalation 自动 allowed-once；提供 Settings → Plugins → Directory Allowlist 与 fs-allowlist.json 热重载。安装使用 dsh plugin --profile web add 本地路径或 github:wzn16/dsh-fs-allowlist#main，需重启 DSH Desktop。白名单应收窄；插件以 DSH 进程权限运行，安装前宜审阅源码。
Read Moredsh-acl-sandbox-patch: DSH 0.1.7 Windows Sandbox Non-System Drive Workspace Fix
dsh-acl-sandbox-patch is a temporary workaround plugin for DSH 0.1.7 that addresses the complete failure of sandboxed commands in workspaces located on non-system drives. By wrapping the underlying API, it resolves the issue where `SetNamedSecurityInfoW` returns Win32 error 5 due to insufficient permissions, and handles token integrity control. After installation, DSH must be restarted to restore normal command execution; however, this compromises part of the integrity-labeling mechanism and carries risks of slower initial loading and abnormal behavior in older sessions.
Read Moredsh-agentenv-sandbox: AgentENV E2B Sandbox
The DeepSeek Harness plugin `dsh-agentenv-sandbox` uses an E2B adapter and the AgentENV Firecracker microVM backend to migrate an Agent's local filesystem and subprocess operations to a remote isolated environment, ensuring secure execution. It supports Bash, file tools, and LSP processes, and adopts a fail-closed policy to guarantee isolation without falling back to the host machine. Deployment requires a Node.js 22.19+ environment, a prebuilt AgentENV template, and specific environment variables. This solution addresses security risks in Agent development and enables secure, persistent sandboxed operations.
Read Moredsh-write-protect: Read-Only Protection for Workspace Paths
The DeepSeek Harness (DSH) plugin `dsh-write-protect` addresses the limitation of the original sandbox, which only supported “all write” or “all read” modes, by allowing developers to apply read-only protection to specific paths (such as `.git`) in `workspace-write` mode. Maintained by azazo1, the plugin supports configuration-based interception of tool writes and command sandbox access, and provides session-level temporary authorization. It also supports placing `.readonly` rule files and configuring additional writable root directories. Note that the plugin requires a DSH engine version of 0.2.0-rc.1 or higher and has compatibility issues on Windows.
Read Moredsh-sandbox-escalation-fix: DeepSeek Harness Sandbox Upgrade Compatibility Plugin
`dsh-sandbox-escalation-fix` is a zero-configuration compatibility plugin for DeepSeek Harness, designed to resolve error and retry-loop issues caused by mismatched tool parameters when third-party models are used in All Access sessions. The plugin dynamically projects tool schemas to ensure that the tools visible to the model are consistent with its current sandbox mode and permissions, and supports Windows, Linux, and macOS. It is compatible with DSH 0.1.1 through 0.1.6-alpha.2. Since the issue has been mitigated in official releases, it is recommended to try the official behavior first and install the plugin only if stability remains unacceptable.
Read MoreIntroducing the DeepSeek Harness Blaxel Sandbox Plugin
The Blaxel sandbox plugin provides remote execution capabilities for DeepSeek Harness. It migrates Git-hosted conversations to private cloud hosts, supporting offline continuation, context retention, and file conflict handling. Users can access sessions in the cloud and merge changes back locally using the "sync back" feature upon completion. The plugin is suitable for cross-device access and secure isolation scenarios. However, note that local models and OAuth cannot be migrated, and remote failures do not fall back to local execution.
Read Moredsh-llm-approver: DeepSeek Harness Sandbox Upgrade Pre-Review Plugin
`dsh-llm-approver` is a plugin for DeepSeek Harness designed to use an LLM to pre-approve sandbox escalation requests, reducing the need for manual confirmation. The plugin operates under a specific permission preset and uses an isolated context to evaluate command safety, automatically allowing clearly safe operations and falling back to UI approval for complex or dangerous ones. Installation and configuration are completed through official scripts and `cordis.patch.yml`, with support for multiple Profile adaptation. When using it, you need to switch to the “Workspace Write · LLM Review” preset. The plugin runs with host permissions; any pre-approval failure or timeout is downgraded to manual handling, and complete audit logs are retained.
Read More