dsh-approval-first: DeepSeek Harness Approval-First Editing Plugin
`dsh-approval-first` is a DeepSeek Harness plugin designed to optimize security controls in sandbox environments. It leverages a “shadow tool” mechanism to display an approval card with code diffs directly to the user when a model attempts a write operation that is rejected by policy, avoiding repeated tool calls by the model. The plugin supports silent and popup modes, and includes features such as “read-first” gating, a drift sensor, and session mode switching. It focuses the review target on diffs rather than textual descriptions, reducing ineffective retries. Currently, the plugin is a transitional stub and affects only the `edit` and `write` tools.
Read MoreDeepSeek Harness Enterprise Approval Policy Plugin
The `dsh-approval-flow-poc` plugin for DeepSeek Harness (DSH) aims to provide pre-invocation security and compliance controls for tool calls in agents and enterprise applications. It supports risk classification of tool calls and implements three policies: allow, block, and manual approval. By recording redacted summaries in audit logs, it balances security and privacy while offering local debugging capabilities. The plugin is easy to install and supports three preset policies — developer, production, and strict — for different scenarios. Note that this project is community-oriented and experimental, and does not provide production-level security guarantees or advanced features.
Read More