prevent-peep

🐟 Prevent-peep

English | 简体中文 | Changelog

🐟 When the big fat fish goes wandering, don't let it see what it shouldn't — and please don't let it upload any of it. 😏 Bonus: stops Holy Liang from roasting your XP choices.

A pair of blinkers for DeepSeek Harness. Every time the agent wants to touch a file, it hits a gate first — and you decide whether it gets through.

🛡️ What it actually does

One window, three lists, four kinds of alert:

When something trips the gate, mix and match: 🔔 a ding, 🪟 a silent corner notification we draw ourselves, 💬 the native Windows balloon, or ⚠️ a modal you have to click.

Plus a native folder picker — no typing paths by hand. Changes save themselves and land within a second, no restart.

⚠️ Read this: it's a soft lock, not a vault

It stops fat fingers and idle curiosity — not someone who really wants in:

• 🧱 It intercepts DSH tool calls, not the operating system
• 🪄 A path assembled inside pwsh ("D:" + "\secret") is invisible to it
• 🚪 Reading the disk outside DSH, using another tool, or just clicking "allow" will sail right past it

If you need nobody to see it, use ACLs / an encrypted container / a separate Windows account — that's a real lock. This plugin just makes snooping slightly more expensive.

📦 Install

Requires DSH with a desktop or web profile. Both packages are needed: bundle is what the plugin manager shows, plugin is the implementation.

git clone https://github.com/0352FL/prevent-peep
dsh plugin --profile desktop add "<path>/prevent-peep/bundle"
dsh plugin --profile desktop add "<path>/prevent-peep/plugin"

Restart DSH once afterwards 🔄

🎛️ Using it

Double-click plugin/大肥鱼我真该控制你了！.cmd and poke around. The lists start empty, so the guard does nothing until you pick at least one enforced root.

Settings live in %USERPROFILE%\.dsh\prevent-peep.json:

{
  "mode": "ask",
  "enforceRoots": ["D:\\"],
  "allowRoots": ["D:\\TE_Code", "D:\\DSH"],
  "denyRoots": [],
  "scanShell": true,
  "alertSound": true,
  "alertCustom": true,
  "alertToast": false,
  "alertPopup": true,
  "relativeBase": "C:\\Users\\TE\\Documents\\deepseek-harness\\default-workspace"
}

Resolution order: deny → allow → enforced root. Paths are fully resolved first (.., \\?\, \\localhost\D$, D:foo, / vs \, letter case), and on Windows symlinks / junctions / 8.3 short names are followed too — if either the literal or the real path is out of bounds, it's out of bounds.

Advanced keys (not in the window, but the window keeps them when you save):

👀 What it watches

Any tool call whose arguments carry a path in pathKeys, or an absolute path inside scanKeys — in practice read, write, edit, glob (including the pattern), grep, read_image, present, working_directory, and pwsh (both workdir and the command itself). File contents you ask it to write are never scanned.

🧠 Honest limits

Read the full README on GitHub →