A per-turn operation counter and explicit-confirmation brake for DSH runs with full permissions, rather than a security boundary.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-10-30
License
MIT
01What can it help you accomplish?
Keep long DSH runs within an operation budget
Counted operations, stop reminders and a confirmation request at the hard limit
DSH users who granted full permissions and want a brake on repeated changes
02How to install into DeepSeek Harness
Prerequisites
- README built and verified against DSH 0.2.0-rc.2; declared peer range >=0.2.0-rc.2.
- The approval setting must be ask for hard-limit prompts to reach an available responder.
Installation steps
- 01
Run `npx -p @deepseek-ai/dsh dsh plugin --profile web add github:SteelUnion/dsh-confirm-gate`.
$ npx -p @deepseek-ai/dsh dsh plugin --profile web add github:SteelUnion/dsh-confirm-gate
- 02
Restart DSH. Defaults are freeLimit 10, hardLimit 15 and confirmWord confirm.
Verify the integration
- For the README module probe, set DEBUG_PROBE to true in lib/index.js, reinstall and restart.
- Check the system-temp confirm-gate-boot.log for `[enter] pre-execute`; a config entry alone is not proof.
03DSH integration and capability boundaries
DSH runtime plugin that counts persistent operations per turn and requests explicit user confirmation.
Per-turn operation budget
Persistent tool operations→Counts, stop instructions and hard-limit confirmation requests
Uncounted reads
Opening files, searching code and listing directories→Read operations do not consume the budget
User-triggered release
A user message containing confirmWord→Release for the entire turn
The trigger word anywhere in a message can release the turn.
04Who is it for? When not to use it?
Good for
- DSH users who granted full permissions and want a brake on repeated changes
Not for
- This is a cost and course-correction tool, not a security boundary. One tool call counts once regardless of how many files it changes.
- The README has not verified actual behaviour at counts 12–15 or whether ask displays a prompt at >=15; that requires approval: ask and an online responder.
05Compatibility, maintenance and safety notes
- This is a cost and course-correction tool, not a security boundary. One tool call counts once regardless of how many files it changes.
- The README has not verified actual behaviour at counts 12–15 or whether ask displays a prompt at >=15; that requires approval: ask and an online responder.
README declares the MIT license; runtime results are author reports.
06Frequently asked questions
Does dsh-confirm-gate replace the DSH sandbox?
No. The README describes a cost boundary and course correction. It stays silent in read-only and workspace-write sandbox modes.
What does replying confirm do in DSH?
Any user message containing the configured trigger word releases the entire turn. It need not be the whole message, so merely discussing the word can also release the turn.
Has the hard-limit prompt been verified?
The README explicitly says actual behaviour at counts 12–15 and whether ask displays an approval prompt at >=15 remain unverified. Prompts require approval: ask and an online responder.
07Related DSH workflows
cc-safety-net
by kenryu42
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
deltabox-lite
by delta-box
Lightweight, agent-native sandboxing with diff, commit and abort
tencentmeeting-cli
by tencentcloud
Tencent Meeting command-line tool with OAuth2 authorization for meeting, recording and attendance-report management.
dsh-auto-review
by perrylink
Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the session log (approval/asked -> autoReview/verdict -> approval/decided).
08Data and sources
A runtime plugin for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).
## License MIT
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-10-30. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.