Apache-2.0 的 dsh 插件：以有序的 allow/deny/ask 规则拦截 DeepSeek Harness 的每一次工具调用，将判定记入会话日志，并强制执行进程级网络策略——全部用 YAML 配置，支持热重载。
DSH 适配
原生运行时
作者声明
安全审计
未审计
最后核验
2026-08-30
许可证
Apache-2.0
01它能帮你完成什么？
Gate every DeepSeek Harness tool call with an ordered allow / deny / ask permission policy written in plain YAML
A deterministic, instant, auditable rule layer on the `tools/pre-execute` waterfall, with every hit and passthrough audit-logged as a `permissionRules/decision` session event
DeepSeek Harness (dsh) operators who want Claude Code-style declarative safety guardrails without re-implementing the approval flow
Control shell subprocess network egress with a process-level network policy
A built-in local HTTP/CONNECT proxy plus ordered network rules (deny-all / whitelist / allow-all / auto) that decide every outbound connection
Teams that need Codex-style egress control and network-policy auditing inside DeepSeek Harness
02如何接入 DeepSeek Harness？
前置条件
- DeepSeek Harness `0.1.1-rc.2` (or compatible) installed as the agent runtime
- Node `^22.19.0 || >=24.0.0`
安装步骤
- 01
Install the bundle: `dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main"`
$ dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main"
- 02
Or from npm (published releases): `dsh plugin --profile web add dsh-permission-rules`
$ dsh plugin --profile web add dsh-permission-rules
- 03
Restart and verify the row: `dsh --profile web --dump-config | grep -A4 'id: permission-rules'`
$ dsh --profile web --dump-config | grep -A4 'id: permission-rules'
验证接入成功
- After restart, `dsh --profile web --dump-config | grep -A4 'id: permission-rules'` prints the permission-rules row
- Run `/rules` to list the active rules, their source files, and any last-reload error
回滚
- Uninstall with `dsh plugin --profile web remove dsh-permission-rules`
- Set `enforce: false` for a dry-run rollback: deny/ask hits are audit-logged with a `dryRun` marker and every call passes through
03DSH 适配与能力边界
Native dsh plugin — installs via `dsh plugin --profile web add`, then hooks the `tools/pre-execute` waterfall as a first-match allow/deny/ask listener.
Ordered allow / deny / ask rules on tools/pre-execute
tool calls on the `tools/pre-execute` waterfall→first-match allow/deny/ask decision; `deny` makes the rule `reason` the model-visible error; `ask` rides the official approval seam
Every hit and passthrough is audit-logged as a `permissionRules/decision` session event (log-only — nothing extra is injected into the model context)Rich rule matching
tool-name globs, agent-identity selectors, argument key/value globs or regexes, workspace-relative path globs, `when` host conditions, shell command decomposition→token-precise match across multiple dimensions
Process-level network policy + local proxy
shell subprocess outbound connections→ordered network rules / deny-all / whitelist / allow-all / auto modes; denied connections audit to `permissionRules/network`
Proxy environment variables are injected for subprocesses (`network.injectEnv`)A built-in local HTTP/CONNECT proxy binds `127.0.0.1`Hot reload & fail-loud loading
rule file edits→Chokidar watch with debounce reload; a broken edit keeps the previous rules, never crashes
Invalid YAML, unknown actions/fields, bad globs/regexes, backtracking-prone patterns, or more than `maxRules` rules fail the load loudly
04适合谁？何时不该用？
适合
- DeepSeek Harness (dsh) operators who want Claude Code-style declarative safety guardrails without re-implementing the approval flow
- Teams that need Codex-style egress control and network-policy auditing inside DeepSeek Harness
不适合
- On pre-marker harness hosts (the `0.1.0-rc.1`–`rc.7` and `0.1.1-rc.1`–`rc.7` lines) the `ignorable` marker is silently dropped and the runtime disables session-log audit with a one-time warning; set `allowUnmarkedAudit: true` to opt back in.
05兼容性、维护与安全提示
- On pre-marker harness hosts (the `0.1.0-rc.1`–`rc.7` and `0.1.1-rc.1`–`rc.7` lines) the `ignorable` marker is silently dropped and the runtime disables session-log audit with a one-time warning; set `allowUnmarkedAudit: true` to opt back in.
- Path candidates are heuristic: only the documented argument keys feed path matching, and workspace-relative matching is ASCII-case-insensitive only when `caseInsensitivePaths` is on. Globs are a conservative subset with no brace expansion.
- `paths` candidates come only from a documented set of argument keys (depth-capped) and only workspace-relative paths match. OS-level sandbox policy belongs to the sandbox seam, not this plugin.
Apache-2.0 · actively maintained (latest release v0.6.1, 2026-08-27)
06常见问题
如何在 DeepSeek Harness 中安装 dsh-permission-rules？
已发布版本执行 `dsh plugin --profile web add dsh-permission-rules`；最新 main 分支执行 `dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main"`。随后重启并用 `dsh --profile web --dump-config | grep -A4 'id: permission-rules'` 验证。
安装前提与兼容性是什么？
需要 DeepSeek Harness `0.1.1-rc.2` 与 Node `^22.19.0 || >=24.0.0`。支持所有平台（宿主进程 + Web 设置客户端），且适配任意模型，因为 deny/ask 的原因会通过工具结果返回。
它如何与 DeepSeek Harness 连接 / 集成？
它是原生 dsh 插件：注册一个 `tools/pre-execute` 监听器，使每次工具调用先经过其有序的 allow/deny/ask 规则。`ask` 判定走官方审批通道——挂载 `dsh-auto-review` 可由第二模型作答，或由人工作答——因此审批流程没有任何重新实现。
它与 Claude Code 的权限或沙箱有何不同？
它风格类似 Claude Code，但作为策略层运行在 DeepSeek Harness 内部，而非内核。`paths` 候选只来自一组文档化的参数键，且只匹配工作区相对路径；操作系统级沙箱策略仍由沙箱通道负责。它还提供进程级网络策略与内置本地代理，并复用 harness 自身的审批流程而非另起一套。
排障：审计日志丢失或规则未加载？
在 pre-marker harness 宿主（`0.1.0-rc.1`–`rc.7` 与 `0.1.1-rc.1`–`rc.7` 系列）上 `ignorable` 标记会被静默丢弃，运行时会一次性告警并关闭会话日志审计；设置 `allowUnmarkedAudit: true` 可重新开启。损坏的 YAML、未知字段、错误的 glob/regex，或超出 `maxRules` 会保留旧规则（热重载）或直接报错加载失败——运行 `/rules` 可查看最近一次重载错误。
07相关的 DSH 工作流
cc-safety-net
作者 kenryu42
面向 AI 编程智能体的执行前安全防护插件，在工具调用前拦截破坏性 Git、文件操作和敏感文件访问，兼容多种编码 Agent 与命令行工具。
tencentmeeting-cli
作者 tencentcloud
腾讯会议命令行工具（CLI），基于腾讯会议开放平台 OAuth2 授权，支持会议管理、录制管理、参会报告等功能。
dsh-auto-review
作者 perrylink
第二模型 AI 自动评审：只读评审子智能体对审批请求返回结构化允许或拒绝结论，默认关闭、全程可审计。
jevcore
作者 perrylink
面向 DeepSeek Harness、MCP 和原生 Node 的 TypeSafe Jev 核心库，用离线优先的类型化判断替代模糊的自然语言决策。
08数据与来源
Claude Code-style declarative permission rules for DeepSeek Harness.
`dsh-permission-rules` puts an ordered **`allow` / `deny` / `ask`** rule list in front of every tool call on the `tools/…
页面基于项目公开文档、仓库元数据和 DSH Plugins 的结构化解析生成；最后核验于 2026-08-30。发现错误？提交更正。
最佳 DeepSeek Harness 插件
从全目录挑出的 12 个值得优先安装的插件，覆盖各个分类。