dsh-perm-guard

English | 简体中文

Auto-approval permission guard for DeepSeek Harness (dsh) web — the "middle tier" between workspace-write (asks too often) and danger-full-access (too open). Common operations like cross-directory edits, git commit/merge and builds run without approval prompts; destructive operations (deletes, disk ops, privilege escalation, curl|sh) always ask for human confirmation.

Features

• Auto approval answerer — intercepts every approval request before the host prompt, classifies the actual command/target, and auto-answers allowed-once for safe operations (13ms, no popup) or forwards to the human prompt for risky ones.
• Command-level firewall (tools/pre-execute) — dangerous categories are intercepted before the sandbox even rejects them.
• Two modes (switchable in the settings page, persisted):
  • Standard — auto-approve inside the trust directories (workspace, sibling directories, custom list); outside + risky operations prompt.
  • Aggressive — location-unrestricted: only destructive operations still prompt.
• 11 per-category tri-state switches (auto / ask / deny) with your personal defaults.
• Audit trail — every decision is recorded (approved / forwarded to human / rejected) with timestamp and command summary.
• Persistent config — ~/.dsh/perm-guard.json, survives restarts. Zero host dependencies.

Install

dsh plugin --profile web add "github:a903067276-rgb/dsh-perm-guard#main"

Then restart dsh web. Update: dsh plugin --profile web update dsh-perm-guard, restart.

Requires pnpm in PATH (dsh plugin is a pnpm forwarder).

Usage

• Auto button — in the composer tool row (left of the input box). Click to toggle auto-approval on/off (green = on). Off restores the host's default approval behavior completely.
• Settings → "Auto 权限" (Auto Permissions) — total switch, mode selection (Standard / Aggressive), 11 category switches, trust directory editor, and the recent-decision audit list.
• Rules apply to all sessions (including subagents) while enabled.

Mode defaults

Category	Standard	Aggressive
File edit (write/edit/cp/mv/mkdir)	auto (in trust dirs)	auto
Git local (commit/merge/rebase/checkout)	auto	auto
Build / test / install	auto	auto
Read-only queries (ls/cat/grep/git status)	auto	auto
Delete (rm, reset --hard, clean -fd)	ask	ask
Protected paths (.ssh/.aws/secrets/.env/system dirs)	ask	ask
Privilege (sudo, services, global installs)	ask	ask
Network download-execute (curl|sh)	ask	ask
Git push	ask	auto
Publish / deploy	ask	auto
Disk / partition / device	ask	ask

Switching modes resets the category switches to that mode's defaults (adjustable afterwards).

Never auto-approved (all modes)

• Deletion: rm, rm -rf / or ~ (circuit breaker, even with $(...) variants), git reset --hard, git clean -fd, Remove-Item
• Disk: dd writing devices, mkfs/fdisk/wipefs/diskutil erase, writes to /dev/
• Privilege: sudo/su, service management (launchctl/systemctl), recursive chmod/chown on / or ~
• Network download-execute: curl|sh, wget|sh
• Force push: git push --force / -f (rewrites history)
• Writes to protected paths

Coverage

• All approval entry points in DSH are covered: bash, pwsh (PowerShell), and the write/edit file tools. MCP tools and other read-only tools have no approval mechanism and are unaffected.
• Compound commands (a && rm -rf x): pure-word chains are split and evaluated per subcommand, taking the strictest result; chains containing variables/redirection/wildcards are treated conservatively as one unit.
• Unknown commands fall back to "ask" in Standard mode (safe default) and "allow" in Aggressive mode.

How it compares to Claude Code / Codex

	Claude Code	Codex	dsh-perm-guard
Read-only command set	built-in, not configurable	sandbox	built-in + configurable
rm -rf / ~ breaker	always prompts	sandbox blocks	always prompts (all modes)
Protected paths	yes	.git/.agents/.codex	.ssh/.aws/secrets/system dirs/.git
Network isolation	tool-level	OS-level (default off)	not available (DSH has no OS network fence; only curl|sh pattern detection)
Approval categories	3 tool classes	5 granular switches	11 explicit switches + 2 modes
Auditing	prompts only	logs	in-plugin audit + host approval/asked/decided events

Configuration file

~/.dsh/perm-guard.json (created on first change):

{
  "enabled": true,
  "mode": "standard",
  "categories": { "fileEdit": "auto", "...": "..." },
  "trustedDirs": []
}

• trustedDirs: extra absolute paths auto-approved in Standard mode (default: workspace + its sibling directories).
• Trust directories are ignored in Aggressive mode (location-unrestricted).

Known limitations

• DSH's sandbox has no OS-level network fence (unlike Codex): the plugin can only detect download-execute patterns (curl|sh) in command text, not block other network traffic.
• Terminal sessions, subagent creation, model calls and MCP tools are outside the approval system entirely.
• Commands whose text contains danger words (e.g. echoing "Remove-Item", or scripts embedding rule sources) are conservatively intercepted — expected, rare in practice.
• The audit list is in-memory (60 entries) and resets on restart; approval decisions themselves are always persisted via the host's approval/asked + approval/decided event pair.

Development

# hot-plug testing (no restart)
# 1. define a dynamic Cordis plugin with the same decision logic
# 2. cordis_run → verify → cordis_stop

# static bundle (this repo layout)
# symlink to ~/.dsh/profiles/web/node_modules/dsh-perm-guard
# add "dsh-perm-guard" to ~/.dsh/profiles/web/package.json dsh.profile.bundles
# restart dsh web

Verification matrix: docs/verify-checklist.md

License

MIT