sjh9714/dsh-movein-permissions

dsh-movein-permissions

Fine grained, per tool permission rules for DeepSeek Harness (DSH).

DSH ships three coarse permission presets (read-only, workspace-write, danger-full-access) and its README names the missing piece itself, there is no per tool allowlist. This plugin adds one at the tools/pre-execute gate, using Claude Code's battle tested rule syntax. You do not need to be migrating from Claude Code to use it.

为 DSH 补上按工具粒度的权限规则。DSH 自带的三档权限预设没有细粒度控制，这个插件在 tools/pre-execute 强制执行 deny/ask 规则，规则语法与 Claude Code 相同。不迁移也能单独用。

Install

dsh plugin --profile web add dsh-movein-permissions

Then add a row to ~/.dsh/cordis.patch.yml (or your profile's patch):

- insert:
    - id: cc-permissions
      name: 'dsh-movein-permissions'
      config:
        deny:
          - 'Bash(rm -rf:*)'
          - 'Read(*secrets*)'
          - 'mcp__github__delete_repo'
        ask:
          - 'Write'
          - 'Bash(git push:*)'

Restart dsh web. Denied calls return a typed refusal to the model, ask rules force a confirmation.

Compatibility

The plugin requires Node.js 22.13 or newer and supports DSH >=0.1.0-rc.8 <0.2.0 on the Web profile.

DSH release · Disposable-profile install · Web start · Uninstall 0.1.0-rc.8 · tested · tested · tested 0.1.1-rc.1 · tested · tested · tested 0.1.1-rc.2 · tested · tested · tested 0.1.2-alpha.3 · tested · tested · tested 0.1.2-alpha.4 · tested · tested · tested 0.1.2-alpha.5 · tested · tested · tested

CI packs this plugin, installs it into a fresh temporary DSH_HOME, confirms the composed profile contains the plugin-owned entry, starts the Web UI on loopback and receives an HTTP response, removes the package, and confirms the entry is gone. It never touches a user profile or sends a model request. The unit suite separately verifies the permission gate itself on Windows, macOS, and Linux.

Rule syntax

Claude Code permission rule shape, Tool or Tool(specifier).

Rule · Meaning Bash(npm run test:*) · any shell command starting with npm run test (matched on terminal_* tools) Read(*secrets*) · any read whose path contains secrets Write · every write mcp__server__tool · one exact MCP tool, names are identical in DSH and Claude Code

Mapped tools. Bash (terminal_open/terminal_send and friends), Read, Write, Edit, and every mcp__* tool. * patterns match as a superset, over-denying is the safe direction for a gate.

Deny wins over ask. Rules that reference tools with no DSH equivalent never match anything, harmless but pointless, the dsh-movein migration report lists them for you.

Coming from Claude Code?

npx dsh-movein --apply generates this row from your existing settings.json automatically, along with the rest of your setup.

License

MIT