PerryLink/dsh-permission-rules

This is a native permission plugin built exclusively for DeepSeek Harness (DSH), bringing Claude Code-style declarative allow/deny/ask permission control to all DSH tool calls. It runs rule checks on the tools/pre-execute waterfall before any tool executes, delivering deterministic, auditable permission management that users can configure entirely through plain YAML files. It supports installation via the 1024 store channel with a one-line command after installing the dsh1024 tool globally, and can also be browsed and added directly through the built-in DSH Desktop Market.

Users write custom rules in a .dsh/rules.yaml file in their project directory, and the plugin supports rich matching options including tool name globs, path patterns, command argument matching, and environment condition checks. It automatically merges rule files from the current working directory up to the filesystem root, prioritizing closer rules, and ships with a built-in baseline rule set for common high-risk operations. It is targeted at developers and teams that need fine-grained security control over DSH tool calls to prevent AI from executing unauthorized risky operations and enforce custom security policies.

The plugin requires Node.js version 22.19.0 or higher, works across all host platforms, and is released under the open-source Apache 2.0 license with no cost for use. It is compatible with DSH version v0.1.5-rc.2 and newer, and old session logs from earlier DSH versions may require a migration repair step. Invalid configuration edits will not crash the plugin, as it retains the last working set of rules, and first-time users only need to create a rules file to start configuring their policy that fits their specific security needs.