Plugins

Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.

Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.

Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.

Commit-time audit harness for AI coding agents: 28 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and a full MCP toolset. Installable via dsh plugin add.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

Auto mode for DeepSeek Harness (dsh): an Auto entry in the Permissions selector whose approval prompts are answered by OpenGuardrails policy instead of a human — plus the full OGR guard engine underneath. No core changes.

Adds persistent execution contracts, recursive work graphs, critical clarification, and evidence gates for long or underspecified Harness tasks.

Host-plane sovereignty clause and content guard: appends user-held adjudication to the system prompt tail, redacts credentials and hidden carriers in tool results, and vetoes irreversible actions before they run. Applies to every agent preset.

Blocks AI coding agents from editing files without evidence and from running unapproved high-risk commands, and tells quoted dangerous strings apart from commands actually being executed.

Local and remote SSH terminals for DeepSeek Harness Web with three permission levels, human approval for risky AI commands, and encrypted credential storage.

Local tool guard that scores every DeepSeek Harness tool call with an Ollama decision model before it runs; risky calls come back as an approval prompt, and an unreachable model stops all calls. Requires DSH 0.2.x and a local Ollama 0.35.1+ with the default ~6 GB clef-flash model pulled first; without them every tool call is denied.

Adds an "approve for me" access mode whose approval requests are answered by an independent reviewer model instead of a person: the reviewer can read the workspace read-only, a reviewer that cannot run hands the request back to the human, and every decision is recorded with its rationale in an Approvals tab.

SolidForge on the DeepSeek Harness — the globally installed plugin face: five skills in every session's catalog plus /solidforge:<skill> colon-gesture injection and the /solidforge, /arm-tools commands.

AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.