Plugins

Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.

Research-only trading workbench bundle: typed market-data provider seam with a CSV reference provider, multi-timeframe indicator regime snapshot and OHLCV tools, interactive chart cards in dsh web with provenance-gated model annotations, and a risk-guard denying execution-shaped tool calls at tools/pre-execute.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

Detects prompt-injection, jailbreak, and secret-leak patterns on the agent/pre-step, tools/pre-execute, and tools/post-execute seams with allow/ask/block tiers, sanitized defend/detection audit events, a defend_report tool, and a destructive-delete command guard.

Fine grained per tool permission rules for DSH at the tools/pre-execute gate, deny and ask lists in Claude Code rule syntax (`Bash(rm -rf:*), Read(_secrets_), mcp__server__tool`), works standalone without migrating.

Hardening guard for mcp__omni__parse in DeepSeek Harness: a tools/pre-execute listener that denies private/reserved host URLs (SSRF), enforces an allow-list or ask (consent), and is fail-closed when allowedRoots is empty.

Fourth permission preset for dsh: unconfined, GPU-capable sessions (danger-full-access) with per-operation user approval for writes outside the workspace or to protected paths (.git/**, .env*); implemented purely as a bundle over the official tools/pre-execute ask hook, no core edits.

Deterministic goal-completion gate for DSH: a contract-first AC grammar with named failable check commands, a gate that re-runs every check itself (zero model trust), verdicts bound to a tree digest so file changes void passing verdicts, and a hard deny on false completion at update_goal via tools/pre-execute with a false-complete counter that blocks after two catches; scope-aware task-level claim handling (strict or goal-only) keeps multi-task Agent Teams loops from deadlocking.

Pre-execution safety valve for DSH that judges with TypeSafe Jev: it hooks tools/pre-execute and decides every bash/pwsh call by first applying offline static rules, then by asking the Jev model — the System One model from TypeSafe, which returns a structured decision instead of prose — one yes-no question ("will this command irreversibly delete or overwrite real data?"), turning the answer into allow, revise, block or escalate; revise hands the model a safer rewrite, escalate offers a one-shot human token; exhausted credit or a missing API key degrades loudly instead of failing silent, and a missing key is requested in the conversation itself (`guard key set`, read from stdin); every verdict is appended to a shared audit log and the text people read is bilingual zh-CN/en.

Pre-execute hook that denies writes under a read-only result zone of protected roots; every other path passes through.

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Removes sandbox_permissions / justification arguments that cannot widen the call's current sandbox mode, so calls no longer fail with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode'. GPT models tend to fill these optional fields on every call and pick workspace-write, which is narrower than danger-full-access. Runs in tools/pre-execute: compares the requested mode with the mode the session's sandbox policy resolves, and drops the fields when the request is the same or narrower (also drops a lone justification). Also understands the values GPT carries over from Codex's own shell tool: null, empty and use_default are treated as no request, and in a danger-full-access session any value (including require_escalated) is dropped because nothing is wider. Real widening requests, unknown modes and tools that do not advertise DSH's escalation schema are left to DSH core. Never widens permissions. Configurable tool list (default bash, pwsh, write, edit, run_code). Zero dependencies.

Jev (TypeSafe System One) judgments at the DeepSeek Harness agent-loop gates: pre-step, pre-execute, post-execute, and turn-stopping. No UI dependencies; mount it in any Harness composition.

DSH 宿主上的 SBTD workflow 适配器。当前为 T5：注册短中文 sbtd section、进程内会话状态、`sbtd_plan`、`sbtd_review`、`tools/pre-execute` / `agent/pre-step` hooks 门禁，以及从 640-skills 只读同步的 `manuals/`。

DeepSeek Harness plugin: a deployment deny list of filesystem roots the model may never touch - fences read, write, search, and shell tool calls at tools/pre-execute