PerryLink/dsh-permission-rules ↗★ 114
dsh-permission-rules
Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.
AI 분석
适合需要对工具调用、参数及网络访问进行细粒度安全管控的系统管理员。
설치
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:PerryLink/dsh-permission-rulesConfiguration
All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need.
| Key | Default | Meaning |
|---|---|---|
rulesFile | .dsh/rules.yaml | Rule file location; relative = resolved against the calling session's cwd, absolute = global and validated at mount |
fallbackPath | (none) | Rule file used when per-cwd discovery finds nothing; validated at mount |
badFilePolicy | fail | Bad rule file: fail errors the pending tool call loudly; ignore-with-warning warns and continues empty |
maxRules | 256 | Hard cap on rule count across the effective source chain |
maxCachedWorkspaces | 512 | Hard cap on cached per-workspace rule loads (LRU eviction) |
patternMode | glob | params/paths/when.env pattern flavor: glob or regex (tool names are always globs) |
watch | true | Chokidar watch + reload on change |
watchStabilityThresholdMs | 200 | Reload debounce window (ms) |
language | en | /rules output language: en, zh, es, pt, hi |
caseInsensitivePaths | (win32) | paths patterns and workspace-root comparison ignore ASCII case; true on Windows |
audit | all | Audit granularity: all logs every hit AND passthrough; hits skips passthrough events |
searchUp | false | Walk parent directories from the session cwd and merge every found rule file, nearest first |
maxGlobStars | 2 | Hard cap on unbounded */** quantifiers per glob pattern |
enforce | true | false = dry-run mode: deny/ask hits are audit-logged with a dryRun marker and every call passes through |
allowUnmarkedAudit | false | Pre-marker hosts drop the ignorable marker; the plugin disables session-log audit with a warning. Set true to opt back in |
network.enabled | true | Master switch for the proxy, env injection, and web-tool mode defaults |
network.mode | auto | Policy mode: auto follows the sandbox preset, or deny-all / whitelist / allow-all |
network.autoFallback | allow-all | Mode used when auto has no sandbox-policy service |
network.unlisted | ask | Whitelist-mode handling of targets no rule matched: ask or deny |
network.proxyBind | 127.0.0.1 | Local proxy bind address (loopback only) |
network.proxyPort | 0 | Local proxy port; 0 picks a free ephemeral port |
network.proxyMaxRecent | 100 | Cap on recent-block records kept for the settings page |
network.loopback | allow | Loopback targets: allow (Codex parity) or policy |
network.injectEnv | true | Whether proxy environment variables are injected for subprocesses |
network.noProxy | clear | Subprocess NO_PROXY handling: clear enforces the policy or preserve |
network.upstreamProxy | off | Upstream proxy for connections this plugin ALLOWS: off dials directly, inherit reuses the launch environment's proxy names, or an explicit http(s):// proxy URL |
network.allowHostAction | true | Settings-page per-block "allow this host" action: false hides the Allow button and makes the permissionRules/allowHost RPC refuse (the rule editor is not affected) |
builtin.enabled | true | Built-in high-risk baseline: false disables the shipped deny/ask ruleset entirely |
builtin.path | (shipped) | Replacement baseline file (absolute, or relative to process.cwd()); validated at mount |