Asuna486-desuwa/dsh-safety-net ↗★ 1
dsh-safety-net
Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:Asuna486-desuwa/dsh-safety-net说明文档
阅读完整 README ↗Configuration
All options live under the safetyNet key:
safetyNet:
# Strict mode: declares a read-only default and warns if the host sandbox
# default is not tightened. Default: true
strict: true
# Additional paths to protect (beyond the built-in DSH critical paths)
extraProtectedPaths: []
# Reserved — retention-based pruning wiring lands in a later release. Default: 30
backupRetention: 30
| Key | Type | Default | Description |
|---|---|---|---|
safetyNet.strict | boolean | true | Declares a read-only default sandbox mode; warns when the host sandbox default is wider (workspace-write / danger-full-access). |
safetyNet.extraProtectedPaths | string[] | [] | Extra paths treated as DSH critical assets. |
safetyNet.backupRetention | number | 30 | Max snapshots kept in the backup store before pruning (reserved; pruning wiring lands in a later release). |
safetyNet.dshHome | string | env DSH_HOME or ~/.dsh | Override the DSH data root (used by the guard, the backup store and the status report alike). |
safetyNet.pluginDataRoot | string | ~/.claude/plugins/data | Override the plugin data root (mainly for tests/injection). |
The backup store is created under /safety-net/backups/.