dsh-plugin-acp

Agentic Control Plane for DeepSeek Harness: every tool call is checked against your policies before it runs, and every decision is recorded — what ran, what was blocked, and why.

This is a native Cordis plugin on dsh's typed interception points, not a shell-hook shim. It registers on:

• tools/pre-execute — the policy decision. allow lets the call through, deny blocks it with the reason in the trajectory, ask hands off to dsh's own approval flow.
• tools/post-execute — output scanning. A server-side block turns the result into corrective feedback; shadow-mode notices surface what enforcement would have done.

Install

dsh plugin --profile  add dsh-plugin-acp
export ACP_BEARER_TOKEN=gsk_...   # or keep it in ~/.acp/credentials
dsh --profile 

No build step, no dependencies, plain ESM. Installing from git works too (dsh plugin add github:agentic-control-plane/dsh-acp-plugin) and needs no build allowance.

Get a key at cloud.agenticcontrolplane.com. No key? The plugin says so loudly and stays out of the way — it never bricks a session.

Configuration

Override the row in your profile's cordis.patch.yml:

- id: acp
  name: dsh-plugin-acp
  config:
    governBase: https://govern.agenticcontrolplane.com  # or your self-hosted gateway
    agentTier: interactive   # default: interactive when an approval service is mounted, background otherwise
    timeoutMs: 4000

ACP_GOVERN_BASE, ACP_BEARER_TOKEN, ACP_AGENT_TIER, and ACP_SHADOW=off work as environment variables too.

Failure posture

An outage of the control plane must not brick the harness, and a lapse in coverage must never be silent:

• Interactive sessions fail open, loudly. Gateway unreachable → the call proceeds, a [ACP] ⚠ UNGOVERNED warning is logged, and a line lands in ~/.acp/lapse.log.
• Unattended agents fail closed. With nobody watching, the block is the safety net.
• Policy denies are unaffected — this posture only covers the inability to ask the policy.

In headless compositions with no approval service mounted, dsh itself resolves to deny — unattended runs cannot self-approve.