Introduction

DSH adopts an “everything is a plugin” approach. For agentic workflows, plugins extend capabilities and broaden the tool invocation surface: bash, file editing, and network requests can all be executed directly. Relying solely on post-hoc logs is insufficient; policy decisions must be made before invocation, and records of allowances, denials, and reasons must be kept.

The following introduces @agenticcontrolplane/dsh. It is a native Cordis plugin designed for DeepSeek Harness, hooking into dsh’s typed interception points rather than using shell-hook shims.

What It Is

The purpose of @agenticcontrolplane/dsh is straightforward: it checks policies before each tool invocation runs and records which invocations were allowed, which were denied, and why.

The repository is agentic-control-plane/dsh-acp-plugin, the npm package name is @agenticcontrolplane/dsh, and it is licensed under MIT. It supports a single workspace covering dsh, Claude Code, Codex, Cursor, and OpenClaw.

Note: packages/acp within the dsh core is Zed’s Agent Client Protocol, unrelated to the Agentic Control Plane plugin discussed here.

Core Features

Pre-Invocation Policy Decision

The plugin registers at tools/pre-execute and supports three decisions:

  • allow: Permit the invocation.
  • deny: Block the invocation and record the reason.
  • ask: Hand off to dsh’s approval flow.

Post-Invocation Output Scanning

The plugin registers at tools/post-execute:

  • On server-side blocking, it converts the result into corrective feedback.
  • In shadow mode, it provides notifications.

Decision Logging

Decisions are sent to the console, including tool, input preview, decision, reason, latency, and cost.

Failure Postures

  • Interactive sessions fail open loudly when the control plane is unreachable.
  • Unattended agents fail closed when the control plane is unreachable.
  • Policy denials are unaffected by outage postures.
  • In headless compositions without an approval service, dsh interprets ask as deny.

Engineering Approach

  • Zero dependencies.
  • Plain ESM.
  • No build steps.
  • Configurable via cordis.patch.yml or environment variables.

Installation and Activation

First, ensure dsh is using Node 22. dsh requires Node 22; Node 20 may fail to start, and error messages may not directly indicate the version issue.

Use the installation script:

curl -sf https://agenticcontrolplane.com/install.sh | bash

After installation, start dsh with a profile:

dsh --profile <your-profile>

Manual installation commands are as follows:

dsh plugin --profile <your-profile> add @agenticcontrolplane/dsh
dsh --profile <your-profile>

Installing the package and mounting it to a profile are separate steps. Confirm the plugin is mounted:

dsh --profile <your-profile> --dump-config | grep @agenticcontrolplane/dsh

If there is no match, add @agenticcontrolplane/dsh to the "dsh.profile.bundles" list in that profile’s package.json.

Credentials can be placed in ~/.acp/credentials or provided via ACP_BEARER_TOKEN. When no key is present, the plugin reports the issue and remains non-interventional, ensuring the session remains usable.

Typical Usage

Start the current profile:

dsh --profile <your-profile>

In the session, tool invocations go through:

  1. tools/pre-execute: Returns allow, deny, or ask.
  2. tools/post-execute: Performs output scanning after invocation.

Configuration can be overridden via the profile’s cordis.patch.yml. Entries use id: acp, name: @agenticcontrolplane/dsh, and configuration items include governBase, agentTier, and timeoutMs:

- id: acp
  name: @agenticcontrolplane/dsh
  config:
    governBase: <your-govern-base>
    agentTier: <your-agent-tier>
    timeoutMs: <your-timeout-ms>

Environment variable method:

export ACP_GOVERN_BASE=<your-govern-base>
export ACP_BEARER_TOKEN=<your-bearer-token>
export ACP_AGENT_TIER=<your-agent-tier>
export ACP_SHADOW=off

Run tests:

npm test

Use Cases and Notes

Suitable for:

  • Pre-execution policy checks on dsh tool invocations.
  • Retaining decision records for allow, deny, and ask.
  • Reusing the same workspace across dsh, Claude Code, Codex, Cursor, and OpenClaw.
  • Setting more conservative failure policies for unattended agents.

Notes:

  • The plugin runs with the permissions of the current dsh process. Before installation, review the source code and MIT license.
  • dsh requires Node 22; Node 20 may fail to start, and errors may not directly indicate the cause.
  • When the control plane is unreachable, interactive sessions fail open loudly, while unattended agents fail closed; policy denials are unaffected.
  • In headless compositions without an approval service, dsh interprets ask as deny.
  • The Claude Code bridge can use an unmodified hooks.json, but input rewriting is not honored; the native plugin is recommended.
  • The package was previously named dsh-plugin-acp; the old name is still installable but deprecated.
  • The community directory is a separate site with no official affiliation with DeepSeek / High-Flyer and should not be considered an official app store.

Conclusion

@agenticcontrolplane/dsh shifts tool invocation policies to pre-execution and retains records of allowances, denials, and reasons. GitHub: https://github.com/agentic-control-plane/dsh-acp-plugin. The directory page link has not been verified in the confirmed facts, so the URL is not provided directly here.