Introduction¶

The DeepSeek Harness (DSH) plugin architecture allows developers to extend Agent capabilities through plugins. When building tool chains that require autonomous operations, manually writing fine-grained permission rules is often cumbersome and hard to maintain. The dsh-risk-gate plugin addresses this issue by analyzing operation semantics and implementing automatic classification and progressive authorization locally.

Plugin Overview¶

This plugin is maintained by leetom314 and is open-sourced under the MIT license. It does not rely on external LLM calls. Instead, it uses a local deterministic classification algorithm to categorize tool invocations into three levels—safe, risky, or redline—based on their semantics, and then executes allow, ask, or deny actions accordingly.

Core Features¶

1. Semantic Classification and Local Categorization
The plugin intercepts the tools/pre-execute hook and classifies tool invocations based on operation semantics. Classification is performed locally and does not involve network requests. By default, unknown tools are marked as risky operations (denied).
* Safe: Reversible or read-only operations, such as reading, searching, web browsing, and benign Bash commands.
* Risky: Irreversible but lower-risk operations, such as writing, editing, installation, and Git commits.
* Redline: High-risk operations, including remote state changes, sending messages, deleting files, and payment-related operations.

2. Progressive Authorization Mechanism
To reduce interruptions caused by manual confirmation, the plugin implements progressive authorization based on signatures (tool name + normalized parameters). After the same operation signature succeeds consecutively N times, subsequent calls are allowed automatically; if a denial or failure occurs, the authorization state for that signature is rolled back.

3. Shell Command Checks
The plugin supports regex-based checking of Bash and PowerShell commands to identify dangerous instructions. Common redline commands include rm -rf, shred, ssh user@host, git push, curl/wget -X DELETE, and so on.

Installation and Activation¶

Ensure the DSH CLI is installed in the environment, then run the following command to install the plugin.

dsh plugin --profile web add "github:leetom314/dsh-risk-gate#main"

Configuration¶

Add the plugin node to the DSH YAML configuration file. The main configuration options are as follows:

• autoAllowThreshold: Automatic allow threshold. Setting it to 0 disables progressive authorization and always asks. The default value is 3.
• alwaysAskRedline: Whether redline operations must always trigger a confirmation prompt. Defaults to true.
• overrides: Allows overrides for specific tools. Setting it to deny blocks them directly.

- id: dsh-risk-gate
  name: dsh-risk-gate
  config:
    autoAllowThreshold: 3
    alwaysAskRedline: true
    verbose: false
    overrides:
      some_tool: deny

Testing and Verification¶

After installation, you can run the test script to verify the plugin behavior.

npm test

For end-to-end verification (using a real model and headless mode), you can run:

./verify.sh

The verification script checks whether read-only operations are allowed, single-file deletion is blocked, recursive deletion (rm -rf) is blocked by the redline policy, and Git push and SSH remote operations are blocked.

Limitations and Considerations¶

1. Non-Sandbox Environment: Shell checks are regex-based and not a complete sandbox execution environment. They primarily serve as a security gate. It is recommended to combine them with dsh-permission-rules or other sandbox executors to strengthen defense in depth.
2. In-Memory State: The plugin’s learned state is stored only in memory. Process restarts or HMR (Hot Module Replacement) cause the state to be lost.
3. Headless Mode: Without an Answerer, the plugin denies operations by default.
4. Dependencies: The plugin depends on @deepseek-ai/dsh-tools.

Summary¶

dsh-risk-gate provides a semantic-based lightweight security control solution. It is suitable for scenarios that require quickly introducing operation classification and authorization control in the DSH plugin ecosystem. For more details, see the Plugin Directory or Source Repository.