Foreword

The core philosophy of DeepSeek Harness (DSH) is “everything is a plugin.” When building agent applications, sandbox mechanisms usually restrict write operations, but read permissions are often retained. The dsh-fs-deny-policy plugin fills this gap. Through a deny list at filesystem root directories, it intercepts requests before the model initiates read, search, or Shell calls, preventing the model from accessing sensitive directories.

Plugin Introduction

This is a DSH plugin maintained by vladlearns, designed to provide deployment-level filesystem access control. It does not rely on complex sandbox configurations, but directly validates paths before tool execution.

Core Features

  1. All-Type Interception: Intercepts read, write, search, and Shell tool calls at the tools/pre-execute hook.
  2. Root Directory Deny List: If the resolved path of a tool call falls within a denied root directory, the call will be blocked.
  3. Proactive Notification: The plugin sends the deny list to the model as part of the system prompt, ensuring the model is aware of restrictions before making calls and avoiding invalid conversations.

Installation and Enablement

Before installation, ensure the environment meets the Node.js 22.19 or higher requirement and that the dsh CLI is installed.

Install using the npm package:

npx @deepseek-ai/dsh plugin --profile main add dsh-fs-deny-policy

If you need to install from GitHub to use a specific version:

npx @deepseek-ai/dsh plugin --profile main add github:vladlearns/dsh-fs-deny-policy

Note: Adding or removing plugins requires restarting the DSH process.

Configuration Method

The configuration file is located at ~/.dsh/profiles/YOUR_PROFILE/cordis.patch.yml. The following example denies access to the SSH directory and a license file:

- id: fs-deny-policy
  config:
    deniedRoots:
      - C:/Users/you/.ssh
      - C:/Users/you/Desktop/license-dongle

Note:
- Paths must be absolute paths. Relative paths or duplicate entries will cause errors during loading.
- Edit this configuration file after installing the plugin; changes take effect in real time.
- If you only want to deny writes while allowing reads, you can set fenceReads: false (the write side is always enabled).

Verifying Configuration

After installation and configuration, use the following command to verify that the configuration was written correctly:

npx @deepseek-ai/dsh --profile main --dump-config

Applicable Scenarios and Precautions

  • Applicable Scenarios: Scenarios where specific sensitive directories (such as SSH keys, license files, or production configurations) need to be protected from being read or modified by the model.
  • Security: This plugin runs with the privileges of the current DSH process. Check the source code and license before installation.
  • Limitations: Shell checks only read the command text and do not actually execute the Shell. Therefore, indirect paths (such as $VAR, $(...), or redirection symbols) may bypass interception.
  • Defense in Depth: It is recommended to use this plugin together with a sandbox for a hard guarantee, rather than as a replacement for it.

Summary

By establishing a filesystem fence before tool execution, this plugin provides an additional security layer for agents. For more configuration details, refer to the plugin directory and the source repository.