When using DeepSeek Harness (DSH) to process files, developers may sometimes need to strictly control the generated content, such as preventing the output of specific prohibited phrases or ensuring that certain contextual information is always present. The dsh-claim-guard plugin provides a rule-based pre-write checking mechanism that intervenes before DSH’s native file tools execute a write, using user-defined rules to decide whether an operation should proceed.

Plugin Positioning

This is an unofficial community project independently developed and maintained by xuxucodepractice-code. It leverages DSH’s native ask decision mechanism to perform deterministic checks on text, rather than directly writing to target files or making network requests.

Core Features

  1. Reads a user-maintained JSON rules file.
  2. Checks whether the new text contains blocked phrases.
  3. Checks whether the new text contains bounded phrases (requiring specific accompanying context).
  4. Returns the check result to DSH’s native ask decision flow, where DSH’s approval service decides whether to execute the operation.
  5. Supports overriding the write, edit, and str_replace_editor tools.

Installation and Enabling

The plugin is currently distributed as a .tgz package from a GitHub Release and does not support installation via npm.

1. Obtain and Verify

Download dsh-claim-guard-0.1.0.tgz and its checksum file from GitHub Release. Before installation, it is recommended to use shasum to verify the integrity of the file:

shasum -a 256 -c dsh-claim-guard-0.1.0.tgz.sha256

2. Install the Plugin

Use the dsh plugin command to install it into the specified profile (using a temporary profile such as claim-guard-smoke is recommended for testing):

dsh plugin --profile claim-guard-smoke add ./dsh-claim-guard-0.1.0.tgz

3. Configure

Add the plugin entry to the DSH configuration file. The rulesPath configuration item points to the rules file (default: claims.json), while include and exclude define file matching patterns:

- insert:
    - id: dsh-claim-guard
      name: dsh-claim-guard
      config:
        rulesPath: claims.json
        include: ['**/*.md', '**/*.mdx', '**/*.txt']
        exclude: []

Rules File Example

The rules file must be strict UTF-8 JSON. Its structure includes a version, options, a list of blocked phrases, and a list of bounded phrases:

{
  "version": 1,
  "options": {
    "window": 60,
    "caseSensitive": false
  },
  "blocked": [
    {
      "id": "manuscript-status",
      "match": "submitted",
      "message": "The synthetic demo manuscript is only in preparation."
    }
  ],
  "bounded": [
    {
      "id": "demo-composite-score",
      "match": "42.5%",
      "mustAccompany": ["synthetic benchmark", "合成示例"],
      "message": "This invented demo value must be labelled as synthetic."
    }
  ]
}

Tool Coverage and Behavior

The plugin checks different scopes depending on the tool:

  • write: Checks all new text (including blocked and bounded).
  • edit and str_replace_editor (str_replace / insert): Checks only the new snippet (blocked only).
  • str_replace_editor (create): Checks all new text (including blocked and bounded).
  • view: Not applicable.

A successful match triggers DSH’s approval flow. If a match fails or no rule matches, control is passed to the downstream policy. A snippet that does not match a bounded phrase does not trigger blocking, but the downstream policy can still reject it.

Limitations and Caveats

  1. Input limit: Input text is limited to 1,000,000 JavaScript UTF-16 code units.
  2. Rules limit: The rules file size must not exceed 262,144 bytes, and the total number of rules is limited to 1 through 256.
  3. Bypass risks: Bash, PowerShell, Python, Node scripts, MCP tools, and similar mechanisms may bypass this plugin. The plugin does not detect binary content or paths outside the session workspace.
  4. Security and privacy: The plugin itself makes no network requests, provides no telemetry, and does not directly write to target files. It runs with local process permissions; community plugins are not a security boundary, and source code and licenses should be inspected before installation.
  5. Configuration errors: Unknown fields, explicit null values, empty values, or incorrect types in the configuration are rejected.

Summary

dsh-claim-guard provides a lightweight, declarative content-checking solution suitable for scenarios that require predefined checks on specific file content at the DSH agent level. By reusing DSH’s native approval flow, it maintains consistency with the DSH ecosystem, but its unofficial nature and potential bypass risks should be noted.