Preface

DeepSeek Harness (DSH) uses a plugin-based architecture. In agent development, tool calls may inadvertently leak sensitive files, such as .env files, the .git directory, or SSH keys. dsh-guard-sensitive-paths is intended to intercept these operations by enforcing approval before execution, ensuring that sensitive data is not read, written, or executed without authorization.

Core Features

This plugin is a DSH bundle that intercepts operations by pre-registering a tools/pre-execute policy. It is enabled by default and takes effect with zero configuration.

It primarily intercepts the following scenarios:
1. Write/modify/execute operations: intercepts calls to sensitive paths from write, edit, str_replace_editor, and bash.
* Sensitive path set: .env files, .git directories, .ssh directories, SSH private key files, and .pem certificate files.
2. Read operations: only intercepts reads of key-material files, namely SSH private keys and .pem certificates. Reads of files such as .env, .git, and .ssh/config remain allowed.

Mechanics:
* Priority: registered using PREPEND, so it runs before other tools/pre-execute listeners.
* Behavior: pure approval policy. When a match occurs, it returns an ask decision, with the reason including the sensitive path category, such as environment-file or key-material. When no match occurs, it delegates unchanged.
* Bash scanning: supports scanning Bash command text to detect whether the command contains sensitive paths, such as .env, id_rsa, and *.pem.

Installation and Enablement

The plugin follows the DSH bundle specification. After installation, it takes effect after the profile restarts.

Install from GitHub:

dsh plugin --profile web add github:TARS-snail/dsh-guard-sensitive-paths

Verify installation:

dsh --profile web --dump-config

The generated configuration should contain an entry with name: dsh-guard-sensitive-paths.

Configuration

It is enabled by default with zero configuration. To disable it, you can override the configuration in the profile’s cordis.patch.yml:

- id: sensitive-paths
  name: dsh-guard-sensitive-paths
  config:
    sensitivePaths: false

Applicable Scenarios and Boundaries

This plugin intercepts by observing tool call arguments and does not modify session behavior.

Coverage:
* Intercepts sensitive path arguments for the write, edit, str_replace_editor, read, and bash tools.

Not covered (threat model boundaries):
* Host-level sidecar / runtime behavior: reads, packaging, encryption, or uploads that do not pass through the tool loop—such as the Zhipu ZCode incident, where a host process packaged and uploaded .git history—cannot be intercepted by this plugin.
* Network egress: the file sandbox governs file access, not where host processes send data.
* Model inference endpoint: task-related context is still sent to the LLM provider.

Conclusion

This plugin ensures that when a tool call matches a sensitive path, approval must be obtained first. It cannot prevent host processes from bypassing the tool loop. To cover these areas, a file sandbox, process isolation, and network egress policies are required.