dsh-claim-guard

In DeepSeek Harness, file tools such as write, edit, and str_replace_editor commit text to disk the moment they execute, leaving no lightweight, auditable checkpoint in between. dsh-claim-guard fills that gap: before a covered tool runs, it reads a user-maintained JSON rule file and performs a deterministic literal-substring inspection of the incoming text. When a blocked phrase or an unbounded bounded phrase is hit, the plugin returns the native DSH ask decision, letting the host approval flow decide whether that single execution proceeds, without inventing a second prompt, policy, or audit mechanism.

The capability surface is deliberately narrow: it covers full-text writes, new-fragment edits, and str_replace_editor create or replace operations. Matching is pure substring, optionally case-insensitive, with no regex, tokenization, fuzzy logic, or semantic inference. Rule files cap at 262 KB and 1 to 256 rules; single-text input caps at one million UTF-16 code units. The plugin makes no network requests, ships no telemetry, and does not write the target file itself; matched excerpts enter the approval UI and session audit only as truncated, escaped snippets. Any rules, configuration, or adapter failure fails closed by design, leaving no warn-and-pass grey zone.

It suits teams already working inside DSH file-tool workflows that want a self-maintained sensitive-phrase checkpoint before writes land, while preserving native cancellation, no-responder, and session-audit behaviors. It is not a DLP engine, sandbox, or malware detector, and it intentionally does not cover shell commands, third-party tools, paths outside the session workspace, or binary content. If you are an admin or security engineer looking for a lightweight, auditable gate on AI-assisted file writes without pulling in heavyweight middleware, this plugin is a pragmatic starting point.