dsh-guard-sensitive-paths

In DeepSeek Harness automation pipelines, an AI agent executing write, edit, str_replace_editor, or bash may inadvertently touch .env, .git, SSH private keys, or .pem certificates. A single careless write can expose credentials or corrupt repository metadata. dsh-guard-sensitive-paths pushes this guardrail ahead of every tool invocation so that calls hitting sensitive paths no longer pass silently but trigger an explicit approval prompt.

At its core, the guard registers at the front of the tools/pre-execute listener chain via PREPEND, running before any permission-granting logic. Write and edit tools match the full sensitive set (.env, .git, .ssh, SSH keys, .pem); read is limited to the key material subset (SSH private keys, .pem) to avoid blocking legitimate environment-file loads; bash command text is scanned against the same set via substring matching. A hit returns an ask decision, and without an approval channel automation fails closed. Non-matching calls are delegated through next() with zero added latency.

It is well suited for teams or individual developers running DSH profiles in local or CI environments where .env, .git, and ~/.ssh files coexist with the workspace and a human-in-the-loop checkpoint around AI tool calls is desired. It activates with zero configuration by default and can be toggled off with a single sensitivePaths boolean.