dsh-perm-gate

DSH permission controls have historically been split across several plugins, each with its own version pinning and its own audit log. dsh-perm-gate collapses the gate, the approval seam, and an optional semantic classifier into a single deterministic package. Every tool call walks a fixed P0–P4 priority chain: P0 hard-denies credential material, protected-path mutations, and dangerous shell invocations, and that verdict can never be overridden by a grant, a rule, a classifier, or a human; P1 issues precise session grants with TTL and use-count limits; P2 applies a static rule chain where blacklist beats whitelist beats ask; P3 optionally consults an OpenAI-compatible LLM for semantic risk grading; P4 falls back to the official approval seam. The entire chain is fail-closed by default, so any anomaly blocks rather than permits.

Rule matching operates at the argv level, not the raw string. The engine recurses into sh -c and bash -c, detects pipelines, checks redirect targets, and recognises recursive or force flags such as rm -rf. A built-in ReDoS bound and a source-hash compile cache keep the pure-function rule engine safe and fast. Every decision is appended to a JSONL audit feed and surfaced in the browser as a notice strip above the conversation input plus an approval-records tab. The plugin also ships an independent Auto-review tier with two variants (permissive and permissive-full) that adjust approval granularity while keeping the fail-closed guarantee, and an opt-in local HTTP/CONNECT proxy that adjudicates shell-subprocess outbound traffic against the same rule file.

Ideal for individuals and teams running DeepSeek Harness who need fine-grained tool-call permission control, a single unified audit trail, and the option of LLM-assisted risk grading—without ever accepting a silent pass-through.