dsh-write-protect
Protect declared workspace subpaths such as .git from writes, and optionally grant extra writable roots under workspace-write.
为工作区指定子路径提供只读保护 (例如 .git), 并支持在 workspace-write 下声明额外可写根。
How to install
dsh plugin add dsh-write-protect About
dsh-write-protect 给 DSH 沙箱补上工作区里某一段路径的只读保护, 典型用途是不让模型改 .git. 也可以在 workspace-write 下声明工作区外的额外可写根, 让 bash 与 write / edit 写到相邻目录, 而不必切到 danger-full-access. write / edit 工具在所有平台都会挡住保护路径, 并放行额外可写根. bash 等命令在 Linux / macOS 上同样生效; Windows 上 bash / pwsh 既挡不住 .git, 也拿不到额外可写根. 读取不受影响. 官方沙箱只有 "整个工作区可写" 和 "全只读" 两档, 管不到工作区内部的某一段, 也不能把工作区外的个别目录并进 allow-list; Codex 一类实现默认会保护 .git, 本插件补这一块. 安装 shell dsh plugin --profile web add azazo1/dsh-write-protect 固定版本: shell dsh plugin --profile web add azazo1/dsh-write-protect#v0.1.1 GitHub Release 同时挂不带版本号的预构建包, 安装时跳过 allowBuilds: shell dsh plugin --profile web add ht…
Recommendation signals
Meta
- License
- MIT
- Language
- TypeScript
- GitHub stars
- 1
- mo. downloads
- –
- Last push
- 2026-09-11
- Created
- 2026-09-07
Basic safety check
- Findings
- None
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- deepseek-harness, dsh, dsh-plugin, git, sandbox
Related plugins
dsh-permission-rules
PerryLink/dsh-permission-rules
Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.
upstream-radar
MicroMilo/upstream-radar
Watches DSH and plugin releases, retests exact published artifacts in disposable runners, publishes machine-readable compatibility evidence, and reconciles managed issues after fixes.
dsh-auth-gate
TecFancy/dsh-auth-gate
Login gate for the dsh web surface: password or shared-token authentication, session cookies, rate limiting, and a user-management CLI (dsh.bundle manifest since 0.4.1, one-command `dsh plugin add` mounting).
dsh-auth-gateway
xbzbing/dsh-auth-gateway
Password + TOTP two-factor authentication gateway for the dsh web UI: every HTTP request and WebSocket upgrade is refused until login, with per-source lockout, global rate limits and one-time backup codes.