dsh-permission-matrix
Turns DSH permissions into 9 selectable presets (3 sandbox modes x 4 approval tiers), with rule plus LLM risk classification across four risk levels, password-gated approval for high-risk operations, and a JSONL audit log.
把 DSH 权限拆成 9 个可选预设（3 种沙箱 × 4 种审批），规则 + LLM 双通道四档风险分级，高风险操作需输入批准密码才放行，附 JSONL 审计日志。
How to install
dsh plugin add github:zhang8019/dsh-permission-matrix About
dsh-permission-matrix — DeepSeek Harness 权限矩阵插件 把 DSH 的权限从「几个固定档位」拆成**两个独立维度**并重新组合: **沙箱(读写边界)**:工作区只读 / 工作区读写 / 全电脑读写 **审批(操作批准方式)**:人工审批 / 自动同意 / 自动风险审批 / 自动拒绝 两者组合出 **9 个可切换的执行类型**,外加**全局默认预设**与**LLM 机器人默认预设**两个维度——社交渠道(QQ / 微信 / 企微 / Telegram…)的会话可以用与 Web 会话不同的权限档位。 取代 dsh-auto-classifier 的单点 auto 预设:本插件保留它的核心思路(规则 + LLM 裁判 + 硬拒绝),但把预设表拆成完整的组合矩阵。 --- 9 个执行类型 | # | 预设 id | 显示名 | 沙箱 | 审批 | 行为 | |---|---|---|---|---|---| | 1 | ro-human | 工作区只读权限 + 人工审批 | read-only | ask | 一切写入被沙箱拒绝,越权操作弹人工确认 | | 2 | ro-deny | 工作区只读权限 + 自动拒绝 | read-only | never | 写入一律拒绝,无人审批环节(真正只读) | | 3 | ww-human | 工作区读写权限…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 0
- mo. downloads
- –
- Last push
- 2026-09-11
- Created
- 2026-09-09
Links
Basic safety check
- Findings
- curated 收录但无 npm 包/安装命令
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- approval, deepseek-harness, dsh, dsh-plugin, permission, sandbox
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.