Overview of dsh-permission-rules
dsh-permission-rules is a TypeScript-based plugin for DeepSeek Harness that implements Claude Code-style declarative permission rules. It enables fine-grained control over tool execution, network access, and workspace interactions through ordered allow, deny, and ask rules. The plugin is designed for testing and red teaming automation, providing a structured way to enforce security policies in AI-driven workflows. It operates under the Apache 2.0 license and is part of a broader ecosystem of over 40 DeepSeek Harness plugins.
The plugin was introduced in 2026 and integrates with DeepSeek Harness version 0.1.7-rc.2 and later, with backward compatibility for earlier versions. It is compatible with Node.js versions 22.19.0 and 24.0.0 and supports all platforms, including both host and web settings clients. The rules are applied across tools, pre-execution checks, session logs, and Hot Module Replacement (HMR) reloads, ensuring consistent enforcement across the system.
How It Works
dsh-permission-rules functions by inserting an ordered list of allow, deny, and ask rules into the tools/pre-execute waterfall of DeepSeek Harness. Each decision is logged as a permissionRules/decision event in the session logs, enabling auditability without injecting additional context into the model.
The plugin supports rich matching capabilities, including tool-name globbing (including multi-command-processor tools), argument key-value globs or regexes with negation support, workspace-relative path globs at any nesting depth, environment variable conditions, platform restrictions, and shell command decomposition. This granularity allows administrators to define precise policies for tool usage, argument validation, and workspace access. Rules are defined in YAML format, with a built-in schema for validation and editor support.
Network policy enforcement is handled through a Codex-style process-level mechanism. Outbound connections from shell subprocesses are routed through a local HTTP/CONNECT proxy, where each connection is evaluated against network-specific rules or predefined sandbox modes (deny-all, whitelist, allow-all, or auto). The default mode follows the sandbox preset, with fallback to allow-all on hosts lacking the sandbox-policy service.
Key Features and Capabilities
- Ordered Rule Evaluation: Rules are evaluated in sequence, with the first match determining the action (allow, deny, or ask).
- Tool-Level Control: Supports glob and regex matching for tool names, arguments, and workspace paths. This allows for precise control over which tools can be executed and under what conditions.
- Network Policy Enforcement: Implements a local proxy to adjudicate outbound connections based on network rules. Supports modes like deny-all, whitelist, and allow-all, with detailed logging for denied requests.
- If a rule file edit fails, the previous rules remain in effect, preventing crashes. Polling is used for unreliable filesystem events, such as those in WSL or under /mnt/.
- Fail Loud: Invalid YAML, unknown actions, malformed globs or regexes, or excessive rule counts result in load failures, ensuring only valid configurations are applied.
- Audit Logging: Every rule decision and passthrough is logged as a permissionRules/decision event, providing a complete audit trail for compliance and debugging.
- Network Diagnosis and Remediation: Blocked connections include diagnostic messages identifying the target, the rule or mode that denied access, and suggested remediation.
Use Cases
dsh-permission-rules is primarily designed for testing and red teaming automation, where controlled and auditable access to tools and resources is critical.
- Security Testing: Enforce strict policies during penetration testing or vulnerability assessments, ensuring that only authorized actions are permitted while logging all attempts for review.
- Red Teaming: Simulate adversarial behavior in a controlled environment, with rules that mimic real-world attack patterns while maintaining visibility into all actions taken.
- Compliance Auditing: Maintain detailed logs of all tool invocations and network requests, facilitating compliance with security policies and regulatory requirements.