julescules/dsh-windows-workspace-guard

README 摘要

dsh-windows-workspace-guard 中文 English [!IMPORTANT] Unofficial community plugin. Independently developed and maintained; not reviewed or endorsed by DeepSeek. Safety policy for DeepSeek Harness on Windows. It checks model-issued pwsh calls before execution and protects workspaces, original files, and Git history. What it does - keeps destructive PowerShell targets inside trusted workspace roots; - makes original/ , signing files, or any configured path immutable; - reviews risky Git commands such as reset --hard , clean -fdx , and force push; - supports block , one-time ask , and audit-only report modes; - writes optional append-only JSONL audit records with redacted previews and command hashes; - permanently blocks disk operations, broad roots, encoded execution, System.IO bypasses, and protected paths. Install Restart DSH after installation. Recommended config Result block ask report Safe allow allow allow Needs review deny ask once allow + audit Hard block deny deny deny Hard blocks cannot be bypassed by allowExact or report mode. Check without running The plugin registers windows workspace guard check . The agent can inspect a command and receive stable PASS , REVIEW , or FAIL …

分类