Hard-stops further tool calls after a configurable per-session budget is reached.
Install
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:173787247/dsh-tool-budget
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).
README
DeepSeek Harness plugin: hard-stop tool use after a per-session call budget.
Pairs with dsh-repeat-stop. Part of dsh-wsl-kit.
Where it sits
Hard-stops tool use after a per-session budget. Identical-call loops are dsh-repeat-stop.
flowchart LR
calls["tool calls in one session"] --> budget["dsh-tool-budget"] --> stop["hard stop"]
Suite diagram and version snapshot: dsh-wsl-kit. This plugin is 0.1.2 (daily). Do not copy that matrix into this README.
Compatibility
| Field | Value |
|---|---|
| Plugin | dsh-tool-budget 0.1.2 |
| Minimum dsh | ≥ 0.1.2 (web UI one-shot ?token= on Windows relay :3081) |
| Latest verified | See dsh-wsl-kit Compatibility (currently 0.2.0-rc.2) — single source of truth for the suite |
| Kit set | daily (also in github / full; fetch+net also in llm) |
| Cloud Flash | Use model id deepseek-flash (V4.1 Flash) in ~/.dsh/settings.yaml / llm-deepseek — not configured by this plugin |
| Agent Teams | Upstream experimental; not required here |
Suite floor versions: kit check-plugin-versions.sh. Fault tree: TROUBLESHOOTING.md.
Why
Repeat-stop catches identical spam. Budget catches “many different tools forever” in one session—useful when long WSL tasks burn API quota.
Default: 80 tracked calls allowed; the 81st is denied. Job status tools are excluded by default.
This is a safety rail, not a product license limit. Raise maxCalls or disable if it feels tight.
Install
dsh plugin --profile web add github:173787247/dsh-tool-budget
Restart dsh web. No new tool. Blocks show as dsh-tool-budget: blocked in Trajectory.
Config
- id: dsh-tool-budget
name: dsh-tool-budget
config:
enabled: true
maxCalls: 80
exclude:
- job_output
- job_list
- job_kill
# include: [] # if set, only these names count
| Key | Default | Meaning |
|---|---|---|
enabled |
true |
Master switch |
maxCalls |
80 |
Allowed tracked calls per session |
exclude |
job_* | Names that do not count |
include |
(empty) | If set, only these names count |
vs dsh-repeat-stop
| Plugin | What it blocks |
|---|---|
dsh-repeat-stop |
Consecutive identical calls |
dsh-tool-budget |
Total tool calls in the whole session |
Test
npm test
FAQ
Does this replace dsh-repeat-stop? No. Repeat-stop blocks identical streaks; this caps total calls per session.
Will it block job_ tools?* Not by default — they are excluded so long-running shell jobs can still be observed.
How do I raise the limit? Set config.maxCalls in your profile cordis.patch.yml and restart dsh web.
License
MIT
Links
More in this category
toby-bridges/api-relay-audit★ 880
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
SeaOf0/dsh-redteam-model★ 698
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
howmp/dsh-pentest★ 609
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
PerryLink/dsh-auto-review★ 232
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
ADWMC/helm-d#helmd★ 190
Single-bundle reverse-engineering and pentest security plugin: first-turn tool narrowing, domain routing, and 33 tools covering APK, web, native binary, protocol, malware and LLM samples — with unpacking, license-bypass and anti-analysis case playbooks, an H-CoT evaluation engine (semantic routing, /hcot command), a web workbench with a ledger-driven tool shelf, an on-disk case workflow (auto-persisted evidence chain, E-numbered validated findings, post-compaction resume), GitHub-based external tool discovery, and 361 on-demand reference docs.
NanmiCoder/dsh-auto-mode★ 164
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
Community comments
Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.