Adds a workspace-write++ permission that keeps file tools inside the workspace while skipping the Windows process sandbox for wildcard-allowlisted executables such as Git Bash.
Install
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:yzxxy010/dsh-workspace-write-plus
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).
README
This plugin publishes its README in Chinese only.
Windows 上用 DeepSeek Harness，一跑 git 就炸：
fatal error - couldn't create signal pipe, Win32 error 5
这不是 Git 坏了。官方「工作区写入」会给子进程套一层受限令牌，Git for Windows / MSYS 需要内存映射和命名管道，一套上就起不来。
这个插件在权限选择器里加第四档：工作区修改++。文件还是只能改工作区，但放行的程序（默认 Git Bash 和 PowerShell）不再套那层进程沙箱。选上之后，git --version 就能正常出来。
它不是「完全访问」。不想把整个磁盘交给模型的时候用这一档。
安装
dsh plugin --profile web add https://github.com/yzxxy010/dsh-workspace-write-plus
装完重启一次 DSH。输入框旁边的权限选择器里会出现 工作区修改++，命令是 /permission workspace-write++。
怎么用
- 选中 工作区修改++
- 该
git、该跑脚本就直接跑 - 想放行别的程序，打开 设置 → 工作区修改++
默认已经放行了 bash 和 pwsh。Windows 上 Git Bash 往往是从 PowerShell 拉起来的，两个都要放，子进程才不会继续继承受限令牌。
放行规则
设置页是一份可增删的名单，一行一条。改完立刻生效，存在 DSH 自己的设置里，重启还在。
| 你写下的 | 实际匹配 |
|---|---|
bash |
任意目录里的 bash.exe |
pwsh |
任意目录里的 PowerShell |
aa |
任意目录里的 aa.exe |
**/Git/bin/bash.exe |
只放行 Git 自带的那一个 bash |
C:/Program Files/Git/** |
Git 安装目录下的所有程序 |
* |
这一档里所有程序都不套进程沙箱 |
不带斜杠，只看文件名；带斜杠或 * / **，按路径匹配。* 不跨目录，** 可以跨任意多层。
名单留空的话，所有程序仍走进程沙箱——等于这一档退化成「工作区写入、但不弹审批」。
另外还有一个单独开关：工作区外写文件。默认关。打开后，write / edit 也可以写到工作区外面。这和放行 Shell 不是一回事，按需再开。
和另外三档
权限选择器里还是那四个格子，底层沙箱模式其实只有三种。++ 是一档预设，不是新的沙箱类型。
| 文件 | 进程沙箱 | 审批 | |
|---|---|---|---|
| 只读 | 不能写 | 包裹 | 要问 |
| 工作区写入 | 只能写工作区 | 包裹，Windows 上 Git Bash 会挂 | 要问 |
| 工作区修改++ | 只能写工作区 | 命中规则的程序跳过 | 不问 |
| 完全访问 | 不限制 | 不包裹 | 不问 |
许可
MIT。
Links
More in this category
toby-bridges/api-relay-audit★ 832
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
howmp/dsh-pentest★ 451
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
SeaOf0/dsh-redteam-model★ 417
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
PerryLink/dsh-auto-review★ 164
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
PerryLink/dsh-permission-rules★ 114
Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.
PensiveFei/dsh-secure-audit★ 85
Read-only security and compliance plugin for DeepSeek Harness: prompt-injection detection, Chinese-PII redaction, and a local configuration audit with redacted, reproducible reports.
Community comments
Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.