v0.2.1 - repo metadata, no behaviour change

Metadata only. The plugin does the same thing it did in v0.2.0.

• SECURITY.md - how to report a vulnerability, and which versions get fixes
• .github/dependabot.yml - weekly npm dependency checks
• package-lock.json - reproducible installs

Open-source catalogues now scan a repository for these files before listing a plugin. This release adds them so the listing check passes. Code is untouched.

Install is unchanged:

dsh plugin add file:<path-to-extracted-dir>

v0.2.0 — WeChat 会话拦截中途选项

v0.2.0

新功能：微信会话里拦掉中途交互选项

回合制通道跑完一整轮才发一条消息，中途弹出的选项卡片没有地方落 —— 整轮会挂住。
本版在微信会话里拦掉会发起中途交互的工具（�sk-user-question），并让模型改用纯文本把问题写进正常回复，等用户下一条消息作答。

• 通过 wechatQueue 服务查询会话归属（ctx.get 软探测，拿不到就当「不是微信」）
• 返回值用 deny +
  eason： ools/pre-execute 只认 �llow/ask/deny/cancel，只有 deny 能把原因送回模型上下文
• 宁可漏拦，绝不误拦：桌面会话的选项功能不受影响

文档

• 新增第九节：微信通道为什么拦、怎么判定、你会看到什么
• 新增第十节：用到的 DSH 核心逻辑
  pre-execute 返回值契约、waterfall 与
  ext()、单调 guard、ctx.provide 唯一入口、
  服务惰性注入、�xec 字段、pre-step 增量语义、source.kind、沙盒双数据源

安装

npx -p @deepseek-ai/dsh dsh plugin --profile web add github:SteelUnion/dsh-confirm-gate

或解压本页附件 dsh-confirm-gate-v0.2.0.zip。

v0.1.4

Attribution and documentation only. Code is identical to v0.1.3.

• LICENSE copyright line, package.json author and the module JSDoc now name the repository owner instead of the previous handle
• two README examples and the retrospective doc used an absolute local path; replaced with a neutral one

Install:

dsh plugin add https://github.com/SteelUnion/dsh-confirm-gate

Upgrading from v0.1.2 or earlier: remove the plugin first. The package name changed in v0.1.3, so an in-place upgrade leaves a manifest entry pointing at a module that no longer resolves.

Tested: 27 integration checks pass. Package rebuilt from the same whitelist as v0.1.3.

v0.1.3 - renamed to dsh-confirm-gate, engines.dsh added

Two changes since v0.1.2, neither of them behavioural.

Changed

• Package renamed @sroada/dsh-confirm-gate to dsh-confirm-gate. The name is a module specifier here, not a label: cordis.patch.yml resolves the plugin by it. All four places that carry it moved together, and the archive was rebuilt so the copy inside it agrees. If you installed v0.1.2, remove then add again -- the old row points at the old name and will not resolve.
• engines.dsh added: >=0.2.0-rc.2 <0.2.1 || >=0.2.1-0 <0.3.0. Written as two cohorts on purpose. Every 0.2.x release so far is a prerelease, and a single band matches neither 0.2.1-rc.2 (default semver rules do not let >=0.2.0 reach a prerelease) nor 0.2.1 prereleases. The plugin market reads only this field; with it absent the manifest carries no requirements and every runtime is reported compatible, including ones below the floor.

Not changed

No behaviour change. lib/index.js is byte-identical to v0.1.2 and the 27 integration checks pass unchanged.

Install

dsh plugin --profile <desktop|web> add file:<path-to-extracted-dir>

file: copies rather than links, so restart DSH afterwards. Watch the profile: installing into desktop when you run web silently does nothing.

What this release is not

Still not a security boundary. It is a cost boundary: a per-turn counter that gives the model a brake, and arguably more usefully, an accounting of what it did. Both caveats from v0.1.1 stand -- in the author's deployment ctx.get('shell') returns undefined, so the "not sandboxed" verdict comes from the fail-open branch rather than a successful read, and the $0.27 figure is an estimate, not a bill.

v0.1.2 — works on 0.2.1-rc.2 and later

Compatibility release. v0.1.1 pinned the peer dependency to DSH 0.2.0-rc.2, so a plugin that works fine on newer RC builds still produced a peer warning. This release declares the real range.

Changed

• Peer range widened to >=0.2.0-rc.2 for @deepseek-ai/dsh, @deepseek-ai/dsh-tools and @deepseek-ai/cordis. Verified loading on 0.2.1-rc.2.
• Compatibility is now stated in both READMEs, including what happens if a future DSH changes the dispatch hooks this plugin binds to: it fails loudly, not silently.
• Version in the header line of both READMEs, so the landing page and the package agree at a glance.

Not changed

No behaviour change. lib/index.js is byte-identical to v0.1.1 — the 27 integration checks pass unchanged.

Install

dsh plugin --profile <desktop|web> add file:<path-to-extracted-dir>

file: copies rather than links, so restart DSH afterwards. See the README for the profile trap (desktop vs web) — installing into the wrong one silently does nothing.

What this release is not

Still not a security boundary. It is a cost boundary: a per-turn counter that gives the model a brake, and arguably more usefully, an accounting of what it did. The two caveats from v0.1.1 remain: in the author's deployment ctx.get('shell') returns undefined, so the "not sandboxed" verdict comes from the fail-open branch rather than a successful read, and the $0.27 figure is an estimate, not a bill.

v0.1.1 - exact host contract

Pins the host contract to the exact runtime this plugin was verified against, instead of leaving it undeclared.

DSH reads only peerDependencies entries named @deepseek-ai/dsh or starting with @deepseek-ai/dsh-, evaluates them with includePrerelease: true, and blocks installation on mismatch. A top-level engines.dsh is never consulted by that check. So the contract lives here, as exact versions.

Package	Version	Checked by DSH
@deepseek-ai/dsh	0.2.0-rc.2	yes
@deepseek-ai/dsh-tools	0.2.0-rc.2	yes
@deepseek-ai/cordis	4.0.4	no (not a host package)

Verification: replayed DSH's own compatibility check using the semver build shipped inside DSH, against runtime 0.2.0-rc.2. Both host-checked entries pass. Integration tests unchanged at 27/27.

Exact versions mean "verified on this version", not "broken elsewhere" - DSH will refuse to install on a mismatch, which is the intended behaviour.

Asset: dsh-confirm-gate-v0.1.1.zip (7 files, source only, no build step).

v0.1.0 — Bounded-run confirm gate

dsh-confirm-gate v0.1.0

A per-turn counter of persistent operations for DeepSeek Harness. When the free budget is spent it reminds the model, then instructs it to stop, then asks the user for confirmation.

Not a security boundary. A cost boundary and course-correction mechanism for hosts that must grant danger-full-access.

Features

• Per-turn counting — resets on each new user message
• Three tiers — reminder → STOP instruction → ask for confirm
• Release the whole turn — if the user's message contains the trigger word (confirm by default), the entire turn is uncounted and unblocked
• Command-level judgement — pwsh is judged by command content, so Get-ChildItem, Get-Content and plain pipelines never burn the budget
• Non-persistent operations never count — read / grep / glob / web-fetch and friends are never interrupted

Configurable

freeLimit · hardLimit · confirmWord · all message texts · include / exclude — set through your profile's cordis.patch.yml. Nothing is hard-coded.

Verified

• 34 automated checks (16 command judgement + 18 integration), all passing
• Real-machine: reminders from operation 1 to 10; the STOP instruction fires at 11 and the model stops on its own
• Hook shape confirmed against DSH 0.2.0-rc.2 — arguments live in exec.arguments and are deep-frozen

Install

dsh plugin --profile desktop add file:<path-to-plugin>

Requires approval: ask in the profile, otherwise the ask tier is rejected as deny.

Known limits

Not verified: operations 12–15, and whether the ask prompt surfaces at >= 15. One tool call counts as one, regardless of how many commands it runs.

---

中文

每轮对话独立的持久化操作计数器。 免确认额度用尽后向模型注入停止指令，达到硬上限时索要用户 confirm。

不是安全边界，而是在必须给完全权限时的成本边界和方向纠偏机制。

功能

• 按轮计数 — 每条新的用户消息重置
• 三档行为 — 提醒 → 停止指令 → 索要 confirm
• 含识别语放行整轮 — 用户消息里出现识别词（默认 confirm），整轮不计数、不拦截
• 命令级判定 — pwsh 按命令内容判断，Get-ChildItem / Get-Content 和纯管道不消耗额度
• 非持久化操作永不计数 — read / grep / glob / web-fetch 从不被打断

可调参数

freeLimit · hardLimit · confirmWord · 全部文案 · include / exclude，通过 profile 的 cordis.patch.yml 配置。没有写死的。

已验证

• 34 项自动化测试（16 项命令判定 + 18 项集成），全部通过
• 真机：第 1~10 次提醒；第 11 次触发停止指令，模型主动停手
• 钩子结构在 DSH 0.2.0-rc.2 上实测确认——参数在 exec.arguments，且被深冻结

安装

dsh plugin --profile desktop add file:<插件路径>

profile 里需要 approval: ask，否则 ask 档会被拒成 deny。

已知限制

未验证：第 12~15 次区间的表现，以及 >= 15 时 ask 是否真的弹出审批框。一次工具调用算 1 次，不管里面跑多少条命令。