dsh-pr-gatev0.1.0

dsh-pr-gate

If this helps you, please give it a star — it helps others find it. Thanks!

Deterministic write gate for DeepSeek Harness (dsh) — the CI gate moved to the moment of the write.

Every file the agent writes (write / edit / str_replace_editor) passes the same scope policy and residue rules that agent-pr-gate applies to PRs in CI — deny-before-write in tools/pre-execute, residue scan of the written text in tools/post-execute, and a durable content-hashed JSONL ledger of every decision. Zero LLM calls in the trust path: the parts of the gate that must NOT be an LLM live here.

Why now (checked 2026-10-12)

The review/guard lane in the dsh ecosystem is entirely LLM-shaped: answer-reviewer plugins re-read turns with a second model, dsh-gungnir verifies goal completion from exit codes, and the closest action-guard (cc-safety-net, 1.6k★ in the Claude ecosystem) blocks destructive commands. Nobody gates what the agent writes deterministically — scope policy, residue markers, or a durable record the CI can consume. That slot is empty, and this plugin is the agent-pr-gate engine living inside the runtime instead of waiting for the PR.

What it does

One policy, two enforcement points

Point policyFile at your repo's agent-pr-gate.yaml and the live session enforces the same allow/deny the CI gate enforces on PRs — all policy entries are unioned. Inline allow/deny config works without a file.

Install

dsh plugin --profile default add dsh-pr-gate

From npm — no build step, no allowBuilds authorization; git installs are equally prebuilt (lib/ ships in the repo).

Configure

- id: dsh-pr-gate
  name: dsh-pr-gate
  config:
    tools: [write, edit, str_replace_editor]
    allow: [src/**, docs/**]     # non-empty = only these
    deny: ["**/*.pem", .github/workflows/**]
    policyFile: ""               # or e.g. agent-pr-gate.yaml
    residueMode: warn            # warn | block
    ledgerPath: .dsh-pr-gate/session.jsonl

Compatibility

• DSH: verified against the 0.2.x line (source snapshot 0.2.1-alpha.2); installs on any profile via dsh plugin add (prebuilt lib/, no build approval).
• Node: >= 20 (CI matrix: Node 20/22/24 on Ubuntu and Windows).
• Disposable-profile evidence (2026-10-19): dsh plugin --profile <fresh> add github:zhengqiuyang/dsh-pr-gate → installed in 30s; boot shows [dsh-pr-gate] active: …; dsh plugin --profile <fresh> remove dsh-pr-gate → dependencies cleared, bundles restored.

Develop

npm install
npm test   # syncs the vendored agent-pr-gate core, builds, runs unit tests

The scope glob semantics and residue rules are vendored from the sibling agent-pr-gate checkout (npm run sync; CI runs sync --check).

Roadmap

• bash command write-heuristics (redirect/shell-write detection, warn-only)
• Ledger → GitHub check-run bridge (session attestations surfaced in CI)
• Per-policy selection by agent preset, matching the CI gate's policy classes
• Claims-vs-diff at turn end (the agent's final summary vs. the session ledger)

Kill criteria

If dsh ships first-party deterministic write gating, or reviewer plugins converge on deterministic enforcement (they are all LLM-based today), this freezes at its last working version with a postmortem here. The engine stays owned by agent-pr-gate either way.

Known limitations

• Paths are judged by their resolved target relative to the workspace root — traversal like src/../.github/workflows/x.yml is normalized before matching (fixed in this release). Symlinks are NOT followed by the pure matcher (documented limitation), and there is an inherent TOCTOU window between check and write; the host's own permissions remain the hard boundary.
• Named file tools only. shell writes, custom tools, and unknown argument shapes are not gated.
• Residue scan is post-write. residueMode: block fails the tool result but does not roll back a file already on disk; default is warn.
• Empty policy = open. With no allow/deny entries, every write passes (ledger still records written).