Security & governancePlugin
Per-command sandbox allow-list for the DSH bash tool: allow-listed CLIs (lark-cli, gh, ...) run under a home-writable sandbox instead of prompting for danger-full-access.
Structure check pending
deepseek-harnessdshpluginsandbox