Auto-approval permission guard for DeepSeek Harness: a middle tier between workspace-write and danger-full-access — auto-allows safe ops in trust dirs, always prompts for destructive ones
dsh plugin --profile web add github:a903067276-rgb/dsh-perm-guard