dsh-worktree-guard

A defense-in-depth guard for DeepSeek Harness that prevents agents from silently creating or mutating Git worktrees.

It combines:

1. A global AGENTS.md policy telling agents to stay in the current workspace unless the user explicitly requests a worktree.
2. A tools/pre-execute guard that requires one-time human approval before mutating git worktree commands execute.

Why

Large Unity and game projects are expensive and risky to duplicate. Agents may otherwise create worktrees for isolation, parallel tasks, reviews, tests, or subagents even when the user did not request one. Prompt instructions reduce that behavior; an execution guard prevents prompt drift from silently carrying it out.

Guarded commands

The following subcommands require one-time approval:

• git worktree add
• git worktree move
• git worktree remove
• git worktree prune
• git worktree lock
• git worktree unlock
• git worktree repair

git worktree list remains available without approval. Normal branch commands such as git switch -c feature are unaffected.

Requirements

• DeepSeek Harness with the Web profile
• PowerShell 7+
• Node.js 20+ for tests
• An interactive DSH approval responder (provided by the Web app)

Install

git clone https://github.com/cty41/dsh-worktree-guard.git
cd dsh-worktree-guard
pwsh -File ./scripts/install.ps1

The installer:

• copies the plugin into ~/.dsh/profiles/web/plugins/dsh-worktree-approval;
• appends clearly marked managed blocks to ~/.dsh/profiles/web/cordis.patch.yml and ~/.dsh/AGENTS.md;
• adds a danger-full-access-ask permission preset;
• selects that preset for future sessions;
• records the previous default preset for uninstall.

Use another DSH home or profile if needed:

pwsh -File ./scripts/install.ps1 -DshHome D:\dsh-home -Profile web

Create a new DSH session after installation. Permission snapshots on existing sessions are intentionally unchanged. If the running Web Host does not pick up the new local module, restart that Host once.

Uninstall

pwsh -File ./scripts/uninstall.ps1

The uninstaller removes only managed blocks and the installed plugin directory. It restores the previous default permission preset when installation recorded one.

Development

npm test

The tests cover Git executable variants, -C, quoted paths, command chains, read-only worktree listing, ordinary branch commands, and prose containing worktree examples.

Security boundary

This is a DSH tool-layer policy, not an operating-system sandbox. It inspects terminal tool command strings and fails closed when approval is rejected, cancelled, or unavailable. An opaque executable that internally runs Git cannot be identified by command-string inspection. The global agent policy prohibits indirect circumvention; stronger adversarial isolation requires an OS policy or Git executable proxy.

License

MIT