# dsh-capability-toggle-plugin **Control agent capabilities from the DSH WebUI — with real runtime enforcement.** [![platform](https://img.shields.io/badge/platform-DSH%20WebUI-2b7cd3?style=flat-square)](#quick-start) ![tests](https://img.shields.io/badge/tests-94%20passing-3fb950?style=flat-square) [![release](https://img.shields.io/github/v/release/lifeopsgo/dsh-capability-toggle-plugin?style=flat-square)](https://github.com/lifeopsgo/dsh-capability-toggle-plugin/releases) [![license](https://img.shields.io/badge/license-MIT-blue?style=flat-square)](./LICENSE) **English** · [简体中文](./README.zh-CN.md) Capability controls for Skills, MCP, Tools, Prompt, and Security

Capability controls for Skills, MCP, Tools, Prompt, and Security

_{Session · Project · Global — blue check = on, red cross = off, dashed dash = unset.}

## What it is A **DeepSeek Harness (DSH) WebUI** plugin for controlling **skills, MCP servers, tools, prompt injections, approval escalation, and safety guards** at session, project, or global scope. Depending on the family, disabling removes, suppresses, rejects, or intercepts the capability on the agent's next step. ## Quick start Requires **Node.js ≥ 22.6**. ```bash dsh plugin --profile web add github:lifeopsgo/dsh-capability-toggle-plugin#v1.0.2 ``` Restart the existing DSH Web GUI process, then refresh the page. Start it with the command below when it is stopped: ```bash dsh --profile web web ``` Open the control beside the ➕ button while the agent is idle. Replace `web` with another profile name when needed.

Upgrade or remove

```bash # Upgrade or downgrade: use any tag listed on the releases page dsh plugin --profile web add github:lifeopsgo/dsh-capability-toggle-plugin#v1.0.2 # Remove dsh plugin --profile web remove dsh-capability-toggle-plugin ```

## Features ### Three-level resolution Each capability has three independent levels: ```text session › project › global › default (enabled) ``` The nearest explicit value wins. **Unset** defers to the next level; with every level unset, the capability remains enabled. The row badge always shows the resolved result. The button displays only its current state: click to toggle **on ↔ off**, or use its small clear badge to return to **unset**. ### Capability families | Tab | Controls | | :-- | :-- | | **Skills** | Individual model-invocable skills | | **MCP** | MCP servers; expand a row to inspect member tools | | **Tools** | Individual model-visible tools and their guidance sections | | **Prompt** | A safe, presence-checked allowlist of prompt injections | | **Security** | Approval escalation and five opt-in safety guards | ### Enforcement Every mechanism is scoped to the current agent; global registrations are not mutated. | Family | Enforcement | | :-- | :-- | | `tool` / `mcp` | Removed with `ctx.tools.restrict({ deny })`; forced calls are refused | | `skill` | Shadowed by a same-named `modelInvocable:false` runtime skill | | `prompt` | Shadowed with empty text, or suppressed with `suppressRuntimeContext()` | | `approval` | Scoped approval requests resolve to `rejected` | | `guard` | `tools/pre-execute` blocks or requests confirmation for matching calls | ### Security controls Turning off **Approval escalation** rejects every approval request from that agent without changing the system `/permission` setting. Safety guards are opt-in: | Guard | Action | | :-- | :-- | | Read-only mode | Block file writes, creates, and edits | | Protect secrets | Block access to common secret files and credentials | | Dangerous shell | Confirm high-risk shell commands | | Destructive git | Confirm history- or work-losing git commands | | Outbound network | Confirm network tools and outbound shell actions | Additional behavior: switches lock while the agent runs, state survives popup close and turn boundaries, and the UI follows the WebUI language. ---

_{MIT — see LICENSE}