rbac 2
查权限过宽:容器跑 root、IAM 通配、CORS 全开、令牌申请 admin —— 权限过宽是入侵的放大器
dsh plugin add @deepwhale-cn/dsh-least-privilegeDeclarative tool-call permission control for DeepSeek Harness — allow/deny/ask rules over tools, paths and commands, fail-closed by default, with JSONL audit log.
dsh plugin add dsh-tool-policy