Allow, ask, or deny DeepSeek Harness tool calls before execution
dsh plugin add @drifter-yh/dsh-tool-policy