dsh-least-priv

Least-privilege auditor: mechanical scans for privilege anti-patterns, plus the four-question permission gate. Sovereignty is built in — all power belongs to the operator; autonomy lives only inside the granted scope; any privilege escalation requires a fresh explicit grant, never self-service.

Anti-patterns scanned

Family	Examples
hardened-escalation	sudo · chmod 777 · plaintext credentials
root-traces	hardcoded /root/... · granting sudo to users
wide-writes	rm -rf / (red-line class)

Four-question gate

1. Does this piece truly need the privilege?
2. Can the privilege be narrowed?
3. What happens on overreach?
4. When is it revoked?

Install & use

dsh plugin add github:<owner>/dsh-least-priv
curl "http://127.0.0.1:<port>/least-priv/api?act=four"
curl "http://127.0.0.1:<port>/least-priv/api?act=scan&path=/path/to/code"