Introduction

Under the plugin mechanism of DeepSeek Harness (DSH), agents can call tools such as shell, SQL, and file writing. If these calls are executed directly, dangerous operations and credential leakage rely on the underlying environment for fallback. lonelymoon87/dsh-guardian provides execution pre-strategies, canonical output redaction after execution, and a read-only security review skill.

Below is an introduction to its positioning, core capabilities, installation methods, configuration examples, and the boundaries to note when using it.

What is it

dsh-guardian is a DSH plugin, with the repository address lonelymoon87/dsh-guardian and the MIT license.

It checks tool names, parameters, canonical results, and rendered output; it can refuse calls or request approval, but it never executes the requested operation itself. It is not a process sandbox, an authorization system, a data loss prevention service, nor does it replace the provider policies mounted underneath it.

Core Capabilities

Pre-execute Strategy

dsh-guardian provides a tools/pre-execute waterfall strategy, classifying dangerous shell, SQL, and structured file write parameters into deny, ask, or unchanged.

The main capabilities include:

  • Providing three profiles: standard, strict, and permissive, offering different approval levels while retaining non-negotiable deny rules.
  • Supporting custom regular expression rules to add deployment-related deny or ask decisions.
  • The Guardian always delegates via next(); if other policy listeners return a decision, the strictest result wins: deny > ask, ask > allow.

Built-in rules include:

  • deny: recursive forced deletion of the root or home directory, network response pipes into shell, raw write to /dev, write to /etc.
  • ask: force push, destructive SQL requests, etc.

Post-execute Redaction

dsh-guardian provides a tools/post-execute waterfall, removing common credentials from canonical JSON results, failures, rendered text, and block feedback.

Specific behaviors are as follows:

  • Built-in deletion patterns cover AWS access-key ID, GitHub token, sk- API key, PEM private key blocks, and common credential assignments.
  • Consecutive text blocks are scanned as a stream to avoid credential splitting across blocks to bypass deletion.
  • When a canonical JSON value exists, deletion is applied to that value, preserving arrays, objects, numbers, booleans, and null.
  • Logs only contain the tool name, match count, and deletion tag.

Security Review

/security-review loads the built-in read-only security review skill.

Installation and Upgrade

The plugin supports DSH >=0.1.0-rc.6 <0.2.0 plugin API and Node.js ^22.19 || >=24. v0.1.3 is tested on DSH 0.1.0-rc.8 and 0.1.1-rc.1, retaining rc.6 compatible peer range.

Pre-built packages are distributed via GitHub Releases; unscoped npm names are owned by other publishers, so this project does not publish to that name.

Install pre-built release package:

dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.3/dsh-guardian-0.1.3.tgz

This release tarball is pre-built and does not require additional building.

Fixed version source code install:

dsh plugin --profile web add github:lonelymoon87/dsh-guardian#v0.1.3

Source code install will run the prepare build. pnpm 10 and higher versions will reject it until the profile allowlist the precise package key printed by the failed command; after allowlisting as prompted, re-run the same dsh plugin add command.

If the target is a one-shot agent profile, replace web with headless.

Upgrade: Re-run dsh plugin add with a newer release URL.

Uninstall:

dsh plugin --profile web remove dsh-guardian

Configuration Example

Configuration uses a YAML array, with an example as follows:

- id: guardian
  name: dsh-guardian
  config:
    profile: standard
    rules:
      - name: production-host
        pattern: production\\.internal
        action: ask
        reason: production target requires review
    redaction:
      enabled: true
      patterns:
        - label: internal-token
          pattern: INT_[A-Z0-9]{12}

Regular expression flags can only contain i, m, s, u. Invalid expressions and labels will fail at plugin load time.

Use Cases and Notes

dsh-guardian is suitable for developers in the DSH environment who need to constrain dangerous tool calls and avoid common credentials entering the model’s visible output. Before installing, you should first check the source code and the MIT license, and confirm that the current DSH process permissions match expectations.

You need to pay attention to the following:

  • It is an MVP, not a process sandbox, an authorization system, a data loss prevention service, nor does it replace the provider policies mounted underneath it.
  • It does not read credential stores, does not initiate network requests, does not write workspace files, does not transmit telemetry, and does not persist custom session events.
  • The plugin does not append custom session events because the current external plugin API does not expose ignorable event envelopes; emitting the required unknown events might make old sessions unreadable after uninstallation.
  • It checks tool names, parameters, canonical results, and rendered output; it can refuse calls or request approval, but it never executes the requested operation itself.
  • Source code install may trigger pnpm 10 and higher versions’ build command allowlist flow.

Conclusion

After the above installation and configuration, dsh-guardian provides a set of runtime dangerous operation policies, canonical output redaction, and read-only security review entry points for DSH. It is suitable to be used together with existing provider policies, rather than replacing the underlying security mechanisms.

GitHub repository:

  • https://github.com/lonelymoon87/dsh-guardian