dsh-guardian

Once an agent holds shell access, a single plausible-looking command can trigger recursive deletion of root or home paths, pipe network responses into bash, or leak AWS key IDs and GitHub tokens in output. dsh-guardian inserts a lightweight policy waterfall between intent and execution, letting operators classify every high-risk action as deny, ask, or allow.

Built-in profiles cover common dangerous patterns while custom regex rules add deployment-specific decisions. The post-execute redaction engine scans canonical JSON, rendered text, and block feedback for AWS access-key IDs, GitHub tokens, sk- API keys, and PEM private-key blocks, merging consecutive text blocks into one stream so credentials cannot be split to bypass filtering. The /security-review command loads a bundled read-only review skill on demand.

It is deliberately not a process sandbox, does not read credential stores, make network requests, write workspace files, or transmit telemetry. It suits developers and ops teams running autonomous DeepSeek Harness agents who want an auditable, lightweight interception and redaction layer without standing up a full DLP pipeline or container isolation.