dsh-llm-injection-filter

In DeepSeek Harness coding-agent sessions, streaming model responses can silently carry prompt-injection payloads or protocol control markers that slip into tool-call arguments, get written verbatim into source files, and end up in Git history — a form of contamination that is very hard to detect after the fact. dsh-llm-injection-filter hooks into the llm/stream waterfall and inspects every delta before it reaches the agent. It applies to all adapters uniformly and requires zero changes to runtime source code.

Detection runs on two independent tracks that are always active simultaneously. Track A enforces a Unicode script whitelist (Latin, Han, Common, Inherited, and Greek by default); any character outside the whitelist triggers an immediate hard block that aborts the agent loop and emits a full forensic record including the offending delta, accumulated payload, tool name, and call index. Track B recognises protocol control tokens (assistant to=, /*, ]] and similar), replacing matched text in place on a per-delta basis, and at block-end rewrites the entire tool-call arguments object into a structured rejection that fails schema validation, prompting the model to self-correct. The two tracks are fully independent: Track A hits never fall through to strip or reject, and Track B hits never trigger a hard block.

A dedicated WebUI settings page (Settings > LLM Injection Filter) lets operators toggle the global switch, edit the script whitelist via clickable chips, switch Track A/B operating modes, and scope filtering by provider or model using substring or prefix matching. Every change takes effect immediately with no restart. A structured audit log records each hit with timestamp, rule identity (HARD_BLOCK, CTRL, PROTO, SCRIPT, KW), payload sample, and reason, and supports query and clear operations. The plugin is designed for teams and individual developers running multi-model, multi-adapter coding agents who want a zero-intrusion, stream-level safety net against injection and protocol pollution without touching a single line of agent-loop code.