dsh-dlp

When a DeepSeek Harness agent reaches for an SSH key, a .env file, or a payment card number through a tool call, that material can flow untouched into a third-party model context, the session log, or FULL-mode telemetry. dsh-dlp plugs into the agent process as a data-loss-prevention layer: it unconditionally denies credential-path reads and secret-bearing network arguments, redacts keys from tool results, spliced messages (the AGENTS.md chain, webhook payloads, sub-agent relays), and exported telemetry before the model ever sees them, and identifies payment-card numbers via Luhn validation combined with issuer-range checks.

Beyond blocking, dsh-dlp addresses quieter attack surfaces: it strips invisible characters that can smuggle hidden instructions (bidi overrides, Unicode Tag Blocks, consecutive Variation Selectors), neutralises remote Markdown images in assistant output, and flags tool calls rewritten between the pre-execute hook and the guard. Before an agent writes files that alter future behaviour—.mcp.json, git hooks, CI workflows, shell startup files, prompt templates—the plugin raises a confirmation prompt rather than silently proceeding. Every denial, redaction, or prompt writes an audit record carrying a rule ID, span offsets, and a keyed hash, readable via dsh-dlp report, while the matched secret itself never appears in the log.

dsh-dlp is suited for teams wiring agents to third-party LLM providers, operating on sensitive repositories, or meeting compliance and audit requirements. It is explicitly not a sandbox: bash commands, run_code programs, or mounted MCP servers already running outside the guard remain unconstrained. It closes the path where the model itself requests credential material through a tool; true process isolation still requires sandboxes, landlock, filesystem permissions, and egress firewalling.