dsh-self-preserve

A single bash call inside a dsh web session can silently kill the very harness that hosts it. The classic failure: a model writes a markdown runbook inside a double-quoted string, the shell expands backticks as command substitutions, and a systemctl stop hits the systemd unit carrying every live session. Because the process exits cleanly, Restart=on-failure never fires—every session on the host vanishes and the service goes dark. dsh-self-preserve exists to catch exactly this class of self-inflicted shutdown.

The plugin is deliberately minimal. It hooks into tools/pre-execute, reads the current Linux unit name from /proc/self/cgroup, and returns a deny decision for any systemctl stop, kill, restart, or try-restart command targeting that unit. On macOS launchd it blocks stop, kill, remove, bootout, unload, and kickstart against the configured label. Read-only status queries and operations on unrelated services remain fully allowed; a genuine restart must be initiated out of band from another machine or an external supervisor. When armed it logs a single confirmation line; when no target can be discovered it emits an explicit inactive warning.

Who should care: anyone running dsh web as a long-lived, multi-session workflow platform, or operating any AI-agent stack where a model session and its host environment share a lifecycle. The plugin does not alter your toolchain or block normal work—it simply adds one safety rail that says: not yourself.