dsh-security-assurance

In AI-assisted coding workflows, security assessment has a habit of living outside the process. A developer runs npm audit by hand, skims the install scripts in package.json, and buries the conclusion in a terminal scrollback that nobody revisits. dsh-security-assurance closes that gap by plugging into DeepSeek Harness through its public service seam, turning security verdicts into versioned, digest-bound, queryable, and recoverable artifacts that survive the session.\n\nCurrent capabilities center on the Node ecosystem. The built-in package.json install-lifecycle check freezes and inspects preinstall, install, and postinstall script fields for risk. In parallel, the plugin reads externally generated npm-audit.json and Gitleaks v8 JSON reports through a pure normalization path, independently re-validates candidates and coverage, and seals one of three terminal verdicts: SATISFIED, FAILED, or INDETERMINATE. All analysis stays inside a pure boundary: no external processes are spawned, no network calls are made, and no live registry is consulted. Report freshness and scan scope remain the responsibility of the generating host or CI pipeline. Three assessment modes are available: REPOSITORY for whole-tree scans, CHANGE for exact committed base-to-head pairs, and TARGETED for explicit relative paths within a Subject. An eight-tool model interface drives the standard repositories to catalog to start to status to findings flow.\n\nBuilt for teams running DeepSeek Harness coding workflows: engineering leads who want security checks embedded in Mission gates, DevOps engineers who need auditable security evidence in CI, and maintainers of multi-repo npm projects who require a single reproducible security policy. When paired with the Engineering Control Plane, a FAILED or INDETERMINATE security verdict directly blocks the final Quality Gate, ensuring that unverified changes never flow downstream.