Foreword¶

self-control-guard is a plugin for the DeepSeek Harness (DSH) that handles scenarios where a model attempts to terminate the host process via the bash tool. It performs a hard rejection on high-confidence host termination attempts, guides the model toward using controlled exit/restart tools, and executes a graceful exit/restart after token confirmation, while writing to the restart recovery roster.

What This Is¶

It is a DSH plugin maintained by pandashere, licensed under MIT.

In terms of positioning, it acts as a self-control guard layer: intercepting direct attempts to kill the host process and routing them into a controlled exit/restart path. Note that it is a UX/interception layer, not a security boundary; the OS can always kill the host.

DSH emphasizes that “everything is a plugin.” The plugin directory mentioned here is an independent site with no official affiliation with DeepSeek / High-Flyer and should not be interpreted as an official app store.

Core Features¶

Intercepting Host Termination in the bash Tool¶

The plugin recognizes canonical host termination forms at the simple command level within the bash tool, including:

• pkill dsh
• kill $PPID
• kill -9 <host-pid>
• killall dsh

Upon detection, it performs a monotonic hard rejection. For dynamically constructed commands, shell functions, unsupported compound syntax, and parser-limit failures, the matcher abstains.

Guiding Toward Controlled Exit and Restart Tools¶

After interception occurs, the plugin injects a pinned guidance message to steer the model toward using controlled tools:

• dsh_self_exit is guided as the controlled exit tool.
• dsh_self_restart is only provided when restartEnabled: true; by default, restartEnabled is false, and the README mentions that web scenarios have no supervisor.

Executing Token-Confirmed Graceful Exit/Restart¶

Exit/restart is executed through existing launcher interfaces:

• Headless runner uses ctx.headlessIo.exit(code).
• Long-lived surfaces use the launcher’s SIGTERM graceful shutdown.

Writing to the Restart Recovery Roster¶

As mentioned in the package.json description, the plugin writes to the restart recovery roster.

Installation and Enablement¶

Requirements are Node.js 22 or higher, and @deepseek-ai/dsh@0.1.0-rc.6.

First, perform local installation, checks, and packaging in the plugin directory:

npm install
npm run check
npm pack

After completing the above steps, install the generated tarball into the DSH profile:

npx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add ./self-control-guard-0.1.0.tgz

Then restart dsh web:

npx @deepseek-ai/dsh@0.1.0-rc.6 web

The plugin has no browser bundle; you need to confirm it appears in the plugin list in the Web settings. Installing the source directory as a link is not supported because host peers are provided by the DSH profile.

If you need to uninstall, run:

npx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web remove self-control-guard

Typical Usage and Configuration Notes¶

To enable the restart tool, set restartEnabled to true; it is disabled by default.

The plugin fails loudly when loading configuration. The following cases will throw an error rather than silently falling back:

• Duplicate or empty interceptModes
• exitCode is the same as restartExitCode
• confirmationCalls < 2
• TTL is not positive
• Cooldown is negative
• Invalid enum members
• Duplicate privilegedBash.matchers

enabled: false is the only way to completely disable interception.

privilegedBash is an optional explicit escape hatch, disabled by default, and the tool is not registered by default.

Applicable Scenarios and Cautions¶

It is suitable for reducing the impact of models mistakenly executing host termination commands in DSH plugin scenarios. When using it, note that:

• It is a UX/interception layer, not a security boundary; the OS can always kill the host.
• The matcher works on canonical host termination forms at the simple command level and abstains on dynamically constructed commands, shell functions, unsupported compound syntax, and parser-limit failures.
• The plugin runs with the permissions of the current dsh process; review the source code and the MIT license before installation.
• The plugin has no browser bundle; the verification entry point is the Web settings plugin list.

Conclusion¶

The value of self-control-guard lies in redirecting host termination attempts mistakenly triggered by the model toward a token-confirmed exit/restart path while writing to the restart recovery roster. If you want to add a layer of misoperation protection for your agent in a DSH environment, you can follow the steps above to install and verify it.

Directory page: https://www.skillhub.cn/plugins/pandashere/dsh-self-control-guard

GitHub: https://github.com/pandashere/dsh-self-control-guard