Introduction¶

The philosophy of DSH (DeepSeek Harness) is “everything is a plugin.” Tool calling capabilities are provided by plugins, and the permissions the model obtains are essentially equal to the permissions of the current process. This means that when an agent executes rm -rf, reads .env, or treats curl | sh as daily operations, the consequences fall directly on the host machine. Looking at output redaction alone is not enough; there must be a mechanism to intercept or confirm before a call is made.

The dsh-guardrail (npm package name dsh-guardrail) maintained by darkmagic-ai, introduced below, is the plugin that does this. It checks tool parameters based on fixed rules: it directly refuses when hitting dangerous commands or sensitive paths, or pops up a web approval request; before handing the tool’s return content to the model, it performs key redaction; and writes every judgment into a local JSONL audit log. It does not replace a sandbox; it prevents mistakes, not adversarial attacks.

What is this?¶

A DSH plugin, category admin-security, currently starred 0 times. It consists of four main functions: dangerous command interception, sensitive path protection, tool output redaction, and local audit logs and daily reports. It also provides the guard_report tool, which returns a Chinese daily operation summary when asked. License MIT, version 0.1.2, requires DSH ≥ 0.2.1-rc.5, Node ≥ 22, and has been verified on Linux and Windows (PowerShell).

Core Features¶

Dangerous command interception has 22 built-in rules, covering recursive deletion, disk formatting, fork bombs, git push --force, curl | sh, registry deletion, adding system users, etc. The action for each rule can be deny (directly refuse) or ask (pop up approval in the web UI, execute only if approved).

Sensitive path protection covers .env, SSH private keys, cloud provider credential files, browser cookies and password vaults, DSH’s own credential files, and system password databases.

Output redaction takes effect before the tool returns content to the model. It has 13 built-in rules, including private keys, JWT, sk- keys, GitHub / AWS / Slack / Google / Stripe tokens, Bearer strings, key-value pairs like password=, ID card numbers, Chinese and Chilean phone numbers; emails and Chilean RUT are disabled by default and need to be enabled separately if needed.

Audit logs are appended to JSONL daily, with the default directory $DSH_HOME/dsh-guard/. Parameter previews are redacted and truncated; the original key text never touches the disk. When there is no approval channel (e.g., headless scenarios), ask degrades to deny, and is recorded as unavailable in the audit.

There is also a dryRun rehearsal mode that only logs without intercepting, allowing you to see which commands might be mistakenly blocked first. The plugin is mounted via cordis.patch.yml and does not require modifying DSH source code.

Installation¶

It is recommended to install it into a separate test profile first:

# Install from npm
dsh plugin --profile <profile> add dsh-guardrail

# Or use an offline package
dsh plugin --profile <profile> add ./dsh-guardrail-0.1.2.tgz

If you see [dsh-guard] 已加载… in the startup logs, it means the installation was successful. When reinstalling the same version, first run dsh plugin --profile <profile> remove dsh-guardrail and then add, otherwise you might read from old cache.

Configuration¶

Configuration can be changed in the web UI under Plugins → dsh-guardrail, or written into the profile configuration. Common items are as follows:

The plugin does not initiate any network requests; logs are written locally only.

Built-in Interception Rules¶

Command-type rules (kind: command) excerpt:

Path-type rules (kind: path) excerpt:

Typical Usage: Observe Before Enabling¶

First turn on dryRun, nothing will be blocked; first look at which hits are recorded in the audit:

# in profile config
dsh-guardrail:
  dryRun: true

After running for a while, read the day’s log:

tail -n 200 "$DSH_HOME/dsh-guard/audit-$(date +%F).jsonl"

After confirming the hits meet expectations, turn off dryRun, and put the rule IDs of wrongly blocked commands into disabledRules as needed, and write the commands that should definitely be allowed into the allow whitelist. Afterwards, ask the model “what did you do today”, it will call guard_report to return a Chinese daily report, formatted similar to the example below:

📋 dsh-guard 日报 2026-11-04
工具调用共 4 次;拦截 1 次,询问 2 次(批准 1 / 拒绝 1)。
输出脱敏共 3 处(github-token×1、cn-phone×1、cl-phone×1)。
调用最多的工具:powershell×3、read_file×1

被拦截/询问的记录(最近 3 条,共 3 条):
- 23:21:05 [powershell] 已拒绝 · 规则 ssh-private-key · type C:\temp\id_rsa
- 23:21:40 [powershell] 询问→被拒绝 · 规则 reg-delete · reg delete HKCU\Software\DshGuardTest /f
- 23:22:10 [powershell] 询问→已批准 · 规则 remove-item-recurse · Remove-Item -Recurse X:\demo

Applicable Scenarios and Notes¶

Suitable for development scenarios using DSH on local or test machines, especially when worrying that an agent might execute dangerous commands or frequently leak key tokens in tool outputs. Commands like Remove-Item -Recurse, reg delete, diskpart on Windows have corresponding entries in the rules.

Points to note before use: The plugin runs with the permissions of the current DSH process, interception happens on the parameter side of the call, and does not provide isolation at the file system or command execution level. It is based on regex matching; commands encoded in base64, variable concatenation, writing scripts before execution, or handed to other interpreters might bypass it; redaction is also based on format matching, uncommon key formats might be missed, and occasionally incorrect redaction might happen. It only checks parameter names specified in the configuration; parameters of non-standard tools might not be visible.

Therefore, do not treat it as a sandbox replacement; true isolation should be combined with sandbox / containers, least privilege accounts, and read-only mounts. Before installing, you should check the source code and license (MIT), and it is recommended to install it into a separate test profile to verify with small traffic.

Summary¶

The value of dsh-guard is to block the most common dangerous operations and key leaks before the call happens, and leave a locally auditable record. The functional boundaries are also clear: a regex guardrail to prevent mistakes, not adversarial attacks. The directory page is at https://www.skillhub.cn/plugins/darkmagic-ai/dsh-guard, source code is at https://github.com/darkmagic-ai/dsh-guard.