dsh-vault-wall: An Isolation Wall Plugin Preventing DSH Agent from Perceiving or Accessing Specified Sensitive Paths
`dsh-vault-wall` is a plugin running on the DSH host, designed to provide isolation and protection for sensitive paths. Through an interception layer, it supports three modes: hide (masquerading as non-existent), deny (returning an error directly), and ask (requiring manual approval). The plugin includes mechanisms such as tool risk assessment, post-execution validation (leak prevention), self-protection, and rule rollback. After installation, rules are configured via JSON, and the `/wall` command enables flexible boundary management to effectively prevent the leakage of sensitive data.
Read Moredsh-capsule: Provides Linux Sandbox Isolation for Third-Party DeepSeek Harness Plugins
dsh-capsule is a Bubblewrap-based security plugin designed to provide system-level isolation for DeepSeek Harness. It creates an independent Linux process to physically isolate third-party plugins from the host environment, preventing malicious code from compromising the system. The plugin supports integrity verification, tool registration, and per-invocation isolation, and allows restricted access to host files via the `workspace-read` permission. Currently, v0.1 primarily supports Linux systems and provides only file-read access, without network, write, or subprocess execution capabilities.
Read More