dsh-egress-guard: Local Zero-Network Key Pre-Check for DeepSeek Harness Model Requests

`dsh-egress-guard` is a security plugin for DeepSeek Harness that locally blocks the leakage of sensitive information before requests are sent to downstream models. It supports scanning various fields, including system prompts, JSON parameters, and tool descriptions, and can detect multiple credential formats. The plugin provides “block” and “audit” modes, supports custom key-matching rules, and defaults to a fail-closed approach. Installation requires specific Node.js and DSH versions, and configuration is done through `cordis.patch.yml`. Note that it does not support image OCR, cannot clean local logs, and is not a global network firewall.