dsh-risk-guard
Zero-interruption audit + fuse blocking for DeepSeek Harness (dsh).
Features
- Silent audit — records every tool call (tool name, redacted arguments,
success/failure, risk tags, explainable score) into local JSONL files.
No dialogs, no permission changes, no sandbox changes.
- Deterministic risk scoring — zero LLM calls, zero extra cost. Covers
destructive deletes, credential reads, network egress, writes outside the
workspace, dependency installs and heavy builds; rapid repeats and
consecutive high-risk calls accumulate bonus score.
- Insurance fuse — blocks only irreversible catastrophes before they
execute: protected-path deletion, disk wipe/format, force-push to protected
branches, and network commands referencing credential files.
- Operation bill —
/risk-guard answers "what did my agent actually do?",
with scores, tags, reasons and redacted details for the current session,
one turn, or all history.
All data stays on your machine under <DSH_HOME>/risk-guard/. No network
calls, no telemetry.
Install
Requires an existing DeepSeek Harness installation.
Option 1 — dsh plugin manager (recommended)
dsh plugin --profile web add dsh-risk-guard
Restart the Web UI, then use /risk-guard in any session.
Option 2 — npm
npm install dsh-risk-guard
or with pnpm:
pnpm add dsh-risk-guard
Then register the plugin in your profile's cordis.patch.yml:
- insert:
- id: risk-guard
name: 'dsh-risk-guard'
Option 3 — from source
git clone https://github.com/shuxue6662-a11y/dsh-risk-guard.git
cd dsh-risk-guard
pnpm install
pnpm build
dsh plugin --profile web add .
Usage
/risk-guard operation bill for the current session
/risk-guard --turn only the last turn
/risk-guard --all summary + bills for every recorded session
/risk-guard --since=2026-08-01
only records from this date (with any other flag)
/risk-guard --json machine-readable output
The bill includes the time range, call/turn counts, high-risk and fuse-block
counts, max/total scores, tag distribution, a risky-calls table and every fuse
denial.
Configuration
All options are optional; defaults are shown below.
| Option | Default | Meaning |
|---|
fuseEnabled | true | master switch for fuse blocking |
maxFileSizeMb | 50 | gzip-archive the monthly JSONL above this size |
retentionDays | 30 | delete gzip archives older than this many days |
cumulativeRiskWindowMs | 600000 | rolling window for the repeat-tag risk bonus |
highRiskThreshold | 60 | score floor for the consecutive-high-risk bonus |
workspaceRoot | unset | detect writes outside the workspace |
homeDir | OS home | home used by path rules and ~ expansion |
dshHome | ~/.dsh or $DSH_HOME | audit store at <dshHome>/risk-guard |
protectedBranches | ['main', 'master'] | force-push to these branches is blocked |
protectedRemotes | [] | force-push to these remotes is blocked |
credentialFileNames | common list | .env, credentials, id_rsa, … |
Example:
- insert:
- id: risk-guard
name: 'dsh-risk-guard'
config:
fuseEnabled: true
workspaceRoot: 'C:/projects/my-app'
protectedBranches: ['main', 'master']
Fuse rules (v1)
rm -rf / del / Remove-Item deleting the filesystem root, the home
directory itself, $HOME/*, DSH_HOME, or a credential file;- disk wipe/format commands (
dd of=/dev/sdX, mkfs*, wipefs, diskpart,
shred /dev/…, format C:);
git push --force / -f targeting main/master or a configured protected
remote (feature branches are not blocked);- network commands (
curl, wget, nc, scp, ssh, …) referencing a
credential file.
Everything else runs untouched. Set fuseEnabled: false to disable the fuse
while keeping the audit recorder active.
Privacy & storage
- Records are appended to
<DSH_HOME>/risk-guard/<yyyy-mm>.jsonl through a
serialized write queue; oversized month files are gzip-archived.
- Secret-shaped values (GitHub tokens,
sk- keys, private-key blocks,
Bearer tokens, .env lines, password assignments) are redacted before
storage; only a digest of the redacted value is kept.
- The plugin makes no network calls and ships no telemetry.
Compatibility
| Environment | Status |
|---|
dsh 0.1.0-rc.6 (npm next) | tested |
web profile | tested |
headless profile | works (command is conditionally registered) |
Troubleshooting
- All tool calls crash after install — host and profile versions of
@deepseek-ai/* differ. Reinstall the plugin in the profile and run
pnpm dedupe.
- The bill is empty — start a new turn and run a few tool calls; records
are written asynchronously.
- I want zero blocking — set
fuseEnabled: false.
Contributing
See CONTRIBUTING.md and SECURITY.md.
License
MIT
