Windows Workspace Guard for DeepSeek Harness
This release caps audit files at 32 MiB, rejects invalid limits, and refreshes the visual walkthrough.
Understand what your Windows agent is about to change—and why a call was blocked.
| Your problem | Ask the agent |
|---|
| A command looks risky | “Check this command without executing it.” |
| Protection seems incomplete after an upgrade | “Run windows_workspace_guard_doctor and explain uncovered tools.” |
| Too many blocks, no clear explanation | “Run windows_workspace_guard_audit_summary and show the most frequent rule IDs.” |
New in v1.1.1: make audit logs useful
The new windows_workspace_guard_audit_summary tool reads the configured audit log and returns decision totals and frequent rule IDs. It excludes commands, working directories, and target paths. Malformed rows and the 100,000-record limit are reported explicitly so partial evidence is visible.
Set auditPath to a project-owned JSONL path in the plugin settings to collect future decisions. Logging is opt-in; the tool cannot reconstruct old activity. You can also run node audit-summary.js D:\project\logs\guard.jsonl from the package directory without a model or API key.
Use the summary to identify a rule, then inspect that specific case with the dry-run tool before changing policy.
中文 | English
[!IMPORTANT]
Unofficial community plugin. Independently developed and maintained; not reviewed or endorsed by DeepSeek.
Stop a Windows agent before it deletes originals, escapes the workspace, destroys Git recovery paths, reads credentials, or changes system state. PowerShell and both official filesystem suites receive a clear PASS, ASK, or HARD BLOCK before dispatch.
Illustrated guard workflow
Start in 30 seconds
dsh plugin --profile web add github:julescules/dsh-windows-workspace-guard#v1.1.1
dsh --profile web --dump-config
dsh --profile web
Restart DSH, then ask:
Run windows_workspace_guard_doctor, then use windows_workspace_guard_check
to inspect this command without executing it:
Get-Content -LiteralPath $env:DSH_HOME\.credentials.yaml
Why v1.1.1
Verified multi-tool boundary
The default protected set follows the official rc.1 Windows/file surface: pwsh, read, extensionless-capable read_image, write, edit, glob, grep, and Minimal's str_replace_editor. Each adapter reads only the official path and operation fields, omits file content, search text, and replacement strings from policy previews, and applies the same workspace, immutable-path, existing-link, and sensitive-path rules.
Configured tools without a verified argument adapter fail closed. Doctor reports every configured tool as covered or unsupported; the plugin never treats an unknown schema as PowerShell and calls it protected.
Upgrades preserve live settings. If an older profile already stored a shorter toolNames list, add read_image, glob, and grep in the settings card; Doctor will show the effective coverage.
Official grep searches hidden and ignored files. With guardSensitiveData enabled, v1.1.1 requires a narrow include glob such as *.js or *.ks; an unbounded search fails closed before a hidden .env can be returned. Explicit credential-like paths and glob patterns are blocked too.
Monotonic hard blocks
Workspace escapes and unverifiable mutation paths are hard blocks. allowExact remains available for explicit review-level commands, but it cannot authorize a write outside the configured workspace or bypass any non-overridable policy.
Static non-overridable rules are also registered through the official synchronous ctx.tools.guard() seam. They remain denials even if another reorderable tools/pre-execute listener short-circuits its waterfall. Older Harness builds without that API keep the pre-execute fallback.
Live junction/symlink inspection remains asynchronous in tools/pre-execute; it cannot be moved into a synchronous guard and is reported honestly as a separate layer.
Credential and secret boundary
With guardSensitiveData: true (default), guarded pwsh, read, and editor calls block explicit reads or copies of:
$DSH_HOME\.credentials.yaml and .env files;- user SSH, AWS, Azure, Git, npm, GitHub CLI, and NuGet credential locations;
- configured
sensitivePaths;
- sensitive environment variables and full
Env: enumeration;
- same-command outbound-network use combined with an explicit sensitive source.
This is a conservative tool boundary, not a general DLP system. It does not inspect arbitrary native-process memory, already-running processes, or tools outside toolNames.
Read-only Windows doctor
windows_workspace_guard_doctor reports facts without changing ACLs or configuration:
ctx.tools.guard() availability;- configured-tool coverage and adapter type;
- DSH home and configured workspace/protected path state;
- existing link metadata for configured roots;
- audit-path writability and bounded duplicate-runtime checks;
- credential-file ACL metadata on Windows, without opening credential contents.
Decisions
| Result | Meaning |
|---|
| PASS | No matched risk under the active policy. |
| ASK | A reviewable operation needs one host approval in mode: ask. |
| HARD BLOCK | Disk/system mutation, policy bypass, immutable path, link traversal, or sensitive-data access cannot be approved away. |
Use windows_workspace_guard_check for a dry run. Select pwsh with command; select read, write, or edit with path; or select str_replace_editor with an operation plus absolute path. It returns machine-readable findings and never executes the call.
Main settings
The DSH Web settings card updates these values live:
enabled: true
mode: block # block | ask | report
toolNames: [pwsh, read, read_image, write, edit, glob, grep, str_replace_editor]
workspaceRoots: [] # empty = current session cwd
protectedPaths: []
guardExistingLinks: true
guardSensitiveData: true
sensitivePaths: []
auditPath: '' # optional append-only JSONL
auditIncludeCommand: false
auditFailClosed: false
With an audit path, dispatch writes occur after host approval and monotonic guards. Denied calls are observed after their final result. Commands are hashed and redacted by default.
DSH integration
The package stays outside Harness core and uses the official dsh.bundle.patch, tools/pre-execute, ctx.tools.guard(), tools/execute, tools/result, settings, and typed-tool seams.
Upgrade, disable, uninstall
dsh plugin --profile web add github:julescules/dsh-windows-workspace-guard#v1.1.1
dsh plugin --profile web list
dsh plugin --help
Use the disable/remove command shown by dsh plugin --help for your Harness build, then restart DSH. Profile command names are still changing during developer preview.
Troubleshooting and data
- Missing settings card: run
dsh --profile web --dump-config, confirm windows-workspace-guard, then restart Web.
- False positive: run the dry-run tool and report finding IDs plus a redacted command/path.
- The plugin makes no network requests. Doctor reads filesystem/ACL metadata only and never credential values.
- No audit file is created unless
auditPath is configured.
- Keep
workspaceRoots and sensitivePaths absolute and narrow.
Verify
npm run check
npm pack --dry-run
node scripts/build-release-metadata.mjs .\dsh-windows-workspace-guard-1.1.1.tgz .\builds\v1.1.1
.\scripts\verify-release.ps1 -PackagePath .\dsh-windows-workspace-guard-1.1.1.tgz -ChecksumsPath .\builds\v1.1.1\SHA256SUMS
Each release ships a SHA-256 checksum and CycloneDX SBOM. The verifier reads files literally and makes no network request.
Limits
- Static policy is not an operating-system sandbox.
- A filesystem TOCTOU window remains between link inspection and execution.
- Tools outside
toolNames are not covered; configured names with unknown argument schemas fail closed and appear as Doctor warnings.
- ACL warnings are review evidence, not automatic permission repair.
For missed cases, reply in the official community plugin thread with Windows, PowerShell and DSH versions, a redacted command, expected PASS/ASK/BLOCK, and redacted doctor output.
See CONTRIBUTING.md and SECURITY.md.
License
MIT
Compatibility: runtime-validated on DSH 0.1.2-rc.1. Upstream 0.1.3-alpha.1 is published on GitHub; its npm package was unavailable on 2026-09-06, so runtime compatibility with that alpha is not yet claimed.
