dsh-egress-gate
DeepSeek Harness 的确定性网络出口控制：网页获取和搜索在执行前会根据目标允许列表进行检查——内容扫描保护代理读取的内容，而此控制机制保护数据可能流向的位置
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zhengqiuyang/dsh-egress-gate#5599f4fc9f7379e81378869c72f8740d22010610Egress Gate 以 dsh-egress-gate 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Deterministic network egress gate for DeepSeek Harness (dsh).
Content scanning (dsh-read-guard) guards what enters the model; this
guards where data may leave to. web_fetch / web_search calls are
checked against a destination allowlist in tools/pre-execute and denied
before they run. Shell commands are scanned for fetch-verb URLs —
observation by default, enforcement opt-in, honest about precision. Zero LLM
calls in the trust path.
Family: read · write · do · call · leave-behind · egress (where data may flow).
Empty lane. Five keyword searches (network allowlist, egress firewall,
url filter, web fetch restrict, …) return nothing on GitHub; the awesome
list has no entry gating destinations. Neighbours are all different axes:
content-pattern secret rules (dsh-defend), LLM-judged commands
(dsh-jev-guard), proxy configuration (official network-proxy docs). For
teams, "which hosts may the agent reach" is the first compliance question —
and the deterministic answer was unowned.
allow list means "only these hosts"
(example.com covers api.example.com; *.example.com is the explicit
form).curl / wget / Invoke-WebRequest /
Invoke-RestMethod / fetch / http on the same command segment. This
cannot see through scripts, variables, or proxies — so it warns by
default and denies only when you opt into shellMode: 'enforce'.dsh plugin --profile default add github:zhengqiuyang/dsh-egress-gate
Prebuilt lib/ ships in the repo — git installs need no build step and no
allowBuilds authorization.
- id: dsh-egress-gate
name: dsh-egress-gate
config:
webTools: [web_fetch, web_search]
shellTool: bash # '' disables the shell scan
allow: [docs.deepseek.com, github.com]
deny: [pastebin.example]
shellMode: observe # observe | enforce
npm install && npm test
If dsh ships first-party destination policy, or proxy-layer plugins add per-host rules, this freezes at its last working version with a postmortem here.