dsh-escrow
延迟执行窗口：把 agent 的不可逆动作放进托管队列，批准才交割，超时默认拒绝。Deferred execution window (escrow) for DeepSeek Harness.
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Floralee2024/dsh-escrow#14ac5f303a03546024d23fb9cb30644e7fa45299Escrow 以 dsh-escrow 发布，当前版本为 0.3.26。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →Pre-execution escrow and fail-closed human approval for irreversible agent actions.
dsh-escrow is a plugin for DeepSeek Harness. It classifies tool calls before execution, places high-risk actions in an escrow window, and releases them only after an explicit decision. Silence, timeout, adapter failure, and unknown outcomes do not release an action.
Current release: v0.3.26. This repository is a system/artifact prototype. Its tests document implemented invariants and exercised behaviors; they do not prove universal security, production-scale effectiveness, or safety against every attacker.
green / yellow / red routing with built-in coverage for destructive, privileged, external-side-effect, shared-resource, and governance actions.host or local adapter mode; asynchronous queueing with escrow_result for the default queue mode.127.0.0.1.Permission presets and post-hoc rollback answer “what can be attempted” or “how can damage be repaired.” Escrow adds a decision point before the side effect takes place. A red action is not treated as successful merely because it was queued, and a missing human decision is not interpreted as consent.
Prerequisites: Node.js 18+ and an installed DeepSeek Harness profile.
git clone https://github.com/Floralee2024/dsh-escrow.git
cd dsh-escrow
dsh plugin --profile web add .
Restart the dsh profile after installing or changing the plugin. If you install from another directory on Windows, pass that directory as the plugin path instead of the example ..
The adapter is an MVP replacement approval surface. It binds to loopback, keeps pending requests in memory, supports the two stable one-shot outcomes currently used by the host protocol (allowed-once and rejected), and automatically opens the local approval page when a new request arrives if no approval page is currently visible.
Start it from the repository root:
node approval-adapter/bin/dsh-escrow-approval-adapter.mjs --port 3099
The adapter attempts to open the tokenized local URL automatically. If the environment is headless or the launcher is unavailable, open the printed local URL manually. Do not expose the adapter on a LAN or public interface.
Configure the dsh profile without committing the token:
- id: escrow
config:
approvalMode: adapter
approvalAdapterUrl: http://127.0.0.1:3099
approvalAdapterTimeoutSec: 300
mode: sync
ttlSec: 300
timeoutPolicy: cancel
defaultAction: yellow
builtinRules: true
Set the token in the process environment, or put it in a private profile overlay:
$env:DSH_ESCROW_APPROVAL_TOKEN = '<token printed by the adapter>'
The end-to-end flow is:
3081 Web session
-> dsh tool call
-> dsh-escrow tools/pre-execute
-> POST 127.0.0.1:3099/v1/approvals
-> structured approval card
-> human clicks “允许一次” or “拒绝”
-> the original tool call is released or denied
-> result returns to the 3081 session
The adapter UI deliberately exposes only the MVP buttons. approve-now and explicit manual whitelist decisions remain available through the /escrow command surface; richer adapter buttons require a compatible host protocol extension.
A card includes the tool, risk class, reason, approval id, and structured action fields where available. It also states the applicable learning policy.
never-learn actions never become automatically allowed, regardless of approval count. They can only be added by an explicit /escrow allow action, with the associated risk left to the administrator.critical-red is reserved for actions such as force push, production/shared-resource deletion, formal package publishing, privilege elevation, security-policy changes, and dsh governance changes. These require an explicit decision each time.-WhatIf; a dry-run command can still require review./escrow pending
/escrow approve <id>
/escrow approve-now <id>
/escrow approve-and-allow <id>
/escrow deny <id>
/escrow allowlist
/escrow allow <signature>
/escrow deny <signature>
/escrow forget <signature>
/escrow approve all
/escrow deny all
/escrow export [path]
/escrow import <path>
/escrow reduce [--since 7d]
/escrow migrate
/escrow doctor
/escrow stats
queue mode is asynchronous and returns a synthetic foreground result while the action remains pending. host and adapter modes are synchronous and wait for the decision. Any unavailable approval path or timeout is fail-closed under timeoutPolicy: cancel.
The main configuration is applied through the profile's cordis.patch.yml:
- id: escrow
config:
ttlSec: 300
timeoutPolicy: cancel # cancel | release | hold
defaultAction: yellow # green | yellow | red
builtinRules: true
mode: async # async | sync
approvalMode: queue # queue | host | adapter
approvalAdapterUrl: http://127.0.0.1:3099
approvalAdapterToken: '' # prefer DSH_ESCROW_APPROVAL_TOKEN
approvalAdapterTimeoutSec: 300
learnWhitelist: true
learnThreshold: 2
autoBlacklist: true
cooldownHours: 24
approvalChoices:
immediateAllow: true
manualWhitelist: true
selfModification:
red: true
trustedToolEffects:
- tool: email.send
effects: [external-write]
- tool: browser.publish
effects: [external-write, shared-resource-write]
User rules are deterministic and first-match-wins. A user green rule cannot suppress an internal red rule. Non-shell tools must receive trusted effects from the host or administrator; tool arguments and MCP annotations cannot self-declare that an action is safe.
Decisions are written to $DSH_HOME/.dsh-escrow/ledger.jsonl after secret redaction. The ledger records observations, queued actions, decisions, waiting time, tool identity, and session identity. Size limits rotate the active file to ledger.jsonl.bak.
Each current-format row carries a SHA-256 chain value and HMAC. /escrow doctor reports integrity, key mismatch, legacy rows, schema problems, and classifier performance. Legacy rows must be migrated before the ledger can provide the full current integrity guarantee.
The integrity design protects against accidental or unnoticed tampering and against an attacker who can rewrite the chain but does not possess the HMAC key. It does not protect against an attacker who can modify both the ledger and its key, nor does it establish that the surrounding runtime is trustworthy.
Run from the repository root:
npm test
npm run test:taste
npm run test:integration
npm run test:host
npm run test:side-effects
npm run test:all
The current full suite covers 107 smoke assertions, 43 taste-state assertions, 76 plugin integration assertions, the visible host seam, external-side-effect classification, adapter integration, and adapter server behavior. The test suite is executable evidence for these cases, not a universal security proof.
The paper artifact is in paper/:
paper/manuscript.md — system/artifact paper draft;paper/experiment-card.json — claim boundary and falsifiers;paper/reproduce.ps1 — reproducibility entry point.allowed-once and rejected; richer learning choices remain command-based.MIT. See LICENSE.