dsh-process-guardian
阻止模型编写的终止 DeepSeek Harness 主机进程的常见尝试
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:emeryxu1-blip/dsh-process-guardian#a90998b254f555f637dfde4ce274d210c1a22ab4Process Guardian 以 dsh-process-guardian 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →A Cordis plugin for DeepSeek Harness (DSH) that guards against accidental, model-authored termination of the DSH host process running the task.
The incident that motivated this plugin was not an automatic DSH “stale state restore.” Two independent root tasks were editing the same workspace toward opposing goals. One model saw the other task's writes, misdiagnosed DSH itself as the writer, found the dsh web PID, and issued the equivalent of:
kill <dsh-host-pid>
Because the Bash tool is a child of that DSH process, the signal stopped the host, interrupted every hosted task, and prevented the tool result from being recorded normally.
The command and its UI description were model-authored Bash arguments. DSH's Bash source explicitly places deployment policy at tools/pre-execute, while DSH's current tool runtime provides a monotonic tools.guard() stage whose denials cannot be force-allowed by a later listener. This plugin installs that guard and adds a matching system-prompt invariant.
Relevant upstream contracts:
ToolGuard is monotonicToolRuntime.guard() registrationThe plugin captures the host PID, parent PID, process group, command line, executable names, and dsh web --port value at startup. Before a bash, pwsh, or submitted terminal_send command runs, it denies recognizable attempts such as:
kill <dsh-host-pid>
kill $PPID
kill -- -<dsh-process-group>
pkill -f 'dsh web'
killall node
pgrep -f dsh | xargs kill
lsof -ti :<dsh-web-port> | xargs kill
node -e 'process.kill(<dsh-host-pid>)'
Signal-zero probes such as kill -0 <dsh-host-pid> remain allowed, as do signals to unrelated application-server PIDs. For example, kill <next-dev-pid> and pkill -P <dsh-host-pid> next can still stop a DSH-owned development child without killing DSH itself.
Denied calls return an actionable model-visible error: inspect concurrent root tasks in the workspace or ask the user, and do not retry with another termination primitive.
Install the tagged release into the web profile with DSH's plugin manager:
dsh plugin --profile web add -w github:emeryxu1-blip/dsh-process-guardian#v0.1.1
The explicit -w acknowledges that a DSH profile is the root of its one-package pnpm workspace. This installs the package and appends its declared dsh.bundle to the profile. Confirm the composed layer without starting another server:
dsh --profile web --dump-config
Restart DSH once after installation so the guard is active before starting new tasks.
To remove it later:
dsh plugin --profile web remove dsh-process-guardian
| Option | Default | Purpose |
|---|---|---|
protectProcessGroup | true | Protect the discovered DSH process group from negative-PGID signals. |
protectTerminalSend | true | Inspect commands submitted through a persistent terminal. |
additionalProtectedPids | [] | Extra fixed PIDs to protect for the lifetime of this DSH process. |
additionalProtectedPorts | [] | Extra ports to protect in dynamic lsof/xargs kill selectors. |
additionalProcessNames | [] | Extra executable or selector names treated as protected. |
The DSH host PID and --port are discovered automatically. Do not hard-code them in normal configuration.
This plugin fixes the direct self-termination path. It does not serialize unrelated root tasks or decide which task owns a shared workspace. Avoid running opposing goals against the same checkout; use separate worktrees or stop one task first.
Static command inspection is not syscall isolation. Opaque scripts, package scripts, encoded commands, native binaries, or commands assembled across multiple terminal writes can hide a signal from the classifier. See SECURITY.md and use an OS/container boundary for hostile code.
pnpm install
pnpm test
The test suite includes the original direct-PID failure shape, process-group variants, name selectors, dynamic pipelines, embedded language APIs, signal-zero probes, unrelated development-server kills, terminal submissions, configuration validation, and Cordis registration behavior.
MIT