dsh-risk-gate
DSH 插件 dsh-risk-gate
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:leetom314/dsh-risk-gate#c8e4866cd50406982fe6580812d5cbf9be2a277cDSH 插件 dsh-risk-gate
Risk Gate 以 dsh-risk-gate 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Semantic risk grading + progressive authorization for DeepSeek Harness. 按操作语义自动分级,不要求用户写规则——把 Hermes Agent 的可逆性决策链移植成 dsh 插件。
Hooks tools/pre-execute and classifies every tool call by operation semantics:
| Level | Meaning | Action |
|---|---|---|
safe | reversible / read-only (read, search, web, benign bash) | pass through (next()) |
risky | irreversible but low-risk (write, edit, install, git commit) | ask via approval seam |
redline | one of four red lines: remote-state change / outbound message / delete / paid quota | ask with explicit redline type; fail-closed deny when no answerer |
Classification is local and deterministic — no network, no LLM call. Unknown tools default to risky (fail-closed).
Same operation signature approved-and-succeeded N times → auto-allowed afterward; a single failure/rejection zeroes the signature back to ask.
alwaysAskRedline: true)# from GitHub (requires dsh CLI; git-based install)
dsh plugin --profile web add "github:leetom314/dsh-risk-gate#main"
# or clone and verify locally first
git clone https://github.com/leetom314/dsh-risk-gate.git
cd dsh-risk-gate && ./setup.sh && npm test && ./verify.sh
- id: dsh-risk-gate
name: dsh-risk-gate
config:
autoAllowThreshold: 3 # 0 = disable progressive auth, always ask
alwaysAskRedline: true # redline ops never auto-allow
verbose: false
overrides: # optional per-tool override
some_tool: deny # 'safe' | 'deny'
npm test # node --test (classifier + host-level progressive auth)
E2E (real model + headless profile, isolated DSH_HOME):
./setup.sh
DEEPSEEK_API_KEY=... ./verify.sh
# expect: read-only pass / rm single-file blocked / rm -rf redline blocked /
# quoted echo string not blocked / git push + scp + ssh remote blocked
verify.sh 动态生成临时 overlay($HERE/index.js 路径),不需要仓库内 overlay 文件——overlay*.yml 已 gitignore(含本机绝对路径,不随版本库分发)。
Shell-command inspection (bash/pwsh only, conservative regex):
rm -rf, shred, mkfs, dd ... of=/dev/...git push (incl. git -C dir push variants), git reset --hard, rsync user@host:, ssh user@host, curl/wget -X POST/PUT/DELETE, data uploadsaws ec2 run-instances, gcloud compute, ...)send_message, im_send, ...)Tool-name mapping: read/glob/grep/web_*/skill/job_* safe · write/edit/str_replace_editor/todo_write/create_goal risky.
dsh-permission-rules / sandbox executors for defense in depth.