dsh-second-agent-kit
适用于 macOS 的 DeepSeek Harness 可审计第二代理防护措施和兼容性补丁
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:f0909172434/dsh-second-agent-kit#31e567137a86167b7751695e02aa0f8145438713Second Agent Kit 以 dsh-second-agent-kit 发布，当前版本为 0.1.4。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Engram PR #4 was merged on
2026-09-21 and shipped in v0.7.7.
It adds opt-in legacyMigration: conservative and JSON migration-claim sidecars.
The default remains eager; this does not reconstruct ownership or make migration
crash-atomic. This kit still pins 0.7.6 as its reproducible verification baseline;
its red safety tests and observations describe that version, not a failed review
of 0.7.7. Revalidating and upgrading the runtime is separate work.
English · 繁體中文
Small, inspectable extensions for DeepSeek Harness 0.1.5-rc.2 on macOS. MIT licensed; independent of DSH Desktop's own license.
scripts/render-office.py) using an isolated profile and explicit macOS system fonts to avoid silent Chinese glyph loss. Requires an official LibreOffice install; --png requires PyMuPDF.The guard also blocks further Mac input after two consecutive known UI failures or 20 input calls in one agent turn. Observation remains available; a new user turn resets the limit. This limits tool dispatch, not total model spending.
Requirements: macOS 14+, Node 24, DSH 0.1.5-rc.2, existing workspace-write + ask mode. Test in a separate profile first.
npm ci
npm test
npm pack
mkdir -p "$HOME/.dsh/packages/dsh-second-agent-kit-0.1.4"
tar -xzf dsh-second-agent-kit-0.1.4.tgz -C "$HOME/.dsh/packages/dsh-second-agent-kit-0.1.4"
dsh plugin --profile YOUR_TEST_PROFILE add "file:$HOME/.dsh/packages/dsh-second-agent-kit-0.1.4/package"
The bundle disables the upstream sandbox row, inserts second-agent-sandbox with the restricted provider and inserts second-agent-approval. If an earlier local daily-approval hook is present, disable that duplicate after validating this plugin. Do not disable DSH's own user-approval plugin. No credentials are required or bundled.
Unsupported sandbox runners fail closed rather than silently returning an unconfined command. This version is deliberately macOS-only. Do not enable danger-full-access as a standing default: that mode bypasses the host's confinement by design.
Use unmodified Engram 0.7.6 for the verified offline profile, with automatic ingestion and query rewriting disabled. Before upgrading an existing memory directory, run the read-only preflight and stop on any nonzero exit:
npm run check:engram-upgrade -- --db-dir /absolute/memory-directory --workspace /absolute/workspace
npm run verify:engram
npm run verify:engram:host
npm run test:migration
The check never opens memory contents or migrates files. It detects ambiguous legacy filenames for supplied workspaces. Verification runs six real-plugin/SQLite cases through HonestCI with zero skipped tests allowed. The pinned 0.7.6 baseline retains legacy ownership ambiguity; reproducing it is not a safety pass. See upgrade guidance and boundaries.
The original scripts/patch-engram.py and tests/memory-runtime.mjs remain historical 0.7.5 artifacts, not instructions for the new default profile.
See patches/computer-use.patch and patches/computer-use-base.txt. Apply only to the recorded upstream commit, install dependencies, and run the upstream pnpm run build to rebuild JS and native artifacts together. The native helper must be built locally; no unreviewed downloaded executable is supplied here. Tests include a standalone Swift routing-policy check. The upstream package remains MIT (license alongside patch).
Install LibreOffice from https://www.libreoffice.org/ and PyMuPDF in an independent Python environment. Then run:
python scripts/render-office.py input.docx new-preview-directory --png
The helper rejects overwriting a PDF and prints the page count. Inspect every PNG. LibreOffice layout does not prove Microsoft Word layout, and spreadsheet calculation or presentation animation still needs application-specific verification.
npm test verifies hook behavior, fail-closed runner handling, and actual macOS kernel denial of TCP sockets/out-of-workspace writes while permitting a workspace write. Pure Swift policy checks reject inactive, unobserved, untrusted and invalid keyboard targets.
This is not a universal semantic firewall. Regex command recognition is advisory; the kernel rule applies only to processes the host confines. Browser/MCP/GUI/plugin capabilities are separate and must retain their approvals. Public publication, payments and destructive operations still require explicit authorization. Unix-domain sockets remain available for local application IPC (including LibreOffice). Local IPC can reach services or proxies with their own authority; this is not an egress boundary against cooperating local services. An allowed workspace file could affect another process that reads it. This project does not claim to eliminate every IPC or indirect-action channel.
No user credentials, conversation logs, personal documents, or production memory databases belong in this repository. See VALIDATION.md for current observed results and unresolved cases.
Desktop 0.15.6 incorrectly treats local tarballs as missing directories and removes them at boot. Keep the extracted directory at a stable path. The per-turn Mac input guard blocks further dispatch after two consecutive recognized failures or 20 inputs; observations do not reset it. It does not impose a token-spending cap.