dsh-veil
DeepSeek Harness 插件：模型看到一致的化名，你的机器保留真实值（veil 隐私代理）
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-veil@0.1.0Veil 以 dsh-veil 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A DeepSeek Harness (dsh) plugin that sends
every DeepSeek model request through veil, a local
privacy proxy. The model sees consistent pseudonyms for your customers' names, emails, phones and
other seeded values. Your machine keeps the real values: dsh's tools run with them, and you read
them in dsh's answers.
dsh ──► veil (127.0.0.1, started by this plugin) ──► DeepSeek API
real values → pseudonyms on the way out
pseudonyms → real values on the way back (answers, tool calls)
Install veil 0.3.1 or later, then seed it with the data the model must not see:
pip install veil-proxy # or: brew install lemonadesaltbagel/veil/veil
veil seed postgresql://localhost/app ./customers.db # any sources veil supports
Add the plugin to a dsh profile (dsh 0.2.1-rc.2 or later; dsh plugin needs pnpm):
dsh plugin --profile headless add dsh-veil
dsh plugin --profile web add dsh-veil
Before the npm package is published, install a release tarball or a checkout:
dsh plugin --profile headless add https://github.com/lemonadesaltbagel/dsh-veil/releases/download/v0.1.0/dsh-veil-0.1.0.tgz
Use dsh as usual. dsh --profile headless "…" and the web app start veil with the session and
stop it on exit. /veil shows the proxy, the upstream and the counts of seeded values and
pseudonyms.
The bundle's patch (cordis.patch.yml) does four things:
veil row runs veil proxy on a free loopback port. It provides the veil
service only after the proxy answers its health check.llm-deepseek and llm-deepseek-account rows inject that
service and take baseURL from it.NO_ADAPTER and sends nothing, instead of calling DeepSeek directly.llm-pi-ai. That route sends other providers (OpenAI, Gemini, …) straight to
their APIs, past veil.A fetch guard backs this up. It refuses any model request (/messages, /chat/completions,
/responses, :generateContent) that isn't addressed to veil. It catches a later layer that points
an adapter elsewhere, such as a profile cordis.patch.yml, a --patch overlay or a Models setting,
and prints dsh-veil: refused a model request to ….
veil restores real values into a tool call only for tools it knows by name. dsh's tools take Claude
Code's argument names, so the plugin maps them onto veil's roles (veil proxy --tool-alias):
| dsh tool | veil role | what the tool receives |
|---|---|---|
bash | Bash | real values, shell-escaped; commands that send data off the machine keep pseudonyms |
read, grep, glob, working_directory | Read / Grep / Glob | real values |
edit, write | Edit / Write | real values only where the file already had them, escaped for the file's language |
str_replace_editor | (built in) | as Write / Edit |
every other tool (run_code, workflow, pwsh, subagent, web_*, terminals) | none | pseudonyms only |
Override the veil row in your profile's cordis.patch.yml:
- id: veil
config:
command: /opt/homebrew/bin/veil # default: veil on PATH
upstream: https://api.deepseek.com/anthropic # default: $DEEPSEEK_BASE_URL, then this
args: [--ner] # extra `veil proxy` arguments
# url: http://127.0.0.1:8787 # use a running `veil proxy` instead of starting one
# toolAliases: {bash: Bash} # replaces the table above
# logFile: /tmp/veil.log # default: <tmp>/dsh-veil/veil-<pid>.log
# startTimeoutMs: 60000
# guardFetch: true
veil's own settings (vault, seeded sources, display mode) live in VEIL_HOME, shared with the
veil CLI. See the veil README.
/v1/files uploads through unchanged.dsh --profile headless. The web app uses the
same rows, but /veil hasn't been exercised in its UI yet.npm install && npm run build
npm test # unit tests
npm run e2e # real dsh + real veil + a scripted model: 0 leaks, tools get real values,
# fails closed without veil, refuses a baseURL past veil
The e2e test needs dsh, pnpm and veil on PATH, or DSH_BIN and VEIL_BIN. CI runs it on
every push against the npm dsh and the PyPI veil-proxy.
Apache License 2.0, like veil.