dsh-zcode-scribe
DeepSeek Harness 的长期记忆，其写入器是一个受限的子代理：负责决定记住哪些内容的组件被移除了网络、shell、MCP 和子代理工具，其剩余写入操作通过参数级防护限制在一个目录内。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:BOWLUNA/dsh-zcode-scribe#9382b12ece1fa15f2cd527d13ef3adac4ba8aec1Zcode Scribe 以 dsh-zcode-scribe 发布，当前版本为 1.0.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
v1.0.0 · developed and verified against dsh >=0.1.5-rc.2 <0.2.0 || >=0.1.6-alpha.1 <0.2.0.
Long-term memory for DeepSeek Harness whose writer is a narrowed subagent.
Status: early, and read-only. The
scribe_recalltool is registered, executes for real inside a live host, and a real model session on dsh0.1.6-alpha.2used it to answer from a memory room —docs/MEASUREMENTS.mdcarries the raw output behind every claim below. 101 tests pass. What does not exist yet: writes, extraction, and the narrowed writer, which is gated on milestone M0 — proving a subagent's capability set can actually be narrowed through a public seam. Nothing is injected into the prompt yet, so installing this changes what the model can ask for, not what it knows.
The DSH plugin market lists 190 plugins under memory. Long-term memory is not an
empty niche, and this project is not justified by a missing feature. It is justified by
three missing safety properties, and it only takes the second slot in the table below
because the first is already served by other people's work.
| Property | Existing coverage |
|---|---|
| A local, bounded, inspectable store | Covered. engramory, dsh-memento, dsh-memoir and dozens more do this well. Install one of those. |
| Hard permission narrowing for the component that decides what to remember | None. No plugin removes capabilities from its writer; the closest analog, dsh-memento, gates writes behind human approval — a different and complementary mechanism. |
| Path safety on the write path (root-relative denylist, Unicode bidi/control stripping, NTFS alternate-data-stream truncation, containment) | None. Schemes that store in a database avoid it; every markdown-based option leaves it open. |
This matters more every month. OWASP ASI06 — Memory & Context Poisoning joined the Agentic Top 10 for 2026, and the published numbers are not close:
Anthropic's own memory-tool documentation says restricting operations to the memory directory "is not optional for any agent with write access to persistent storage", and advises scoping write permission to the sessions that actually add memories.
What makes the problem unavoidable is this: legitimate memory writing and malicious memory injection are the same operation. Same file, same write call — only intent differs, and intent is not observable.
So dsh-zcode-scribe does not try to detect intent. It removes capability, and constrains what
remains:
the writer → cannot see: shell · run_code · every MCP tool · network fetch/search
subagents · present · upload/attachment tools
→ can do: Read/Grep/Glob · Write/Edit only inside the memory room
rm only for a contained, absolute, non-glob, non-recursive .md
Two enforcement layers, because they fail differently:
| Layer | Seam | Effect |
|---|---|---|
| Remove | ctx.tools.restrict({ deny }) on the writer's agent.ctx | the tool is absent from the writer's tool list — it cannot be talked into reaching for it |
| Constrain | ctx.tools.guard(exec => reason | undefined) on the writer's agent.ctx | argument-level policy for the tools that must remain, e.g. "read a file, but write only *.md under the memory root" |
Both require a scoped context and both throw rather than silently degrade to global — which is what makes them usable as a security boundary instead of a convention.
Almost everything. This project's contribution is the combination, not the parts:
MEMORY.md capped at the first
200 lines or 25 KB; topic files loaded on demand, never at session start; an
over-cap write succeeds and returns an error telling the model to rewrite the index
rather than truncating silently; subagent memory in a separate directory./memories as a mapped
prefix, mandatory path-traversal rejection.engramory for the ctx.tools.guard() primitive, dsh-memento
for loud-not-truncating budgets and session-frozen snapshots, dsh-memoir for
prefix-cache-aware injection.Full tables, sources and line-referenced seam evidence: docs/ARCHITECTURE.md.
user turn ──▶ agent/post-step
│ skip if the main agent already wrote memory this turn
│ skip if the user turn carried no substantial prose
│ skip if the cursor did not advance
▼ (coalescing: only the newest snapshot survives)
mint the writer ──▶ restrict({deny}) + guard(...) ← the whole point
▼
writer reads the manifest, writes candidates inside the room
▼
admission: path safety · cap (loud) · conflict hold · secret screen
▼
accept → versioned write → index rebuild → audit row
hold → needs a human decision
The main agent sees the index and a manifest of filenames plus descriptions. Topic bodies are never injected automatically — the model reads them on demand.
dsh plugin --profile web add dsh-zcode-scribe
dsh --profile web --dump-config | grep -A3 'id: scribe' # rows collide ⇒ hard boot failure
node test/run.mjs # all suites
Requires Node >= 20. No runtime dependencies — the plugin imports node: builtins and the
host's peer packages only.
MIT.