dsh-sast-security
SQL 优化模式:EXPLAIN 分析、索引策略、N+1 解决、查询改写。受 wshobson/agents(38k★ MIT)启发。
409 results
SQL 优化模式:EXPLAIN 分析、索引策略、N+1 解决、查询改写。受 wshobson/agents(38k★ MIT)启发。
Intercepts `rm` commands issued by any DSH agent session (GUI, automation runs, headless bridges) at the tools guard layer and moves the targets to the macOS Trash instead of deleting them. Switchable from the web GUI under Settings → General.
Runtime data-flow audit log for DeepSeek Harness: who mutated what, in what order — per-plugin, per-fiber attribution.
Guard DeepSeek Harness npm installs with vulnerability, license, bundle-size, and package-health audits.
Installation safety gate & data-protection guard for DeepSeek Harness: 60 static signature rules scan plugin sources for malicious install scripts, credential theft, obfuscation and network callbacks before 'dsh plugin add', with scan baselines (gate_diff), structured reports (gate_report), 12 destructive-command patterns and workspace-boundary checks.
Password gate for dsh-web: opening the web port requires a username/password login; account credentials are stored salted+scrypt-hashed and AES-256-GCM encrypted in a local config file under $DSH_HOME. Host-only cordis plugin, no dsh source changes.
Evidence-backed runtime nutrition labels for DeepSeek Harness plugins and tool namespaces
Read-only, offline-first security scanner plugin for DeepSeek Harness plugins.
DSH skill authoring toolkit: scaffold + 9-gate quality audit for skills
Access lock for DeepSeek Harness web profile (password, passkey, IP lists, Nginx)
Auto-reject unanswered permission requests with a model-visible timeout notice
A fourth permission option for DeepSeek Harness sessions: selected-workspace-write, where the user opens the workspace directory tree and toggles which directories the agent may write to.
Host-authenticated password gate for the DSH Web GUI, API, SSE, and WebSockets
DeepSeek Harness 插件安全体检官 —— 静态扫描 + 运行时副作用追踪,为 4300+ 插件建立安装前必看体检报告
Remote access login gate for the DeepSeek Harness Web UI: a password wall in front of non-loopback access, session cookies, an injected browser-side gate, and a Remote Access settings section. The /api RPC surface is authenticated by dsh itself.
DSH plugin health scorecard: quality & security audit, rankings, search, score history and open-data export across the dsh-plugin ecosystem, with a workspace-persisted incrementally-synced catalog. 插件体检评分卡:质量/安全审计、榜单、搜索、历史评分曲线与开放数据导出(目录增量同步)。
Normalize invalid non-widening sandbox escalation arguments before DSH tool dispatch.
Zero-interruption audit + fuse blocking for DeepSeek Harness. / 零打扰 Agent 审计与保险丝拦截插件。
A DSH profile bundle that ships the Telegram ↔ DeepSeek Harness bridge as a model-callable install tool. Requires the session sandbox policy to allow subprocess TLS to api.telegram.org (danger-full-access in the default sandbox policy).
Codex-style auto reviewer (approve for me) permission mode for DSH
End-to-end encrypted remote access to DeepSeek Harness and experimental Codex workspaces from desktop, web, and Android, with dsh-TUI Host support.
Bounded, layered, approval-gated, auditable cross-session memory for DeepSeek Harness — a capability seam (ctx.memory service + local SQLite provider + memory tool + frozen snapshot injection), not another memory warehouse
dsh-risk-gate
Approval timeout for DeepSeek Harness: when a sandbox/escalation approval is not answered within a configurable period, the request is automatically rejected instead of waiting forever.