dsh-safety-net
Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting
91 results
Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting
Make Git Bash the only terminal tool for DeepSeek Harness on Windows: enables the bash executor and tool on win32, disables PowerShell (pwsh) everywhere, ships standard-bash/code-bash/cordis-bash agent presets, and sets the sandbox/approval defaults Git Bash's cygwin runtime needs.
DSH web plugin: play a notification chime when the agent asks the user a question (ask_user_question / plan review) or requests approval (sandbox escalation, tool approval).
Deterministic DeepSeek Harness Web client plugin that explains the Windows-sandbox `spawn EPERM` failure as a distinct Conversation Node.
Native Auto Review for DeepSeek Harness with automatic host compatibility selection
Stent MXC sandbox sidecar for the DeepSeek Harness
DeepSeek Harness bundle that routes real sandbox escalation prompts through a dedicated approval reviewer
Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle
Multi-workspace sandbox for DSH: automatically grant file-write access to ALL registered workspaces — add a workspace in the UI, write to it immediately, no config needed.
DeepSeek Harness (DSH) host-layer plugin: detects and auto-fixes Windows PowerShell command syntax mistakes — bash constructs, broken line continuations, pasted prompts, CRLF pollution — then executes the corrected command through the host shell seam under the normal sandbox/approval policy
LLM pre-review for sandbox-escalation approvals: an independent-context LLM gate answers sandbox escalation requests before they reach the user, falling back to the user on any failure.
Database connector bundle for DeepSeek Harness (dsh): SQLite/PostgreSQL/MySQL connections, schema introspection, read-only safety, write approval gate, and a JSONL SQL audit trail.
Seam-aligned background command execution for DeepSeek Harness — run_command via ctx.shell under the session sandbox policy, auto-promotion into ctx.jobs
Sessionless LLM sandbox approval reviewer for DeepSeek Harness.
DSH sandbox extension: protect declared workspace subpaths (e.g. .git) from writes, and optionally grant extra writable roots under workspace-write, enforced for sandboxed CLI commands and the write/edit tools. 为 DSH 沙箱增加工作区子路径只读保护, 并支持在 workspace-write 下声明额外可写根.
DeepSeek Harness plugin: installs the 'wsl' agent preset — the Windows WSL variant of the standard preset that routes the bash tool through Windows Subsystem for Linux (WSL), with automatic shell discovery and sandbox-aware gating.
DSH plugin: a codex-style apply_patch tool (*** Begin Patch / *** Update File / *** Add File / *** Delete File) injected into the model toolset through DSH's built-in sandbox, with a settings card to choose injection scope (off / GPT models only / all models).
修复 sandbox_permissions 和 justification 字段在 pwsh/bash/fs/dsh-sandbox 中的 no-op 升级报错。当会话已是 danger-full-access 模式时,模型携带空 justification 或重申同一模式被拒的问题。
Press Enter to approve the sandbox permission-escalation prompt in the DeepSeek Harness WebUI instead of clicking the Allow once button.
OS-isolated capability capsules for third-party DeepSeek Harness plugins
Self-healing DeepSeek-Harness plugin: keeps confined pwsh/bash console windows invisible (SW_HIDE) on Windows — no black console flash on every sandboxed command.
DSH Web GUI plugin: session-scoped "Allow for this session" option in the approval dialog (per-mode standing grants, localStorage)
Container-isolated backend for the DeepSeek Harness code-execution seam: Code Mode programs run in a fresh container with no network, a read-only rootfs, and kernel-enforced memory, CPU, and pid ceilings
A fourth permission option for DeepSeek Harness sessions: selected-workspace-write, where the user opens the workspace directory tree and toggles which directories the agent may write to.