dsh-hidden-paths
Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.
109 results
Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.
Bitwarden/Vaultwarden credentials in every DSH session: vault tools + proactive prompt guidance + a settings card for the master password.
Allowlisted git execution for DeepSeek Harness: a model-facing git tool that runs outside the file sandbox, with a settings page where the user ticks which git subcommands are permitted and, per path, which reads and writes are allowed, prompted or refused
Tolerate redundant sandbox_permissions requests: a tool call asking to escalate to a mode that is not strictly wider than the session's standing mode runs as-is at the standing mode instead of failing with "not strictly wider". Genuine escalations still route through the approval flow.
End-to-end encrypted remote access to DeepSeek Harness and experimental Codex workspaces from desktop, web, and Android, with dsh-TUI Host support.
DSH (DeepSeek Harness) plugin that bundles the battle-tested 'safe plugin installation' skill: audit candidates, install one at a time, verify through five levels, and uninstall cleanly. Built from a real beginner's painful install journey.
Verification toolkit for DeepSeek Harness agents: evidence-based claim checking against workspace files with line citations, config validation (JSON/YAML), HTTP URL status checks, npm package checks, GitHub repo submission-readiness checks, and batch verification with bounded concurrency and per-result confidence grading
Offline DSSE/in-toto attestation evidence for DeepSeek Harness releases
Offline content-addressed proof for supplied DSH workflow duty separation
Offline content-addressed proof that a temporary policy waiver stayed within approved bounds
Offline content-addressed evidence that an approved Windows control-plane change settled across required surfaces
Blocks high-confidence secrets before dsh-TUI sends them to a model.
Offline content-addressed proof for supplied credential-retirement closure