JohnXu22786/auditrail

README 摘要

dsh-audit-trail Security auditing & session forensics for DeepSeek Harness (dsh). A dsh bundle (plugin) that records every tool-invocation across the harness session stream and the tool pipeline, flags high-risk operations, persists a redacted, hash-chained audit trail to SQLite, and gives you query, export, policy, and plain-text replay tools — plus a standalone CLI that works on the same database without starting the harness. Fills a gap: the dsh ecosystem has observability plugins for performance (OTel / Prometheus). Nobody was doing a security audit trail — complete tool-invocation-chain recording with sensitive-operation marking, privacy masking, query/export, and text-terminal replay. That is what this bundle is. Table of contents - What it does - How it works - Install & integrate with dsh - Configuration - Model-facing tools - CLI - Replay - Compliance export format - Sensitive-operation rules - Privacy & redaction - SQLite schema - Project layout - Development - License What it does 1. Complete audit chain recording — subscribes to the append-only session/event stream and the live tool pipeline ( tools/result , tools/change ) and records, for every event: who (session/acto…

分类