krimvp/dsh-airlock

README 摘要

dsh-airlock Provenance-gated tool use for DeepSeek Harness (dsh). Status: 0.1.0. The plugin labels context by origin and enforces rules over those labels at five seams. The seam claims are verified against dsh 0.1.0-rc.6 , which warns of compatibility-breaking changes. The behaviour is verified end to end against dsh 0.1.0-rc.6 . See Verified end to end. Expect breaking changes while the harness is a release candidate. Read the shell hole before you rely on secret-no-egress . A secret read through bash is not labelled, so egress stays open. A live run reproduced a one-line shell command that read a credential file and posted it, with the plugin mounted, and the plugin allowed it. Opaque readers close half of that, are off by default, and cost a great deal. The problem Every tool guard in the dsh ecosystem matches patterns on arguments or output. That approach is advisory, and the harness maintainers say so: Argument matching is advisory, not enforcement. When one command gets denied, the agent simply tries alternative approaches to achieve the same outcome. Only restricting the underlying capability provides true enforcement. — deepseek-harness Discussion 174 A model told "no" to c…

分类