v0.1.0

dsh-secure-audit v0.1.0

Read-only security & compliance plugin for DeepSeek Harness (DSH). First release.

Disclaimer. Unofficial third-party tool. Not affiliated with, endorsed by, or sponsored by DeepSeek.

Added

• security_scan_text — prompt-injection detection tool:
  • Rule engine with 24 English + Chinese patterns (instruction override, role switch / jailbreak, system-prompt leak, data exfiltration, tool abuse, harmful content).
  • LRU cache (default 512 entries) keyed by SHA-256(text) + ruleset version.
  • Fail-open cooperative budget: on timeout the scan returns allow with an explicit warning.
  • Pluggable model classifier: invoked only on review verdicts without critical hits; failure degrades to the rule decision with a warning.
  • Per-rule reasons with PII-masked, single-line snippets; optional maskedText copy of the input.
• security_redact_text — PII redaction tool (Chinese-first): CN mobile (+86), CN ID cards (date-validated), CN bank cards (Luhn-validated), emails, IPv4 (octet-validated), API keys/tokens, URL credentials; configurable mask char and type filter.
• security_audit — read-only local audit tool: nine deterministic checks across config / sessions / plugins / paths / network / env; PII-redacted, path-normalized, reproducible evidence; per-check remediation.
• security-review runtime skill (registered via the optional skills service).
• Structured JSONL logger with requestId correlation and automatic PII masking.
• Adversarial sample suite (English + Chinese attack vectors and benign false-positive cases).
• Registration tests against the real @deepseek-ai/dsh-tools contract; CI (Node 20/22/24): lint (syntax + secret scan) + tests.

Fixed

• Order numbers no longer mis-detected as CN ID cards (date structure required) or bank cards (Luhn checksum required).
• Benign phrasing no longer over-triggers: "build a bomb shelter", "jailbreak detection", "运行命令 npm install", "你现在是怎么想的".
• Placeholder secret values (xxx, your-…, <…>, changeme) are correctly skipped.
• Tool output schemas validated against real dsh-tools enforcement (null → empty string).
• Bundle patch uses the loader's insert form (top-level rows fail with "entry not found").
• Shipped files carry no UTF-8 BOM (the bundle loader JSON.parses manifests).
• plugins-inventory scans per-profile node_modules and counts only dsh-manifest packages.
• Audit reports carry a limitations array; tool descriptions state heuristic limits; README gained a limitations & disclaimer section.

Upgrade notes

• Peer dependency: @deepseek-ai/dsh-tools >= 0.1.0-rc.7 (provided by the DSH runtime). No install-time scripts, no build step.
• Tested against @deepseek-ai/dsh-tools 0.1.0-rc.7. DSH is pre-1.0 — pin your DSH version and re-run security_audit after upgrading either side.
• Report compatibility results in the official DSH Discussions to earn the dsh.so Verified tag (otherwise entries are Declared).

Known issues

• File-permission checks are best-effort on Windows (POSIX mode bits only; ACLs not inspected).
• Session-file PII sampling covers the first 10 files.
• The model classifier ships as an interface + Ollama adapter example; no classifier is bundled.
• Redaction covers the listed types only (names/addresses need NER — roadmap).

Install

# tarball attached to this release
dsh plugin add ./dsh-secure-audit-0.1.0.tgz

# git source (no build runs; pin the commit)
dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>

npm: not published yet — dsh plugin add dsh-secure-audit will work once the package lands on the registry; until then use the tarball or git source above.

Tarball attached to this release: dsh-secure-audit-0.1.0.tgz.