v0.2.0

亮点

• 出站守卫（egress）:可选的目的地址级 CONNECT 守卫,填 DSH 的 HTTPS_PROXY 缝,不做 TLS 中间人
• 包名拆分: npmjs 与 Release tarball 用 @r0cky20/dsh-sensitive-guard,GitHub Packages 镜像用 @gythialy/dsh-sensitive-guard

安装

dsh plugin --profile web add @r0cky20/dsh-sensitive-guard

或使用下方 Release 资产 dsh-sensitive-guard.tgz(+ SHA256SUMS)。

升级提示

插件 id 已从 @gythialy/dsh-sensitive-guard 改为 @r0cky20/dsh-sensitive-guard。已有 profile 请先
dsh plugin --profile web remove @gythialy/dsh-sensitive-guard 再安装新名字,否则 dsh 会视为两个插件。

变更

Added

• Opt-in destination-level egress guard (ADR D4b, design §6.6.1/§19.5): a
  zero-dependency loopback CONNECT + plain-HTTP forward proxy on
  127.0.0.1:<egress.port> that fills DSH's launch-time HTTPS_PROXY seam.
  host/host:port allow-deny with globs, unknown destinations default to
  allow-with-audit, cloud metadata endpoints are denied by default, enforce
  refuses to mount when the port cannot bind (failClosed), optional upstream
  chaining, and no certificate authority.
• egress audit phase (mount/connect/close/deny/canary/error)
  recording host, port, decision, rule id, bytes, and duration — never a path,
  header, or body.
• /guard egress [status|canary]: listener, live https_proxy wiring check,
  counters, recent destinations, and a loopback canary that proves the tunnel
  instead of claiming coverage.
• /guard egress report [--since 7d] [--yaml]: aggregates phase: "egress"
  connect records (active log plus rotations) into destination counts so an
  allowlist can be built from real traffic; --yaml prints a suggested
  egress.allow block without writing anything.
• Tests: policy, real-listener CONNECT and plain-HTTP forwarding, canary
  outcomes, upstream chaining, apply() mount/audit/dispose, a spawned
  curl -x allow/deny pair, and the audit report (windowing, rotations,
  malformed lines, YAML suggestion).
• Research notes in the design document: §19.6 records why per-child
  attribution is not reachable from a plugin (host support required), and §19.7
  records the gate and platform costs for any future TLS interception.
• Profile e2e for the guard (test/e2e/egress.mjs): a headless run with
  http(s)_proxy pointing at the guard lets the model call bash, proving the
  host-spawned child's request is proxied and audited; the deny variant proves
  the refusal and that the origin receives nothing. The listener no longer keeps
  a one-shot headless process alive.

Changed

• Split package identity across the two registries: the canonical name is now
  @r0cky20/dsh-sensitive-guard for the GitHub Release tarball and npmjs, while
  the GitHub Packages mirror is republished as
  @gythialy/dsh-sensitive-guard because that registry requires the package
  scope to match the repository owner. A profile installed under the old
  @gythialy name must remove that plugin id before adding the new one.

v0.1.1

v0.1.1

This patch makes guard prompts follow the DSH language setting and shows what a pending tool call will do.

Highlights

• Guard messages follow the DSH language preference (English / Chinese), falling back to the process locale and then English.
• Approval prompts show Tool, Type, and a redacted Action summary.
• Action summaries cover shell commands, URLs, file paths, and generic arguments; secrets are replaced with placeholders and URL credentials/query values are masked.
• Denial reasons, /guard status, /guard usage, restore errors, redaction notices, and startup logs are bilingual.
• Fixed the CodeQL comparison alert in the action-summary helper.

Upgrade

dsh plugin --profile web add https://github.com/gythialy/dsh-sensitive-guard/releases/download/v0.1.1/dsh-sensitive-guard.tgz

Then restart dsh web or the TUI outside the current session. The stable latest tarball remains available at releases/latest/download/dsh-sensitive-guard.tgz.

Notes

• No policy, redaction, or audit behavior changed.
• The DSH language setting is read from the locale.preference field; browser-only language detection is not visible to host plugins.
• Release assets include dsh-sensitive-guard.tgz and SHA256SUMS once the publish workflow finishes.

v0.1.0

dsh-sensitive-guard v0.1.0

First public release of the host-only sensitive-data guard for DeepSeek Harness.

Highlights

• Policy gate on tools/pre-execute: credential-path denial, argument/network checks, monitor/enforce modes, fail-closed evaluation.
• Redaction on agent/pre-step, tools/post-execute, spill files, PTC logs, and system prompts: secrets, tokens, private keys, and keyed PII pseudonyms.
• /guard commands: status, on, off, and opt-in restore <placeholder> <file> (memory-only map, new 0600 file, never echoes).
• redact.notify: one count-only notice per redacted step.
• bin/scan.mjs: standalone scanner for repositories and CI, with --json, --staged, --max-bytes, and masked output.
• Hash-only audit with rotation; no plaintext secrets, PII, or full paths.
• End-to-end coverage of a disposable headless profile with a mock provider.

Install

GitHub Release tarball (anonymous):

dsh plugin --profile web add \
  https://github.com/gythialy/dsh-sensitive-guard/releases/download/v0.1.0/dsh-sensitive-guard.tgz

GitHub Packages (GitHub token required; package visibility must be set to Public after this release):

# ~/.dsh/profiles/web/.npmrc
@gythialy:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}

dsh plugin --profile web add @gythialy/dsh-sensitive-guard

Verification

• 176 unit/integration tests plus pnpm test:e2e.
• CI on Node 22/24 and CodeQL pass on the release commit.
• pnpm verify and pnpm publint pass.
• The downloaded SHA256SUMS verifies the attached tarball.

Notes

• npmjs publication is deferred until an npm account is available; tracked in #6.
• Secrets remain irreversible; PII restore is opt-in and process-local.
• The GitHub Packages package defaults to private after the first publish; set it to Public in package settings.