Skip to content

dsh-claim-guard v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@xuxucodepractice-code xuxucodepractice-code released this 03 Sep 17:11
Immutable release. Only release title and notes can be modified.
v0.1.0
e07d918
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unofficial community project. dsh-claim-guard is independently developed and maintained by xuxucodepractice-code; it is not published, certified, maintained, or endorsed by DeepSeek.

What this release does

dsh-claim-guard is a deterministic pre-write claim guard for verified DeepSeek Harness file tools. Before a supported write executes, it reads strict UTF-8 JSON rules and returns DSH's native ask decision when it finds a blocked phrase or an unqualified bounded claim.

This first release includes:

  • tools/pre-execute coverage for the verified write, edit, and str_replace_editor argument shapes;
  • blocked and bounded literal-substring rules;
  • fail-closed handling for missing, unreadable, malformed, or schema-invalid rule files;
  • native DSH approval behavior, including allow-once, reject, cancel, and no-responder outcomes;
  • 98 automated tests plus real ToolRuntime/ApprovalService integration tests; and
  • a synthetic example rules file and synthetic demonstration only.

Verified compatibility

Component Verified release baseline
DeepSeek Harness 0.1.1-rc.2, tag dsh-v0.1.1-rc.2, commit b150a551b8d465e31e418e1b2eaf5e79bbb7d28e
Node.js 22.19.0 and 24.15.0
pnpm 11.7.0
npm pack 11.12.1
CI platforms macOS local validation and Linux GitHub Actions

The exact release commit passed both required Node jobs and the single release-artifact job in GitHub Actions run 33779418493.

Verify and install

Download both attached files, keep them in the same directory, and verify the tarball before installing:

shasum -a 256 -c dsh-claim-guard-0.1.0.tgz.sha256
dsh plugin --profile claim-guard-smoke add ./dsh-claim-guard-0.1.0.tgz

Prepare a valid claims.json first, use a dedicated profile, and run synthetic clean and blocked writes before enabling the plugin in an important workflow. See the README for the complete sequence and configuration schema.

Integrity

  • Release source commit: e07d9182fb309af24d52f53806ba2bb4315cf82a
  • dsh-claim-guard-0.1.0.tgz: fee9861477472430e5359605bcf7ed6430792e3fda32c738cb2307ee8c2be21d
  • The attached .sha256 file records the same tarball digest.
  • The repository enforces immutable releases; after publication, the tag and attached assets cannot be moved, replaced, or deleted while this release exists.

Known limitations

  • Incremental edit, replace, and insert operations inspect only the new fragment and do not evaluate bounded rules against a reconstructed file.
  • Shells, scripts, MCP tools, custom or future write tools, host-internal writes, binary content, and paths outside the session workspace are not covered.
  • Matching is literal substring matching, not fact checking or semantic analysis.
  • This plugin runs in the DSH process and is not a sandbox or malicious-host boundary.

Please use private vulnerability reporting for security issues. Remove all private rules, real documents, tokens, session data, and local paths from reports.

Assets 5
Loading