🧹 dsh-housekeeper — Environment Housekeeper

中文说明 · DeepSeek Harness plugin

Keep your agent's hands clean: toolchain inventory, safe one-click cache cleanup, and machine rules (AGENTS.md) editing — all inside the DSH Web GUI settings. Zero runtime dependencies, one command install.

• 📋 Toolchain inventory — auto-detects node/pnpm/git/gh/ffmpeg/Edge/Chrome locations and versions
• 🗑️ One-click cache cleanup — scans the .tmp and cache directories agents leave behind (size / file count / mtime), check and delete
• 🛡️ Whitelist protection — only project .tmp dirs and cache-root children are deletable; .. escapes, symlink escapes, and system paths are rejected, with a realpath re-check before every delete
• 📝 Machine rules editor — read/write ~/.dsh/AGENTS.md (the global rules every agent session loads), live on save

Install

dsh plugin --profile web add dsh-housekeeper

Restart dsh web, then Settings → Plugins → 环境管家.

Requirements: DSH web profile, Node ≥ 22.

Security model

• All routes accept loopback clients only (403 otherwise)
• Cleanup whitelist — a path is deletable only when ALL hold:
  • under \\ .tmp\, or a direct child of \
  • normalized path stays inside the whitelist root (no ..)
  • realpath still lands inside the whitelist root (no symlink escapes)
  • the whitelist roots and repo dirs themselves are never deletable
• The rules endpoint reads/writes $DSH_HOME/AGENTS.md only; the path is fixed
• No telemetry, no external network calls

How it works

GUI settings ──fetch──▶ /housekeeper/state|clean|rules (loopback) ──▶ host plugin
                          ├─ probe: candidate paths + PATH lookup + versions
                          ├─ scan: rule-driven walk with sizes (4000-file cap)
                          ├─ clean: whitelist + realpath check, then rm
                          └─ rules: read/write $DSH_HOME/AGENTS.md (64KB cap)

Develop

pnpm install
node build.mjs         # esbuild → lib/index.js (host ESM) + lib/client.js (ModuleLoader bundle)
node tests/core.mjs    # 21 whitelist/scan/clean sandbox tests, no real environment needed

MIT licensed. Issues and ideas welcome.