dsh-egress-guard

Local, zero-network, deterministic secret preflight for DeepSeek Harness model requests.

dsh-egress-guard inspects the fully assembled request at the official llm/stream boundary. It first validates and freezes the exact plain-data request graph that downstream code will consume. If it finds a likely credential, it stops before calling the downstream model adapter. Matches never appear in the error, finding report, or plugin log.

The default policy is fail-closed:

• known secret patterns block the request;
• images and unknown content blocks block because this version cannot inspect their bytes safely;
• requests larger than the configured scan limit block;
• cyclic, proxy/accessor-backed, non-plain, sparse, oversized, non-enumerable, unknown-field, or otherwise unfreezable request graphs block even in audit mode;
• invalid configuration prevents the plugin from loading.

It does not rewrite request values and never sends request content to another service.

Install

From npm after the package is published:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add dsh-egress-guard
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

From the public GitHub repository now:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add git+https://github.com/LKRCharon/dsh-egress-guard.git
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

From a local checkout, use a file: specifier so pnpm installs a package copy instead of a symlink:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add file:/absolute/path/to/dsh-egress-guard
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

For a release-equivalent local smoke test, run npm pack in the checkout and add the resulting .tgz by absolute path. Do not add a bare checkout path: rc.6 treats it as a symlink, which can bypass the profile's host-module fallback at real startup.

The preview CLI delegates plugin installation to pnpm, so ensure it is on PATH first. With Corepack, run corepack enable pnpm; alternatively install pnpm 11 directly. A global dsh install may replace the pinned npx prefix above. The dump should contain an egress-guard row before you start the profile.

DSH rc.6 profiles disable automatic peer installation. The add command can therefore warn about the @deepseek-ai/cordis and peers even though the host supplies them at runtime. They intentionally remain peer dependencies so the plugin shares the host runtime and identity.