dsh-agentfuse

AgentFuse is a fail-closed pre-dispatch policy boundary for AI agent tools, ported from the DHMS AgentFuse Python project to a DeepSeek Harness (DSH) guard plugin.

Every model-directed tool call flows through the DSH tools/pre-execute waterfall. AgentFuse evaluates it against a deterministic denylist → asklist → allowlist → default policy, fails closed on block, defers asklisted tools to the DSH human-approval chain, and appends a durable agentfuse/decision session event for blocked calls carrying the canonical evidence — reason code, policy id, and a canonical arguments hash, never raw arguments.

AGENTFUSE_IS_A_DANGER_CLASSIFIER=false
AGENTFUSE_IS_A_POLICY_AND_AUTHORIZATION_BOUNDARY=true
AGENTFUSE_DECISIONS=allow|block
AGENTFUSE_DEFERRALS=ask
AGENTFUSE_FAILS_CLOSED=true

What it is / is not

AgentFuse owns only the deterministic allow | block decision and its evidence. It is not a process sandbox, malware detector, intrinsic danger classifier, or universal interceptor. Risk classification, approval, dispatch, and physical execution remain the integrating runtime's responsibility — the same boundary the Python dhms_agentfuse documents.

Config

# cordis.yml (or a cordis.patch.yml insert)
- id: agentfuse
  name: '@deepseek-ai/dsh-agentfuse'
  config:
    defaultAction: block      # 'allow' | 'block' — fall-through for unlisted names
    denyTools: []             # always wins
    askTools: []              # defer to the DSH human-approval chain
    allowTools: []            # non-empty = only these names may run
    logDecisions: false       # durable evidence; needs in-repo catalog (see note below)

Policy resolution order (fixed, deterministic):

1. denyTools match → block (explicit_denylist)
2. askTools match → ask (requires_approval)
3. configured allowTools without the name → block (not_allowlisted)
4. configured allowTools containing the name → allow (allowed)
5. defaultAction → allow/block (allowed / policy_denied)

Approval integration

An askTools match returns { kind: 'ask' } from the tools/pre-execute waterfall. The DSH tool registry routes it through the approval service (), which prompts the composed answerers (the Web GUI approval card, CLI answerers, …) and records the + audit pair on the session log.