dsh-defend
Prompt-injection, jailbreak, and secret-leak detection with allow/ask/block interception for DeepSeek Harness: an Aho-Corasick pattern engine and heuristics ported from the Prompt-Injection-Payloads, Jailbreak-Detector, and Secret-Key-Leaker-Detect assets, gating user messages on agent/pre-step, tool arguments on tools/pre-execute, and tool results on tools/post-execute, with sanitized defend/* session audit events, a defend_report tool, and a /defend command.
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:PerryLink/dsh-defend说明文档
阅读完整 README ↗Configuration
All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. cordis.patch.yml documents each key inline.
| Key | Default | Meaning |
|---|---|---|
enabled | true | Master switch for both layers |
action | deny | Destructive-delete guard action (deny / ask) |
toolNames | ['bash','persistent-bash','terminal-bash'] | Tool names whose command arguments the guard reviews |
detection.enabled | true | Detection-layer switch |
detection.maxScanChars | 10000 | Scan cap per interception (head only) |
detection.normalizeUnicode | true | NFKC-normalize text before scanning (blocks lookalike-Unicode bypass) |
detection.secretMinEntropy | 3.0 | Minimum Shannon entropy (bits/char) to admit a secret regex hit; 0 disables |
detection.injectionAction | ask | Injection family: allow / ask / block |
detection.jailbreakAction | ask | Jailbreak family: allow / ask / block |
detection.secretAction | ask | Secret family: allow / ask / block |
detection.secretBlockCritical | true | Critical secrets always block regardless of secretAction |
detection.audit | true | Write defend/detection session audit events |
detection.allowUnmarkedAudit | false | Keep writing session audit on hosts whose Session.append predates the ignorable marker (every released line so far) or that fail-closed on unknown event types (host 0.1.2-rc.1+), accepting the unresumable-session hazard |
detection.maxReportEntries | 200 | In-memory report ring-buffer cap |
registerCommand | true | Register the /defend command |
registerTool | true | Register the defend_report tool |