dsh-self-preserve

A tiny DeepSeek Harness hook plugin that stops a model session from stopping the harness it is running inside.

The failure it prevents

dsh web runs as a systemd user service. A session used the bash tool to write a runbook on another host:

ssh peer "cat > RUNBOOK.md `. The deny reason tells the model why and gives the out-of-band route:

systemd-run --user --on-active=5 systemctl --user restart deepseek-harness.service

`restart` and `status` stay allowed. Outside a systemd service the plugin registers nothing.

## Install (profile as a local package)

```sh
git clone https://github.com/n8guru/dsh-self-preserve ~/.dsh/local-mods/dsh-self-preserve
cd ~/.dsh/profiles/web      # and profiles/headless if you use it
# package.json: add to "dependencies" and to dsh.profile.bundles
#   "dsh-self-preserve": "file:../../local-mods/dsh-self-preserve"
pnpm install --ignore-workspace
systemctl --user restart deepseek-harness.service

Test

node --test guard.test.mjs

Files

• guard.js pure policy (ownUnit, decide) so it can be tested without a harness
• index.js the Cordis plugin: one ctx.on("tools/pre-execute", …) listener
• cordis.patch.yml empty; a host-only hook needs no bundle rows

MIT.