okaditya84/dsh-agent-sentinel ↗★ 0
dsh-agent-sentinel
Security guard plugin for DeepSeek Harness: secret redaction, a shell command denylist, indirect prompt-injection scanning, and syntax verification on file writes.
安装
此插件尚未提供可验证的 bundle，或兼容性检查未通过。请先阅读仓库说明。 阅读完整 README ↗
说明文档
阅读完整 README ↗Configuration reference
| Option | Type | Default | Description |
|---|---|---|---|
redactSecrets | boolean | true | Redact secrets/credentials found in tool output content blocks. |
customSecretPatterns | { name, pattern }[] | [] | Additional secret regex patterns. |
blockDangerousCommands | boolean | true | Veto shell calls matching the built-in destructive-command denylist. |
customCommandRules | { id, pattern, reason, severity? }[] | [] | Additional shell command denylist rules. |
detectPromptInjections | boolean | true | Scan file-read/fetch output for prompt-injection patterns. |
verifyCodeSyntax | boolean | true | Verify syntax of file writes/edits (JS, TS, JSON, Python). |
auditLogPath | string | .sentinel-audit.jsonl | Path for the append-only JSONL audit log. |
strictMode | boolean | false | Block (rather than just log) a write that introduces a syntax error. |
maxAuditHistory | number | 500 | In-memory audit ring-buffer size (independent of the on-disk log, which is never truncated by this plugin). |