English · 简体中文 · Security · Upstream DSH

Make agent side effects explicit, durable, and reviewable · 让 Agent 的副作用显式、持久、可审查

---

DSH Integrity Plugins is a focused, out-of-tree safety layer for DeepSeek Harness. It keeps the upstream agent loop untouched and adds three capabilities at official DSH plugin seams: a crash-safe effect ledger, durable workspace mutation wrapping, and isolated subagent workspaces with explicit parent acceptance.

This repository deliberately does not rebuild DSH's filesystem, sandbox, approval flow, session runtime, or subagent lifecycle. It composes with them.

✨ Three Plugins

Plugin	What it adds	What remains upstream-owned
dsh-integrity-effect-ledger	Record-before-dispatch journals, idempotency-key refusal, incomplete-outcome inspection, digest-only payload storage	Tool registry and tools/execute pipeline
dsh-integrity-workspace-mutation	Routes write and edit through the durable ledger	Atomic writes, observation guards, stale-version checks, sandboxing
dsh-integrity-subagent-workspace	Private child workspace, fixed child policy, retained changes, parent-only explicit acceptance	Agent creation, prompts, models, cancellation, result collection

All three use the same terminal model:

PREPARED → AUTHORIZED → APPLYING → APPLIED | FAILED | UNKNOWN

APPLYING without a terminal record is never replayed automatically.

📦 Installation

Requirements:

• Linux x64
• Node.js 24
• DeepSeek Harness 0.1.5-rc.1
• a DSH Web profile or another base-backed profile

Install directly from a checkout, in dependency order:

git clone https://github.com/CommitStrip/dsh-integrity-plugins.git
cd dsh-integrity-plugins

dsh plugin --profile web add \
  ./packages/effect-ledger \
  ./packages/workspace-mutation \
  ./packages/subagent-workspace

dsh --profile web --dump-config
dsh --profile web

For an immutable deployment artifact, pack each plugin first:

npm pack --workspace packages/effect-ledger
npm pack --workspace packages/workspace-mutation
npm pack --workspace packages/subagent-workspace

Then install the three generated .tgz files with dsh plugin --profile ... add. No install-time build script is required.

🚀 Quick Start

Once the three bundles are installed, ordinary DSH write and edit calls pass through the durable mutation boundary automatically.

The subagent bundle adds two parent-facing tools:

• subagent_isolated — starts a child in a private copy of the parent's durable workspace. The child cannot call the acceptance tool.
• accept_subagent_workspace — checks ownership, path safety, and parent drift, then explicitly merges the retained child changes.

A typical agent flow is:

1. Parent calls subagent_isolated.
2. Child works under workspace-write + approvalPolicy: never.
3. Child exits; the parent workspace is still unchanged.
4. Parent reviews the result and calls accept_subagent_workspace.
5. The plugin rejects on parent drift or applies the retained file delta.

🏗️ How It Works

flowchart LR
    MODEL["Agent / model"] --> TOOLS["DSH tools/execute"]
    TOOLS --> LEDGER["Effect ledger<br/>fsynced JSONL"]
    LEDGER -->|authorized| FS["Upstream DSH FS<br/>guards + atomic write"]
    LEDGER -->|authorized| CHILD["Isolated child workspace"]
    CHILD --> RETAIN["Retained delta"]
    RETAIN -->|explicit parent accept| FS
    LEDGER -->|crash window| UNKNOWN["Manual recovery required"]

Loading

The durable boundary stores SHA-256 digests of requests, results, idempotency keys, and error messages. Raw tool content and raw exception text are not written to the journal.

🔒 Security Properties

• External/opaque effects are denied by default when classified through the effect ledger.
• Duplicate or interrupted idempotency keys fail closed.
• Journal files and control records use private permissions and fsync before dispatch.
• Child workspaces reject symbolic links, sockets, devices, NUL paths, absolute manifest paths, and .. escapes.
• Acceptance is bound to the durable parent-agent id.
• Every affected parent file must still match the child workspace's baseline.
• Child agents are pinned to workspace-write; approval is pinned to never.
• .git and .dsh-integrity are excluded from child copies by default.

Read SECURITY.md before exposing any DSH deployment to a network. The plugins do not turn upstream DSH Developer Preview into a hardened public multi-tenant service.

✅ Verification

The current suite contains 11 focused tests:

Area	Cases
Effect ledger	5
Workspace mutation integration	3
Isolated workspace / acceptance	3

npm install
npm test

The server acceptance run additionally verifies prebuilt tarball checksums, clean install/uninstall against an official Web profile, peer resolution, and an authenticated loopback Web response.

📁 Repository Structure

packages/
  effect-ledger/          durable effect Service + tools/execute consumer
  workspace-mutation/     write/edit adapter over the ledger
  subagent-workspace/     isolated provider + explicit acceptance tool
docs/
  logo.svg
.github/workflows/
  ci.yml

Each package is a standalone DSH bundle with its own package.json, cordis.patch.yml, runtime entry point, and tests.

⚠️ Compatibility and Honest Limits

DSH version	Status
0.1.5-rc.1	pinned and tested
newer prereleases	unsupported until revalidated
0.1.1-rc.2 and older	use the archived legacy implementation, not these bundles

Still required before a broad production claim: kill-at-every-state fault injection, adversarial multi-process stress, a real-model subagent end-to-end run, large-tree performance characterization, and a user-facing Integrity inspection panel.

🙏 Upstream and Licensing

This project is an extension of deepseek-ai/deepseek-harness, pinned to tag dsh-v0.1.5-rc.1 for the current release line. It relies on DSH's Cordis plugin model and public service/event seams. See THIRD_PARTY_NOTICES.md.

License

MIT © 2026 CommitStrip