dsh-egress-guard

Local, zero-network, deterministic secret preflight for DeepSeek Harness model requests.

dsh-egress-guard inspects the fully assembled request at the official llm/stream boundary. It first validates and freezes the exact plain-data request graph that downstream code will consume. If it finds a likely credential, it stops before calling the downstream model adapter. Matches never appear in the error, finding report, or plugin log.

The default policy is fail-closed:

• known secret patterns block the request;
• images and unknown content blocks block because this version cannot inspect their bytes safely;
• requests larger than the configured scan limit block;
• cyclic, proxy/accessor-backed, non-plain, sparse, oversized, non-enumerable, unknown-field, or otherwise unfreezable request graphs block even in audit mode;
• invalid configuration prevents the plugin from loading.

It does not rewrite request values and never sends request content to another service.

Install

From npm after the package is published:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add dsh-egress-guard
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

From the public GitHub repository now:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add git+https://github.com/LKRCharon/dsh-egress-guard.git
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

From a local checkout, use a file: specifier so pnpm installs a package copy instead of a symlink:

npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add file:/absolute/path/to/dsh-egress-guard
npx --yes @deepseek-ai/dsh@0.1.0-rc.6 --profile web --dump-config

For a release-equivalent local smoke test, run npm pack in the checkout and add the resulting .tgz by absolute path. Do not add a bare checkout path: rc.6 treats it as a symlink, which can bypass the profile's host-module fallback at real startup.

The preview CLI delegates plugin installation to pnpm, so ensure it is on PATH first. With Corepack, run corepack enable pnpm; alternatively install pnpm 11 directly. A global dsh install may replace the pinned npx prefix above. The dump should contain an egress-guard row before you start the profile.

DSH rc.6 profiles disable automatic peer installation. The add command can therefore warn about the @deepseek-ai/cordis and @deepseek-ai/dsh-llm peers even though the host supplies them at runtime. They intentionally remain peer dependencies so the plugin shares the host runtime and LlmError identity.

Default coverage

Built-in rules cover:

• PEM private keys;
• GitHub, AWS, Google, Slack, Stripe, npm, PyPI, Hugging Face, GitLab, and common sk-* provider keys;
• bearer and basic-auth credentials;
• credentialed PostgreSQL, MySQL, MongoDB, and Redis URLs;
• high-confidence password=, api_key=, access_token=, and related assignments.

Common placeholders such as process.env.API_KEY, changeme, and your_api_key are ignored. Pattern matching is intentionally conservative; it is a safety layer, not a complete secret scanner.

Configure

Later DSH patch layers override a row by id. Add this to the profile's cordis.patch.yml and restate the row name:

- id: egress-guard
  name: dsh-egress-guard
  config:
    mode: block
    scanToolSchemas: true
    blockUnscannable: true
    maxScanBytes: 4194304
    maxFindings: 64
    skipProviders: []
    skipPurposes: []
    customRules: []

Available settings:

Custom rule example:

customRules:
  - id: acme-production-key
    prefix: 'ACME-PROD-'
    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
    length: 24

Custom rules do not execute regular expressions. The matcher finds a literal prefix, then requires exactly length characters from alphabet and a suffix boundary. Prefixes must be 4–64 printable ASCII characters and end in a delimiter outside the alphabet; alphabets contain 2–128 unique printable ASCII characters; suffix length is 1–256. This deliberately narrow format keeps custom scanning deterministic and avoids regular-expression backtracking.

What is scanned

• the system prompt;
• provider/model routing ids, reasoning effort, and session id metadata;
• each message's provider-facing text and reasoning channels;
• message source/provenance fields, including adapter replay metadata;
• raw JSON tool-call arguments;
• nested tool-result content, including text reconstructed across nested result layers;
• tool descriptions and parameter schemas;
• stop sequences;
• ordinary conversation, compaction, and session-title requests.

Text is joined only inside the same message and channel, matching the provider serializer. It is never joined across messages.

Safety boundary

This plugin prevents a matching request from reaching the downstream DSH model adapter. It is not a machine-wide network firewall.

Important limits:

• Text already entered into DSH may remain in the local session log even when outbound dispatch is blocked.
• Binary image contents are not OCR-scanned; they block by default.
• The guard freezes the same request object graph before scanning so a direct caller cannot mutate it during asynchronous adapter resolution; the live AbortSignal remains unfrozen.
• Encoded, fragmented, novel, or low-entropy secrets may evade regular-expression detection.
• A malicious plugin that exfiltrates data outside the normal downstream adapter path is outside this plugin's boundary.
• Same-process code that mutates shared JavaScript prototypes or other globals after preflight is also outside the boundary; the guard freezes the request's own plain-data graph, not the whole runtime.
• audit mode records only rule ids, structural locations, counts, a one-way provider fingerprint, and request purpose, but it does not prevent egress.

Development

Requires Node.js 22.19.x or 24 and newer, plus DeepSeek Harness 0.1.0-rc.6 or a compatible 0.1.x preview.

npm install
npm run check
npm run pack:check

The package ships plain ESM and leaves @deepseek-ai/dsh-llm external so the host's LlmError identity remains intact.

中文说明

这是一个纯本地的 DSH 模型请求出站检查插件。它在 llm/stream 边界扫描完整请求；发现疑似密钥时不调用下游模型适配器，并返回固定的脱敏错误。默认不联网、不改写请求、扫描不了的图片或未知内容直接阻断。注意：它只阻止模型请求外发，不会自动清理已经写入本地 session 日志的原文。

License

MIT