deepseekplugins

DeepSeek Harness plugin

dsh-policy-drift-proof

Content-addressed, value-redacted policy drift evidence for DeepSeek Harness

Development & Runtime
Jump to install

Source facts

Repository
dongsheng123132/dsh-policy-drift-proof
Latest update
Aug 20, 2026
Category
Development & Runtime
GitHub stars
3
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/dongsheng123132/dsh-policy-drift-proof
Plugin: dsh-policy-drift-proof
Author: dongsheng123132

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

dsh-policy-drift-proof

![CI](https://github.com/dongsheng123132/dsh-policy-drift-proof/actions/workflows/check.yml) ![MIT license](LICENSE) ![Node.js 22+](package.json) ![Awesome DSH Plugins](https://github.com/dongsheng123132/awesome-dsh-plugins#2origin-plugin-lab)

Read-only, content-addressed policy/configuration drift evidence for DeepSeek Harness.

Version 0.2 adds host-neutral DSH ToolDefinitions, a proof-only inline Codex MCP surface, real ToolRuntime calls and a stock Web Loader regression. The package exposes namespace exports only and does not bundle a second DSH runtime.

This plugin does not enforce tool calls, approve actions, scan repositories, or repair configuration. dsh-tool-policy already provides pre-execution policy routing, while SecurStack provides security scans and policy gates. This plugin covers the missing evidence question: did the policy snapshot actually observed by an operator differ from the pinned baseline, and was the difference weakening, tightening, exact, or unclassified?

Evidence model

The explicit manifest pins a baseline and observed policy-snapshot/v1 by SHA-256 and revision. Rules cover declared JSON Pointer roots:

  • ordered-not-weaker: enum order is restrictive to permissive; moving right fails.
  • set-no-additions: additions fail, removals are recorded as tightening.
  • exact: any change fails.
  • any changed covered leaf without a rule fails closed as UNCLASSIFIED_DRIFT.

Reports include paths, classifications and SHA-256 digests only. They never include policy values. Secret-shaped fields, raw output fields, absolute/escaping paths, symlinks, oversized inputs and excessive structure are rejected. The verifier performs no network calls or child processes and writes only one content-addressed JSON report beneath the explicit artifactDir, then reads it back and verifies its digest.

verified means both snapshot hashes and revisions matched and no weakening, exact or unclassified violation was found. Tightening remains observable through driftStatus: "changed". This is evidence about supplied snapshots, not a security certification.

CLI

node bin/dsh-policy-drift-proof.mjs inspect \
  --workspace examples/basic \
  --manifest policy-drift.manifest.json

node bin/dsh-policy-drift-proof.mjs verify \
  --workspace examples/basic \
  --manifest policy-drift.manifest.json \
  --artifactDir artifacts

The CLI prints one JSON object to stdout. A drift violation exits 2; invalid usage exits 1.

DeepSeek Harness bundle

dsh plugin --profile policy-proof add github:dongsheng123132/dsh-policy-drift-proof#<commit>
dsh profile --profile policy-proof compose

The bundle registers:

  • dsh_policy_drift_inspect
  • dsh_policy_drift_verify

The companion stdio MCP server exposes policy_drift_inspect and policy_drift_verify through .mcp.json. MCP accepts an inline manifest and pinned inline snapshots, performs no filesystem/network/subprocess/write operations, rejects secret- and raw-output-shaped fields, and never returns policy values. DSH and CLI remain the surfaces for workspace-bound files and content-addressed report publication.

Verification

npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
DSH_CHECKOUT=/path/to/built/deepseek-harness npm run smoke:dsh
DSH_CHECKOUT=/path/to/built/deepseek-harness DSH_HOME=/path/to/isolated-home npm run smoke:web-loader
python C:/Users/ZhuanZ/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .

CI runs tests, structural checks and MCP smoke on Ubuntu and Windows. Node.js 22 or newer is required.

License

MIT

Back to searchOpen GitHub repository

More related plugins

View category