Identity Sentinel · 身份哨兵

> ⚠ CONSENT / 知情同意: Installing this plugin means you have read this README and agree: > the plugin inspects your machine's local signals (locale, language, timezone, keyboard layout, > region format — all purely local, zero network requests). If the composite verdict is > "not Chinese" (mainland / Hong Kong / Macau / Taiwan), the plugin terminates all workflows. > If the verdict is Chinese, it does nothing. 安装本插件即视为已知情并同意上述行为。

THIS IS A PERFORMANCE ART PIECE. This is not security tooling and not policy. It is a mirror held up to the idea that a machine can — or should — judge the nationality of its operator.

How it works

1. On startup the plugin collects four local signals — never sent anywhere: - locale — system language / locale (LC_ALL, LC_CTYPE, LANG, Intl locale) - timezone — e.g. Asia/Shanghai, Asia/Hong_Kong, Asia/Taipei, Asia/Macau - keyboard — keyboard layout (XKBLAYOUT on Linux, defaults on macOS, registry on Windows) - region — region part of the Intl locale (CN, HK, MO, TW) 2. Signals are aggregated into an identity profile with a confidence score. 3. A weighted rule engine renders a verdict: - non-cn signals >= threshold (default 2) and forceTerminate on → terminate - otherwise → pass (nothing happens) 4. On terminate: an art banner, the manifesto, and a termination declaration are printed; the process exits with code 1. On pass: a banner is printed and a single introspection tool (system_identity) is registered — nothing else changes.

Ambiguous or undetectable signals never count toward the threshold. Each failing collector degrades gracefully and is logged.

Install

# via the dsh plugin manager
dsh plugin add <path-to-this-package>

# or with a patch overlay on the web profile
npx @deepseek-ai/dsh --profile web --patch <abs-path>/cordis.patch.yml

pnpm users need the upstream peer fix (the official latest train still declares the unpublished @deepseek-ai/dsh-type-meta — see deepseek-harness discussion #2862):

# pnpm-workspace.yaml
overrides:
  "@deepseek-ai/dsh-type-meta": "npm:@deepseek-ai/dsh-invariants@0.0.1-rc.1"

Tool

system_identity — asks the machine for its current verdict about its owner: identity (cn / non-cn / unknown), action, confidence, and the full signal list.

Embed

The core is a zero-dependency pure-function library — import it from any project:

import {
  collectSystemLocale, collectTimezone, collectKeyboard, collectRegion,
  aggregateIdentity, decide, renderArt,
} from '@dsh-io/identity-sentinel'

Configuration

License

MIT © 2026 dsh-io