Security & Permissions

Security-audit facts AI coding agents cannot compute, plus a verdict gate: euthyna history attributes deleted lines to commits and flags those from security fixes (--origins finds the first introducer), euthyna coverage reports which changed symbols no test ever invoked, and euthyna gate checks each finding against six gates, downgrading any without evidence to an observation.

Adds an Explain button to the approval card: one model call returns exactly three lines reading the pending operation, covering what it does, which files or system state it reads, writes, modifies or executes, and a risky/attention/safe verdict with a one-sentence justification. It also renders the detail area for `write` and `edit` calls, which the shipped renderer leaves blank because it only reads a `command` field.

Blocks an agent from reading, searching, writing, or editing chosen files and directories, keeping their contents out of the conversation — including sensitive-word files whose text can make later provider requests fail with a 400. Rules are picked from a file/directory browser on the plugin page.

Filesystem permissions for shell calls, granted per path and capability rather than per command name. The command line is parsed for the read, write, create, delete and execute effects it needs, a capability it lacks raises the approval card instead of a flat refusal, and the same rules are compiled into the macOS Seatbelt profile the process, its children and the code its arguments never showed all run under. An Approvals tab in the conversation reads the audit log back and shows which rule, automatic reviewer or person answered each call.

Pre-install compatibility gate for DSH plugins: locks the resolved version, checks peer/engines declarations, dry-installs into an isolated DSH_HOME and boots it with a timeout, blocks on any failure, and restores the profile if the real install fails. Optionally intercepts dsh-market install/update clicks.

Provider-backed automatic approval review for DeepSeek Harness.

Native Auto Review for DeepSeek Harness with automatic host compatibility selection

Sanitizes leaked DeepSeek DSML closing tags from model text streams.

保险区 Vault Wall — 让 DeepSeek Harness 无法感知、无法触碰用户指定敏感路径的隔离墙插件（隔离墙 + 临时借出 + 触碰审计 + 紧急熔断）

P0–P4 deterministic-first permission gate with permissive tier, learning sedimentation and approval-history UI; hard-deny credentials and protected paths, auto-allow internal read-only tools.

Smart checkpoints, workspace safety guards and instant rollback for DeepSeek Harness.

Login gate for the dsh web UI: unauthenticated visitors get a login/register page and the first registrant becomes admin; includes user and role management plus login and access audit logs.

Policy plugin that gates kubectl by kubeconfig context: hard-deny irreversible verbs outside local clusters, ask for the rest.

Workspace-scoped Semgrep SAST tool for DeepSeek Harness with a managed Windows x64 runtime, structured bounded findings, cancellation and timeout controls, and user-approved sandbox escalation. Installs from npm as @aaub-software/dsh-semgrep-sast.

Deterministic loop guard: denies a tool call repeated with identical arguments and caps per-agent calls, in code outside the model; incident log lets a parent interrupt a stuck subagent.

Pre-install static audits for npm-installable DSH plugins; emits and validates the open `dsh-vet/v1` report with severity, confidence, evidence, derived grades, a CI Action, and auditable badges.

Live request metadata minimization for DeepSeek Harness, covering the native DeepSeek provider with WebUI settings.

Real-time repetition guard for DeepSeek Harness (DSH): stops model generation when the same string repeats >=10 times in the streamed output. 实时检测 DSH 大模型流式输出中的重复内容，同一字符串重复十次以上立即停止生成。

Global prompt-injection / context-virus defense for DeepSeek Harness: scans tool arguments, tool results, pre-model messages and the outbound stream; quarantine/block/monitor modes, canary trap, and an evolvable on-disk signature library with learn/import/export.

Hard-stops further tool calls after a configurable per-session budget is reached.

Safe Git Credential Manager hints for WSL without exposing secrets.

Stavros RedTeam for DeepSeek Harness (DSH) — authorized red-team persona + scope-guarded pentest tooling (persona, 24 subagents, methodology and 78 zero-dependency guard tools).

Re-validates Cloudflare Access JWTs at the DSH origin so Settings, Credentials, Agent Preset management, and model discovery work from a remote hostname.

Single-password authentication gate for the dsh web surface: configurable session validity, Ctrl+Shift+L lock, CLI password management, brute-force lockout, in-UI password controls.