dsh-bash-escalation-gate

dsh-bash-escalation-gate

Host-side companion plugin for DeepSeek Harness. It prevents speculative Bash sandbox escalation from reaching the approval UI.

简体中文

Why this exists

DSH 0.1.0-rc.7 exposes the optional sandbox_permissions and justification fields in the model-facing Bash schema whenever a confining shell is mounted. A model can fill those fields on an ordinary command before any sandbox denial occurred, which can produce unnecessary approval prompts or invalid escalation errors.

This plugin makes escalation denial-driven:

1. normal Bash schemas omit both escalation fields and their prompting prose;
2. a model-direct, foreground Bash call must return structured sandbox.denied: true telemetry under the current policy;
3. only the exact command and execution arguments receive a one-step, one-use lease;
4. only a strictly wider retry on the immediately following model step can enter DSH's existing approval path.

The plugin never parses stderr or model-visible denial text. DSH's stock sandbox and approval services remain the security boundary.

Compatibility

Plugin	Tested DSH	Node.js	Status
0.1.0	0.1.0-rc.7	22+	Unit and installed-runtime integration tests

The implementation intentionally targets rc.7 public events and services: system-prompt/assemble, tools.guard, tools/result, sandboxPolicy.resolve, and approval.overrideOf.

Install

From GitHub:

dsh plugin --profile web add github:ruby1304/dsh-bash-escalation-gate
# Restart dsh web.

After the npm package is published:

dsh plugin --profile web add dsh-bash-escalation-gate

For local development:

dsh plugin --profile web add link:/absolute/path/to/dsh-bash-escalation-gate

The bundled patch installs the host gate once for the whole Web profile, including descendant agent and preset scopes.

What is enforced

• ordinary commands such as pwd and rg --files cannot request escalation without prior matching denial evidence;
• the retry must preserve command, workdir, timeout, background mode, and all other execution-affecting arguments;
• display-only description text may change;
• the requested mode must be strictly wider than the denied mode;
• approval policy, sandbox mode, session working directory, turn, step, and lease TTL must still match;
• a lease is consumed before the stock Bash body runs, so cancellation, rejection, or replay cannot reuse it;
• nested Code Mode calls cannot redeem a model-direct lease.

Leases are memory-only and disappear on turn end, process restart, policy changes, mode changes, expiry, or use.

Limitations

The schema projection applies to direct/native Bash tools. Nested Code Mode dispatches remain protected by the execution guard, but Code Mode's generated SDK declaration cannot be dynamically projected through the rc.7 public API.

The rc.7 sandbox.denied result is the strongest public denial signal available to an external plugin, not a cryptographically bound kernel receipt. This plugin is designed to stop accidental model-filled escalation fields; it does not replace OS sandboxing or user approval.

Verify

npm ci
npm run check
npm pack --dry-run

npm test runs both the deterministic unit suite and an integration suite composed from the real DSH rc.7 Cordis, system-prompt, Bash, sandbox-policy, shell, and approval packages. Set DSH_APP_ROOT only when you want that suite to use another installed DSH application root.

Remove

dsh plugin --profile web remove dsh-bash-escalation-gate
# Restart dsh web.

Security

See SECURITY.md. Please use GitHub's private security-advisory flow for vulnerabilities.

License

MIT