보안 및 권한

Login gate for the dsh web surface: password or shared-token authentication, session cookies, rate limiting, and a user-management CLI (dsh.bundle manifest since 0.4.1, one-command `dsh plugin add` mounting).

Risk-gated approval automation for DeepSeek Harness: flash pre-classifies whether a write/command is irreversible — safe operations are auto-approved, dangerous ones are escalated to human approval (fail-safe).

dsh-skill-pack-security용 선택적 프로바이더 플러그인: 팩의 skills/(중국어) 또는 skills-en/(영어) 버전을 ctx.skills에 등록. 두 버전 모두 pack/에 내장되어 제공

턴 단위 "이 작업에 한해 허용" 승인: 매칭되는 `danger-full-access` 에스컬레이션을 현재 작업에 한해서만 자동 허용한 뒤 만료

Microsoft 크로스 플랫폼 샌드박스 지원

스킬과 MCP 설정에서 프롬프트 인젝션, 동형 문자(homoglyph), 숨겨진 유니코드, 위험한 셸 명령, 자격 증명 유출을 스캔

Runtime security gate on the tool pipeline: denies calls naming hosts outside an egress allowlist, redacts credentials from results at the canonical value rather than only the rendered content, and appends every decision to a JSONL audit log; ships in monitor-only mode.

Transport-level authentication gate for the DeepSeek Harness Web GUI with server-side sessions, HttpOnly cookies, IP-based login throttling, and an scrypt password CLI.

Deterministic code security review: 40+ rules, secret entropy detection, staged-diff review, SARIF export, baseline acceptance and SBOM-lite dependency inventory.

Rules execution engine for dsh: parses AGENTS.md, hard-blocks rule-violating tool calls, text-based B/D rule auditing, /guard command, version-guard for versioned files, and free-zone support (engine skips free-zone sections).

Static and runtime security guard for dsh: rule-based scans for malicious code, prompt injection and token waste, runtime interception of dangerous tool calls, /scan command, plugin_scan tool, web panel, and allowlist.

위험 작업 정책 검사, 출력 마스킹, 보안 검토 워크플로 추가

수동 승인 모드("Manual Mode" / "Ask Mode")

읽기 전용 에이전트 플릿 자격 증명 위생 감사: 자격 증명 파일 권한, git 원격에 포함된 자격 증명(출력에서 마스킹), 프로바이더 토큰 리터럴 개수; 의존성 없음, 결정적 동작

텍스트 위생 관리를 dsh 플러그인으로 제공: 신뢰할 수 없는 텍스트 정제, 보이지 않는 문자 검사, LLM 포맷팅 정리, CSV 수식 인젝션 이스케이프

Pre-install supply-chain poison scanner for DSH plugins: AST (JS-X-Ray) + deobfuscation + regex heuristics, exits non-zero on findings for CI gating.

HashiCorp Vault backend for the credential seam: KV v2/v1, AppRole machine auth, per-operation reads so rotation needs no restart, and compare-and-swap writes.

Container-isolated backend for the `ctx.codeRuntime` seam: each Code Mode program runs in a fresh container with no network, a read-only rootfs, dropped capabilities, and kernel-enforced memory, CPU and pid ceilings.

Zero-interruption audit and fuse blocking for DeepSeek Harness: silently records every tool call with deterministic risk scoring, cumulative-risk bonuses, risk-level breakdowns and retention-based cleanup; blocks irreversible catastrophes (protected-path deletion, disk wipe, force-push to protected branches/refs, credential exfiltration), and renders a redacted /risk-guard operation bill with --since filtering.

Live CVE/supply-chain audit for your workspace's own project dependencies (npm/pip/go), backed by OSV.dev, with a `cve_audit` tool plus optional automatic re-scan on lockfile changes.

Plugin value auditor: pre-install review (source scan + LLM judge) and post-install audit of installed bundles, with model-switch re-audit reminders.

Autonomous permission classifier for the auto preset: tool-scoped allow/deny rules, an LLM semantic judge, and git checkpointing for unattended sessions.

Blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe sg_* inspection tools that never print raw values.

Destructive-command interception gate for dsh: parses shell semantics, judges risk against 41 built-in rules, and holds irreversible rm -rf, git reset --hard, and git push --force style commands at a confirmation gate.