dsh-baseline: A Fail-Closed Security Baseline DSH plugin for DeepSeek Harness

What Does It Do?

Baseline is a DSH plugin for DeepSeek Harness that turns network egress, subagent permission ceilings, and audit logging into one verifiable mechanism. It addresses the three places where real escapes happen despite tool-name-level permission control: network egress, subagent inheritance, and the question of who allowed what, when, and why. The plugin is fail-closed: any uncertain decision, missing or timed-out approval, broken subagent lineage, or unavailable audit store is rejected with an explicit reason. It relies only on officially documented DSH extension points and events without patching the host source, is maintained by bbo777, and is released under the MIT license.

Core Features

• Layered network egress: private, loopback, link-local, CGNAT, and cloud metadata hostnames are blocked by default, with host allowlists, per-session egress budgets, and per-call approval in strict mode; network commands and URLs are extracted at pre-execute and re-checked in the guard.
• Monotonic subagent permission ceiling: walks ancestors via session.header.parentSession and replays the policy of the same call inside ctx.tools.guard(), which can only deny or stay out of the way, so later-registered listeners cannot widen permissions.
• Hash-chained audit: every decision and result is written to a single SHA-256 hash chain, redacted before writing, with verifyChain() returning the first broken link; the client queries read-only and never touches SQLite directly.
• Non-overridable baseline rules: destructive system commands and raw writes to device or kernel interfaces always take precedence over custom rules and cannot be disabled from config or the panel.
• Complementary by design: it does not replace permission categories and only guards the network, subagent ceiling, credential, and destructive-operation lines, so it can coexist with permission-gating and global-audit plugins.

How to Use This Plugin?

Once enabled in DSH, a "Baseline Audit" entry appears in the sidebar, and the panel and HTTP API depend on DSH running in Web mode. Day to day there is nothing extra to do: the plugin evaluates and records every tool call automatically. To adjust behavior, edit policy items such as blockedCIDRs in the config file, or explicitly turn off credential-read denial and the subagent ceiling via the guard switches, which the panel cannot toggle. In strict mode every network egress goes through the standard DSH approval flow. Note that it does not cover malicious plugins calling native processes directly, Code Mode worker-thread escapes, or DNS resolution; those need process-level isolation or container policies.

How to Troubleshoot This Plugin?

The plugin rejects execution whenever it cannot verify a decision, and the error states the reason: missing or timed-out approval means checking whether the DSH approval flow is working; broken subagent lineage means confirming the session's parentSession chain is intact; an unavailable audit store usually means the runtime lacks node:sqlite support, so repair the runtime per the official instructions. If the panel or HTTP routes do not appear, first confirm DSH is running in Web mode.