Read-only agent-fleet credential hygiene audit: credential-file permissions, embedded credentials in git remotes (masked in output), and provider token literal counts; zero-dependency and deterministi

by jwilson411

DeepSeek Harness plugin: redact known secret shapes before the model sees them; JSONL incidents never store the preimage

by zhengqiuyang

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger;

by 7gzgn

Pre-release credential leak scanning: Don't commit API keys, tokens, or passwords to public repositories

A global permission watchdog: a hard budget on auto-approved permission requests. At most 10 per rolling 60 seconds, at least 3 seconds apart; anything past either limit is deferred to the human answe

Turn-scoped “Allow for this task” approvals: automatically allow matching `danger-full-access` escalations only for the current task, then expire.

by DWJZ

DeepSeek Harness Permission Memory Plugin: Add a certain type of command to the allow list, so the same command prefix stops asking afterward. / Remember sandbox-escalation approvals so the same command prefix stops asking.

Local-first privacy shield for DeepSeek Harness: keep plaintext local, send only placeholders to the model, restore real values in the transcript.

Encrypted local credential vault for DeepSeek Harness: sidebar record management, an info_records tool for pre-sign-in lookups, opt-in chat capture, per-record manual-only mode, and AES-256-GCM storag

Permission mode between workspace-write and full access: shell commands are checked by deterministic rules and a subagent review; irreversible or system-level actions require explicit approval.

Irreversible secret-scrubbing guard: rewrites access keys, bearer tokens, and private key blocks into `[REDACTED:<category>]` placeholders before they reach the session log and the model.

by xinvxueyuan

Cordis / DeepSeek Harness plugin — the agent asks the human for a secret in an inline conversation card and only ever receives an opaque session-scoped DSH_SECRET_* name, never the value

by whoisDDD

DSH approval/question/completion notifier with native browser notifications and toast fallback. / DSH approval/question/completion notifier plugin, supporting native browser notifications and toast fallback.

by a5557

DeepSeek Harness guardrail plugin: evidence-first read-only inspection plus write-time protection of DSH private storage. One command captures authoritative state - workspace registration, session identity headers, directory layout, host running state - so a count difference is never mistaken for data loss; writes to protected paths are intercepted before dispatch, backed up first, and never allowed while the host may still be running. No network, no telemetry, zero runtime dependencies.

DSH plugin: drop sandbox_permissions that cannot widen the current sandbox mode, fixing 'not strictly wider' errors from GPT models

Advisory permission checks for DSH tool calls: risk tiers, a path sandbox (empty allowed_roots denies every path-like call), a per-minute call limit and a JSONL audit, exposed through gate_check / gat

by coffee-man666

Repository and agent-runtime analysis skills as an installable DeepSeek Harness (dsh) plugin

DeepSeek Harness approval guardian: a reviewer model decides permission requests before they reach you, with a System One decision-API backend (TypeSafe Jev, SiliconFlow, self-hosted Laya), a configur

by zhengqiuyang

Hermetic composition lock for DeepSeek Harness — profile fingerprint; drifted compositions warn or fail (strict)