dsh-egress-gate

Deterministic network egress gate for DeepSeek Harness (dsh).

Content scanning (dsh-read-guard) guards what enters the model; this guards where data may leave to. web_fetch / web_search calls are checked against a destination allowlist in tools/pre-execute and denied before they run. Shell commands are scanned for fetch-verb URLs — observation by default, enforcement opt-in, honest about precision. Zero LLM calls in the trust path.

Family: read · write · do · call · leave-behind · egress (where data may flow).

Why now (checked 2026-10-12)

Empty lane. Five keyword searches (network allowlist, egress firewall, url filter, web fetch restrict, …) return nothing on GitHub; the awesome list has no entry gating destinations. Neighbours are all different axes: content-pattern secret rules (dsh-defend), LLM-judged commands (dsh-jev-guard), proxy configuration (official network-proxy docs). For teams, "which hosts may the agent reach" is the first compliance question — and the deterministic answer was unowned.

Policy

• Deny always wins; a non-empty allow list means "only these hosts" (example.com covers api.example.com; *.example.com is the explicit form).
• Web tools are enforced at full precision — the URL is in the arguments.
• Shell: URLs following curl / wget / Invoke-WebRequest / Invoke-RestMethod / fetch / http on the same command segment. This cannot see through scripts, variables, or proxies — so it warns by default and denies only when you opt into shellMode: 'enforce'.

Install

dsh plugin --profile default add github:zhengqiuyang/dsh-egress-gate

Prebuilt lib/ ships in the repo — git installs need no build step and no allowBuilds authorization.

Configure

- id: dsh-egress-gate
  name: dsh-egress-gate
  config:
    webTools: [web_fetch, web_search]
    shellTool: bash            # '' disables the shell scan
    allow: [docs.deepseek.com, github.com]
    deny: [pastebin.example]
    shellMode: observe         # observe | enforce

Develop

npm install && npm test

Kill criteria

If dsh ships first-party destination policy, or proxy-layer plugins add per-host rules, this freezes at its last working version with a postmortem here.