dsh-plugin-vet is the trust layer for DeepSeek Harness: deterministic static scan (R1–R20), an alarm-only runtime guard with honeypot lures, an agent audit-protocol skill, and a live GUI shield.
dsh plugin --profile <profile> add @jieai/dsh-plugin-vet
vet occupies the whole trust chain — download → scan → audit → score → decide → runtime watch — and stops there: it reports, it advises, it never enforces.
R1–R20 rules over an AST (engine v20), verdicts produced only by the static layer — never spoofable by prompt injection. The scanner runs as an isolated subprocess: AST read-only, never eval'd.
verdict · critical / suspicious / cleanT1 sentinel watches host resources (Linux: /proc; macOS: ps/lsof + fs watch — memory, forks, fds); T2 hooks wrap fs/child_process and attribute dangerous operations to the plugin that did them. Watches, never kills.
alarm-only by defaultFake credentials planted in an unobtrusive location (no honeypot keywords — anti-honeypot). Anyone rifling through key files gets caught red-handed with high confidence.
opt-in · honeypot.enabledThe agent reviews a plugin in preset steps and writes a health record to disk; `requireAudit` turns "unaudited" into "unusable". Official packages anchor to a content hash baseline (contentBaseline) — a changed tarball is surfaced, never silently trusted. vet ships criteria, not conclusions.
vet-audit-protocolA green/yellow/red status light in the DSH web header with live metrics, per-alarm advice, one-click dismiss, and a runtime-guard toggle. Click to inspect, never to act.
status.json · polledExact-version known-vulnerability queries against Google OSV for the plugin and its direct dependencies. Network trouble degrades silently — never a false block.
osvCheck · exact versionsCoverage-class boundary alerts are deduplicated persistently by (kind, pkg, version, capability diff) — the same version never re-alarms, an upgrade that changes capabilities does. Official-anchor C2 notices downgrade to info and fold across packages; the store fails open (repeat a notice, never go blind).
known-boundaries · fail-openA QA contract, not a claim: 34 malicious mutants must all be killed and 8 benign controls must stay clean — enforced by `--gate` on every release. Escape shapes are added as corpus, never deleted.
34 killed · 8 clean · R1–R20Every release pins a hash of its shipped artifacts (`vet-self-pins.json`). Change the code without re-pinning and the self-scan gate fails — byte-swapped or tampered installs are caught on scan.
gen:self-pin · pinned-matchThe scanner runs in its own process — even if the host is compromised by escaped plugin code, scan results still come from a clean, read-only process.
Detail in docs/ARCHITECTURE.md · trust boundaries below.
Real numbers from the test suite and coverage run — a security layer should be able to show its receipts.
The verdict comes only from the deterministic static layer — regex/AST judgments, not spoofable by prompt injection.
The static layer is physically isolated from plugin code — a separate process, AST read-only, never eval'd.
No single merged score — the verdict is never blended with subjective review into one number.
Fail-open by default — `mode: report`; deny interception is an explicit deployer opt-in.
Alarm-only runtime guard — watches, never kills. Interception exists only in the opt-in watch mode, for confirmed destructive operations.
Not a security boundary — a "speed bump + forensics layer", aligned with DSH's official stance.
Deduplication never goes silent — the known-boundaries store fails open: a damaged or unwritable store means the notice repeats, never that it disappears.
Differential trust for official anchors — noise drops inside the content-trust anchor (info, folded, counted out of `alarmCount`); the anchor itself is content-hash-verified, and everything outside it is alarmed as usual.
A trust layer that hides its blind spots isn't a trust layer. All of these are empirically verified and documented.
Install into any profile you want guarded. Reports by default, blocks only when you say so.
dsh plugin --profile <profile> add @jieai/dsh-plugin-vet