dsh-ironbound-policy

A hard-gate guard for DeepSeek Harness. Blocks dangerous shell commands before they ever reach a tool — and degrades an agent that keeps trying to run them.

---

Why this exists

A DSH agent can run arbitrary shell. One bad call — rm -rf /, git push --force, a curl | sh — and the model has already done something you can't undo. That's the Ironbound problem: put a hard gate between the model and the machine, not just a prompt telling it to be careful.

dsh-ironbound-policy is that gate. It listens on the tools/execute seam before a tool runs, replaces a dangerous call with a structured TOOL_BLOCKED result, and applies a double-layer degrade counter so a model that keeps hitting the same wall gets progressively more constrained — from a warning, to a human-review message, to a hard block.

Provenance & trust: this is a community-maintained port, not an official DeepSeek AI package. The danger regex is ported from Claude Code's block-dangerous-cmd.sh blacklist. It targets the DSH plugin system (dsh-plugin). Use it with your own judgment — and feel free to open an issue.

---

Quickstart

npm install @shizhanyu13/dsh-ironbound-policy

Add the plugin to a profile's cordis.patch.yml:

- id: ironbound-policy
  name: '@shizhanyu13/dsh-ironbound-policy'
  config:
    denyList: []      # extra regex patterns merged over the built-in deny list
    perIssueLimit: 3  # same issue repeated N times -> degrade message
    totalLimit: 10    # cumulative denials beyond this -> hard block

That's it. The plugin ships prebuilt ESM + .d.ts, so no build step at runtime. It needs a DSH host that provides the peer packages (@deepseek-ai/cordis, @deepseek-ai/dsh-agent, @deepseek-ai/dsh-tools, @deepseek-ai/dsh-invariants).

---

What it does

1. Dangerous-command deny

A built-in denylist (the block-dangerous-cmd.sh blacklist) plus your denyList. A matching shell call never runs; instead the model sees a structured result:

tool-bash error: Ironbound policy: dangerous command blocked (A:Bypass): rm -rf /
code: TOOL_BLOCKED

2. Double-layer degrade counter

• Per issue — the same problem repeated perIssueLimit times degrades to a human-review message.
• Total — cumulative denials beyond totalLimit hard-block the agent.
• The per-issue counter resets on a clean run; the total does not.

3. It's a listener, not a tool

It never appears in the model's tool catalog and has no request-cache effect. It's pure overhead on the execution seam — zero surface area on the prompt.

---

Configuration

field	default	meaning
denyList	[]	extra regex patterns merged over BUILTIN_DENY
perIssueLimit	3	consecutive same-issue denials before a degrade message
totalLimit	10	cumulative denials before a hard block

---

Default behavior

• Active by default when wired through dsh-base; every profile inherits this row.
• A dangerous shell command → TOOL_BLOCKED; the tool never runs.
• Wired as a single source in your profile; override the limits to tune it.

---

Known limitations

• ENG-02 surgical scope is deferred (needs the ctx.fs read seam).
• The counter is per-agent in-process (a WeakMap keyed by Agent), not persisted — a process restart resets it.
• Direct ctx.tools.execute() callers outside the agent loop are denied outright without counting.
• GATE-03 read-before-edit is provided by the companion @deepseek-ai/dsh-fs-observation-policy — compose it alongside for the full Ironbound gate set.

---

Community & contribution

• Discoverability: tag your own plugin repo with the dsh-plugin topic so the DSH community can find it.
• Upstream PRs: DSH does not currently accept external pull requests, so this is delivered as an independent plugin rather than a patch to deepseek-ai/deepseek-harness.
• Feedback, bug reports, feature ideas: open an issue, or start a discussion.

---

License

MIT