@yadsh/dsh-model-safety-gate

Independent defense-in-depth safety gate for DeepSeek Harness: a deterministic scanner plus an isolated small-model classifier check user prompts, streamed model output (text and reasoning), tool calls, and tool results before they reach the model, the user, or the execution layer.

The gate is an additional decision layer. It does not replace the DSH sandbox, the permission system, or approval gates, and it never patches DSH core.

Features

• Input guard (agent/pre-step): prompts are normalized and scanned before the main-model request; matched prompts can be warned about or blocked outright, with a sanitized reason published to the session.
• Output stream guard (llm/stream): text-delta and reasoning-delta channels are checked with rolling windows. In the default buffered mode chunks are quarantined until their window passes, so blocked content never reaches the UI or session; blocking aborts the upstream provider request.
• Tool gate (tools/pre-execute): fully assembled tool calls are checked before execution — allow, defer to the native DSH approval flow, or deny.
• Indirect-injection guard (tools/post-execute): tool results from untrusted sources are scanned; hits raise the turn risk state, which tightens decisions for subsequent sensitive tool calls.
• Two classification layers: L0 is a fast local scanner (injection patterns, jailbreak markers, secrets/credential formats, Unicode obfuscation, zero-width characters, suspicious encoding, repeated-payload floods, user patterns). L1 is an isolated safety classifier on a small model — a DSH provider/model pair, an OpenAI-compatible endpoint, or off.
• Monotonic safety merge: deterministic red lines cannot be weakened by the classifier; verdicts only escalate.
• Failure modes: classifier timeout or malformed output follows the configured failure mode — closed, open, rules-only (default), ask.
• Safety ≠ usefulness: quality verdicts (unclear, spam, low-information) warn by default and never block unless explicitly opted in.
• Sanitized audit: plugin logs and counters record decisions with content hashes, never raw blocked content or secret values (raw logging is opt-in). Audit records include the session id but never enter the Harness session journal.
• Classifier isolation: classifier calls run under a process-local bypass marker, so moderating a generation never recursively moderates the moderator; the classifier has no tools.

Install

Install the published npm package by name:

dsh plugin --profile web add @yadsh/dsh-model-safety-gate

Configuration

All options are optional; defaults are shown.

enabled: true # master switch: false silences every surface at once
mode:
  warn # off | audit | warn | enforce — default decision profile
  # off scans nothing; audit records findings but never enforces, including
  # turn-risk escalation

classifier:
  backend: none # none | dsh | openai-compatible
  provider: "" # backend: dsh — DSH provider id for the classifier model
  model: "" # backend: dsh — model id
  baseURL: "" # backend: openai-compatible — endpoint base URL
  apiKey: "" # backend: openai-compatible — API key (kept out of logs)
  timeoutMs: 3000 # classifier request timeout
  maxTokens: 128 # bounded structured response
  temperature: 0
  failureMode: rules-only # closed | open | rules-only | ask — on timeout/error/malformed
  requireLocal: false # true forbids remote (openai-compatible) endpoints

input:
  enabled: true # gate user prompts on agent/pre-step
  safetyAction: block # allow | warn | block for safety verdicts
  qualityAction: warn # allow | warn | block for quality-only verdicts (block = opt-in)

output:
  enabled: true # gate main-model streaming output
  mode: buffered # observe | interrupt | buffered
  text: true # check the visible-answer channel
  reasoning: true # check the reasoning channel when the provider streams it
  checkEveryChars: 512 # new quarantined chars between classifier snapshots
  windowChars: 1536 # snapshot window size sent to the classifier
  lookbehindChars: 768 # preceding context included with each window
  minCheckIntervalMs: 250
  maxBufferedChars: 8192 # overflow fails closed in buffered mode

tools:
  enabled: true # gate tool calls on tools/pre-execute
  semanticClassifier: true
  unanswerableAsk: deny # deny | ask — an escalation the session's approval policy refuses before asking anyone

toolResults:
  enabled: true # scan tool results on tools/post-execute
  classifyUntrustedSources: true

audit:
  enabled: true
  includeRawContent: false # opt-in raw content logging (default: hashes only)

ui:
  enabled: true
  showWarnings: true

allowSessionOverride: true # false forbids per-session downgrade of the global mode

Switching the gate off

enabled: false and mode: off are the same decision spelled twice, and both mean the gate does nothing at all: no scan, no classifier call, no audit record, no blocked decision — on the input, streaming-output, tool-call and tool-result surfaces alike. Switching either one at runtime reaches the very next check; there is nothing to restart.

Use mode: off when the profile is what changes between environments and enabled: false when the plugin itself should be inert; audit is the middle setting for a deployment that wants the findings without the enforcement.

Escalations the deployment cannot answer

A tool call the gate escalates is resolved by DSH, not by the gate: the call becomes an ask decision, the tool runtime passes it to the approval service, and the outcome carries no reason — the runtime turns it into its own sentence. So the refusal a model sees is the user rejected tool "X", even when nobody was asked, and the rule that actually fired is lost.

That is exactly what a session whose effective approval policy is never produces: the service returns the refusal before dispatching to any answerer, deterministically. A QA lockdown pins that policy, so every escalation there reached the model as a human "no".

tools.unanswerableAsk: deny (default) refuses such an escalation with the gate's own verdict instead, categories included:

Blocked by dsh-model-safety-gate (unsafe_tool_intent): this call needs
confirmation, but the session's approval policy is "never", so the request
could only ever be refused without asking anyone

The gate reads the policy the same way the approval service does — the session's logged override first, else the deployment default — and only refuses when that read completes: a host composing no approval service, or a policy the gate cannot read, keeps the native ask, which the runtime still resolves through the real seam. Set ask for a deployment whose own gate answers asks ahead of that policy (for example a QA surface with interaction.approvals: interactive, where the operator decides).

Deployment presets

Profile	Input	Output	Tools	Failure mode
Personal	warn	interrupt	ask	rules-only
Balanced	block	buffered	ask	rules-only
Strict	block	buffered (text + reasoning)	block	closed, session override disabled

Privacy

If the classifier backend is openai-compatible, prompts, streamed output, and reasoning content are sent to that endpoint. The settings card states this in place, next to the endpoint it would use; set classifier.requireLocal: true to forbid remote endpoints entirely.

classifier.apiKey is declared a secret slot: configuration surfaces receive only whether a key is configured, and the literal is never returned to a browser. The safetyGate Remote projection redacts it as well.

Settings card

The plugin's row in the Plugins panel carries the card: opening the row's configure control edits this plugin's configuration through the live fields of its own profile entry — the settings namespace of a plugin is its entry id, dsh-model-safety-gate, and it is also the row id the bundle's patch declares, which is why moving the card off the old Settings tab changed nothing about where a stored value lives. Every field the card writes is declared .volatile() in the config schema, so a committed change re-resolves the running gate on the spot: turning the gate off stops the next check, and switching the mode to enforce blocks the next matching prompt.

The Host validates a write against the schema and nothing more, so a combination the schema cannot express (a dsh backend without a provider, an uncompilable customBlockPatterns entry) is stored, then refused when the gate re-resolves it. The gate keeps running its last workable configuration and the card says so — the refusal is reported by the safetyGate Remote as configRejected, never swallowed. An operator who wants the change applied has to correct the field.

The card also reports what the running gate is doing through the safetyGate Typert Remote — effective mode, whether the classifier is actually wired, the process-lifetime counters, and the last 50 sanitized verdicts. That view never carries the classifier key, and it carries content only when raw logging is switched on.

Chat moderation banners and a per-session shield control are not built yet (design SPEC Phase 6); ui.* and allowSessionOverride are accepted keys with no effect today.

Harness API

ctx.safetyGate.inspect(); // effective config, metrics, recent verdicts

The plugin registers one Cordis service (safetyGate) and publishes four stable plugin-log categories (safety-gate/check|block|warn|classifier-error).

Compatibility

• DeepSeek Harness >=0.1.7-rc.2 <0.2.0 (channel next), extension points: agent/pre-step, llm/stream, tools/pre-execute, tools/post-execute.
• Node.js ^22.19.0 || >=24.0.0.
• See compatibility.json for the machine-readable manifest.

Development

pnpm nx run dsh-model-safety-gate:lint
pnpm nx run dsh-model-safety-gate:typecheck
pnpm nx run dsh-model-safety-gate:test
pnpm nx run dsh-model-safety-gate:build
pnpm nx run dsh-model-safety-gate:verify

License

MIT — see LICENSE. Architecture credits are listed in NOTICE.md.