pandashere/dsh-self-control-guard

self-control-guard

English | 中文

A self-control guard for the DeepSeek Harness host process.

Why

When developing DSH plugins, an agent frequently — by accident or by a misfired command — kills its own host process (pkill dsh, kill -9 <host-pid>, kill $PPID, killall dsh). The session dies mid-task, work is lost, and there is no audit trail. This plugin is designed to prevent agent self-termination: it intercepts high-confidence host-kill attempts from the bash tool, hard-denies them, teaches the model the controlled exit tool, and leaves an audit trail.

It does three things:

1. Intercepts high-confidence attempts to terminate the host from the bash tool (canonical kill <host-pid>, kill $PPID, pkill dsh, killall dsh forms) with a monotonic hard denial that no pre-execute listener can force-allow.
2. Teaches the model the controlled tools — dsh_self_exit always, and dsh_self_restart only when restartEnabled: true (hidden by default — TBD, see Known Limitations) — by injecting a pinned guidance message right after an interception. The tools are registered up front but hidden: they never appear in the model-facing tool list (hidden: true keeps them out of schemas()), so an unassisted model cannot discover them by enumeration — yet they stay callable by name, so a caller that learns them from outside the tool list (the guard's denial text, a user instruction, another tool) can invoke them immediately.
3. Runs a token-confirmed graceful exit/restart through the launcher's existing seams: the headless runner's ctx.headlessIo.exit(code) (code-exact) on one-shot runs, and the launcher's SIGTERM graceful shutdown on long-lived surfaces (web).

Design stance: this is a UX/interception layer, not a security boundary. The matcher recognizes canonical kill forms at the simple-command level inside a bounded shell command list (; && || | |& &, newlines, comments, quoting, ( list ) / { list; } groups, redirections (target word opaque)); dynamic construction ($VAR, $(...), backticks, globs, heredocs), shell functions, unsupported compound syntax, and parser-limit failures abstain. Variable splicing, encodings, interpreters, process-group signals, PTY, MCP, Code Runtime, cordis_mount, and direct syscalls are all documented out-of-scope (see Interception coverage and Known Limitations). The OS can always kill the host; the guard's job is to make the model reach for the controlled tools instead, and to leave an audit trail when it does.