my-dsh-plugin/readonly-security-audit

安装

> bash -c "$(curl -fsSL https://raw.githubusercontent.com/my-dsh-plugin/dsh-presets/main/readonly-audit/install-readonly-audit.sh)"
> ```
>
> Windows PowerShell:
>
> ```powershell
> irm https://raw.githubusercontent.com/my-dsh-plugin/dsh-presets/main/readonly-audit/install-readonly-audit.ps1 | iex
> ```
>
> Trade-off: the native edition has **no automatic read-only** — the
> deployment's `sandbox-policy` default must already be `read-only` (or the
> session must be switched manually), and there is no tool-level allowlist
> gate or mandatory delivery choice. It is still fully read-only at the
> enforcement layer for everything it mounts.

---

A new **read-only security audit mode** for DeepSeek Harness. It appears in the agent-preset picker beside Standard, PTC, Minimal, and Creator: **只读安全审计 / Read-only audit mode**. The assistant may read and analyze code, dependencies, and configuration, while every file mutation is rejected by the system unless the user approves one exact write.

## What it does

- The `readonly-audit` agent preset starts the session already in audit mode (`active: true`); no slash command is required to enter it.
- `/readonly-audit off` leaves the mode for the current session and restores its previous sandbox/approval policy; `/readonly-audit on` and `/readonly-audit status` are also available.
- Entering the mode writes `sandbox/mode: read-only`, so the harness's existing filesystem and process sandboxes reject file writes (`write`, `edit`, bash commands that touch files) at the enforcement layer, not by prompt good will.
- The plugin also registers an outermost `tools/pre-execute` gate. In audit mode every tool call must be an allowlisted reader (`read`, `read_image`, `glob`, `grep`, `str_replace_editor view`, sandboxed `bash`/`pwsh`, web read/search, ask tools) or an explicitly approved single mutation. Everything else fails with `[readonly-audit] 只读安全审计模式`.
- Before the audit starts, the model is forced to call `choose_audit_report_delivery`. The user chooses:
  - **对话直接回复** — the final report is printed in the conversation; no file is created.
  - **生成报告文件** — at the end the assistant writes `SECURITY_AUDIT_REPORT.md`. That single write is sent through the approval channel; only an explicit user approval temporarily widens the session to `workspace-write`, and the plugin restores `read-only` immediately after the call.
- The report contract requires, for each finding: problem description, severity, location, evidence, and a text-only remediation suggestion. The assistant never fixes code in this mode.

## Why it is enforced, not prompted

1. `readonly-audit/mode` and `readonly-audit/delivery` are durable session events; resume/fork restore them by replay.
2. The session's `sandbox/mode` is set to `read-only`. The stock `dsh-fs-sandbox` and `dsh-bash-sandbox` backends enforce this for filesystem tools and subprocesses.
3. A prepended `tools/pre-execute` listener blocks every non-reader tool call before dispatch. If the mounted shell executor cannot enforce read-only, `bash`/`pwsh` are refused outright.
4. Approved writes are one-shot and one-tool-call only: `workspace-write` is appended after approval, and `tools/post-execute` appends `read-only` again. The built-in `sandbox_permissions` escalation ladder is rejected in audit mode, so an approved report write cannot become full access.

## Install on any DeepSeek Harness checkout or fork

This plugin is not tied to one checkout path. The same instructions work for an
upstream checkout, a personal fork such as `deepseek-harness-fork`, a packaged
Harness install, or another machine.

There are exactly two things to install:

1. the plugin package into a profile;
2. the `readonly-audit` agent preset where the Harness preset roster can see it.

No build is required on the target machine — the repository ships `lib/`.

### 1. Install the plugin into a profile

Generic form, using the target checkout's own `dsh` CLI:

把 my-dsh-plugin/readonly-security-audit 加入你的 DSH 配置（web profile）即可启用。