dsh-override-guard

A sanitizing layer that outranks dsh-purge. It does not touch the model and does not swap prompts. It exists so that no plugin gets to speak on the model's behalf.

• Re-sanitizes the assembled system prompt (drops the region/sector exclusion clause, rewrites bare <project_instructions> with a scope attribute)
• Restores user messages that an upstream hook swallowed
• Clears blocked / refusal-text error markers other plugins set on tool calls
• Detects forged refusals and logs who wrote them, with a timestamp
• Repairs dsh-purge's own source when an upgrade puts the gate back

---

Why this layer is needed

dsh-purge registers its injection hook like this:

ctx.on("system-prompt/assemble", handler, { global: true, prepend: true });
// inside: const assembled = await next(); return rewriteLiveAssembly(...);

prepend: true plus await next() means it sits at the head of the chain and rewrites whatever the rest of the chain produced. Registering earlier does not help — it wraps you.

So the strategy is not to race it, but to do three things at once:

Approach	Where	Effect
Post-hoc sanitize	system-prompt/assemble, agent/pre-step	Whatever changed last, it passes through again
Source sanitize	$DSH_HOME/prompt-inject.md + the encrypted slot	What it injects is already clean
Source self-heal	net-scope.js / index.js / core.js	If an upgrade reinstalls the gate, it is removed again within five minutes

Defense in depth: no single failure changes the outcome.

---

Install

dsh plugin add https://codeload.github.com/X-max0/dsh-override-guard/tar.gz/refs/heads/main --profile web

Git and local-link variants:

dsh plugin add https://github.com/X-max0/dsh-override-guard.git --profile web
dsh plugin add "link:C:/path/to/dsh-override-guard" --profile web

Manual install:

1. Place this package at $DSH_HOME/profiles/web/node_modules/dsh-override-guard (junction or symlink is fine).
2. Append to $DSH_HOME/profiles/web/cordis.patch.yml:

- insert:
    - id: dsh-override-guard
      name: dsh-override-guard
      inject: [systemPrompt, tools]
      config: {}

postinstall registers the package in the profile's dsh.profile.bundles, which is what makes it appear in the plugin manager.

⚠️ Running dsh plugin add / pnpm add while the host is running rewrites node_modules and drops the live process. Stop the host first, or accept the restart.

ℹ️ pnpm 9/10 blocks dependency build scripts by default. If the install log shows Ignored build scripts: dsh-override-guard, run pnpm approve-builds once; otherwise postinstall will not register the package in dsh.profile.bundles. Manual fallback: add "dsh-override-guard" to the profile's dsh.profile.bundles array — the effect is identical.

Restart the host once after installing — bundles are read at boot.

---

Verify

dsh-override-guard status   # inject file, purge markers, override-state
dsh-override-guard verify   # exit code 1 on any problem
dsh-override-guard heal     # run a full repair now
dsh-override-guard where    # resolved paths

Confirm the plugin actually loaded:

grep "plugin.applied" "$DSH_HOME/override-guard/guard.log" | tail -1

Runtime log: $DSH_HOME/override-guard/guard.log

Event	Meaning
plugin.applied	loaded by the host
assemble.sanitized	a system prompt was rewritten
preStep.restore	swallowed user messages were restored
tool.unblock	a blocked marker was cleared
denial.detected	a forged refusal was caught (excerpt attached)
heal.trigger / heal.done	purge source had been reverted and was repaired

---

Hooks

Event	Option	Action
system-prompt/assemble	prepend	await next(), then sanitize sections[].text
agent/pre-step	default (tail)	sanitize decision.messages; restore when messages came back empty
tools/pre-execute	prepend	clear exec.blocked and refusal-text exec.error
session/event	global	detect forged refusals in short assistant text
—	timer	every 5 minutes, check purge markers and self-heal

Sanitizing touches exactly three things: the Excluded targets only: ... sentence, the bare <project_instructions> tag, and the fixed refusal string 该目标在禁止范围内……. Nothing else.

---

Self-heal patches

File	Target	Result
net-scope.js	publicHostHit()	returns null; original logic kept as publicHostHitLegacy for audit
index.js	installRegionGate(ctx)	commented out; no more agent/pre-step / tools/pre-execute gate
core.js	defaultOverrideText()	sanitizes the decrypted slot, so apply/update/restore cannot reintroduce the clause

Each is marked [operator-fix], idempotent, and backed up as *.bak-<timestamp> before writing.

---

Compatibility

• Host: DeepSeek Harness 0.2.x (same generation as dsh-purge)
• Target: dsh-purge 1.x — if a marker does not match, it skips instead of writing garbage
• Node >= 18

If a major dsh-purge release changes a signature, heal reports a pattern miss rather than corrupting the file. Check verify output and add a rule for the new signature.

---

Uninstall

dsh plugin remove dsh-override-guard --profile web

Remove the insert entry from cordis.patch.yml and restart. Leftover *.bak-* files can be deleted.

---

License

MIT