dsh-egress-gate

Part of the DSH trust layer — ten deterministic checks, no LLM in the trust path.

If this helps you, please give it a star — it helps others find it. Thanks!

Deterministic network egress gate for DeepSeek Harness (dsh).

Content scanning (dsh-read-guard) guards what enters the model; this guards where data may leave to. web_fetch / web_search calls are checked against a destination allowlist in tools/pre-execute and denied before they run. Shell commands are scanned for fetch-verb URLs — observation by default, enforcement opt-in, honest about precision. Zero LLM calls in the trust path.

Family: read · write · do · call · leave-behind · egress (where data may flow).

Why now (checked 2026-10-12)

Empty lane. Five keyword searches (network allowlist, egress firewall, url filter, web fetch restrict, …) return nothing on GitHub; the awesome list has no entry gating destinations. Neighbours are all different axes: content-pattern secret rules (dsh-defend), LLM-judged commands (dsh-jev-guard), proxy configuration (official network-proxy docs). For teams, "which hosts may the agent reach" is the first compliance question — and the deterministic answer was unowned.

Policy

• Deny always wins; a non-empty allow list means "only these hosts" (example.com covers api.example.com; *.example.com is the explicit form).
• Web tools are enforced at full precision — the URL is in the arguments.
• Shell: URLs following curl / wget / Invoke-WebRequest / Invoke-RestMethod / fetch / http on the same command segment. This cannot see through scripts, variables, or proxies — so it warns by default and denies only when you opt into shellMode: 'enforce'.

Install

dsh plugin --profile default add github:zhengqiuyang/dsh-egress-gate

Prebuilt lib/ ships in the repo — git installs need no build step and no allowBuilds authorization.

Configure

- id: dsh-egress-gate
  name: dsh-egress-gate
  config:
    webTools: [web_fetch, web_search]
    shellTool: bash            # '' disables the shell scan
    allow: [docs.deepseek.com, github.com]
    deny: [pastebin.example]
    shellMode: observe         # observe | enforce

Compatibility

• DSH: verified against the 0.2.x line (source snapshot 0.2.1-alpha.2); installs on any profile via dsh plugin add (prebuilt lib/, no build approval).
• Node: >= 20 (CI matrix: Node 20/22/24 on Ubuntu and Windows).
• Disposable-profile evidence (2026-10-19): dsh plugin --profile <fresh> add github:zhengqiuyang/dsh-egress-gate → installed in 30s; boot shows [dsh-egress-gate] active: …; dsh plugin --profile <fresh> remove dsh-egress-gate → dependencies cleared, bundles restored.

Develop

npm install && npm test

Kill criteria

If dsh ships first-party destination policy, or proxy-layer plugins add per-host rules, this freezes at its last working version with a postmortem here.

Known limitations

• Web tools are enforced; shell is observe-only by default (set shellMode: 'enforce' to change). A fetch verb gates every URL in its own command segment; segments without one (a plain echo) are not treated as sends.
• No redirect resolution: the check sees the requested host, not where a redirect lands.
• This is not an OS-level network control. Scripts, sockets, proxies, and MCP tools with their own network access are outside this gate — use a sandbox or proxy for hard boundaries.