dsh-route-fence-linter
Audits every plugin HTTP route in a profile for a browser-trust fence: plugin routes win the web server's longest-prefix match ahead of the /api gateway, so they never see its trust check and must pin the Host to loopback themselves. Grades PASS/WARN/FAIL per route and fails a fence that compares Origin to Host without pinning it (bypassable by DNS rebinding). Ships as a CLI for CI and a route_fence_scan tool.
审计 profile 内所有插件 HTTP 路由的浏览器信任围栏：插件路由在 Web 服务器的最长前缀匹配中优先，因此缺少围栏的路由会被静默暴露；逐条给出文件与行号级别的证据。
How to install
dsh plugin add github:Vladimir-Kryshchenko/dsh-route-fence-linter About
dsh-route-fence-linter Every plugin route registered on webServer is dispatched by **longest-prefix match**, ahead of the host's /api gateway — so it never passes the gateway's unified trust check. Each plugin author must ship their own browser-trust fence, and most do not. This linter finds the ones that did not. Usage sh dsh-route-fence scan # $DSH_HOME/profiles/web dsh-route-fence scan /path/to/profile Exit codes: 0 clean · 1 at least one FAIL · 2 usage/IO error. Verdicts | Verdict | Meaning | |---|---| | PASS | The handler gates on a fence that pins the Host before Origin handling. | | WAR…
Recommendation signals
Meta
- License
- MIT
- Language
- TypeScript
- GitHub stars
- 0
- mo. downloads
- –
- Last push
- 2026-08-22
- Created
- 2026-08-21
Links
Basic safety check
- Findings
- curated 收录但无 npm 包/安装命令
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- deepseek-harness, dsh-plugin, security
Related plugins
dsh-secure-audit
PensiveFei/dsh-secure-audit
Read-only security and compliance plugin for DeepSeek Harness: prompt-injection detection, Chinese-PII redaction, and a local configuration audit with redacted, reproducible reports.
dsh-auto-approve
Jiao-XXX/dsh-auto-approve
Adds an `auto` permission preset between workspace-write and danger-full-access: a classifier grants routine sandbox escalations once, while dangerous or uncertain requests still go to a human.
dsh-plugin-vet
wulun811/dsh-plugin-vet
Plugin trust pipeline for DeepSeek Harness: deterministic static scan with verdicts, opt-in runtime guard with honeypot lures, agent audit-protocol skill, and a browser shield status light. Alarm-only, never an enforcer.
dsh-agent-approval
MoonlitDropOfBlood/dsh-agent-approval
An independent approval subagent judges every sandbox escalation, with a configurable model and an audit log.