dsh-plugin-vajraclaw

dsh plugin --profile web add dsh-plugin-vajraclaw

⚡ DROS™ VajraClaw for DSH & Multi-Agent Workstations

Local Tool-Call Failsafe & Runtime Governance Sidecar for Autonomous AI Agents





[English](#english) | [繁體中文說明](#-繁體中文說明) | 🌐 Official Website

Local tool-call failsafe for DSH: blocks high-risk shell patterns (e.g. destructive recursive deletions, fork bombs, disk overwriting) and credential-file reads before execution, with a persistent hash-linked JSONL audit log, and an optional external Gateway for centralized multi-agent policy.

🎯 Dual Architecture Overview:

1. Embedded Mode (Default): Zero-dependency local TypeScript pattern-matching failsafe and JSONL audit chain running natively inside DSH with zero latency overhead.

2. Gateway Mode (Optional): Connect to an external DROS Gateway container for multi-agent workstation synchronization (AGY, Codex, Claude Code, Cursor).

                 DSH Tool Call Event
                          │
                          ▼
            [dsh-plugin-vajraclaw]
                          │
           ┌──────────────┴──────────────┐
           ▼                             ▼
   [Embedded Mode] (Default)      [Gateway Mode] (Optional)
   • Regex Pattern Failsafe       • Centralized Multi-Agent Policy
   • Sensitive File Protection    • Cross-Station Sync (AGY, Codex, Claude)
   • Persistent JSONL Audit       • Requires DROS Gateway Container

---

🎁 【Community Edition: Free Forever for Personal Multi-Agent Workstations】

* 🛡️ 100% Free for Personal Use (Non-Commercial Use): Embedded local failsafe is fully open-source (Apache-2.0).

* 📝 Audit Logging: Structured JSONL audit records linking execution history across session restarts.

* ⚡ Optional Centralized Gateway: Provides cross-agent governance when opting into external Gateway deployment.

> 📌 Compliance Notice: Any deployment operated by corporate entities, salaried employees within the scope of employment, or used to generate commercial value strictly requires a commercial license.

---

🏛️ Philosophy: Guarding the Hyper-Open Plugin Ecosystem

The brilliance of DeepSeek Harness (DSH) lies in its radical openness: "Everything is a plugin." However, this hyper-openness inevitably expands the attack surface:

• Any rogue third-party plugin can attempt unauthorized tool execution, memory poisoning, or silent data exfiltration.
• DROS steps in as the universal anchor, orchestrating best-of-breed open-source security tools (Falco eBPF, Cilium CNI, Wazuh SIEM) to construct an impregnable Defense-in-Depth perimeter for all developers!

┌─────────────────────────────────────────────────────────────┐
│ 1. In-App Layer: DSH Security Plugins                       │  <── 🏢 Reception Security (Prompt Filtering)
│    (NeMo / Llama-Guard filters conversational toxicity)     │
└──────────────────────────────┬──────────────────────────────┘
                               │ (Valid Prompt, prepares Tool Call)
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Runtime Gateway: DROS VajraClaw (Core Anchor)            │  <── 🏛️ Vault Gatekeeper (Execution Identity)
│    (W3C DID Signature + 364ns O(1) Tool Permission Bitmap)  │      Enforcement-path latency <1 μs under specified benchmark!
└──────────────────────────────┬──────────────────────────────┘
                               │ (Permitted Tool Call)
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Infrastructure Layer: Open-Source SecOps (Cilium / Falco)│  <── 🚓 Police Grid (Kernel & Network Fabric)
│    (Cilium blocks rogue egress; Falco eBPF catches escapes)  │
└─────────────────────────────────────────────────────────────┘

---

🧭 Governance Scope: What DROS Defends vs. What It Doesn't

To maintain complete architectural clarity and rigorous technical defense, DROS defines crisp defensive boundaries:

Attack Vector / Threat · Traditional Semantic Guardrails · DROS VajraClaw Core · Defensive Outcome

Indirect Prompt Injection (PDF/Web hijacking tool execution) · ❌ Easily fooled by LLM confusion · ✅ Deterministic Block · Deterministic In-Band Fusing (<1μs benchmarked bitmap match)

Rogue Tool Calling (Unauthorized DB write / Shell execution) · ❌ Flawed application logic · ✅ Cryptographic Block · 100% Interception within defined threat model & capability vector

Data Exfiltration (Plugin silently sending tokens to C2) · ❌ Invisible to LLMs · ✅ Network Isolated · 100% Dropped (internal: true sandbox topology)

Container Escape / Privilege Escalation · ❌ No host visibility · ⚠️ Handled via Falco · eBPF Kernel Detection (cap_drop: ALL capability isolation)

Business Logic Flaws / Model Hallucinations · ❌ Beyond security scope · ❌ Beyond security scope · Handled via Prompt engineering & Agent QA workflows

---

🔑 Zero-Trust Key Management & Root Recovery Principle

DROS operates on a strict Zero-Trust Cryptographic Model:

1. No Backdoors Policy: The vendor holds NO master keys. Your Ed25519 private seed hex is generated locally. Always backup your seed hex into your password manager.

2. Rebuilding Root of Trust: If you lose your private key, recovery is only possible if you maintain Root/SSH access to the host server to re-deploy th

…(truncated)