dsh-trust-panel

dsh plugin --profile web add dsh-trust-panel

dsh-trust-panel

If this helps you, please give it a star — it helps others find it. Thanks!

One plain-language dashboard for the dsh trust family in your

DeepSeek Harness (dsh) web sidebar: every interception,

denial, drift and forgotten constraint across nine channels, translated into sentences a non-security

user can read and act on. Zero LLM calls.

What you see

A status light, nine channel rows, and event cards — that's it:

• 🟢 All clear — nothing suspicious
• 🟡 Caught a few things for you — all handled, nothing to do
• 🔴 {n} thing(s) worth a look (below) — each such card carries a Got it button; acknowledging it clears the state, and the light falls back on its own

Every event answers the same four questions in order: *who, what they tried, what we did about it,

whether you must act.* Engine jargon (INSTR_OVERRIDE, hash-chain digests, surface drift) stays in the

expandable detail; the headline is a sentence like:

Something the agent read asked it to send your credentials somewhere. Flagged for review.

A long conversation was summarized — the agent forgot 2 of your instructions. Reported so you can restate them.

The tools available to your agent changed since the last checkpoint. 1 removed: janitor_scan.

A first-run intro card explains the light and the row semantics in one glance; it dismisses with one

click and stays dismissed.

Bilingual (zh/en)

The panel follows the DSH i18n system: events travel from the host as **translation keys +

params**, the client renders them through its zh/en dictionaries with the host's locale service

(language switches live, browser language as fallback). A regression test pins the contract: every

key the host can produce must exist in both dictionaries.

State-like events (tool-surface / prompt / composition drift) carry a content-derived stable id:

acknowledging one sticks across polling, and a genuinely new drift arrives as a genuinely new card.

The nine channels

Channel · Source · What it watches

What the agent reads · dsh-read-guard · prompt injection in files and fetches

What the agent changes · dsh-pr-gate · writes outside the promised scope

The activity record · dsh-attest-chain · tampering with the custody ledger (verified live)

The tools it can use · dsh-mcp-test · registry drift vs baseline

Leftovers in your workspace · dsh-janitor · scan verdicts

Where data is sent · dsh-egress-gate · destinations outside the allow list

The instructions it starts with · dsh-prompt-drift · system-prompt changes

The plugins that are loaded · dsh-freeze · profile composition

What it remembers · dsh-compaction-guard · constraints lost to compaction

Channels report not installed when their plugin/data source is absent — the panel degrades

gracefully and still works standalone: the read/egress engines run from the panel's own

npm dependencies, so injection and egress events appear even without the sibling plugins.

Install

dsh plugin --profile web add dsh-trust-panel

Configuration (in cordis.yml): eventsPath (panel event log), maxEvents, and the

allow/deny domain lists used by the built-in egress mirror.

Design notes

• The trust path stays deterministic — the panel only reads files and harness events; it never calls a model.
• Translation, not display — the engine terminology the family logs internally is mapped to plain sentences in translate.ts; the mapping is unit-tested, so a rule rename cannot silently regress the wording.
• Poll, don't push (v0.1) — the client polls /trust-panel/api/summary every 5 s; a WebSocket upgrade can come later without changing the model.
• Web client modules are not plain ESM — dsh's web runtime loads client halves through its window.__ModuleLoader__ module table (react arrives via that table's require, not a bundler). This package authors its client directly in that format and ships it unbuilt; a rolldown build is unnecessary at this size. Undocumented upstream, learned the hard way.
• Native sidebar tabs are address-driven — registering a tab kind shows nothing until the sidebarRight controller opens it; the panel calls openTab once per session so the light is visible out of the box.

Kill criteria

If the family's engines change their ledger formats in incompatible ways and the sync

cannot be maintained, this panel should be retired rather than show stale or wrong

translations — a trust UI that lies is worse than none.

Compatibility

• Verified on DSH 0.2.x (source snapshot 0.2.1-alpha.2, 2026-10-19): disposable-profile

install → boot → right-sidebar tab compose → /trust-panel/api/summary responds with

live aggregation (including a true-positive tool-surface drift detection during the

verification boot), Chinese rendering verified in-browser, acknowledge flow verified

across poll cycles by browser automation.

• Node ≥ 20.

License

MIT