DSH Plugin Hub
Sandbox & Runtimedsh-plugin

dsh-tool-runseal

RunSeal sandbox provider for DeepSeek Harness, replacing the built-in sandbox with OS-native policy-enforced command execution on Windows/macOS/Linux.

Stars
0
Forks
0
Open issues
0
Last push
Aug 15, 2026
Latest release
—
24h Growth
+0
7d Growth
+0

Installation

No reliable install command was detected. Check the project README for installation instructions.

Overview

RunSeal sandbox provider for DeepSeek Harness, replacing the built-in sandbox with OS-native policy-enforced command execution on Windows/macOS/Linux.

  • OS-native sandbox with enforceable filesystem, process, resource, and network boundaries
  • Maps dsh sandbox levels (read-only, workspace-write, danger-full-access) to RunSeal policies
  • Network modes: unmanaged, disabled, or proxy with credential redaction
  • Streaming stdout/stderr and exit code propagation via RPC events
  • Fail-closed behavior: missing setup or backend rejects with clear error
  • Structured audit events and JSONL audit records for every execution
  • Automatic Windows sandbox setup with UAC prompt on first confined execution
  • Out-of-tree plugin, depends only on published dsh base packages

Related plugins

dsh-approve-for-me

Unofficial DeepSeek Harness plugin for rule-gated automatic approval of Shell and PowerShell sandbox escalations. It applies fixed high-risk checks and literal command-prefix rules, optionally uses a tool-free LLM reviewer, grants only one allowed-once per decision, and returns uncertain requests to native human approval.

Sandbox & Runtimedsh-plugin
151TypeScriptSep 12, 2026
dsh-server-deployment

Server-side deployment for DeepSeek Harness: a zero-dependency Node gateway adds a multi-user login portal, per-user independent DSH instances with OS-level isolation, per-user API keys, and a delivery file drawer. File access runs through sudo helper scripts using runuser to drop privileges to dsh-<name> (fixes issue #1 TOCTOU). Not a local/desktop tool.

Sandbox & Runtimedsh-plugin
81JavaScriptAug 18, 2026
QAQ

QAQ is a launch resilience guard for DeepSeek Harness (DSH) by WTStarMark. It supervises the `dsh web` process, reads the browser's real DOM through headless Chrome + CDP, detects host crashes, Web UI red screens and plugin degradation, then restores the configuration snapshot from the last successful boot and restarts, preserving the broken config for manual recovery. It is described as non-invasive, shipped as a one-command script with structured logs, and includes a plugin hot-update guard (c

Sandbox & Runtimedsh-plugin
41TypeScriptAug 17, 2026
DSHBox

DSHBox is an Android application that lets users run the complete DeepSeek Harness locally on Android 10+ ARM64 devices by bundling Debian, Node.js, DSH, PRoot, and an embedded WebView into one APK without root or Termux.

Sandbox & Runtimedsh-plugin
30KotlinSep 9, 2026