dsh-guardian-mode

The fifth mode of DeepSeek Harness (DSH): preset id guardian, combining
PTC code presentation, independent review, and a human-approved Cordis
remediation loop.

An agent on this preset keeps full standard-mode capabilities (shell,
filesystem, web, skills, goals, subagents, workflows, Code Mode tool
presentation). Cordis self-modification tools stay model-hidden during ordinary
work and are exposed temporarily only after the user accepts a critical
remediation. Separately, every session drives two isolated reviewer roles. The
reviewer backend is configurable as Codex, Claude Code, or the host
DSH LLM runtime. The default remains one persistent Codex app-server:

Codex and Claude Code keep separate persistent role sessions. The DSH backend
uses direct, tool-free llm.stream() calls instead of starting another DSH
Agent, so it cannot recursively enter Guardian mode. Those calls are stateless,
so Guardian includes the current objective and a bounded tail of sidecar review
memory in every DSH audit.

All unaccepted feedback and reviewer state is written to a sidecar
(${DSH_HOME:-~/.dsh}/guardian/sidecars/<sessionId>.json). Only explicit human
acceptance appends a bounded <guardian-remediation> prompt and capability
lease at the context tail. The model then loads the named skills through DSH's
stable skill tool; prior messages are never rewritten and raw reviewer output
remains private.

Install

# in your dsh profile (profiles/web and profiles/tui use the same pattern)
cd ~/.dsh/profiles/web
pnpm add dsh-guardian-mode@github:yhfgyyf/dsh-guardian-mode
# Recommended stable tool discovery for Guardian and Auto target presets:
pnpm add dsh-progressive-tools@github:yhfgyyf/dsh-progressive-tools
# add both bundles to package.json dsh.profile.bundles (both profiles),
# then restart the profile.

The bundle patch adds one dual-face row:

- insert:
    - id: guardian-bundle
      name: dsh-guardian-mode

The node half mounts the host guardians service, registers the /guardian
command, and (when a webserver is present) the Remote API. The same row's
browser half (dsh.client) renders the guardian strip in the composer dock.

Using the mode

• Start a session with --preset guardian (TUI) or pick guardian in the
  Web preset chip, or /preset guardian on a blank session.
• /guardian status — round, cadence interval, last verdict, pause state.
• /guardian now — force an audit (out of cadence).
• /guardian history — recent audits from the sidecar.
• /guardian accept [audit-id] — approve the latest/specified remediation.
• /guardian resume — clear a non-critical-review failure/manual pause.

Reviewer configuration

Configure the guardian-bundle row in the profile's cordis.patch.yml. No
configuration preserves the existing Codex defaults:

- id: guardian-bundle
  config:
    reviewer: codex
    binary: codex
    args: [app-server, --stdio]
    models:
      summarizer: { model: gpt-5.6-luna, effort: medium }
      auditor: { model: gpt-5.6-sol, effort: max }

summarizer and auditor are stable, responsibility-based keys; their model
names remain fully configurable. Legacy luna / sol keys are still accepted
and are migrated to the new names at runtime.

Claude Code uses print mode with JSON-schema output, plan permission mode,
safe mode, and an empty tool set. Set Claude-supported model names explicitly:

- id: guardian-bundle
  config:
    reviewer: claude-code
    claudeBinary: claude
    claudeArgs: []
    models:
      summarizer: { model: haiku, effort: medium }
      auditor: { model: opus, effort: max }

The DSH backend routes directly through a registered provider. A per-role
provider overrides dshProvider when summary and audit use different routes:

- id: guardian-bundle
  config:
    reviewer: dsh
    dshProvider: deepseek-official
    dshMaxTokens: 4096
    models:
      summarizer: { model: deepseek-v4-flash, effort: off }
      auditor: { model: deepseek-v4-flash, effort: high }

Changing reviewer does not translate model names. Guardian fails loudly if
the selected backend does not support a configured model; it never silently
substitutes an audit model.

Behavior

• Cadence: the first audit requires at least two steps and 60 seconds;
  later audits run every three steps or three minutes, with a 60-second minimum
  gap. Anomalies audit at the next safe boundary.
• Warning approval: a warning leaves the main Agent running. Acceptance
  cancels the current turn, appends the approved repair prompt, executes one
  repair turn, and performs a fresh verification audit.
• Critical approval: critical pauses the main Agent and active Goal first.
  Acceptance temporarily exposes Cordis tools and appends a capability lease.
  The repair Agent must load editing-cordis-compositions through the stable
  skill loader, and loads cordis-plugin-development only for plugin or
  model-facing-tool work. The original task resumes only after the repair audit
  is no longer critical.
• Three consecutive failures (reviewer unreachable, timeouts, malformed
  replies) pause the session with reason failures.
• Every 5 rounds a full objective-alignment audit runs (objective +
  boundary rules + recent summaries).
• Final audit runs when the session is disposed (or /guardian now with
  the Remote API final: true).
• Fixed capability: guardian (GUARDIAN_CAPABILITY). The auto router
  keeps routing only standard / code / minimal / cordis.

Remote API (browser)

Third-party routes, declared by this package:

The Web dock strip registers at conversation.input.dock order 5 —
rendered between the Todo strip (order 0) and the Goal strip (order 10).

TUI

dsh-tui-app renders an independent color-coded block (pass=green,
warning/critical/paused=red) beside the config row:

• a — accept a pending remediation (empty composer only)
• c — copy feedback while paused
• r — resume a non-critical-review pause
• Esc / Ctrl+C — stop current work

Development

npm test            # unit + integration
npm run check       # syntax, package manifest, tests
npm run pack:check  # npm pack --dry-run

scripts/build-preset.mjs regenerates presets/guardian/agent.cordis.yml
from the shipped code + cordis compositions (checked-in result, so the
package works standalone). Tests use test/fixtures/fake-codex.mjs and
fake-claude.mjs; no real reviewer login is required. Backend, models, effort,
binaries, CLI arguments, DSH provider route, timeout, and DSH output limit are
configuration rather than constants.

Compatibility

• Never calls session.delete or any session-removal API; disposal is
  observed via the host session/disposed event for a final audit only.
• Auto still routes only the original four modes. When the companion auto
  router supports capability hints, those names are appended after routing and
  do not alter the original user prompt.
• Images, ordinary skills, goals, subagents, and workflows flow unchanged.
  Guardian's two composition skills are progressive, critical-approval-only
  additions (see presets/guardian/agent.cordis.yml).
• Persisted messages remain byte-for-byte unchanged. Acceptance only appends
  remediation, runtime-catalog, and continuation tail messages, so the prior
  message prefix remains eligible for KV-cache reuse. With
  dsh-progressive-tools, Cordis restriction changes affect discovery results
  rather than the model-visible system/tool prefix. Without that companion,
  DSH normally rebuilds the Code Mode SDK when visibility changes. An actual
  plugin/system-prompt repair still takes effect through DSH's normal
  restart/new-task prefix rebuild.
• Does not modify the global node_modules; install as a profile bundle.