DeepSeek Harness: Defensive Programming and Incident Review

// ❌ Hardcoded API Key
const apiKey = 'sk-abc123def456'

// ❌ API Key written to logs
ctx.logger.info(`connecting with key: ${apiKey}`)

// ❌ API Key in URL
const url = `https://api.example.com?key=${apiKey}`

// ❌ API Key in error message
throw new Error(`Authentication failed for key: ${apiKey}`)

// ✅ Read from configuration
export const Config = Schema.object({
  apiKey: Schema.string().required().hidden()
})

export function apply(ctx: Context) {
  const apiKey = ctx.config.apiKey
  // apiKey only used within apply, not leaked externally
}

// ✅ Use environment variables
const apiKey = process.env.MY_PLUGIN_API_KEY

// ✅ Pass via request header (not in URL)
const response = await fetch(url, {
  headers: { 'Authorization': `Bearer ${apiKey}` }
})

// ✅ Hide sensitive info in logs
ctx.logger.info(`connecting to ${endpoint}`)  // Don't log the key

// ✅ Custom log filter
function sanitize(obj: any): any {
  const sanitized = { ...obj }
  if (sanitized.apiKey) sanitized.apiKey = '***'
  if (sanitized.authorization) sanitized.authorization = '***'
  return sanitized
}

ctx.logger.info('request:', sanitize(request))

export const Config = Schema.object({
  apiKey: Schema.string().required().hidden(),
  keyRotationDays: Schema.number().default(90)
})

export function apply(ctx: Context) {
  ctx.setInterval(() => {
    const age = getKeyAge()
    if (age > ctx.config.keyRotationDays * 86400000) {
      ctx.logger.warn('API key is overdue for rotation')
    }
  }, 86400000)
}

// ❌ Don't validate tool results
async execute({ path }, ctx) {
  const result = await ctx.shell.execute(`ls ${path}`)
  return result.stdout  // May be empty or malformed
}

// ✅ Validate tool results
async execute({ path }, ctx) {
  const result = await ctx.shell.execute(`ls ${path}`)
  
  if (result.exitCode !== 0) {
    return {
      error: true,
      message: `ls failed: ${result.stderr}`,
      exitCode: result.exitCode
    }
  }
  
  if (!result.stdout || result.stdout.trim().length === 0) {
    return {
      error: true,
      message: 'Directory is empty or does not exist'
    }
  }
  
  const files = result.stdout.trim().split('\n')
  return { count: files.length, files }
}

// ❌ Don't validate API responses
const data = await response.json()
return data.result

// ✅ Validate API responses
async function callAPI(ctx: Context, endpoint: string): Promise<any> {
  const response = await fetch(endpoint)
  
  if (!response.ok) {
    throw new Error(`API error: ${response.status} ${response.statusText}`)
  }
  
  let data: any
  try {
    data = await response.json()
  } catch {
    throw new Error('API returned invalid JSON')
  }
  
  if (!data || typeof data !== 'object') {
    throw new Error('API returned unexpected format')
  }
  
  return data
}

// ❌ Don't validate user input
async execute({ command }, ctx) {
  return await ctx.shell.execute(command)  // Command injection risk
}

// ✅ Validate and sanitize input
async execute({ command }, ctx) {
  if (!command || typeof command !== 'string') {
    return { error: true, message: 'Invalid command' }
  }
  
  if (command.length > 1000) {
    return { error: true, message: 'Command too long' }
  }
  
  // Whitelist check
  const allowed = ['ls', 'cat', 'grep', 'wc', 'head', 'tail']
  const baseCommand = command.split(' ')[0]
  if (!allowed.includes(baseCommand)) {
    return { error: true, message: `Command not allowed: ${baseCommand}` }
  }
  
  return await ctx.shell.execute(command)
}

export function apply(ctx: Context) {
  // All resources that need cleanup
  const resources: { close: () => void | Promise<void> }[] = []

  // Register cleanup immediately when acquiring resource
  function acquireResource<T extends { close: () => void | Promise<void> }>(
    resource: T
  ): T {
    resources.push(resource)
    return resource
  }

  // Unified cleanup
  ctx.effect(() => {
    return async () => {
      for (const r of resources.reverse()) {
        try {
          await r.close()
        } catch (e) {
          ctx.logger.warn('cleanup error:', e)
        }
      }
    }
  })

  // Usage
  const db = acquireResource(openDatabase())
  const ws = acquireResource(new WebSocket('ws://localhost:8080'))
}

export function apply(ctx: Context) {
  const tempFiles: string[] = []

  ctx.effect(() => {
    return async () => {
      for (const file of tempFiles.reverse()) {
        try {
          await ctx.fs.unlink(file)
        } catch {}
      }
    }
  })

  async function createTempFile(content: string): Promise<string> {
    const path = `/tmp/dsh-${Date.now()}-${Math.random().toString(36).slice(2)}`
    await ctx.fs.writeFile(path, content)
    tempFiles.push(path)
    return path
  }
}

Principle 1: Minimize side effects
  → Only execute necessary operations
  → Prefer read-only, then idempotent writes

Principle 2: Side effects should be reversible
  → Save original state before writing
  → Provide undo operations

Principle 3: Side effects should be auditable
  → Record details of each side effect
  → Users can view operation history

Principle 4: Side effects require approval
  → Destructive operations must be approved
  → Non-idempotent operations should be approved

interface ReversibleAction {
  execute(): Promise<void>
  rollback(): Promise<void>
}

class FileEditAction implements ReversibleAction {
  private originalContent: string | null = null

  constructor(
    private path: string,
    private newContent: string,
    private ctx: Context
  ) {}

  async execute() {
    try {
      this.originalContent = await this.ctx.fs.readFile(this.path)
    } catch {
      this.originalContent = null
    }
    await this.ctx.fs.writeFile(this.path, this.newContent)
  }

  async rollback() {
    if (this.originalContent !== null) {
      await this.ctx.fs.writeFile(this.path, this.originalContent)
    } else {
      await this.ctx.fs.unlink(this.path)
    }
  }
}

const auditLog: AuditEntry[] = []

function audit(action: string, details: any, reversible: boolean) {
  auditLog.push({
    timestamp: Date.now(),
    action,
    details,
    reversible,
    user: 'agent'
  })
  ctx.emit('audit/action', { action, details, reversible })
}

// Usage
audit('file_edit', { path: 'src/app.ts', operation: 'edit' }, true)
audit('email_send', { to: 'alice@example.com' }, false)

# Incident Review: [Title]

## Basic Information
- Date: YYYY-MM-DD
- Impact: [Affected features/users]
- Severity: P0/P1/P2
- Handler: [Name]

## Timeline
- HH:MM — [Event 1]
- HH:MM — [Event 2]
- HH:MM — [Fix]

## Root Cause Analysis
[5 Whys analysis]

## Remediation
- Short-term: [Immediate fix]
- Long-term: [Prevention measure]

## Lessons Learned
- [Lesson 1]
- [Lesson 2]

Incident: Agent deleted user project files

Why 1: Agent executed rm -rf /project
  → Because the tool had no path validation

Why 2: Tool had no path validation
  → Because the developer didn't implement whitelist checking

Why 3: Developer didn't implement whitelist checking
  → Because there was no security review process

Why 4: No security review process
  → Because the team hadn't established a security checklist

Why 5: Team hadn't established a security checklist
  → Because of insufficient security awareness training

Fix: Establish a security audit checklist; all plugins must be checked before publishing

# Run security audit
dsh audit my-plugin

# Output
🔒 Security Audit: my-plugin

✅ No hardcoded credentials
✅ All ctx.effect() have cleanup functions
⚠️ Tool 'db_query' has no input validation
❌ API response not validated in 'fetch_data'
✅ Approval policy configured for destructive operations
⚠️ Permission 'shell.execute' may not be necessary

2 errors, 2 warnings found. Fix before publishing.