{"_id":"@cueai/dsh-omni-reader-guard","_rev":"5-5d60b3828de4e1ee0f03ca10bb5e511f","name":"@cueai/dsh-omni-reader-guard","dist-tags":{"latest":"0.1.5"},"versions":{"0.1.0":{"name":"@cueai/dsh-omni-reader-guard","version":"0.1.0","keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf"],"license":"MIT","_id":"@cueai/dsh-omni-reader-guard@0.1.0","maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"c5250ca4ecfee2b54381451214593d8beeb44fb9","tarball":"https://registry.npmjs.org/@cueai/dsh-omni-reader-guard/-/dsh-omni-reader-guard-0.1.0.tgz","fileCount":6,"integrity":"sha512-/EKBAJ2SUaLfzyBD/M0IOr1A/P0O0s7rg0BUk3eTzNxeE+4xG8s3HGBUWMyUtno+UEANLhr85r11Zt72jEGT8Q==","signatures":[{"sig":"MEQCIFIvs1iSq4N9+xuWkUuZ1ZCyk16QuwFRN32b/5g/p1PgAiBK1D44nOCmS3mLIf3ix2aFgg4rdFwF57XmapCi9Ty/0w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":16014},"main":"./index.js","type":"module","engines":{"node":">=20.12"},"exports":{".":"./index.js"},"gitHead":"a0e36830e5703478c0e5ac6c685a2a763b4d2f6e","_npmUser":{"name":"huhoo","email":"dianming.hu@gmail.com"},"_npmVersion":"12.0.1","description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","directories":{},"_nodeVersion":"22.22.3","dependencies":{},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/dsh-tools":"*"},"_npmOperationalInternal":{"tmp":"tmp/dsh-omni-reader-guard_0.1.0_1787402073395_0.6143729838967442","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@cueai/dsh-omni-reader-guard","version":"0.1.1","keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf"],"license":"MIT","_id":"@cueai/dsh-omni-reader-guard@0.1.1","maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"2cd81abd40a5651733b233e665fb8261b99c59e6","tarball":"https://registry.npmjs.org/@cueai/dsh-omni-reader-guard/-/dsh-omni-reader-guard-0.1.1.tgz","fileCount":8,"integrity":"sha512-c76932j1eahvp2lwkS6MVRlCqXQ9ipCumt+LZNmM/noSWcJN7ShYY7R+O4WuWqQL2s4T+AqX7zm4KmvaN+A5CA==","signatures":[{"sig":"MEUCIQD+NOBZwSgGTN3UmyOk7A2Qp48oP373pKF3X/7+QD++RwIgG+Z/3ZXGskXRXKtjItbpeN5WbvJTZwUDbIuQS8kWMKU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":21923},"main":"./index.js","type":"module","engines":{"node":">=20.12"},"exports":{".":"./index.js"},"gitHead":"5938e94825739ed52d60ba28029720d39f574454","_npmUser":{"name":"huhoo","email":"dianming.hu@gmail.com"},"_npmVersion":"12.0.1","description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","directories":{},"_nodeVersion":"22.22.3","dependencies":{},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/dsh-tools":"^0.1.1-rc.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-omni-reader-guard_0.1.1_1787552394695_0.25317647652181363","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@cueai/dsh-omni-reader-guard","version":"0.1.2","keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf"],"license":"MIT","_id":"@cueai/dsh-omni-reader-guard@0.1.2","maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"c4d3cfe24dd92f713a9c6815550955aa006c485e","tarball":"https://registry.npmjs.org/@cueai/dsh-omni-reader-guard/-/dsh-omni-reader-guard-0.1.2.tgz","fileCount":8,"integrity":"sha512-PXmt1/jf6ohNUC+48MvbWWKDYNY7DO+lLtwYEoaDyhdpp+cg1GlKcG7/475jLRa2l35wpOzLRozLjVlWGRNiHQ==","signatures":[{"sig":"MEQCIFjmdJJa7ayw+sHWm6NzvQVO/QI4B6sQPpoeegA9Toj9AiA5+9pO/wbTrCWwYNFSvyrgQILim6668G4iEgvIQvZJUg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":22545},"main":"./index.js","type":"module","engines":{"node":">=20.12"},"exports":{".":"./index.js"},"gitHead":"fb70d337330d547c0fa9803d28891855007b7443","_npmUser":{"name":"huhoo","email":"dianming.hu@gmail.com"},"_npmVersion":"12.0.1","description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","directories":{},"_nodeVersion":"22.22.3","dependencies":{},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/dsh-tools":"^0.1.1-rc.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-omni-reader-guard_0.1.2_1787809575971_0.775746210570261","host":"s3://npm-registry-packages-npm-production"}},"0.1.4":{"name":"@cueai/dsh-omni-reader-guard","version":"0.1.4","keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf"],"license":"MIT","_id":"@cueai/dsh-omni-reader-guard@0.1.4","maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"9a2fbcbbcdb58590345c120d190c15d6709906f6","tarball":"https://registry.npmjs.org/@cueai/dsh-omni-reader-guard/-/dsh-omni-reader-guard-0.1.4.tgz","fileCount":8,"integrity":"sha512-Wt2/uAnRYdlzryLNnyQeXDCVJPPr464XeikjNsViQbZx7n8w0WcvGgkeL8RTk9t8Dmwf8Hi6Mbsyg2zsFJH4eg==","signatures":[{"sig":"MEYCIQCoNgAvKhFCUQVg3X2S7OaRQKivNKq/7mAIPAO/YvHahAIhAJ8X3k215p9Pmi7+z8a02pg0eTK63XZrHyRW0vWjgG7f","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":22753},"main":"./index.js","type":"module","engines":{"node":">=20.12"},"exports":{".":"./index.js"},"gitHead":"f8b746af7023a2d5ab413990d59227812dbd8b03","_npmUser":{"name":"huhoo","email":"dianming.hu@gmail.com"},"_npmVersion":"12.0.1","description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","directories":{},"_nodeVersion":"22.22.3","dependencies":{},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/dsh-tools":"^0.1.1-rc.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-omni-reader-guard_0.1.4_1787811935364_0.7851059410235948","host":"s3://npm-registry-packages-npm-production"}},"0.1.5":{"name":"@cueai/dsh-omni-reader-guard","version":"0.1.5","description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","license":"MIT","type":"module","main":"./index.js","exports":{".":"./index.js"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dependencies":{},"peerDependencies":{"@deepseek-ai/dsh-tools":"^0.1.1-rc.2"},"engines":{"node":">=20.12"},"keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf","dsh-plugin"],"gitHead":"9f7e657a3e2ea3a7d3e23ea87bbdcfc5916aa1dc","_id":"@cueai/dsh-omni-reader-guard@0.1.5","_nodeVersion":"22.22.3","_npmVersion":"12.0.1","dist":{"integrity":"sha512-H9GzWG8JvwAkzXCD99VW7kQ7/vN46NrKuu0+MEviFs+FYZt6DrEcM3+iiIp9n3VaFaca6Z4e0N3Ka67qCgZkNw==","shasum":"2b961df0840b1c30949477a2b5a39a649ecfe7a7","tarball":"https://registry.npmjs.org/@cueai/dsh-omni-reader-guard/-/dsh-omni-reader-guard-0.1.5.tgz","fileCount":9,"unpackedSize":23019,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCQ5sdYlmIGX9tt/9sgc4C0rIJeatzXhWbCZbboU4S2gQIgOddxOEs7UD57RkN74lUSUA51Jgwe3SpWjfnu7waUGOU="}]},"_npmUser":{"name":"huhoo","email":"dianming.hu@gmail.com"},"directories":{},"maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/dsh-omni-reader-guard_0.1.5_1788523927342_0.18584661862174534"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-22T12:34:33.257Z","modified":"2026-09-04T12:12:07.694Z","0.1.0":"2026-08-22T12:34:33.548Z","0.1.1":"2026-08-24T06:19:54.841Z","0.1.2":"2026-08-27T05:46:16.106Z","0.1.4":"2026-08-27T06:25:35.508Z","0.1.5":"2026-09-04T12:12:07.511Z"},"license":"MIT","keywords":["dsh","deepseek-harness","mcp","omni-reader","guard","ssrf","dsh-plugin"],"description":"DSH bundle: a tools/pre-execute guard that blocks SSRF (private/loopback/link-local/metadata) and enforces an allow-list or explicit consent for the Cue Omni Reader parse tool.","maintainers":[{"name":"huhoo","email":"dianming.hu@gmail.com"}],"readme":"# @cueai/dsh-omni-reader-guard\n\n**中文** · [English](README.md)\n\n一个可选的 **DeepSeek Harness** bundle,用于加固 Omni Reader 的 `parse` 工具。它注册一个 `tools/pre-execute` 监听器,门控 `mcp__omni__parse`,使模型无法静默解析任意 URL。请在 [`@cueai/dsh-omni-reader`](../cue-omni-reader) wiring bundle **之后/旁边**安装它。\n\n## 它做什么\n\n在 `mcp__omni__parse` 调用派发前,护栏会对 `source` 分类:\n\n| source | 结果 |\n|---|---|\n| **私网 / 回环 / 链路本地 / 云元数据主机**(`10/8`、`172.16/12`、`192.168/16`、`127/8`、`169.254.169.254`、`100.64/10`、`fe80::`、`fc00::`、`::1`、`localhost`、`*.local`、`metadata…`) | **deny**(SSRF 护栏) |\n| **白名单主机**(`allowList`) | **allow** |\n| 其它外部主机 | `policyForUnknown` —— `deny`(默认)、`ask` 或 `allow` |\n| **显式配置的 `allowedRoots` 内的本地路径** | **allow** |\n| **`allowedRoots` 之外的本地路径,或未配置 `allowedRoots`** | **deny**(fail-closed) |\n\n其它工具原样放行(护栏只针对 `mcp__omni__parse`)。它同时门控 `source` 参数与 `url` 别名(Bridge 1.5+ 二者只取其一)。\n\n## 安装\n\n```sh\ndsh plugin --profile web add @cueai/dsh-omni-reader-guard\n# 或一次性:\ndsh web --patch ./dsh/cue-omni-reader-guard/cordis.patch.yml\n```\n\n## 配置\n\n通过 bundle 的 `cordis.patch.yml` `config`(无密钥、无硬编码部署路径):\n\n| 字段 | 类型 | 默认 | 含义 |\n|---|---|---|---|\n| `blockPrivate` | boolean | `true` | 拒绝私网/保留主机(SSRF 门禁) |\n| `allowList` | string[] | `[]` | 免同意的宿主/域名(裸域名也放行其子域;`*.x` 仅子域) |\n| `allowedRoots` | string[] | `[]`(本地文件**被拒**) | 本地 `source` 必须落在其中的绝对目录。**须显式设置**才允许本地解析;空 = fail-closed |\n| `policyForUnknown` | `'deny'`\\|`'ask'`\\|`'allow'` | `'deny'` | 不在 `allowList` 的外部主机的结果 |\n| `consentReason` | string | … | `policyForUnknown: ask` 时的提示文案 |\n\n示例:放行一个可信 API 主机,其余需同意。\n\n```yaml\nconfig:\n  blockPrivate: true\n  allowList: ['api.example.com']\n  policyForUnknown: ask\n```\n\n## 验证\n\n```sh\nnode --test dsh/cue-omni-reader-guard/test/policy.test.js\npython3 scripts/verify_dsh_bundles.py\n```\n\n## 说明\n\n- `ask` 需要 DSH 的 approval 服务返回 `allowed-once`;没有则退化为 deny(fail-closed)——见 `tools/pre-execute` 瀑布契约。\n- 这是护栏,不是沙箱:它过滤主机与本地根,**不**改写参数。把 `allowedRoots` 收到最小,无人值守 agent 建议用 `deny` + 显式 `allowList`。\n- 核心策略(`policy.js`)是纯 Node(`node:url`/`node:net`),所以安全逻辑无需活 DSH 即可测试。\n\n## 许可\n\nMIT — 见 [LICENSE](../../LICENSE)。\n","readmeFilename":"README.zh-CN.md"}