DSH Orchestrator Security Boundaries

Credentials

The repository contains no provider key, token, OAuth client, credential path, or login implementation. Both provider rows use env: {}. DSH preserves ordinary child process facts such as HOME but scrubs credential-shaped ambient variables. Each vendor CLI may use only the native account state it owns.

Permissions

• Claude uses permissionMode: dontAsk, fixed for the provider instance and not inherited from any session. It denies operations that native policy has not already authorized.
• Codex uses workspace-write plus untrusted as its static fallback. With inheritSessionPermissions, the session's sandbox and approval policy are inherited independently: any valid sandbox/mode is adopted, while only the DSH never approval policy is; every other policy keeps the fallback.
• Copilot permission: reject declines every ACP permission request and the CLI receives an empty available-tool catalog.
• Copilot custom instructions, built-in MCP servers, ask_user, remote control/export, and auto-update are disabled.
• No child permission request is surfaced as a blocking human dialog.
• Changing Claude to bypassPermissions requires explicit user approval and a dedicated security review.

The repository contains no direct Google provider, credentials, proxy, custom OAuth, or headless Antigravity wrapper. Gemini runs as a model hosted behind GitHub Copilot's documented ACP interface and GitHub authentication boundary.

Codex dynamic-tool bridge

@softspark/dsh-codex keeps its standalone experimentalDynamicTools and inheritSessionPermissions defaults disabled. This bundle must follow dsh-codex in the DSH profile bundle order and replaces the complete llm-codex configuration with the reviewed orchestration settings: workspace-write and untrusted fallbacks, inheritSessionPermissions: true, allowApiKeyAuth: false, bounded request/turn/tool timeouts, and experimentalDynamicTools: true. Inheritance needs dsh-codex 1.4.0 or newer; an older package keeps the unknown key and ignores it. A session running the DSH danger-full-access preset starts its Codex thread with danger-full-access and never, so the presets a profile offers are part of this boundary.

The bridge only exposes the DSH tool catalog to the Codex app-server turn. DSH remains responsible for executing a selected tool and returning its correlated text result; dsh-codex does not call Claude, Copilot, or credentials directly. When no earlier llm-codex row exists, DSH warns and skips the override rather than creating a second or incomplete provider. Reordering or changing either bundle requires a new composition test and live subscription-backed smoke test.

Process and workspace

Each delegation starts a fresh process in the parent workspace. A child can observe or modify files only according to its vendor runtime and permission configuration. Cancellation does not roll back effects already committed by the child.

Data flow

Prompts and model-visible workspace content leave the computer through the selected vendor CLI. DSH does not make that traffic local. Copilot Gemini has no file tools, but the standalone prompt itself still reaches GitHub and the hosted model. Review repository sensitivity before delegating.

Logging

Do not attach credentials, complete session logs, private prompts, or proprietary file contents to issues. Keep DSH telemetry disabled unless a separate policy explicitly authorizes it.

Upstream verification

The separately installed Copilot CLI 1.0.80 macOS arm64 artifact matched official npm and GitHub/Homebrew hashes during review, but its embedded Apple signature did not pass codesign --verify. The bundle neither installs nor redistributes that binary. Keep auto-update disabled and repeat provenance, static, and platform-signature checks before changing the accepted version.