DeepSeek Harness Plugin Hub

Publish and manage complete Harness Profiles. Discover Plugins for your next setup.

Explore

PluginsPresetsDocsNews

Community

Publish a pluginContactReport an issue

Resources

Plugin Hub on GitHubDeepSeek HarnessSystem statusPrivacy notice
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

Independent and unofficial. Not affiliated with, authorized by, or endorsed by DeepSeek.

Destinywind Tpm — DSH Plugin for DeepSeek Harness
DeepSeek Harness Plugin Hub
ProfilesPluginsCategoriesNewsDocsSign inManage Profiles
ProfilesPluginsCategoriesNewsDocsSign in
← Plugins
D

dsh-destinywind-tpm

Destinywind Tpm

Cross-platform hardware/user-level credential storage: reference values and records are sealed with the strongest local key protector before being written to disk (Windows TPM CNG preferred, falling back to DPAPI; Linux tpm2-tools preferred, falling back to the session keyring), and unsealed only du

The plugin will be installed here. Keep web if you are unsure.

npx -y @deepseek-ai/dsh plugin --profile web add github:rickwindman/dsh-destinywind-tpm#5ffa8a113cfab3fc315fff28fcb56d1d62b74679
READMECompatibilityVersions

Description

Cross-platform hardware/user-level credential storage: reference values and records are sealed with the strongest local key protector before being written to disk (Windows TPM CNG preferred, falling back to DPAPI; Linux tpm2-tools preferred, falling back to the session keyring), and unsealed only during resolve; mounting is refused if no protector is available, and plaintext is never written.

Compatibility and provenance

Destinywind Tpm is published as dsh-destinywind-tpm and currently resolves to version 1.0.0. The Hub verifies its manifest and preserves the exact installation source for reproducible installs.

DSH compatibility
*
Runtime surfaces
any
Release source
github
Registry updated
9/26/2026

Versions

1.0.0stable
9/26/2026

Related plugins

Loading related plugins…

Latest
1.0.0
DSH
*
HMR
Process restart
Tree shaking
Safe tree shaking not declared
Unpacked size
Unavailable
Files
Unavailable
Surface
any
License
MIT
Source
github
GitHub
★ 0
Weekly downloads
0
Last push
9/26/2026
View source ↗
README badge

Click the badge to copy Markdown for your README.

Do you maintain this Plugin?Claim benefit · Priority security scan

Verify the GitHub repository declared in package.json to manage this listing. After you claim it, Hub will prioritize a security scan of the current version and publish the result when it passes.

Claim this Plugin →
Report an issue

Related plugins

More verified plugins in security-access.

Cc Safety Netcc-safety-netA coding agent CLI hook - block destructive commands and secret file accessDSCODE@toddzheng024/dscode-bundleA complete DeepSeek coding agent with persistent shell, Ultra collaboration and automatic permission review.Mcp Connectordsh-mcp-connectorDeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.Experimental Auto Review@deepseek-ai/dsh-experimental-auto-reviewPer-tool LLM authorization review for the DeepSeek Harness Auto permission preset

README

dsh-destinywind-tpm

跨平台硬件级凭据存储插件(DSH bundle)。引用值与记录在落盘前用本机最强的密钥保护者封存(AES-256-GCM 信封加密),只在 resolve 时解封:

  • Windows:TPM(CNG Microsoft Platform Crypto Provider)优先,回退 DPAPI
  • Linux:TPM 2.0(tpm2-tools)优先,回退会话密钥环(libsecret)
  • 两者皆不可用则拒绝挂载,绝不落明文

安装

声明了 dsh.bundle.patch,装完即生效,无需手工编辑任何配置文件:

plugin_manager { action: "install_bundle", target: "<本仓库绝对路径>" }

命令行等价形式:

dsh plugin --profile web add link:<本仓库绝对路径>

安装后重启 dsh web 生效。本补丁会按 id 覆盖默认的 credentials 行(置 disabled: true)——一个上下文只能提供一个 credentials 服务。

行为要点

  • 密库文件:$DSH_HOME/.credentials.dpapi.json(权限 0600,staging + 原子 rename 落盘)
  • 没有明文回退层:全新安装在新值保存之前解析不到任何凭据,这是刻意设计
  • 密钥绑定本机本用户:密库文件复制到其他机器/账户无法解密,备份即失效
  • 禁用本 bundle 恢复默认提供方;已封存的值保持封存,需为默认提供方重新录入
  • 启动时校验:重新解封全部密文,任何解封失败都会报错而非静默降级

测试

tests/ 是本机集成测试(离线端到端 + 模块解析钩子),依赖本机 D:\dsh 安装环境(路径硬编码),不能直接在 CI 运行:

node --import ./tests/resolve-hook.mjs tests/offline.mjs

许可

MIT,见 LICENSE。