dsh-llm-agent-bridge
Brings vendor agent SDKs into DeepSeek Harness
as selectable LLM providers. Today that is Claude, served through Anthropic's
official Claude Agent SDK.
Pick it from the model dropdown in any DSH mode — Standard, PTC, Creator,
Minimal, or your own preset. DSH keeps its prompt, its tools, its approvals and
its conversation history; Claude does the thinking.
How it works
DSH's LLM service routes a call to whichever adapter owns options.provider.
This plugin registers one adapter under the provider id claude, and
that adapter:
- Creates (or resumes) a Claude Agent SDK session keyed to the DSH session.
- Passes DSH's assembled system prompt through as the SDK's
systemPrompt,
with settingSources: [] so no ~/.claude settings, CLAUDE.md, skills, or
hooks load on top of it.
- Hands DSH's tools to Claude as an in-process MCP server (
mcp__dsh__*) and
passes tools: [] so Claude Code's own built-ins are removed from context —
allowedTools alone only pre-approves, it does not scope, and the built-ins
would win. toolAliases redirects built-in names at the DSH tool of the same
name, since DSH's prompt refers to its tools bare ("use the read tool").
- Hands tool calls back to DSH to execute. The MCP handler does no work: it
parks, announces the call, and the adapter emits it as a DSH
tool-call
chunk with a tool-calls finish. DSH's own agent loop then runs the tool
under its sandbox and approval policy, records tool/call and tool/result
in its trajectory, opens the next step, and calls back with the result —
which resumes the same Claude query rather than starting a new one.
The bridged tools are listed in allowedTools, which pre-approves them at
the SDK layer on purpose: they run through DSH's tool runtime, which resolves
"ask" decisions through its own approval seam against the session's sandbox
policy. Gating at the SDK layer as well would prompt on every call regardless
of that policy — workspace-write included — which is not how DSH treats its
own agent's calls.
- Projects Claude's reasoning and text into DSH's native stream chunk
vocabulary, so the conversation renders like any other model's, and reports
the turn's token usage and the model's context window so DSH's own counters —
input, output, cache-hit rate, tokens/sec, context pressure — work for Claude
rows exactly as they do for its own. Usage arrives once per turn, on its last
step, since one Claude query spans every step of that turn. The plugin
contributes no client bundle and no renderer of its own: tool work is DSH's
to display, from its own trajectory.
Claude still decides what to call and when; DSH executes. One DSH step per model
call, exactly as with DSH's own models — which is what puts Claude's tool calls
in the trajectory and keeps the conversation history shared between providers.
Install
npx @deepseek-ai/dsh plugin --profile web add github:daveycodez/dsh-llm-agent-bridge
npx @deepseek-ai/dsh web
Authenticate Claude Code normally first (claude, then sign in). This plugin
never sees your credentials — see below.
Plan usage in the composer
A usage ring sits in the composer's tool row while a Claude row is selected,
reporting the subscription limit that matters for the current model and opening
a panel of every reported window:
Plan usage limits · Max
5-hour limit Resets in 1 hr 8 min 10%
Weekly · all models Resets in 19 hr 18 min 81%
Weekly · Fable Resets in 19 hr 18 min 100%
The numbers come from the Agent SDK's own usage reporting — the same source as
Claude Code's /usage — served to the browser over this plugin's /agent-bridge
channel. No credential is read and no other plugin is required.
Reading them costs a Claude Code control session, so the answer is cached on the
host and again in the browser, with no idle polling: the ring revalidates when
you interact with it or while a turn runs, never on a timer. The underlying SDK
method is explicitly experimental, so a failure to read leaves the ring hidden
rather than failing anything.
Thinking
Turns request thinking: { type: "adaptive", display: "summarized" }. Without
that display, the models stream thinking blocks whose text is empty — a
signature and a token count, nothing to render — which is why reasoning appeared
to be missing for every model except Haiku. With it:
| model | reasoning text without it | with it |
|---|
| Opus 5 | 0 chars | 140 |
| Sonnet 5 | 0 chars | 1,178 |
| Haiku 4.5 | ~340 | 680 |
It composes with the effort selector rather than replacing it: effort still
decides how much thinking happens — Sonnet at low does none at all, at high
it thinks and the summary comes through — while display decides whether you
can read it. Adaptive thinking is genuinely variable, so a given turn may think
little or not at all; reasoningTokens in the usage counter tells you which.
Set thinkingSummaries: false on the plugin row to leave the SDK's own default
alone.
Switching models mid-session
The Claude session only knows the turns it answered. When it is created, or when
another model answered turns while it was deselected, the adapter prepends those
turns as a <dsh-context> block so switching providers mid-session does
not silently drop context.
Tool calls and their results live in DSH's own message history, so a later
DeepSeek turn sees the actual work rather than a prose summary.
One known limit: DSH-side rewrites are not replayed. If DSH compacts or edits
earlier turns after Claude has seen them, the Claude session keeps the original.
DSH's session telemetry
@deepseek-ai/dsh-base mounts an OTLP exporter aimed at
harness-telemetry.deepseeksvc.com. Since dsh 0.1.5 it is on by default, in
FEEDBACK_ONLY mode (earlier releases defaulted to DISABLED). DSH's own note
on the row says uploads carry session-log records "with no
session-telemetry/record redaction rule, so exports are the raw captured copy" —
and with this plugin installed, that copy contains Claude's output.
Recommended: run DSH with the exporter off at the source. Set
DSH_TELEMETRY_MODE=DISABLED in the shell that launches DSH (or
DSH_TELEMETRY_DISABLED=1, which patches the row off entirely). The backend is
then constructed with no pipeline, nothing is ever captured, and the guard below
has nothing to do.
The guard runs per turn, not at load. At the start of every Claude turn the
adapter reads the mounted sessionTelemetry backend — exact, because it sees the
exporter whatever switched it on, which a scan of environment and config layers
cannot promise — and, if it is exporting, acts according to the telemetry
mode:
disable (default) drains and quiesces the pipeline through the backend's
own shutdown(). Once that resolves the OTel provider drops every later
record, and the row is remembered as quiesced for the rest of the process, so
later turns neither refuse nor shut it down again. A shutdown() that rejects
(the backend's own deadline) fails the turn instead: disable degrades to
refuse rather than reporting a success it cannot verify. A fresh backend
instance — a reload, another plugin re-mounting the row — is caught and
handled in its turn.refuse fails the turn with an inline error naming what to switch off, and
never touches host configuration.ignore skips the guard entirely.
The guard never unmounts the row or disposes another plugin's fiber. Earlier
releases did both, from inside plugin activation — and with dsh 0.1.5's
exporter on by default that deadlocked the boot: the cordis loader waited on a
fiber this plugin had just disposed, dsh web never printed its URL, and the UI
was unreachable. Activation now only reads the posture and logs one line saying
what the first turn will do; it completes promptly whether or not telemetry is
exporting.
The test suite mounts the real dsh-session-telemetry-otel backend in
FEEDBACK_ONLY against a loopback collector, shows a record reaching it, runs
the guard, and asserts that the row stays mounted, that nothing reaches the
collector afterwards, and that later turns do not shut it down again. A
separate test activates the plugin against a fake exporting backend and asserts
activation completes without calling shutdown() or fiber.dispose().
What this does not cover: an exporter some other plugin adds. The guard reaches
the row DSH ships, not an arbitrary one — another reason to prefer
DSH_TELEMETRY_MODE=DISABLED.
Configure the behaviour on the plugin row if the default does not suit:
- id: agent-bridge-llm
name: 'dsh-llm-agent-bridge'
config:
telemetry: disable # default; `refuse` fails the turn instead, `ignore` skips the guard
Tracing a stalled turn
The handoff spans two stream() calls with a live Claude query parked between
them, so a stall has no stack to show. Set DSH_AGENT_BRIDGE_DEBUG=1 to record
each decision to $DSH_HOME/plugin-data/agent-bridge-debug.log (or give it a
path of your own):
DSH_AGENT_BRIDGE_DEBUG=1 dsh web
Each line names the parked call ids and the tool-result ids that came back, so a
mismatch is visible directly. A resumed turn that stays silent fails after five
minutes rather than hanging; DSH_AGENT_BRIDGE_RESUME_TIMEOUT_MS overrides that.
Anthropic terms compliance
This plugin uses your Claude subscription the way Anthropic's
legal and compliance page
requires: it never collects, stores, or intermediates your credentials.
- The only route to Anthropic is
await import("@anthropic-ai/claude-agent-sdk")
— the official SDK, which runs the published Claude Code binary. That binary
performs its own authentication and token refresh, exactly as when you run
claude yourself.
- No source file reads
~/.claude/.credentials.json, the macOS Keychain,
CLAUDE_CODE_OAUTH_TOKEN, or any API-key environment variable.
- No source file constructs an
Authorization header or calls
api.anthropic.com directly.
- The CLI fallback spawns
claude with this process's environment and nothing
else: there is no per-turn env override, so no caller can inject
ANTHROPIC_BASE_URL or an API key into the binary that holds your login.
Verify it yourself:
grep -rnE "credentials\.json|find-generic-password|CLAUDE_CODE_OAUTH_TOKEN|ANTHROPIC_API_KEY|Authorization|api\.anthropic\.com" *.js *.mjs internal src
What this does not claim
Running this locally, on your own subscription, signed in through Anthropic's own
flow, matches the carve-out on that page for "an end user signing in to the
unmodified Claude Code binary with their own Claude subscription". Publishing a
plugin whose function is to route Agent SDK traffic through subscription OAuth
is addressed by a different sentence in the same section — developers "should use
API key authentication through Claude Console". Both are true at once, and the
second is advisory rather than prohibitive. Only Anthropic can rule on it; this
README describes what the code does, not what they permit.
An API key resolves the question outright: export ANTHROPIC_API_KEY in the
shell that launches DSH and the binary uses it, with no change to this plugin.
Two things that remain your responsibility:
-
Keep DSH bound to localhost. A DSH instance other people can reach means
your subscription is serving their requests, which the terms prohibit. DSH
refuses --host 0.0.0.0 outright ("it would expose remote code execution to
the network"), but that guard matches the literal string only — a LAN address
or :: still binds, and a tunnel pointed at the web port bypasses it
entirely. Don't tunnel DSH.
-
Use an API key for unattended workloads. Subscription limits assume
"ordinary, individual usage"; batch or scheduled runs belong on a key.
-
Turn DSH's telemetry off. Set DSH_TELEMETRY_MODE=DISABLED in the shell
that launches DSH. @deepseek-ai/dsh-base mounts an OTLP exporter pointed at
harness-telemetry.deepseeksvc.com, on by default in FEEDBACK_ONLY since
dsh 0.1.5, and DSH's own note says uploading mirrors session-log records "with
no session-telemetry/record redaction rule, so exports are the raw captured
copy." With this plugin installed, that raw copy contains Claude's outputs —
and Anthropic's Consumer Terms prohibit using the Services to develop or train
competing models. The plugin's per-turn guard (below) shuts a live exporter
down before Claude runs, but the version with no gap at all is never
constructing it: DSH_TELEMETRY_MODE=DISABLED, or DSH_TELEMETRY_DISABLED
set to any non-empty value, which patches the row off entirely.
Check your own posture:
env | grep DSH_TELEMETRY; grep -i telemetry "${DSH_HOME:-$HOME/.dsh}/settings.yaml"
Credits
Forked from relay-dsh-plugin-claude
by yangbobo2021 (MIT), which integrates Claude Code as its own DSH mode. This
fork takes the opposite trade: Claude as a provider usable from every mode,
with DSH owning the prompt and tools.
MIT.
