dsh-direnv
direnv support for DeepSeek Harness
What it does
| |
|---|
| Injects | the environment direnv export json reports for the session workspace, merged into the child's environment variables |
| Per workspace | the workspace is fixed by the calling agent's session cwd |
| Announces at startup | starting a session injects one model-facing snapshot naming the workspace's direnv variables, or why none loaded; a workspace with no .envrc stays silent |
| Asks before allowing | direnv_allow routes through DSH's approval channel before running direnv allow |
Session-start context
When a session starts, the plugin resolves its workspace once and queues one
model-facing context message (agent/created + agent.inject())
before the first turn. The model therefore knows, without running anything,
whether the workspace has an active direnv environment:
[dsh-direnv] The workspace direnv environment is active.
[dsh-direnv] /home/me/proj/.envrc injects 3 variable(s) into every command the agent runs:
[dsh-direnv] API_BASE, PROJECT_TOOLCHAIN, RUST_LOG
[dsh-direnv] Values are applied to each command's environment and are deliberately not shown here.
Only variable names are ever shown. A blocked, denied, or failed workspace gets the same
actionable wording as the command notice, so the model can call direnv_allow
immediately. A workspace with no .envrc stays silent. A new message is sent after compact or resume.
Session creation awaits this resolution before the first turn.
Set sessionContext: false to suppress the message;
the workspace is still resolved.
The blocked-workspace UX
An unapproved .envrc does not fail the command and does not leak its
contents. The command runs without the direnv environment. Set notifyOnBlocked: true to add a notice to the result's
stderr that the model can act on:
[dsh-direnv] This command ran WITHOUT the workspace direnv environment.
[dsh-direnv] /home/me/proj/.envrc is not approved, so native direnv refused to load it.
[dsh-direnv] Call the direnv_allow tool to ask the user to approve this workspace:
[dsh-direnv] direnv_allow
[dsh-direnv] Workspace: /home/me/proj
The model then calls direnv_allow (optionally with a reason), which requests
user approval for the calling session workspace without reading or previewing
the file contents. The host runs direnv allow in the workspace.
Explicit reload
At session startup, the plugin runs direnv status --json and
direnv export json in the fixed workspace, waits for the result; a failed resolution
is saved as an error and does not prevent the session from starting.
Commands only read the resolved environment. Use the model-facing tool explicitly to apply changes:
direnv_reload # reload the calling session workspace
Configuration
- id: direnv
name: dsh-direnv
config:
executable: direnv # bare PATH name or absolute path
probeTimeoutMs: 10000 # budget for one direnv run
notifyOnBlocked: false # opt in to append actionable notices to results
sessionContext: true # inject the workspace's direnv variables at session start
| Field | Default | Meaning |
|---|
executable | direnv | The direnv binary; must be on PATH or absolute. |
probeTimeoutMs | 10000 | Each direnv status --json or direnv export json run is killed past this. |
notifyOnBlocked | false | Opt in to append actionable notices; off leaves command results unchanged. |
sessionContext | true | On, starting a session injects the workspace's direnv variables (or why none loaded). |
Disable the provider with Cordis's disabled: true on its plugin row, outside
config. Its dependent adapters and tools become inactive automatically.
Installation
From npm
dsh plugin --profile web add @snylonue/dsh-direnv
The plugin only takes effect after a restart.
To uninstall, use dsh plugin --profile web remove @snylonue/dsh-direnv.
Development
pnpm install
pnpm typecheck # source AND tests
pnpm test # builds, then runs vitest
License
MIT.
The plugin icon is the direnv logo
by Peter Waller, licensed under
CC BY 4.0.
