@agentvalet/dsh
受治理的 DeepSeek Harness 平台访问——机器上不存储凭据
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @agentvalet/dsh@0.1.1@agentvalet/dsh 以 @agentvalet/dsh 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →Governed platform access for DeepSeek Harness agents: an agent calls Slack, GitHub, Gmail, Stripe, or any other AgentValet-connected SaaS platform through a broker that enforces the owner's grants and approval flow, with no API key stored on the machine the agent runs on.
dsh plugin --profile web add @agentvalet/dsh
This installs both plugins the bundle ships: av-identity (the agentvalet
service) and av-tools (the four tools below). Restart or reload the profile
after installing.
An installed but unconnected profile has no identity yet — calls report "not connected" rather than failing obscurely. To connect it:
AGENTVALET_BOOTSTRAP_TOKEN=<token> npx agentvalet-dsh-connect --profile web
--token <token> works too; the environment variable just keeps the token out
of your shell history. The command prints the new agent id and nothing else —
never the token, never the key. --help lists the rest of the flags.
Connecting is a command you run, not a tool the agent can call. An enrolment tool would let an agent bootstrap its own identity with no human in the loop, and the identity would stop attesting to a person's decision to create it.
The command generates an RS256 keypair locally and sends only the public
key to AgentValet's /v1/agents/bind endpoint. The private key never leaves
the machine. It is written to $DSH_HOME/agentvalet/<profile>.json
(~/.dsh/agentvalet/... when DSH_HOME is unset) at mode 0600, and the
store refuses outright to write anywhere inside a git working tree.
Once bound, the agent shows up in the dashboard deny-by-default — it can call nothing until the owner grants it specific platforms and scopes.
A bootstrap token is single-use. Re-running connect on an already-connected profile is refused rather than silently replacing the identity, so one agent's audit history can never be laundered into another's.
Connecting also writes a short routing block into $DSH_HOME/AGENTS.md — the
rule that platform calls go through AgentValet rather than around it. The block
sits between <!-- agentvalet:start --> and <!-- agentvalet:end --> fences:
anything else in that file is yours and is left untouched, and re-running
connect refreshes the region in place instead of appending a second copy.
It is written there because that is where dsh reads. The instruction loader
(@deepseek-ai/dsh-agent-instructions) reads $DSH_HOME/AGENTS.md and then
each directory from the project root down to the session cwd — it never scans
node_modules, so the AGENTS.md shipped inside this package reaches no
model. That copy is documentation for you to read or paste into a project root.
Note it follows $DSH_HOME, not --home: --home only relocates where the
identity is stored, and following it would put the file somewhere nothing reads.
If the write fails, connect says so and still reports the enrolment — by then
the single-use token is spent and the agent exists, so failing the whole command
over a markdown file would strand a real identity.
The block deliberately contains no agent id, owner id, or scope list. This file lands in a home directory and gets copied into project roots and pasted into issues; identity in it would leak through ordinary use.
| Tool | Method | Notes |
|---|---|---|
agentvalet_list_platforms | — | Lists platforms and scopes the owner has approved for this agent. Call this before any platform call — grants can change at any time. |
agentvalet_read_platform | Always GET | Read from an approved platform. |
agentvalet_write_platform | POST (default), PUT or PATCH | Create or update. May require owner approval. |
agentvalet_delete_platform | Always DELETE | Usually requires owner approval. |
Every tool takes the platform id and scope string exactly as returned by
agentvalet_list_platforms, plus an endpoint. All four resolve to
{ ok: true, data } on success or { ok: false, error } on failure — a
denial, a pending approval, or a suspended agent all come back as a plain
result the model can read and explain rather than as a thrown error. (That is
a guarantee about our own tool bodies. Argument validation happens in the
harness before our code runs, so a malformed call comes back in dsh's own
isError result shape instead.)
Declared harness range: >=0.1.0-rc.5 <0.2.0. Verified against
@deepseek-ai/dsh@0.1.0-rc.7, @deepseek-ai/cordis@4.0.1, and
@deepseek-ai/dsh-tools@0.1.0-rc.7 — see VERIFICATION.md for what was and
was not confirmed against a real harness run.