Preface¶

DeepSeek Harness (command name dsh) is an open-source runtime for intelligent agents developed by DeepSeek AI, currently in developer preview. Its core philosophy is “everything is a plugin”: models, tools, skills, sessions, sandboxes, and interfaces can all be replaced or combined via plugins. There is also an independent community plugin directory site deepseek-harness-plugin.com, which is not officially affiliated with DeepSeek / HyperGAN, and collects community repositories tagged with the dsh-plugin topic.

When the internal test was wrapping up, participants often wanted to do one very specific thing: prove “I was there” and leave a short message. Public repositories cannot display real participant lists, and official organization member rosters will change over time as the organization goes public and members join or leave. dsh-group-photo, maintained by SenmuuuuW, is a polaroid photo wall built for this scenario: it uses zero-permission GitHub OAuth to verify identity, and a frozen whitelist to determine who can appear in the photo wall.

What is dsh-group-photo¶

dsh-group-photo is a fun plugin for DeepSeek Harness, maintained by SenmuuuuW, with the repository address at SenmuuuuW/dsh-group-photo. The community directory categorizes it under the “Fun” section, with an MIT license and HTML as the primary language. The version number in the repository’s package.json is 1.0.0, and it requires Node.js ≥ 20. As of 2026-08-17, GitHub shows 17 stars; the directory page still showed 15 stars at the time, so refer to the repository page for the latest count.

It solves a very narrow problem: building a polaroid wall for members of the dsh-external internal test. Members log in via GitHub (the authorization page does not request any scopes), and only identities that match the frozen whitelist can browse the photo wall, add themselves to it, and leave a message. The built-in skill/SKILL.md in the repository clearly states: the core is an independent Node.js site with zero dependencies, not a Cordis plugin; it is still listed as a DSH plugin in the directory, and provides the dsh plugin add installation command, with a separate DSH Skill package in the repository to help intelligent agents start the service, freeze the whitelist, or export the commemorative version according to the documentation.

Core Features¶

Cross-referencing the repository’s README and skill/SKILL.md, the implemented capabilities are as follows.

Polaroid photo wall. The frontend is pure HTML/CSS/JS (public/index.html): avatar cards, NO.xxx serial numbers, messages, and entry times, with real-time updates, confetti effects, and mobile adaptation. The message limit is 140 characters, deduplicated by GitHub user ID, and authors can edit their own messages.
Zero-permission OAuth. The authorization URL does not include a scope parameter; login is only used to prove “you are this GitHub user”, and no repository or organization permissions are requested. The Skill documentation also specifies that the Device Flow is not used.
Frozen whitelist. The qualification list is a snapshot from the private internal test period (whitelist.json), and the runtime will not check current organization members. The matching priority is GitHub user id first, followed by username (case-insensitive). Subsequent publicization of the organization or member changes will not alter the entry qualifications for this photo wall.
Browsing is also locked down. GET /api/members returns 401 without a session cookie; unlogged users can only see the total number of members. The session token is a 48-character random hexadecimal string, and the cookie has the HttpOnly flag set.
Fail-closed. When the whitelist is missing or cannot be read, all logins are rejected (gate_error), and no access will be granted.
Zero npm dependencies. The server code is in server.js, and only uses Node.js built-in modules; the startup command is npm start (equivalent to node server.js), with the default port 8808.
Static commemorative version. Running node export-archive.js will generate a single-file archive/index.html, which can be opened by double-clicking or hosted on static platforms like GitHub Pages. After export, it no longer relies on server-side login.
Representative repository mapping. Member cards will display the user’s representative repository in the dsh-external organization, with data sourced from works.json (mapped by the first commit author of the repository).

The public repository is a “safe demo version”: members.json, whitelist.json, works.json, and archive/index.html all use fictional members. The real member list and messages are stored in a private data layer (the README uses SenmuuuuW/dsh-group-photo-data as an example), injected via file mounting or environment variables, and never committed to the public Git history.

Installation and Activation¶

The installation command provided by the community directory page can be run in the DeepSeek Harness terminal:

dsh plugin add github:SenmuuuuW/dsh-group-photo

For reproducible installations, fix the commit hash as instructed on the directory page:

dsh plugin add github:SenmuuuuW/dsh-group-photo#commit

Replace #commit with the actual commit SHA. The directory page also reminds users that the plugin runs with the permissions of the current dsh process, and may execute code during installation; you should inspect the source repository and license before installing.

To actually run the photo wall, refer to the repository’s README. The prerequisite is Node.js ≥ 20, and no npm dependencies need to be installed. The clone example in the README uses https://github.com/dsh-external/dsh-group-photo.git, which currently redirects to the same repository as SenmuuuuW/dsh-group-photo.

git clone https://github.com/SenmuuuuW/dsh-group-photo.git
cd dsh-group-photo

# 1. Create an OAuth App on GitHub, fill in the callback URL:
#    http://localhost:8808/auth/callback

# 2. Inject secrets via environment variables (do not commit to the repository)
export GH_CLIENT_ID=yourClientID
export GH_CLIENT_SECRET=yourClientSecret
export GH_ORG=dsh-external

# 3. Start the service (equivalent to node server.js)
npm start

Open http://localhost:8808 in your browser. Visiting /auth/login will redirect to GitHub, and /auth/callback will exchange the authorization code, check the whitelist, and set a session cookie if the user matches.

The secrets can also be written to clientId / clientSecret in config.json, which default to empty strings in the repository. Other supported environment variables include PORT, as well as custom data paths: GH_DATA_FILE, GH_WHITELIST_FILE, GH_WORKS_FILE, GH_SOCIAL_FILE.

A GitHub OAuth App only allows registering one callback URL, which must match exactly: use http://localhost:8808/auth/callback for local development; for public tunnels, use https://<tunnel-address>/auth/callback, and you will need to update the OAuth App configuration if you change the address.

Typical Usage Scenarios¶

Local Participation¶

After completing the OAuth configuration in the previous section and starting the service, log in with a GitHub account that is on the whitelist. Accounts not in the snapshot will not be granted access; if the whitelist file itself is unavailable, no one will be able to access the service. The public repository comes with a demo whitelist; to use real internal test data, maintainers need to copy whitelist.json, members.json, works.json, and social.json from the private data layer.

Temporary Public Network Access¶

The tunnel command provided in the README is:

cloudflared tunnel --protocol http2 --url http://localhost:8808

During the event, the directory page and README also shared a temporary Cloudflare address: https://rio-palm-cfr-benz.trycloudflare.com/, marked as only accessible to dsh-external internal test members. Tunnel addresses will change, so after the event ends, refer to the archive/index.html in the repository instead, and do not treat temporary URLs as permanent entry points.

Re-freeze the Whitelist¶

The runtime does not read PATs. Only when regenerating the snapshot, write a classic PAT with the read:org permission to the pat field in config.json (or the GH_PAT environment variable):

node freeze-whitelist.js

Immediately revoke this PAT after generating or updating whitelist.json. The server hot-loads the whitelist based on the file’s mtime, so no restart is required.

Export Static Commemorative Version¶

node export-archive.js

The output is archive/index.html: a single file, no login required, and suitable for static hosting. The Skill documentation reminds users that members.json and sessions.json are stored alongside server.js, so backup temporary disk deployments before republishing.

Use with DSH Skill¶

The trigger instructions in skill/SKILL.md state that it is used when a user wants to start the photo wall, re-freeze the whitelist, export the commemorative version, or explain the security model. It describes the same standalone Node.js site, and does not turn the photo wall into a UI plugin in Cordis.

Applicable Scenarios and Notes¶

It is suitable for the following groups: members who participated in the dsh-external internal test and want to join the photo wall on the closing night; event maintainers who need to separate the member list and messages from the public repository; developers who want to reuse this “zero-permission OAuth + frozen snapshot” access control system to build similar memorial pages for their own communities.

It is not suitable for those who expect it to enhance DSH’s coding capabilities. It does not provide models, tools, or web UI skins, and will not add a photo wall panel to the dsh web interface. The demo data in the public repository should not be treated as a real internal test member list.

Before using it, please note:
- The plugin runs with the permissions of the current dsh process, so you should read the source code and MIT license before installing.
- Store secrets only in environment variables or the local config.json, and do not commit them to Git.
- Qualifications are only based on the frozen snapshot, not current organization members; if the whitelist is corrupted, all access will be denied.
- An OAuth App only has one callback URL, so local and tunnel configurations cannot share the same setup.
- Real member data is private, and the README requires that it never be committed to public repositories.

Summary¶

dsh-group-photo turns the closing of the DSH internal test into a polaroid photo wall: zero-permission login verifies identity, the frozen whitelist controls entry qualifications, and the results can be exported as a static page that can be saved permanently. It is not a Cordis capability plugin, but a standalone site wrapped with a DSH Skill package; it is listed as a fun plugin in the directory, and its source code and license can be verified directly.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-group-photo/
GitHub: https://github.com/SenmuuuuW/dsh-group-photo
DeepSeek Harness: https://github.com/deepseek-ai/deepseek-harness

Set up a Polaroid photo wall for the internal test finale of DeepSeek Harness with dsh-group-photo