Introduction

In DSH plugin usage scenarios, agents sometimes determine that a tool is missing an API key. If users are allowed to paste keys directly into a regular conversation, the keys will enter the session history and may also enter the model context.

dsh-credential-handoff provides a write-only handoff path within the session for this scenario: a browser dialog collects credentials, writes them via the DSH credential service, and the tool call only receives fixed status metadata without returning the keys to the model context.

What is it

xiaohj233/dsh-credential-handoff is a DSH Feature Plugin, licensed under MIT.

It registers the request_credential tool, allowing agents to request specific credentials without putting keys into the model context. Verified data indicates this plugin was tested on DeepSeek Harness 0.1.0-rc.6.

Core Features

  • Provides the request_credential tool to allow agents to request specific credentials without putting keys into the model context.
  • Writes credentials in a write-only manner via the DSH credential service and returns fixed status metadata to the tool call.
  • Each session allows one pending request; the dialog expires after 10 minutes.
  • Tool results only report the credential reference and whether it was configured or replaced.
  • HTTPS is allowed for submission; plaintext HTTP is only allowed for exact loopback hosts; non-loopback plaintext HTTP is blocked in control and submission handling.
  • The Host registers request_credential and waits for a tagged userQuestions request; the Client only handles the tagged question and calls credentials.set directly.
  • Credential references use shell-style names: the first character is a letter or underscore, followed by letters, numbers, or underscores.
  • No plugin configuration is required.

Installation and Usage

The installation command is as follows:

dsh plugin --profile web add "github:xiaohj233/dsh-credential-handoff#v0.1.0"

Restart the Web profile after installation.

Typical Usage

An example of the model calling request_credential is as follows:

{"ref":"TAVILY_API_KEY","label":"Tavily API key","reason":"Required for Tavily search"}

This call only expresses the credential request. The key value is not returned to the model context via this tool call; the tool result only reports the credential reference and whether it was configured or replaced.

The uninstall command is as follows:

dsh plugin --profile web remove dsh-credential-handoff

Deleting the plugin removes the tool and the dialog, but does not delete credentials stored by a configured DSH credential provider.

Use Cases and Considerations

Suitable for scenarios where, in a DSH Web profile, users supplement credentials within a session, while wanting tool results to not return keys.

Not suitable for the following purposes:

  • It is not a vault.
  • It is not an encryption provider.
  • It is not a credential viewer.
  • It is not a subprocess credential injector.
  • It is not a replacement for DSH credential providers.

It also cannot protect against a compromised browser, host process, or DSH credential backend.

Boundaries to note include:

  • DSH is a release candidate; future versions may change the question, credential, or client-slot contracts.
  • Do not expose the DSH Web control plane to untrusted networks. Blocking non-loopback plaintext submission does not imply adding authentication for DSH.
  • In rc.6, the generic question UI always provides an “Other” text answer; if the client takeover package loading fails, the fallback prompts not to paste the key and cancels, but the host cannot remove this generic field.
  • Direct clients may also bypass this plugin to call the DSH credential API; the transmission and authentication of the broader Web control plane remain the upstream responsibility.
  • The plugin runs with the current DSH process permissions; the source code and license should be checked before installation.

Links

GitHub: https://github.com/xiaohj233/dsh-credential-handoff