dsh-credential-handoff
Run the following command in DeepSeek Harness:
dsh plugin install xiaohj233/dsh-credential-handoff
Paste the following prompt into your AI chat to install this plugin:
Run dsh plugin install xiaohj233/dsh-credential-handoff in your DeepSeek Harness terminal to install the plugin (source: https://github.com/xiaohj233/dsh-credential-handoff), then restart the Web profile to activate it.
About this plugin
When an agent needs an external API key, asking the user to paste it into chat leaves the secret in transcripts and model context with no recall. dsh-credential-handoff provides a write-only handoff path: a conversation-local password dialog in the browser submits the value through DSH's credential service, and the tool call returns only the reference name and a configured-or-replaced status. The secret never appears in the question answer, tool result, logs, or session event payload.
Transport safety is built in. HTTPS submissions are accepted; plaintext HTTP is allowed only on exact loopback hosts (localhost, 127.0.0.1, IPv6 loopback), and non-loopback plaintext is rejected in both the UI controls and the submit handler. One pending request is permitted per session, and the dialog expires after ten minutes. The plugin is not a vault, encryption layer, credential viewer, or subprocess injector; it adds only a safe in-conversation handoff on top of DSH's existing credential services.
Best for developers running DSH agents that require API keys but should not expose them in chat transcripts. No plugin configuration is needed; install, restart the Web profile, and the model can call request_credential with a shell-style reference name.
Use Cases
- Agent discovers a missing API key mid-session and needs the user to supply it without transcript exposure
- Securely collect named credentials such as TAVILY_API_KEY within a DSH conversation while the tool returns only status metadata
- Prevent irreversible secret leakage by avoiding key paste into model context
Best For
- Developers running DSH agents that require external API keys
- Security-conscious users who must keep secrets out of chat transcripts and model context
- Teams using DSH credential services that need an in-conversation secure collection path
Related Plugins
Adds an Auto approval mode on the official workspace-write sandbox, classifying semantic risks, asking when ambiguous, and denying destructive operations.
Undo/rollback system for DSH: config & plugin snapshots, one-click undo/redo/restore, message-level revert, secret masking, safe mode, and offline WebUI/GUI/CLI rescue tools for when DSH won't start.
Packages all 87 SKILL.md files from upstream reverse-skill as a DeepSeek Harness plugin that auto-registers them for authorized reverse engineering, penetration testing, and security research.
Dockyard DSH is a native DeepSeek Harness plugin that unifies official OAuth/client sessions for Codex, Antigravity, Grok, Claude, and Cursor, providing account pool, model catalog, and quota status.