dsh-secure-remote

On macOS and Linux, an overly long ControlPath in OpenSSH can cause PTY startup failures and fragile remote Workspace connections; passwords leaking into command-line arguments or logs is a persistent risk. dsh-secure-remote replaces the built-in SSH provider in DeepSeek Harness via a bundle patch, delivering more stable connections and an auditable security boundary without modifying upstream source code or migrating existing ssh_workspace v1 data.

The plugin covers both Key and Password authentication. Key mode auto-discovers hosts and default keys from SSH Config, or accepts a single key file or directory. Password mode hands credentials to the DSH credentials service so the password never appears in SSH arguments, logs, or status endpoints. Workspace rows show live connected, connecting, degraded, and disconnected status with latency, and the official openRawChannel is preserved for Remote Agent installation and long-lived connections. Remote file tools are confined to the Workspace root, rejecting path traversal and symlink escapes; remote targets must be POSIX, and non-POSIX environments return REMOTE_OS_UNSUPPORTED explicitly.

If you manage remote POSIX servers over SSH from macOS or Linux and want a remote Workspace with predictable state, reconnection, and credential handling while keeping security defaults like StrictHostKeyChecking=yes intact, this plugin is built for that. Remote Bash retains the full permissions of the SSH account without extra file-boundary isolation, keeping behavior transparent and expected.