bailinghub-dsh-plugin

Your local DeepSeek Harness Agent is great at coding and scripting, yet it rarely has a safe path into production business systems—order databases, customer records, SaaS admin panels. Handing raw API credentials to a model bypasses approval workflows, breaks audit trails, and creates a hard-to-justify security gap. bailinghub-dsh-plugin places a BailingHub authorization gateway between the Agent and your business systems, so reasoning and tool orchestration stay local while identity verification, scope enforcement, approval state, idempotency, and audit logging are revalidated on every single managed call.

Key capabilities include credentials stored in OS-level secure storage (macOS Keychain, Windows DPAPI) that never appear in plugin config or model context; the model cannot select a Hub URL, workspace, business identity, or approval result through tool arguments; repeated authorization under the same public binding automatically replaces the older local connection and revokes its stale session; and approval-required capabilities resume the original invocation after approval rather than spawning a duplicate request. The adapter registers only BailingHub tools and does not intercept unrelated DSH tools or model-provider traffic.

This plugin is built for teams that already run a local DSH Agent and want it to look up orders, update permitted fields, or execute governed admin actions in stores, SaaS products, or other business systems. Set up four public configuration fields, complete a one-time browser authorization, and the Agent operates within the existing identity, permission, and approval rules while every tool invocation is traced in BailingHub.