dsh-spill-s3

When a DeepSeek Harness tool result exceeds the model's context window, the harness spills it: the full text is persisted and the model receives a locator plus retrieval guidance. The default local backend writes that text to a private directory on the agent's host. That is a sensible single-developer default but a team-level problem: in a containerized or headless run the artifacts die with the container, other engineers have no way to read them, and encryption-at-rest or lifecycle policies depend entirely on whatever the host happens to do.

dsh-spill-s3 swaps the storage substrate from local disk to any S3-compatible object store such as AWS S3, MinIO, or Cloudflare R2. It implements the single saveText method the spill seam declares and leaves retention and tool-result replacement policies exactly where they already live. The SigV4 signature is written directly in roughly 150 lines of node:crypto, avoiding the tens of megabytes of transitive dependencies that @aws-sdk/client-s3 would pull in for a single PUT. Credentials are resolved per upload by reference, so no secret value ever touches a patch file. Bucket keys are built from a hashed session id and a random prefix to prevent session identifiers from leaking into inventory listings or access logs. Three retrieval modes — CLI command, presigned URL, or locator-only — let you trade convenience for safety as your threat model requires.

This plugin is aimed at teams running DeepSeek Harness in containers, CI pipelines, or headless environments, especially those who need a unified retention policy, want teammates to read spilled artifacts without SSH-ing into the agent host, or prefer keeping long-lived AWS keys in a central secret store rather than on the machine that executes tools.