dsh-attachment-s3

By default, DeepSeek Harness writes session attachments into the local DSH_HOME directory. In multi-instance, containerised, or cross-machine deployments this becomes a silo: an image admitted on node A is invisible to node B, and a machine migration loses the attachments entirely. dsh-attachment-s3 redirects the entire attachment persistence path to an S3-compatible object bucket, implementing the exact same AttachmentStore interface as the built-in local backend. The seam accepts exactly one provider, so installing this plugin replaces the local backend rather than layering on top of it.

Three capabilities stand out. Writes use conditional requests (If-None-Match: *), so concurrent uploads of identical bytes never clobber each other: the losing writer simply verifies the existing object instead of re-publishing. Reads pull exactly the byte range the reference claims, re-hash the payload, and re-derive the image header before returning, so a bucket-side substitution surfaces as ATTACHMENT_CORRUPT before it can reach a model request. Session logs record only opaque sha256: identifiers—never a key or URL—meaning backend swaps change nothing about transcript semantics. Credentials are carried as reference names, not values, so a rotated secret is picked up on the next request without a restart.

This plugin is a fit for teams that scale Harness horizontally across Kubernetes, ECS, or multi-region clusters and need centrally managed, durable attachments readable from any node. It works with AWS S3, MinIO, Cloudflare R2, or any other S3-compatible service. Bucket-level policies—encryption, storage class, lifecycle—are left to the bucket, keeping application code lean. Keep in mind the current surface supports PNG, JPEG, WebP, and GIF only, one bucket per deployment, and session-log persistence is still handled by the profile’s own storage backend.