dsh-file-checksum

When verifying file integrity inside a DSH agent workflow, the typical approach is to load the file into the conversation and ask the model to hash it, wasting tokens and risking exposure of sensitive content to the context window. dsh-file-checksum moves this operation to a pure byte-read layer: the plugin reads raw bytes through the active Harness filesystem provider, computes the digest, and returns the result directly, keeping file contents entirely out of the model conversation.

At the core, the plugin supports SHA-256 (default) and SHA-512 algorithms, accepts absolute or workspace-relative paths, and optionally takes an expected digest for match or mismatch verification. Each call reads a single regular file with a default 64 MiB cap, configurable up to 256 MiB. It does not invoke a shell, touch the network, read credentials, or write or delete any file. Results are returned in a structured format that both Native and Code Mode callers can consume directly.

This plugin fits workflows where you need to verify the integrity of downloaded files, model weights, logs, or build artifacts within a DSH agent session. If you want the agent to compare on-disk digests against expected values without surfacing file contents in the prompt, this minimal, read-only, auditable checksum tool fills that gap.