dsh-plumb-identity

DeepSeek Harness multiplexes every conversation over a single plumb connection per process, yet DSH's MCP client sends no identity with its requests—no per-conversation session id, no _meta tag. Plumb's isolation layer (workspace shards, read tracking, mail addressing) arms on a declared identity, so unidentified conversations silently force-re-pin each other's workspaces. The usual workaround is an AGENTS.md instruction asking each conversation to declare a session_id, but DSH's in-process subagents carry no parent context and are structurally anonymous, so an instruction alone cannot cover them.

dsh-plumb-identity solves this at the transport layer. It listens on DSH's tools/execute waterfall, extracts the caller's session UUID and workspace from exec.agent, and mints a stable logical-agent id for every plumb tool invocation. A narrow patch on the MCP SDK request path then stamps _meta identity onto each plumb-bound call, and the plugin proactively issues a session_start declaration on each agent's first plumb request to pin its workspace shard and record the session linkage. The entire chain fails open: if the SDK is missing, the patch is refused, or the declaration is rejected, the call proceeds as-is and the AGENTS.md instruction surface remains as the fallback.

If you run multiple workspaces and conversations under DSH, rely on plumb's per-agent sharding for isolation, or frequently delegate work to in-process subagents that make tool calls, this plugin turns identity from a model-behaviour expectation into a transport-layer guarantee—eliminating pin-contests and cross-workspace overwrites. It is equally useful for a developer juggling parallel windows or a team orchestrating multi-agent pipelines.