dsh-terraform

As AI agents increasingly step into DevOps pipelines, handing a large model a raw terraform apply is a recipe for uncontrolled changes. dsh-terraform was built for exactly this gap: it gives DeepSeek Harness agents a structured Terraform interface with 8 native tools (init, plan, apply, destroy, state, output, show, validate), each wrapped in auditable, gate-controlled calls so the agent can reason about infrastructure within a clearly defined read-only boundary before any mutation is approved.

The design prioritises safety and reproducibility. Plan output honours the -detailed-exitcode contract (exit 2 signals pending changes) and surfaces it explicitly. The plan-file workflow (terraform plan -out then apply against the .tfplan) lets every change be reviewed offline and replayed deterministically. Read-only operations (plan, state, output, show, validate) are the default surface; write operations (init, apply, destroy) require explicit gating. Schemastery configuration and a bundle-patch layer allow upstream harnesses to orchestrates plugin behaviour uniformly.

Targeted at DevOps teams and platform engineers wiring AI agents into their IaC pipelines: instead of hand-rolled shell scripts stitching together terraform subcommands, you declare intent in a dsh workflow and the plugin resolves semantics, executes, and returns structured results—while preserving human approval and rollback checkpoints at every write step.