dsh-openkapsel

If you already run an OpenKapsel remote workspace full of code, shell environments, a context graph, and scheduled tasks, but DeepSeek Harness only exposes local tools to the model, dsh-openkapsel is the bridge you are missing. It wraps the entire OpenKapsel REST surface into a coherent set of kapsel_* tools, so the model can list directories, read and write files, execute shell tasks, browse archives, manage async transfers, and drive mapped clients through a unified RPC entry point, all from a natural conversation without manual curl commands.

Security boundaries are a first-class design goal. The bundled OpenKapsel Remote preset intentionally mounts no local Bash, filesystem, editor, or run_code tools, so the model can only reach the remote endpoint. A fail-closed guard additionally rejects execution if a future preset edit accidentally exposes a local tool. Every mutating operation routes through the DSH approval service and is attributed via OpenKapsel Plan and taskname, while read-only sandbox mode blocks all mutations and shell execution outright.

It is built for developers who operate an OpenKapsel Server and want the Harness model to live inside their remote workspace without handing over local host permissions. You supply a workspace URL and a control token; authentication renewal, error decoding, and context merging are all handled by the Python helpers bundled with the plugin, keeping the protocol maintained in one place as OpenKapsel evolves.