deepseekplugins

DeepSeek Harness plugin

dsh-filetransfer

Native-feeling file drafts for DSH web: stage files, confirm with Send, render file cards, and download deliverables.

Security & Permissions
Jump to install

Source facts

Repository
kerlyken/dsh-filetransfer
Latest update
Aug 20, 2026
Category
Security & Permissions
GitHub stars
0
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/kerlyken/dsh-filetransfer
Plugin: dsh-filetransfer
Author: kerlyken

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer4 files
README.mdSource · read only
README language

dsh-filetransfer

简体中文

Native-feeling file drafts and local deliverable downloads for DeepSeek Harness Web.

!CI

What it does

  • Drop or select non-image files and review them as draft cards before sending.
  • Send a file by itself or together with ordinary user text.
  • Keep images on DSH's official image-attachment path.
  • Render Word, Excel, and generic files as distinct transcript cards.
  • Remove a draft file only through its close button, without exposing or

editing the hidden reference placeholder.

  • Download agent-produced files from a loopback-only deliverables panel.

Uploading is stage-only: it never calls session.prompt. The file reaches the agent only after the user presses DSH's normal Send button.

Compatibility

Version 0.2.5 targets @deepseek-ai/dsh 0.1.0-rc.7 and Node.js 22.19 or newer. DSH is a developer preview, so later releases may require a compatibility update.

DSH 0.1.0-rc.7 has a native image block but no generic file block. This plugin stores a compact workspace-relative <dsh-file> marker in the message and projects it as a file card in the Web UI. The internal path is not rendered as visible conversation text.

Install from GitHub

From the directory that should be the DSH workspace:

npx @deepseek-ai/dsh plugin --profile web add github:kerlyken/dsh-filetransfer
npx @deepseek-ai/dsh --profile web --dump-config
npx @deepseek-ai/dsh web

For reproducible installs, replace the GitHub spec with github:kerlyken/dsh-filetransfer#<commit-sha>.

Do not install @deepseek-ai/dsh-cordis-host-runner; DSH Web already ships the Host runner.

Configuration

The included cordis.patch.yml uses these defaults:

  • Host endpoint: http://127.0.0.1:3199
  • Workspace: the directory from which DSH is launched
  • Inbox: <workspace>/bridge/inbox
  • Deliverables: <workspace>/deliverables
  • Maximum decoded upload: 64 MiB
  • Allowed DSH Web origins: http://127.0.0.1:3080 and

http://localhost:3080

Override the filetransfer row in the profile's cordis.patch.yml when paths, origins, or ports differ. A later patch replaces the row's entire config, so repeat every required setting.

Optional local integrations

The core plugin has no dependency on WeCom or any other messaging platform. Trusted local integrations can opt into the same card renderer by submitting a normal user text block containing a workspace-relative marker:

<dsh-file path="bridge/inbox/example.docx"></dsh-file>

Append the user's optional instruction on the next line. Reject files outside the configured workspace before constructing the marker.

integrations/wecom/ contains optional, dependency-free reference modules for matching WeCom's separate text and file events. That directory is tested in CI but excluded from the npm package and is not required by the plugin.

Security

The upload and download server binds to 127.0.0.1, checks allowed origins, sanitizes file names, enforces path containment, and applies an upload limit. Do not expose port 3199 to a network without adding authentication and a separate threat model. See [SECURITY.md](SECURITY.md).

Development

npm test
npm run pack:check

The pack check should contain the plugin, tests, documentation, and license, but not integrations/, local configuration, inbox files, or deliverables.

Community status

DeepSeek Harness currently asks community plugins to live in standalone repositories and use the dsh-plugin topic. External pull requests to the official repository are not currently accepted, so this project follows that ecosystem route.

License

[MIT](LICENSE)

Back to searchOpen GitHub repository

More related plugins

View category