dsh-plugins

Generic, config-driven plugins for DeepSeek Harness (dsh). No dsh core patches required — everything is built on documented Cordis seams (services, typed events, waterfalls).

Status

Early scaffold. The plugin shapes, config schemas, and seam choices are in place; event-payload field names are marked TODO(verify) where dsh pre-release APIs may shift. Pin your dsh version and check the markers before production use.

Compatibility

dsh is in developer preview and will break compatibility between releases. Every release of these plugins pins a tested dsh version in this matrix; upgrade deliberately.

Install

Each package is a dsh bundle (ships a cordis.patch.yml). With the dsh CLI:

dsh plugin --profile my-agent add dsh-a2a dsh-storage dsh-langfuse
dsh --profile my-agent

For local development from this checkout, use a --patch overlay instead (no packaging needed):

# dev.patch.yml
- insert:
    - id: langfuse
      name: file:///absolute/path/to/dsh-plugins/packages/dsh-langfuse

dsh --profile my-agent --patch dev.patch.yml

Configuration

All three plugins are disabled by default and configured through the standard dsh plugin config layer (Schemastery-validated, hot-reloaded). Example profile cordis.patch.yml snippet:

- insert:
    - id: langfuse
      name: dsh-langfuse
      config:
        enabled: true
        publicKey: pk-lf-...
        secretKey: sk-lf-...
        baseUrl: https://cloud.langfuse.com
    - id: storage-mirror
      name: dsh-storage
      config:
        enabled: true
        database:
          enabled: true
          url: mysql://user:pass@host:3306/agent
    - id: a2a
      name: dsh-a2a
      config:
        enabled: true
        host: 127.0.0.1   # no auth built in — keep loopback or front with a proxy
        port: 41241
        cwd: /srv/agent-workspaces
        taskStore: redis  # memory | redis | gcs — A2A task state only
        redis:
          url: redis://127.0.0.1:6379
        gcs:
          bucket: my-agent-archives

Data model

dsh-storage's relational shape (packages/dsh-storage/prisma/schema.prisma) matches the source project's ai_messages / ai_chat_histories tables, so existing data stays compatible (one deviation: no user_id column — tenancy rides on session_id):

• ai_messages — one row per projected session event (user / model / tool), with thoughts, tokens, tool_calls, agent_id, metadata JSON columns and soft-delete.
• ai_chat_histories — per-session rollup (message count, total tokens, first/last message timestamps, archive marker).

The logical message id rides in metadata.id; the DB primary key is a cuid, so re-projected events update rather than duplicate.

A2A task state is a separate concern from conversation history: dsh-a2a ships pluggable TaskStore backends — in-memory (default), Redis (task metadata JSON + TTL, contextId → taskId index), and GCS (gzipped task metadata + optional workspace tar archive, same layout as the source project's GCSTaskStore).

Security

dsh ships no authentication or authorization. dsh-a2a binds 127.0.0.1 by default; if you expose it, put an authenticated reverse proxy in front and treat every agent as running with the host process's OS privileges. Multi-tenant deployments need per-tenant isolation (containers) on top.

Repository layout

packages/
├── dsh-a2a/        # A2A protocol server plugin
├── dsh-storage/    # session storage mirror plugin (+ prisma schema)
└── dsh-langfuse/   # Langfuse observability plugin

Development

pnpm install
pnpm build        # tsc per package
pnpm typecheck

Known scaffold gaps (help welcome):

• dsh-a2a: the session-event → A2A event translation table is a stub (translateSessionEvent in bridge.ts); the @a2a-js/sdk transport (RequestHandler, ExecutionEventBus, resubscribe-with-replay) is not wired yet — the Redis/GCS TaskStores are created from config but not yet fed by the SDK handler.
• dsh-langfuse: turn-trace ↔ generation/span parenting needs the verified session identity path from llm/stream options.
• dsh-a2a GCS store: workspace archiving shells out to tar.

License

MIT