dsh-chat-preset

A DeepSeek Harness bundle that registers a chat agent preset: a plain helpful assistant with web access and local skills, and no way to touch the filesystem or run a command.

Abstract

The harness composes behaviour from bundles, presets, and plugins. This bundle adds one preset row and one guard plugin, so a session can be switched to a chat mode whose model can search, fetch, and load skill instructions, and nothing else. A preset-scope tool restriction would also filter the preset's own tools, so the restriction is applied per agent once that agent exists.

What it registers

One preset, mounted from cordis.patch.yml:

Field	Value
id	chat
name	Chat
order	5
persona	helpful assistant, cites sources, marks uncertainty, never claims to have run something it did not
tools	web_search, web_fetch, skill
compaction	basic compaction plus /compact

The persona is complete: true, so it replaces rather than extends the host prompt, and includeRuntimeContext is off: chat mode does not get the workspace facts injected.

Why a guard instead of a config flag

The preset's own tools are registered in the shared preset scope, and the host also registers a few global tools such as working_directory. A restriction applied at the preset scope would filter the preset's own tools too, and would miss the globals. So the restriction is applied per agent, once the agent exists.

lib/guard.js listens for agent/created, reads the tools that agent can actually see, keeps web_search and web_fetch, adds skill when it is present, and calls agent.ctx.tools.restrict({ allow }).

Reading the allow list from the visible tools rather than hard-coding it means a search-only or fetch-only web configuration still produces the right restriction instead of an empty one. If no web tool is registered at all, the guard logs a warning and leaves the inherited tools unrestricted, which is a deliberate failure mode: it prefers a visible configuration error over silently removing a tool the user asked for.

Why the skill tool survives

skill reads only the skill files that the discovery provider exposes. It never resolves a workspace path, so keeping it does not widen filesystem access. Dropping it would make user-level skills unreachable in the one mode that most needs them.

Install

DSH_HOME=${DSH_HOME:-$HOME/.dsh}
git clone https://github.com/ThomasTZh/dsh-chat-preset \
  "$DSH_HOME/local-plugins/dsh-chat-preset"

Register it in $DSH_HOME/profiles/web/package.json as a dependency:

"@local/dsh-chat-preset": "link:<absolute path to $DSH_HOME>/local-plugins/dsh-chat-preset"

and list @local/dsh-chat-preset in dsh.profile.bundles, then:

cd "$DSH_HOME/profiles/web" && pnpm install

dsh plugin --profile web add "<path-to-this-clone>" performs the same registration through the harness CLI.

Verification

Check	Command	Result
Unit tests	node --test test/guard.test.mjs	pass, 6 tests
Module parses	node --check lib/guard.js	pass
Install layout	clone into a temporary DSH_HOME, then check the package and its patch arrive	pass; pnpm install and a harness restart were not run

Not tested: a full preset switch in a freshly installed harness. The machine this bundle was written on runs the preset, but no separate live check was repeated from this repository.

Limitations

• The guard restricts tools, not prompts. A chat session can still load any skill the discovery provider exposes, by design.
• The preset rows name shipped harness packages (@deepseek-ai/dsh-agent-preset, dsh-persona, dsh-agent-instructions, and the skill and compaction plugins). They are resolved from the harness install and are not vendored here.

Acknowledgements

The harness and its shipped packages are the work of the DeepSeek Harness project [1].

References

1. DeepSeek Harness. https://github.com/deepseek-ai/deepseek-harness. MIT.