dsh-credential-handoff

English | 中文

Status: Feature Plugin. Tested with DeepSeek Harness 0.1.0-rc.6.

dsh-credential-handoff lets an agent ask for a named credential without placing the secret in model context. The browser opens a conversation-local password dialog, writes the value through DSH's credential service, and returns only fixed status metadata to the tool call.

Problem

Agents can discover that a credential is missing, but asking the user to paste a key into normal chat exposes it to the transcript and model context. This plugin provides a write-only handoff path for that moment.

Behavior

The request_credential tool accepts a credential reference such as TAVILY_API_KEY, an optional label, and a reason. One pending request is allowed per session. The dialog expires after ten minutes. The tool result reports only the reference and whether it was configured or replaced.

On HTTPS, credential submission is allowed. On plaintext HTTP it is allowed only for exact loopback hosts (localhost, 127.0.0.1, and IPv6 loopback). Non-loopback plaintext HTTP is blocked in both the controls and the submit handler.

Non-goals

This package is not a vault, encryption provider, credential viewer, credential injector for subprocesses, or replacement for DSH's credential providers. It cannot protect a compromised browser, host process, or DSH credential backend.

Mechanism

• Host: registers request_credential and waits on a tagged userQuestions request.
• Client: handles only that tagged question and calls credentials.set directly.
• Result: answers the pending question with fixed text and returns value-free metadata.

The secret is never included in the question answer, tool result, normal logs, or session event payload created by this plugin.

Compatibility

Tested with DeepSeek Harness 0.1.0-rc.6, Node.js ^22.19.0 || >=24, and pnpm >=10. DSH is a release candidate; later versions may change the question, credential, or client-slot contracts.

Install

dsh plugin --profile web add "github:xiaohj233/dsh-credential-handoff#v0.1.0"

Restart the Web profile after installation.

Configuration

No plugin settings are required. The model calls:

{"ref":"TAVILY_API_KEY","label":"Tavily API key","reason":"Required for Tavily search"}

Credential references use shell-style names: letters or underscore first, followed by letters, digits, or underscore.

Uninstall

dsh plugin --profile web remove dsh-credential-handoff

Removing the plugin removes the tool and dialog. It does not delete credentials already stored by the configured DSH credential provider.

Safety

Do not expose the DSH Web control plane to an untrusted network. Blocking plaintext non-loopback submission prevents this plugin from sending a secret on that transport; it does not add authentication to DSH. Review the configured credential provider's storage properties separately.

Tests

npm test
npm run check:syntax
npm run scan:secrets -- synthetic-test-value lib/index.js lib/client.js test/validate.test.js
npm pack --dry-run

The tests cover reference validation, secret-shape handling, transport classification, question/result mapping, and package syntax.

Limitations and upstream status

DSH already provides resolve, describe, set, and unset credential services. This plugin adds only a conversation-local handoff UI and model tool. It does not read credential values back into the browser or model.

The rc.6 generic question UI always offers an Other text answer. If the client takeover bundle fails to load, the fallback question warns the user not to paste a secret and to cancel, but the host cannot remove that generic field. Direct clients can also call DSH's own credential API outside this plugin; transport and authentication for the wider Web control plane remain upstream responsibilities.

License

MIT. See LICENSE.