Introduction¶

In DSH, the most common way for an agent to operate on remote machines is to open a separate SSH channel: the agent constructs the commands itself, and manages the shell itself. This approach has three direct problems: you cannot see what commands it actually typed; interactions that must be performed by humans, such as passwords / sudo / fingerprints, have no entry point; and there is no record to review afterwards.

feely0208/dsh-ssh-console provides a controlled, auditable execution channel. It does not use a shared PTY, but hardcodes boundaries: host whitelist, key-only, dangerous command confirmation, and full trace logging. Below is an introduction to its capabilities, installation, and usage boundaries.

What is it¶

@deepwhale-cn/dsh-ssh-console is a plugin for DSH (DeepSeek Harness). Its package description is “DeepSeek SSH Console”: listing hosts from ~/.ssh/config in the sidebar panel, executing remote commands, and providing full audit logging. It is maintained by feely0208, with the repository address github:feely0208/dsh-ssh-console. The author field in package.json is Wenzhou Deepwhale Intelligence Technology Co., Ltd.

The problem it solves is: the agent needs to be able to interact with remote machines, but the execution process must be within the scope of human visibility, confirmation, and review. Keywords (from the original README) are SSH, remote operations, audit, dangerous command confirmation, and DeepSeek Harness plugin.

Core Features¶

1. Host Whitelist: By default, only aliases in ~/.ssh/config are allowed. If you explicitly need to relax the policy to arbitrary user@host, set DSH_SSH_ALLOW_ANY=1.
2. Key-only: Uses BatchMode=yes when calling the local ssh. Scenarios requiring a password will error out explicitly, rather than inducing you to write the password into the configuration or the plugin.
3. Dangerous Command Confirmation: When matching patterns like rm -rf, mkfs, dd, shutdown, chmod 777, force push, npm publish, etc., it returns “requires confirmation” and only executes when confirm=true is present.
4. Full Audit: Every execution, rejected execution, and pending request is written to ~/.dsh/ssh-console-audit.jsonl.

The panel is divided into four areas:

Installation and Usage¶

The installation command comes from the original README:

dsh plugin --profile web add @deepwhale-cn/dsh-ssh-console

Environment requirements before installation (from package.json):

"engines": {
  "dsh": ">=0.1.0-rc.6 <0.3.0",
  "node": ">=18"
}

The license is MIT, current version 0.1.0. The plugin targets the web platform, dsh.client.inject injects @deepseek-ai/dsh-client-runtime, platform is web, immediately is true; dsh.bundle.patch points to ./cordis.patch.yml. The entry is ./lib/index.js, with an additional ./lib/client.js.

You should read the source code and LICENSE before installing. The plugin runs with the permissions of the current dsh process. It relies on the local ssh executable to execute remote commands, so you must also ensure that the account running dsh has access to the relevant hosts and credentials.

Typical Usage¶

After installation, the sidebar will have an additional “SSH Console”. Prepare two things first: confirm that the alias for the target host is written in ~/.ssh/config, and confirm that local ssh is configured with keys or ssh-agent (the plugin does not save passwords and does not do credential proxying).

The execution order is as follows:

1. Select an alias in the “Host” area. The list comes from ~/.ssh/config.
2. Input the command to execute in the “Command” area, supporting multi-line input.
3. Click “Execute”. The panel displays the exit code, duration, stdout, and stderr.
4. If a dangerous command pattern is matched, the panel will not execute directly. Instead, an entry will appear in the “Pending Confirmation” area, requiring you to click “I know the risk, execute”; or you must confirm by passing confirm=true.
5. Every execution, rejection, or pending confirmation will append a record to ~/.dsh/ssh-console-audit.jsonl, which can be viewed in the “Audit” area for the last 20 entries.

The following commands are examples of dangerous commands that will trigger double confirmation:

rm -rf /var/lib/app
mkfs.ext4 /dev/sdb1
dd if=/dev/zero of=/dev/sda
shutdown -h now
chmod 777 /etc/app
git push --force origin main
npm publish

Use Cases and Considerations¶

Suitable for these scenarios: needing to initiate remote commands from the DSH sidebar, wanting every remote operation to have time / host / result / command summary for review, and not wanting passwords to enter the plugin or configuration files.

Boundaries to note (from the README “Boundaries (Important)” section):

• No password saving, no proxying: It only calls the local ssh. Credentials are managed by your ssh system (key / agent).
• Not a full terminal: Executes one command at a time, does not preserve shell state, and cd / export do not cross commands. For interactive logins, please use the system terminal.
• Timeout: Default 30 seconds, max 120 seconds. For long tasks, please use nohup / tmux to host them yourself.
• Audit file is plaintext JSONL: It stays on the local machine; do not place it in a shared directory.

This plugin is a tool. Users must comply with the laws and regulations of their region and assume sole responsibility for the consequences caused by using this project.

Conclusion¶

The value of this plugin lies not in providing a smoother remote shell, but in fixing the boundaries of remote execution: who executed it, whether they could execute it, what was executed, and what was rejected—all are recorded. The directory page and repository are as follows:

• SkillHub Directory Page: https://www.skillhub.cn/plugins/feely0208/dsh-ssh-console
• GitHub: https://github.com/feely0208/dsh-ssh-console

It should be noted that SkillHub is an independent community directory site and has no official affiliation with DeepSeek / Huansuan. This plugin is not a product listed in an official app store.