dsh-lab-ssh: Securely Controlled SSH Development Tool for DeepSeek Harness

dsh-lab-ssh is a standalone community plugin (v0.3.0 experimental, MIT licensed) that provides a securely controlled SSH development tool for DeepSeek Harness (DSH) and MCP clients. Its core purpose is to allow agents to securely access lab GPUs and file resources while maintaining server isolation from the public internet, thereby avoiding the direct exposure of arbitrary hosts, commands, and file paths. The plugin implements least-privilege access through fixed host aliases, OpenSSH fingerprints, and a command allow list. It supports alias-based remote directory restrictions, bounded UTF-8 read/write (with hash-protected atomic writes), and optional HTTPS artifact bridging (disabled by default, with strict security checks). It explicitly does not provide interactive shells, port forwarding, arbitrary file transfers, or background commands to maintain network security.