English · 中文

DSH SSH Ops

An SSH operations plugin for DeepSeek Harness: drive the current server from the main conversation while keeping a real interactive terminal on the right, with built-in file management, port forwarding, and database management.

Screenshots

Drive the connected server directly from the main conversation, with a real interactive terminal on the right and panels for files (SFTP), tunnels, and databases:

What it does

• Open a resizable xterm.js SSH terminal on the right of a session. When DSH-better-sidebar is also enabled, the terminal docks to the left of the sidebar instead of covering the file sidebar or the top-right controls.
• Manage any number of servers and groups under Settings → Plugins → SSH Resources; the top SSH toggle only shows or hides the right-side terminal.
• Server name, address, port, username, auth type, and group are stored in DSH local storage; there is no count limit.
• Passwords, PEM private keys, and passphrases are stored only in DSH's official local credentials store ~/.dsh/.credentials.yaml (owner-only permissions). Browser storage, agent context, tool results, and resource lists never read or display secrets.
• The main conversation auto-detects the currently-connected server on the right; the agent never has to ask the user for an internal connection id.
• Commands the agent runs via ssh_exec are echoed in the right-side terminal, and the exit code, output, duration, timeout, and truncation status are returned to the main conversation for analysis.
• Manual terminal output is read on demand via ssh_read; it is never silently injected into the conversation context.
• Output sent to the model is redacted for private keys, Bearer tokens, common passwords/API keys (including bare sk--prefixed keys), and database passwords.
• Connection stability: SSH connections enable keepalive (20s interval, 3 checks), so NAT/firewalls no longer silently drop idle connections. Transport drops trigger exponential-backoff auto-reconnect (capped at 30s); a command that drops mid-run is retried once transparently. Transient connection failures auto-retry 3 times (auth failures excluded). Explicit disconnect or plugin unload never triggers reconnect; remote tunnels re-register automatically after a reconnect.
• File management: a Files tab in the SSH panel browses the server's filesystem over SFTP with upload, download, mkdir, delete, and rename. The sftp_* tools can also be used directly in the conversation.
• Port forwarding: a Tunnels tab starts local forwards (this machine → server-reachable target) and remote forwards (server → this machine), with a live tunnel list and stop control. The tunnel_* tools can also be used directly.
• Databases: a Database tab connects to MySQL / PostgreSQL / Redis / MongoDB, runs SQL queries or commands manually, and shows results in a table. The db_* tools can also be used directly.
  • db_connect auto-tunnels over SSH: once a server is connected, loopback hosts (127.0.0.1 / localhost / ::1) are automatically tunneled through the current server to reach intranet databases. via_ssh selects auto (default) / yes / no; an explicit ssh_connection_id takes precedence.
  • Three SSL modes (disabled plain / preferred encrypt-without-verify / verify encrypt+verify-CA) for cloud-managed databases.
  • Database connections can be saved as profiles for one-click reconnect after restart; passwords are encrypted in the DSH credentials store; saved resources support renaming and collapsible grouping.
  • High-risk SQL (DROP DATABASE/SCHEMA/TABLE, TRUNCATE, SHUTDOWN) is auto-blocked, detected by statement verb (skipping strings/comments, supporting multi-statement), so keywords inside string literals are never false-positives.
• Multi-server fan-out: ssh_cluster runs one command concurrently across all connected servers (or a filtered subset), returning exit code and output per connection.

Security boundary

DSH's own permission mechanism remains in effect. This plugin additionally stops agent tools from executing clearly irreversible or destructive operations, such as deleting files, dropping databases, formatting disks, terraform destroy, kubectl delete, docker prune, forced Git cleanup, and reboot/shutdown.

When the agent hits the blocklist it is not silently refused: the plugin creates a one-shot pending-confirmation record and shows an execution card above the SSH panel's terminal. Each card shows the target server, the risk reason, and the full command; only the operator's red Execute button submits it, and Undo clears the record and the prefilled input line. The keyboard Enter cannot submit an agent-prefilled dangerous command; Ctrl-C or any edit invalidates the record, and subsequent input is treated as normal manual input. Multiple dangerous commands queue independently. If no terminal session can be safely prefilled, or the command contains control characters like Tab, it degrades to a copyable command card returned in the conversation for the operator to paste into the terminal. Ordinary ops (configure SSL, install packages, edit configs, reload services) flow through DSH's normal permission process.

The same model covers sftp_delete (the agent no longer deletes directly; instead the equivalent rm -rf <path> is queued for confirmation) and db_execute high-risk SQL (DROP/TRUNCATE/SHUTDOWN): high-risk SQL keeps the same pattern, returning a card with a ``sql code block for the operator to paste into the database panel's SQL editor and run manually. SQL detection works by **statement verb** (skipping strings/comments, splitting on;` for multi-statement), so keywords inside string literals are never false-positives, and high-frequency CRUD passes through normally.

Installation

From GitHub (recommended)

dsh plugin --profile web add github:caoyiwei850/dsh-ssh-ops#v0.2.12

Then restart DSH Web:

dsh web

Open any session, click the top SSH tab, and use the right-side panel to connect to a server.

From a release archive

Download dsh-ssh-ops-0.2.12.tgz from GitHub Releases, then:

dsh plugin --profile web add /path/to/dsh-ssh-ops-0.2.12.tgz
dsh web

dsh-ssh-ops-0.2.12.zip is for offline review or further development; extract it and run npm install && npm run build in the directory.

Usage

1. Open Settings → Plugins → SSH Resources and create a group or server resource; PEM / .key files can be imported directly.
2. A saved resource can be "connect & open" to auto-create a right-side PTY terminal. When editing, leaving a secret field blank keeps the existing value; clearing credentials requires explicit confirmation.
3. The top SSH only toggles the right-side terminal; the + in the top-right picks a saved resource or creates a non-persistent temporary connection.
4. In the main conversation, just say "check server memory usage" or "configure the Nginx SSL certificate". The agent can only operate the active connection; it cannot enumerate saved resources, read credentials, or auto-connect using saved credentials.
5. For databases, have the agent call db_connect (or create a connection yourself in the Database tab), then query/execute from the conversation.

Agent tools

There are 24 tools. Omitting connection_id / db_connection_id targets the active connection — no need to call ssh_list / db_list_connections first.

SSH (7)

SFTP (6)

Port forwarding (3)

Database (8)

Use db_query for read-only SQL, db_execute for SQL writes, and db_run for Redis/MongoDB. MySQL uses ? placeholders; PostgreSQL uses $1 placeholders.

Development

npm install
npm test
npm run build
npm run pack:release

Artifacts are written to release/:

• dsh-ssh-ops-0.2.12.tgz: installable directly by DSH.
• dsh-ssh-ops-0.2.12.zip: full offline source archive.

License

MIT