DSH Universal File Attachments

Session-scoped universal file attachments for DeepSeek Harness (DSH).

It replaces path injection with a compact attachment rail: images, videos, audio, documents, archives, unknown files, and folders are kept as safe, session-scoped attachments. Browser and agent tooling receive attachment IDs, never a local machine path.

Features

• Drag or paste files directly into a DSH conversation. No extra picker UI.
• Preview images and videos; show type cards for documents, audio, archives, folders, and other files.
• Chunked uploads with SHA-256 finalization and a 2 GB per-file / 10 GB batch limit.
• Session, tenant, user, and agent isolation on every host route.
• Agent tools for listing, reading, extracting, searching, materializing, and explicitly importing attachments into an asset or knowledge service.
• Safe folder manifests: relative paths only; .git, node_modules, .DS_Store, device files, and unsafe paths are rejected.

Platform support

The plugin is implemented with Node.js and standard Chromium browser APIs and works on macOS, Windows 10/11, and Linux when DSH runs on a supported Node.js runtime.

Capability	Windows Chrome / Edge	macOS Chrome	Firefox
File drag and paste	Supported	Supported	Supported
Image / video previews	Supported	Supported	Supported
Folder drag with directory tree	Supported	Supported	Browser fallback only
Chunked file upload	Supported	Supported	Supported

Folder traversal uses the File System Access API when available, then the standard Chromium directory entry API, then the browser file list. Use current Chrome or Edge for complete folder-tree support on Windows.

Install

From a local clone:

git clone https://github.com/13323232dong/dsh-file-attachments.git
cd dsh-file-attachments
npm install
npm run build
dsh plugin --profile web add .

Restart the DSH web process after installation. The plugin occupies the conversation.input.attachments slot with a higher-priority universal rail, so remove other plugins that independently consume document-level file-drop events.

Configuration

The core attachment store works without external services. Optional explicit imports to an OPC-compatible asset or knowledge API need server-side settings:

- id: opc-file-attachments
  config:
    apiBaseUrl: https://your-opc-api.example
    identityHmacSecret: !!js process.env.OPC_DSH_IDENTITY_HMAC_SECRET

Never expose identityHmacSecret to the browser. The browser sends only its current DSH session ID; the host resolves the principal and signs outbound requests.

Development

npm install
npm test
npm run typecheck
npm run build

License

MIT