Public DSH Contract Matrix

Validated against DeepSeek Harness 0.1.1-rc.2 and the official plugin development guide.

Need	Public contract	Decision
Tool registration	@deepseek-ai/dsh-tools: ctx.tools.register(defineTool(...))	Supported; Cordis-owned cleanup.
Session identity / cwd / cancellation	exec.agent?.session, session.header.cwd, exec.signal	Supported; tools fail closed without an agent cwd.
Canonical filesystem	@deepseek-ai/dsh-fs: ctx.fs	Supported.
Filesystem policy	ctx.sandboxPolicy.resolve(...), ctx.fs.sandboxMode, and ctx.fs.writeText(..., policy)	Supported; mutations use an exact provider version guard, and read-only escalation is unavailable for bare non-enforcing providers.
Read observations	Public fs/observed event	Supported; this plugin also owns exact observed line intervals.
Process management	@deepseek-ai/dsh-subprocess: ctx.subprocess	Supported.
Process confinement	@deepseek-ai/dsh-sandbox: ctx.sandbox.confine	Supported; process-backed read tools force read-only policy and inspect reported enforcement. Full is required by default; explicitly opted-in native Windows may accept partial enforcement. The public contract has no backend attestation.
Atomic process read whitelist	No public contract	Unsupported; AST directory/path scans are gated off and exact provider-read file bytes are supplied over stdin.
Process launch approval	Generic ctx.approval.request only	Enabled by default and operator-configurable; disabling the prompt never disables forced read-only policy, enforcement eligibility checks, or the exact configured spawn plan.
Oversized output	@deepseek-ai/dsh-spill: ctx.spillStore.saveText	Supported when an owner session exists; otherwise output remains bounded.
Settings UI	@deepseek-ai/dsh-settings plus the public settings.plugin.item client slot	Supported; the Host exposes coding-tools, while the browser card edits four live availability controls, two live approval controls, and one warned native-Windows compatibility control through the revision-fenced settings scope. The Host uses SettingsScope.watch, exact registration disposers, a transition guard, and generation-scoped cancellation.
Built-in read bookkeeping	No consumer API required	The plugin uses its own code_read observation store.

No DSH private source path is imported.