dsh-ssh-pro

Enhanced SSH ops for DeepSeek Harness — fills the easy-to-overlook gaps of the base dsh-ssh plugin: connectivity testing, remote directory listing, ~/.ssh/config import, known_hosts fingerprint checks, and one-shot exec across many hosts.

Independent community project. Reuses the host store of @linxin666/dsh-ssh (Apache-2.0) but has no runtime dependency on it — only the ssh2 library. Coexists with any SSH plugin.

Why

The base dsh-ssh ships ssh_list/exec/upload/download/tunnel/cluster plus a full GUI, but leaves five engine capabilities unexposed to the agent — the classic "exists but easy to overlook" gap:

Features

• 5 native tools: ssh_test / ssh_ls / ssh_import / ssh_keyscan / ssh_multi_exec
• Reads ~/.dsh/dsh-ssh.json directly (interops with dsh-ssh GUI config)
• ssh_multi_exec filters by alias/environment/tags with concurrency control
• Bundled SKILL.md, Schemastery config, bundle patch layer
• Security model mirrors dsh-ssh: 0600 host store, verbatim output, no key leakage

Prerequisites

• DeepSeek Harness (dsh)
• ssh2 npm package (plugin dependency)
• Hosts configured via the dsh-ssh GUI or ~/.dsh/dsh-ssh.json (ssh_import can populate from ~/.ssh/config)

Install

# in a profile's cordis.patch.yml
- insert:
    - id: ssh-pro
      name: './src/index.js'
      config:
        storePath: ~/.dsh/dsh-ssh.json
        sshConfigPath: ~/.ssh/config
        timeoutMs: 30000

# or local dev
pnpm dsh web --patch ./dsh-ssh-pro/cordis.patch.yml

Tools

Config

Security

• Passwords/passphrases live in the 0600 host store; tools never emit keys
• ssh_multi_exec returns output verbatim (env etc. may bring back remote env vars)
• ssh_keyscan is read-only; a "new host" notice means confirm the fingerprint with the user

Layout

dsh-ssh-pro/
  src/index.js            # plugin entry: 5 tools + ssh2 engine + config
  skills/ssh-pro/SKILL.md # agent skill
  docs/                   # docs
  cordis.patch.yml        # bundle patch layer

License

Apache-2.0.