dsh-files-manager

English | 简体中文

Upload files through the DeepSeek Files API (https://api.deepseek.com/files), preview and delete them from the DeepSeek Harness Web UI, and reference uploaded file_ids in prompts.

Features

• Adds a DeepSeek 文件 button beside the existing composer controls.
• Accepts multiple image files (JPEG, PNG, GIF, WebP) and uploads them to the DeepSeek Files API as purpose=user_data.
• Shows pending files as cards above the composer.
• Serializes each uploaded file into a model-readable file_id reference only when the message is submitted.
• Clears pending cards after submission and restores them when submission fails.
• Lists all files on the account in Settings → DeepSeek 文件, with preview and delete actions.
• Keeps the DeepSeek API key server-side only; the browser never sees it.

Compatibility

• DeepSeek Harness (Web profile)
• Node.js 22 or newer (server-side fetch)

The DeepSeek Files API supports the deepseek-v4-flash-vision-exp model. Uploaded files are referenced by file_id in a file content block. See the Files API guide and the Vision guide.

Install

Install a tagged GitHub release into the Web profile:

dsh plugin --profile web add "github:l541402398/dsh-files-manager#v1.0.0"

To install the latest development branch instead:

dsh plugin --profile web add "github:l541402398/dsh-files-manager#main"

To remove it:

dsh plugin --profile web remove dsh-files-manager

Restart the running Web profile after installation, then refresh the browser page.

Configure

The plugin proxies browser requests to the DeepSeek Files API and authenticates with the same DeepSeek API key DSH already uses, resolved through the Host credentials service. No extra key is required — set DEEPSEEK_API_KEY in the Harness credentials store (the Web Models page writes it), and the plugin picks it up automatically.

Variable	Default	Purpose
DEEPSEEK_API_KEY	(used by the built-in DeepSeek provider)	DeepSeek API key used to authenticate the Files API calls. Read via the credentials service; the plugin also accepts DSH_FILES_API_KEY and ANTHROPIC_API_KEY.
DSH_FILES_API_BASE	https://api.deepseek.com	Override the DeepSeek API base (e.g. an Anthropic-compatible base).

API key resolution order

config.apiKey → config.apiKeyEnv via the credentials service (DEEPSEEK_API_KEY by default) → DSH_FILES_API_KEY env → DEEPSEEK_API_KEY env → ANTHROPIC_API_KEY env.

The key is stored server-side in $DSH_HOME/.credentials.yaml (written by the Harness Web Models page) or exported in the launching environment; it is never exposed to the browser.

# $DSH_HOME/.credentials.yaml
version: 1
refs:
  DEEPSEEK_API_KEY: sk-...

Use

1. Open a conversation in the Harness Web GUI.

2. Select DeepSeek 文件 in the composer toolbar.

3. Choose one or more image files.

4. Review or remove the pending cards above the composer.

5. Add any normal prompt text you want, or leave the editor empty.

6. Submit the message. The model receives a line such as:

   DeepSeek 文件：`file-api-xxxxxxxxxxxxxxxx` (image.jpg)
   

Endpoints

The plugin registers two exact HTTP routes on the Harness Web server:

Route	Method	Purpose	DeepSeek upstream
/api/dsh-files	GET	List files (optionally ?id= to retrieve one)	GET /files or GET /files/{id}
/api/dsh-files	POST	Upload a file (multipart file + purpose)	POST /files
/api/dsh-files	DELETE	Delete a file (?id=)	DELETE /files/{id}
/api/dsh-files/content	GET	Retrieve a file's bytes (?id=)	GET /files/{id}/content

Security model

• List, upload, content, and delete routes use the same loopback/trusted-host and Origin checks as the built-in Harness Web API.
• Cross-site browser requests are rejected.
• The DeepSeek API key lives only in the Host process and is never returned to the browser.
• Requests are proxied with the upstream error message surfaced (without leaking the key).

This trust fence is not a user-account authentication system. If the Harness Web GUI is exposed to other users or the public Internet, protect the whole deployment with an authenticated reverse proxy and configure Harness trusted hosts correctly.

Development

Run the checks:

npm test
npm run check

The package is a persistent dual-face Cordis bundle:

• index.js — Host HTTP proxy routes to the DeepSeek Files API and trust checks.
• client.js — composer button, pending-file rail, hidden reference codec, and Settings UI.
• cordis.patch.yml — installable dsh.bundle composition row.
• test/index.test.js — Host storage, routing, and trust-boundary regression tests.

See CONTRIBUTING.md for local-link development instructions.

License

MIT