Hyperionjust/dsh-tool-underseal
30Last commit Aug 14, 2026
dsh-tool-underseal DSH plugin
dsh-tool-underseal is a DSH plugin that implements the Underseal protocol, a hash-sealed, file-authorization system for delegating bounded work between AI agents. It ships two sub-plugins (tool-underseal and underseal-guard) providing eight model-facing tools and a worker check-in lock, along with a bundled skill documenting the delegation workflow. The plugin enforces byte-level supply-chain sentinels to prevent tampered packages from activating.
How to install the dsh-tool-underseal DSH plugin
dsh plugin add dsh-tool-undersealCopying does not run this command. Review the repository and version before installing the dsh-tool-underseal DSH plugin.
dsh-tool-underseal DSH plugin data source
dsh-tool-underseal DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-tool-underseal DSH plugin can do
- Provides eight typed tools that wrap the frozen Underseal adapter for secure delegation of tasks.
- Includes a monotonic execution guard (underseal-guard) that blocks mutation tools until READY evidence is present.
- Runs three byte-level anti-forgery checks (E1, E2, E3) on startup to verify vendored verifier, skill body, and bundle patch integrity.
- Ships a DSH skill (underseal-delegation) with workflow documentation and reference files.
- Supports three installation methods: npm, Git checkout, and tarball.
Where the dsh-tool-underseal DSH plugin fits
- Securely delegate bounded coding tasks to AI subagents with hash-sealed assignments.
- Audit and enforce non-repudiable evidence trails in multi-agent workflows.
- Prevent unauthorized tool execution by requiring a worker check-in before mutations.
- Integrate with DSH profiles to run sealed ceremonies (doctor, seal, start, event, audit, retire).
Who the dsh-tool-underseal DSH plugin is for
- AI developers and researchers using DeepSeek Harness (DSH) to build multi-agent systems.
- Teams needing a cryptographically verifiable authorization layer for AI agent tasks.
dsh-tool-underseal DSH plugin limitations
- Requires a Python interpreter on the host system (default python on Windows, python3 on POSIX).
- Tested only on DSH 0.1.0-rc.5; compatibility with other versions is not guaranteed.
- The Git checkout install method requires allowlisting the build in the profile's pnpm-workspace.yaml, which grants build-time code execution outside sandbox.
- Local paths containing spaces must be wrapped in double quotes due to a CLI quoting issue.
dsh-tool-underseal DSH plugin: from the repository README
Quoted from the Hyperionjust/dsh-tool-underseal README, the upstream source of the dsh-tool-underseal DSH plugin. Copyright remains with the original authors.
**English** | [中文](README.zh.md)    > **The one-breath pitch:** chat is transport, not authorization. Authority is a > hash-sealed assignment file; evidence is append-only and re-derivable by any > third party; and every boundary fails closed — sealed tools, a worker > check-in lock, and byte-pinned supply-chain sentinels — behind a single > `dsh plugin add dsh-tool-underseal`. > **Tested on DSH 0.1.0-rc.5** — runtime mounting smoke test passed: `dsh plugin > add` + `dsh --dump-config` mounts both layers (`underseal` and > `underseal-guard`), and the full ceremony chain > (doctor → seal → start → event → audit → retire) ran end to end through the > vendored adapter in a real Git repository. Two field notes: when `dsh plugin > add` takes a **local path containing spaces**, wrap it in literal double > quotes (`dsh plugin --profile p add '"D:\Project Hyperion\A_Deepseek Harness Workspace\underseal-dsh"'`) — > the CLI joins pnpm args through a shell without quoting; and after seal
Read the full READMERepository license: Apache-2.0
dsh-tool-underseal DSH plugin questions
How do I install dsh-tool-underseal?
You can install it via npm: `dsh plugin --profile <name> add dsh-tool-underseal`. Alternatively, use a Git checkout with a pinned commit: `dsh plugin --profile <name> add github:you/dsh-tool-underseal#<sha>`, or build a tarball with `pnpm pack` and add it locally. The npm form is preferred because it ships prebuilt lib/ and does not require build permission.
Does the plugin work on Windows?
Yes, but note that on Windows the default Python interpreter is `python`. If your local path contains spaces, you must wrap it in double quotes when running `dsh plugin add` because the CLI joins pnpm args through a shell without quoting. For example: `dsh plugin --profile p add '"D:\Project Hyperion\A_Deepseek Harness Workspace\underseal-dsh"'`.
What are the supply-chain sentinels and why do they matter?
The plugin runs three byte-level checks during startup (E1, E2, E3) to verify the integrity of the vendored verifier, the skill body, and the bundle patch. If any check fails, the plugin either logs an error and registers no tools (E1, E3) or logs a warning and still loads the skill (E2). This prevents a tampered package from activating silently, ensuring that only the reviewed bytes are used.
Can I customize the adapter path or Python interpreter?
Yes. The plugin provides config fields `adapterPath` and `pythonPath`. By default, the vendored `python/underseal_adapter.py` is used with `python` (Windows) or `python3` (POSIX). If you set `pythonPath: ''`, the adapterPath is treated as an executable directly. You can also override `adapterPath` to point to a separately provisioned console-script install.
What is the performance overhead of sealing?
Based on benchmarks with DSH 0.1.0-rc.5 and deepseek-v4-flash, the seal adds a flat ~10.4K uncached tokens per task, not a percentage tax. For a trivial one-file task this was 42% of total input; for a real coding task (Python module + 16-test suite) it dropped to 13.8%. Wall-clock overhead is ~10s for trivial tasks and ~54s for real tasks. Full details in BENCHMARK.md.