@deepseek-ai/dsh-credentials
@deepseek-ai/dsh-credentials is a shared library inside a DeepSeek Harness profile: the credential seam plugins read provider keys through.
Currently 0.2.2-rc.3. It is not a plugin row: it has no panel to install and should not be removed on its own, because other packages are built on it.
What it is
A plugin asks for a provider key instead of keeping its own copy in its settings, so one login can serve several plugins.
That is what lets one login serve several plugins, and what makes revoking a key a single action instead of a hunt through every plugin that copied it.
It arrives with a profile, not as an install
None of the 16 profile packages depends on it directly; it comes in with the plugins that declare it as a peer.
No profile package lists it directly; plugins that need a key declare it as a peer. To see whether a given plugin is wired to the seam, check its peerDependencies in the installed package.json — a plugin reading keys another way will not list it.
"@deepseek-ai/dsh-credentials": "0.2.2-rc.3"
# $DSH_HOME/profiles/<name>/package.jsonWho uses it
4 community plugins declare it as a peer; each page shows what it patches.
Version and engines
npm publishes 0.2.2-rc.3 (2026-11-13), one day after 0.2.2-rc.2. The latest tag is stale at 0.0.1-rc.1, same problem as the other two dsh support packages.
Common questions
Where does the key actually live?
Not here. This package is the interface, not the store; the implementation behind the seam decides where the value sits. What the seam guarantees is that a plugin asks instead of holding a copy.
Can a plugin read the raw key text?
A plugin that gets the credential value can. The seam does not sandbox a plugin from its own process — it removes the need for each plugin to persist a second copy, which is the part that leaks in practice.