GuoMonth/dsh-multi-tenant
Multi-tenant SaaS extension for DeepSeek Harness (DSH): tenant identity, session isolation, authorization, tenant-aware MCP, and audit.
安装Install
dsh plugin --profile web add github:GuoMonth/dsh-multi-tenant把 GuoMonth/dsh-multi-tenant 加入你的 DSH 配置（web profile）即可启用。
READMEREADME
简体中文 | English
dsh-multi-tenant
Composable multi-tenant plugin primitives for DeepSeek Harness (DSH).
Phase: kernel prerelease line.
0.1.0-rc.1is publicly published; the current convergence candidate is0.1.0-rc.2. The DSH target remains0.1.0-rc.7. See ROADMAP.md anddocs/reference/release.md.
What this is
A plugin family with a small kernel, not a promise to implement an entire
SaaS platform. dsh-multi-tenant owns only the tenant/session primitives this
repository can enforce directly: minimal tenant/user identity, immutable session
ownership, fail-closed authorization, and the TenantSessionStore provider
contract.
Other capabilities enter the project only when their boundary is real and useful. A DSH/third-party dependency is handled through a minimal contract/conformance proposal; a surface we cannot reliably enforce is documented as a boundary instead of being absorbed into a local fork.
Guiding principles
- Control → enforce — strict fail-closed rules with executable invariants.
- Ecosystem → standardize — define the smallest useful seam/contract and collaborate upstream.
- Outside control → bound — state the threat-model/support boundary plainly. Complexity is not evidence.
- Fast-follow prereleases — pin explicit DSH prereleases and revalidate only affected seams.
- One-way dependency — no JWT/PostgreSQL/HTTP/MCP/Redis dependency in the kernel.
- Default ≠ only — replaceable providers prove conformance with the shared contract suite.
Release scope
dsh-multi-tenant— published kernel: ownership, authorization, store seam, testing utilities.dsh-multi-tenant-web— private experimental enforcement spike; production principal binding waits for a DSH request/connection-scope seam.
The 0.1 line does not claim shell/filesystem/process/container/network
isolation, billing/UI/organization management, host-global resource tenancy,
general RBAC, or cross-user team ACLs. Roles/permissions are deliberately not
part of the kernel TenantPrincipal.
Packages
| Package | Distribution | Role |
|---|---|---|
packages/multi-tenant |
npm dsh-multi-tenant@next |
Kernel: ctx.multiTenant + ctx.tenantSessionStore, claim-once ownership, fail-closed authorization, provider contract/testing. |
packages/multi-tenant-web |
private workspace | Experimental tenant-bound ApiProxy research; production principal binding is DSH-transport-gated. |
See CONTRIBUTING.md for development policy and
docs/specs/architecture.md for layer ownership.
Development
pnpm install
pnpm typecheck
pnpm test
pnpm build
License
MIT
相关推荐Related
- deepseek-ai/deepseek-harness DeepSeek Harness: Everything is a Plugin.
- deepseek-ai/deepseek-harness DeepSeek Harness (dsh) — 由 DeepSeek AI 开发的开源 agent harness（智能体框架）。一切皆插件：核心 + 插件 + 技能 = 可热插拔的 AI 编程工作台。DeepSeek Harness: …
-
nexu-io/open-design
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your…
-
ruvnet/ruflo
🌊 The original agent meta-harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build c…
-
amruthpillai/reactive-resume
A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source a…
-
volcengine/OpenViking
Self-evolving Context Database for AI Agents. Unify Agent Memory, Knowledge RAG and Skills.
-
Molunerfinn/PicGo
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosti…
-
titanwings/colleague-skill
将冰冷的离别化为温暖的 Skill，欢迎加入数字生命1.0！Transforming cold farewells into warm skills? It's giving rebirth era. Welcome to Digital …