Concern: Session logs are uploaded to DeepSeek by default

[HJ-chem]

I noticed that @deepseek-ai/dsh-session-log-deepseek is enabled by default in @deepseek-ai/dsh-base.

When using the official DeepSeek API, the plugin automatically attaches session logs to requests through the dsh_session_log field. These logs may contain much more than conversation metadata:

Full user messages.

Complete file contents from read, write, and edit operations.

Tool commands and execution results.

Session IDs, working directories, and other environment information.

In other words, files opened or modified by the agent may also be transmitted to DeepSeek, potentially without users realizing it.

I consider this a significant privacy concern, especially for users working with confidential code, unpublished research, or sensitive project data.

What I would like to see

Make session-log uploads opt-in rather than enabled by default.

Clearly disclose that file contents and tool results may be uploaded.

Allow users to exclude file contents, tool outputs, or selected directories.

Provide visibility into how much session data is attached to each request.

Clarify the plugin description so users understand what is actually being transmitted.

Questions for the developers

Is the default-on behavior intentional?

Why are complete tool results necessary instead of a more limited log?

Can users directly delete session logs already uploaded to DeepSeek?

Has this behavior been evaluated from the perspective of academic and enterprise data confidentiality?

Environment

DSH 0.2.2-rc.3

Profile: desktop

Provider: deepseek-account

Plugin: include:session-log-deepseek

I have disabled the plugin and submitted a separate deletion request to DeepSeek for previously uploaded data.

I am raising this issue because users should be explicitly informed before their local files and tool outputs are transmitted to an external service. This should be a conscious choice, not a hidden default.