v0.0.1 — cross-session agent-to-agent messaging

First release. Three tools let one DeepSeek Harness session address another by name and deliver a message into its inbox.

Install

npx -p @deepseek-ai/dsh dsh plugin --profile web add github:happyren/dsh-agent-messaging#v0.0.1

dsh plugin needs pnpm ≥10 on your PATH (corepack enable pnpm). The package ships a prepare script, so the first add will ask you to allowlist its build in the profile's pnpm-workspace.yaml — see the README.

What it does

• peer_list — sessions this one can address, named from each session's folded title and collision-disambiguated.
• peer_send — one message, with the sender choosing urgency: steer (interrupt at the next step), followup (its own later turn), context (no wake). Sessions that are not running still accept messages; they are spooled and delivered on next start.
• peer_inbox — messages held under the hold policy, released when the operator asks.

Delivery is a direct call within a host process and a per-host Unix domain socket across them. Both routes converge on the same admission path, so a receiver's inbound policy cannot be bypassed by sharing a process with it.

Built on existing harness seams

Rather than reimplementing what the harness has: ctx.sessionQuery for discovery, Agent.steer/followup/inject for delivery, and the existing ContextForm: 'relay' for attribution. The plugin adds only the directory, transport and admission policy that were missing.

Safety

Inbound messages are framed as untrusted by default — information, never instructions, and unable to approve an action or grant a permission. peerAuthority: act plus an explicit trustedPeers allowlist lets an operator authorise a specific peer to be acted on directly. That control is prompt-level and grants nothing: the receiving session's own permission rules and sandbox remain the enforcement boundary at every level.

Verification

122 tests. Transport, presence and spool run against real Unix sockets and real files, covering stale-socket reclaim, refusing to steal a live socket, timeouts, cancellation, path-traversal containment, and a test that a hostile message body cannot forge its own frame. Also exercised end to end in a live dsh web host across two sessions and a separate process.

Known limitations

Same machine only (Unix sockets). Plain text only. Spooled messages expire and the deepest are dropped first. Presence records are advisory. The harness is a developer preview with no compatibility promise — this builds against the npm rc line, so re-verify after a harness upgrade.