Use Guilduo with DeepSeek Harness

Requirements

• Tested on Windows with DSH 0.2.0-rc.2, Cordis 4.0.4 and MCP client 2.0.0. Other operating systems and host versions are outside the accepted evidence.
• Have an existing Web profile or Desktop app and a Guilduo account. Open the Web host on the same computer through localhost or numeric loopback.
• No source checkout, build or pasted token is needed. Installing or loading the plugin starts neither OAuth nor model inference.

Install through the standard host command

Stop Web and Desktop hosts sharing the same DSH_HOME before installing or updating. Replace web with your existing Web profile name.

1. For Desktop, add the same package through its native plugin manager. The tested fixed version is 0.6.0-beta.17. The CLI cannot manage the reserved desktop profile.
2. Install in each participating profile, restart the host and reload the browser. Use standard bundle activation without a second manual Cordis overlay.

dsh plugin --profile web add @guilduo/dsh-oauth-poc@latest --ignore-scripts

Sign in from Settings

New authentication is shared across eligible ordinary/new conversations, top-level forks and updated Web/Desktop profiles for the same Windows user and DSH_HOME. Subagents, children and independently seeded sessions are excluded. Native Credentials stores the grant with CurrentUser DPAPI.

1. In an ordinary conversation, open Settings → Guilduo and choose 接続 → ブラウザーで認証.
2. Approve OAuth with the same account as the Web App. Keep the original conversation and Settings open until 接続済み. The endpoint is https://mcp.guilduo.com/mcp.
3. For an older valid grant shown as この会話のみ, choose 全会話で使う once in its original conversation. A missing grant requires explicit sign-in again.

Check the Agent and task permission

Free allows 2 registered Agents. Installation, OAuth and Agent linking neither register an Agent automatically nor authorize continuing Quest writes. The guilduo-workflows Skill guides authorized work; it grants no completion, acceptance or reward permission. OAuth connection-management grants and Agent execution scopes are distinct. Do not broaden execution scopes to fix a linking error.

1. Read get_agent_link first to check the association with the intended existing Registry Agent. Use list_registered_agents to identify an existing permitted Agent if needed. Never infer IDs from display names or client names.
2. For an unlinked dedicated connection, obtain explicit owner approval and pass the existing Agent ID to link_agent. Preserve a correct link. Never use link_agent to switch a shared connection between Agents.
3. Read get_current_agent_context and the exact get_quest, and check the returned Agent and Quest IDs. When requiresAgentSelection is true, select the owner-authorized actingAgentId from allowedAgentIds and retain it on every preview, read and write call.
4. Authorize the exact Quest and allowed changes before working. Preview tools that support dryRun. For update_quest, send a narrow patch with fresh expectedUpdatedAt and read back the saved result; do not send dryRun to update_quest.

Verify the first connection with reads

A DSH runtime Agent ID differs from a Guilduo Registry Agent ID. Each conversation or host does not require a new Registry Agent.

Check Guilduo MCP read-only.
Read get_agent_link, then get_current_agent_context and the exact get_quest using the known permitted Agent. Verify the returned IDs.
Retain actingAgentId on every call when the shared connection requires Agent selection.
Do not create, update or delete anything. Do not display credentials or private Quest text.

Update and stop work

Stop all participating hosts, repeat the add command, then restart and reload. Replace @latest with @0.6.0-beta.17 for a fixed version. Recheck Settings and the first read after updating.

Stop current inference with the standard DSH stop control. Explicitly tell the working Agent when you withdraw continuing update permission. This version installs no Stop hook and guarantees no automatic update at each phase end.

Disconnect and remove

Unloading or removing the plugin does not log out. Disconnect from an old unshared conversation before deleting that conversation as well.

1. Choose Settings → Guilduo → 切断 first. A shared disconnect affects eligible conversations and Web/Desktop profiles in the same DSH_HOME. If it fails, saved credential removal is unconfirmed; retry from the original conversation after protection or storage recovers.
2. Revoke server-side authorization separately in the connection settings at https://app.guilduo.com/. Stop the host before removing the Web plugin; use the native plugin manager for Desktop removal.

dsh plugin --profile web remove @guilduo/dsh-oauth-poc

Evidence and support

Beta.17 is a published maintenance release with local and native synthetic checks. User-confirmed public OAuth, basic MCP reads/writes and saved authentication after Desktop restart belong to beta.16; they are not fresh beta.17 public acceptance.

Public Human answer → resume and Agent-specific Handoff remain unaccepted for beta.17, as do settings-free first-input/new-session/fork use. Verify your required workflow on a small Quest before expanding it.

Include the host/plugin version, Web or Desktop, and reproduction steps in a report. Exclude tokens, callback URLs, credential files, private conversations and Quest text. The article sources provide the status record and README.