Plugins

Kimi Coding web search and web fetch providers for the DeepSeek Harness — one coding-plan key fills both ctx.web seams (POST /v1/search and /v1/fetch), a settings card in the GUI stores it via the credentials service, and the fallback chain reads the Kimi CLI config for zero-setup installs.

Re-validates Cloudflare Access JWTs at the DSH origin so Settings, Credentials, Agent Preset management, and model discovery work from a remote hostname.

DeepSeek account balance in the sidebar footer plus spend per session, today, this month and all time, priced by a configurable time-of-day price table per currency (DeepSeek CNY/USD defaults included). Two read-only remote methods, no host routes, key read through the host credentials seam on every call, egress only to the configured provider origin.

Named user credentials the model uses by reference: values are entered on a Settings → Credentials page and injected into each shell execution as DSH_CM_* variables instead of being printed into the transcript, with credential_read as the documented last resort.

macOS desk pet forked from anneheartrecord/dsh-desk-pet, in a real always-on-top window that covers fullscreen Spaces: the pose follows whatever the local DSH is doing across six states, the right-click menu is a real AppKit one carrying quiet mode and a session list, and seven skins ship with it. Two of the seven are drawn from geometry by a script in the repo rather than generated, so making a skin needs no image model and no API credits; the bundled skill still expands one photo into all eighteen poses on your own image tool and credentials. There is no Electron and nothing to install alongside it: the window is driven through ctypes on the Python that ships with macOS.

Screen capture and external vision recognition: take_screenshot, list_windows, analyze_image and view_image tools with a configurable GPT vision channel (gpt-5.5 / gpt-5.6-sol / gpt-5.6-terra), API key via the credentials service, and a settings card; view_image shows the screenshot in the Web UI while the model context keeps text only.

Laufzeit-Sicherheitsgate in der Tool-Pipeline: lehnt Aufrufe ab, die Hosts außerhalb einer Egress-Allowlist nennen, redigiert Credentials in Ergebnissen am kanonischen Wert statt nur im gerenderten Inhalt und schreibt jede Entscheidung in ein JSONL-Audit-Log; wird im Nur-Überwachungsmodus ausgeliefert.

Blockiert das Lesen oder Schreiben sensibler Dateien (.env, Credentials, Schlüsselmaterial) durch Agenten, maskiert geleakte secret-artige Werte in Tool-Ergebnissen, führt ein Audit-Journal und stellt sichere sg_*-Inspektionstools bereit, die nie Rohwerte ausgeben.

Unternehmensdatenquelle Qichacha (企查查) als dynamisches Cordis-Plugin: 5 Agentenwerkzeuge (Auth mit QR-Login, Firmensuche, Wissenssuche, Werkzeugsuche, Werkzeugausführung) über 100+ Daten-Dimensionen (Handelsregister, Aktionäre, Justiz, IP), plus Kontoverwaltung auf der Einstellungsseite; Netzwerk-/Datei-IO über DSH-Teilprozesse mit node -e; Zugangsdaten interoperabel mit dem lokalen BizOwl-Client.

DeepSeek-Harness-ACP-Bundle für die Delegation an Editoren: ein per Einzelbefehl startbares Agent-Client-Protocol-stdio-Server-Profil, das dsh-Zugangsdaten und Sitzungsprotokolle teilt.

Schreibgeschütztes Audit der Zugangsdaten-Hygiene der Agentenflotte: Berechtigungen von Zugangsdaten-Dateien, eingebettete Zugangsdaten in Git-Remotes (in der Ausgabe maskiert) und Anzahl wörtlich vorkommender Provider-Token; abhängigkeitsfrei und deterministisch.

Tavily-backed search provider for the DeepSeek Harness web seam (ctx.web): keyless-first credentials, a cooldown after the keyless tier refuses, and a user-visible notice when it falls back to the key.

Gemini provider for DeepSeek Harness on Google Cloud Vertex AI, with Application Default Credentials, streaming, and thought-signature replay across tool calls.

DeepSeek Harness (dsh) plugin that connects Sber GigaChat models: a built-in local OAuth proxy (client-credentials -> OpenAI-compatible endpoint, upstream serialization, legacy tool-calling translation) plus automatic provider-route bootstrap, so GigaChat

Pure JavaScript macOS Keychain credentials provider for DeepSeek Harness, replacing plaintext .credentials.yaml storage and fully supporting both refs and records without native builds, signing, or Xcode.

OpenCode Go provider that verifies a model against the gateway rather than treating a recommendation as a measurement: the models.dev protocol suggestion is probed before it is used, reasoning levels follow a measured contract, and requests run through an ordered protocol fallback chain. Context window, max output and image-input numbers are declared by a runtime-refreshed models.dev layer rather than probed, with operator overrides above both. Several OpenCode Go credentials can be stored and switched from the settings page.

Sync your DeepSeek Harness (DSH) configuration between machines over a private git or WebDAV channel: settings, plugins, MCP servers, skills, agent presets, workspaces and provider credentials. DSH 配置远程同步插件（私有通道，明文自用）。

Use your DSH models in [Libre WebUI](https://github.com/libre-webui/libre-webui) for chat, sandboxed Work and usage tracking, with provider credentials kept in DSH. Requires Libre WebUI 0.37.0 or later.

A full-page console panel opened from the sidebar, with eight tabs: an overview; a session list read from the sessions service (title, directory, running state, updated time, with filters); installed bundles and Loader entries from pluginInventory and pluginManager, with per-bundle enable switches; a plugin market listing public topic:dsh-plugin repositories from the GitHub search API; a model and provider editor that writes the llm-pi-ai settings namespace through remote.settings.mutate (switch a session model, add or edit providers and their model lists, and store API keys via remote.credentials, merging over the stored profile so fields the form does not expose survive an edit); MCP and skills tabs; and a usage tab that reads the host's loopback /api/dsh-usage/overview document. Services are declared through ctx.inject, so a deployment that omits one mounts without the console rather than crashing.

Feishu (Lark) OpenAPI MCP connection for DeepSeek Harness: drives the official @larksuiteoapi/lark-mcp stdio server with your Feishu app credentials, exposes Feishu API tools (IM messages, Bitable, docs, calendar, drive) under mcp__feishu__*, and a web se

Alibaba Cloud MCP connection for DeepSeek Harness: static AccessKey credentials + local Alibaba Cloud MCP Proxy (uvx alibabacloud.mcp-proxy) connecting to the official OpenAPI MCP Server, with tools under mcp__aliyun__* and a web settings panel

Phone and remote access to the DSH Web UI: scan a LAN QR code, or reach your PC from anywhere through a self-hosted relay server you run yourself instead of a cloudflared tunnel. Per-device credentials that pair, list, and revoke individually, and several PCs sharing one relay with automatic failover.

LLM provider plugin for the DeepSeek Harness (dsh): streams Claude through your Claude Code subscription (claude.ai OAuth credentials), no Anthropic API key required.

Web management panel for Docker on DeepSeek Harness: manages Docker MCP servers (deploy/remove, official catalog search/pull, gateway start-stop-restart, custom deploy) and containers/images (list, start/stop/restart, remove, logs, inspect, interactive terminal, create, pull, build, load) across local CLI and SSH remote targets with one-click switching. Credentials are encrypted with Windows DPAPI, HTTP is loopback-only, and command parameters are whitelist-filtered. Build-free pure ESM; client is zero-dependency.