Plugins

DeepSeek-Harness-(dsh)-Genehmigungsbeantworter, gestützt auf die agent-governance-Sidecar — jede Genehmigung/Anfrage wird durch das Deny-by-Default-Gate, L0–L4-Regeln und die organisatorische Prüfkette entschieden.

Berechtigungsmodus zwischen Workspace-Write und Vollzugriff: Shell-Befehle werden durch deterministische Regeln und eine Subagent-Prüfung geprüft; irreversible oder Systemebenen-Aktionen erfordern eine ausdrückliche Genehmigung.

WeChat iLink ClawBot-Brücke: offizielles Tencent iLink-Protokoll, Web-UI-Einstellungen (QR-Login, Modell, Preset, Berechtigungen, Sitzungsverwaltung mit Löschen), 24-Stunden-Auto-Erneuerung, die vor Ablauf einen neuen QR-Code sendet, ohne Ausfallzeit.

Auto-Genehmigungs-Berechtigungsschutz: eine Zwischenstufe zwischen workspace-write und danger-full-access — erlaubt sichere Operationen in vertrauenswürdigen Verzeichnissen automatisch und fragt bei destruktiven Vorgängen immer einen Menschen um Bestätigung, mit 11 schaltbaren Optionen pro Kategorie und einem Prüfprotokoll.

Autonomer Berechtigungsklassifikator für das auto-Preset: toolspezifische allow/deny-Regeln, ein semantischer LLM-Richter und Git-Checkpoints für unbeaufsichtigte Sitzungen.

Auto-Review-Berechtigungsmodus im Codex-Stil: Fügt eine Auto-Review-Voreinstellung hinzu, die sichere Sandbox-Eskalationen automatisch genehmigt, bei riskanten oder mehrdeutigen nachfragt und kritische unbestätigte Vorgänge ablehnt.

Ereignistöne für DSH: spielt einen gewählten Ton bei Sitzungsende, Options-Popup, Berechtigungsanfrage und Stopp, mit KI-generierten Charakter-Sprachzeilen und einer verwaltbaren Soundbibliothek.

Eine mittlere Berechtigungsstufe für DeepSeek Harness zwischen workspace-write und danger-full-access: genehmigt harmlose Befehle sowie Operationen auf konfigurierten vertrauenswürdigen Bereichen außerhalb des aktuellen Arbeitsbereichs automatisch.

Schreibgeschütztes Audit der Zugangsdaten-Hygiene der Agentenflotte: Berechtigungen von Zugangsdaten-Dateien, eingebettete Zugangsdaten in Git-Remotes (in der Ausgabe maskiert) und Anzahl wörtlich vorkommender Provider-Token; abhängigkeitsfrei und deterministisch.

Remote DSH access that needs no hosting of your own — the Feishu DM chat is the interface over the bot's outbound long connection, with cards for workspace, session (switch and rename), model, reasoning effort, permission preset and balance, and tool approvals and agent questions answered in that same chat.

Loopback-only ACP door for DeepSeek Harness: attach an external client (such as the DSH Panel VS Code extension) to the kernel you already have running, exposing session listing and permission presets.

Zero-intervention permission gate for DSH agents on macOS: auto-allows local writes made reversible by git or Time Machine, blocks network, package installs, process control and sensitive-path reads, with full audit logs.

One-click Approve & escalate on the approval card: answers the pending request and switches the live session to a permission preset.

Query and manage JumpServer through conversation: assets, users, accounts, permissions, sessions, command audit logs, command filters, and RBAC roles, authenticated with an AccessKeyID/AccessKeySecret pair (HTTP Signature).

A continuation of simon300000/dsh-auto: the Auto Approve permission preset for the DSH Web UI reviews each approval with one single-shot model call instead of a reviewer subagent, auto-approves only the actions that pass and hands the rest to human approval, and remembers confirmed decisions as project- and global-scope allow/deny lists, with an approval timeline in the right sidebar.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.

33 github_* tools covering REST reads, issue writes, Git data writes, private repo creation, and clone; in-process permission gate and cost-discipline companion skill; no gh CLI required.

Git integration for DSH modelled on IDEA's VCS: a git icon beside the permission mode in the composer shows the current branch and the pending-change count, opens a branch switcher on hover and an IDEA-style VCS panel on click (branch tree, commit graph, changes and staging, commit detail, file diff), plus a settings page for commit identity, the git binary and the network flags. Registers no model tools with DSH.

Computer Use for macOS desktop applications: reads any app's accessibility tree as text with element indices, then clicks, types, pastes, scrolls, drags, selects text and sets values through it, plus screenshots read back as images. Driven by a persistent JavaScript REPL — the agent gets two tools (`js`, `js_reset`) and calls an `sky` API inside them, so state survives between calls and the tool schema stays fixed as capabilities grow. Accessibility trees come back as diffs after the first read; actions address elements by index and indices from a stale read are refused rather than misapplied; typing waits for keyboard focus and reads the field back; paste restores the clipboard. Requires macOS 14.4+, Accessibility permission (Screen Recording only for screenshots) and Node 20+; ships a prebuilt native module, so nothing compiles at install time.

System-audio visualizer for the turn navigator rail: the rail reacts in real time to whatever the default playback device is rendering, with four motion modes (spectrum, pulse, sway, travelling wave), a 16-band logarithmic spectrum from a 2048-point FFT on the host, and live sensitivity, strength, bass-punch and wave-speed controls. Audio is captured host-side through WASAPI loopback, so there is no permission prompt, no microphone and no screen capture. The browser half adds one attribute, one stylesheet, some CSS variables and a sidebar control row, and never patches the official component; switching it off removes the attribute, the stylesheet and the variables, returning the rail to its default styling. Windows only.

Named, file-defined subagent roles for DeepSeek Harness: persona, subagent-only skills, tool permissions, an ordered model chain with failover, and derived groups.

Require a real, immediately preceding sandbox denial before DSH Bash can request wider permissions.

Three-mode visible-session advisor plugin for DeepSeek Harness with configurable tool permissions, local-subagent coverage, and task-tree budgets.

Unified management and invocation of external Agent CLIs in DSH, fully isolated from the user's native installs; preset Provider, model, reasoning effort, and permissions per CLI, callable directly or like native subagents.