Plugins

Typisierte, abgesicherte Container-Steuerung: ps/logs/inspect/exec/start/stop sowie compose up/down mit JSON-Ausgabe, projektbewusster Zielauswahl und genehmigungspflichtigen destruktiven Vorgängen.

Auto-approval permission guard: a middle tier between workspace-write and danger-full-access — auto-allows safe operations inside trust directories, always asks a human for destructive ones, with 11 per-category switches and an audit trail.

Codex-inspired managed approval for DeepSeek Harness: risk-based MCP review, one-time grants, explicit denials, and human fallback on reviewer failure.

DeepSeek Harness plugin: Windows toast notification with sound when a session requests elevation approval — shows which session, why, and what is being elevated

Make Git Bash the only terminal tool for DeepSeek Harness on Windows: enables the bash executor and tool on win32, disables PowerShell (pwsh) everywhere, ships standard-bash/code-bash/cordis-bash agent presets, and sets the sandbox/approval defaults Git B

Automated approval review: auto-approve read-only tools, auto-deny dangerous commands, fail-closed policy engine.

System-level desktop notifications: turn-completion and workflow-end banners, plus a modal alert when an approval is needed (macOS osascript / Linux notify-send).

Approval/completion/error event notifications: browser Notification plus native toasts (PowerShell WinRT on Windows, notify-send on Linux/macOS), quiet hours, same-kind error merging, and an independent switch for subagent completion.

Ambient fullscreen status grid for DeepSeek Harness sessions with token/rate graphs, plus ntfy push and alarm notifications when a turn ends, errors, or waits for approval.

Short Web Audio cues when a session needs your attention (approval, question, or plan review) and when a task finishes. No popups or OS notifications.

Desktop notifications and tones when a task finishes, waits for approval, or errors — native on macOS, Windows and Linux with zero runtime dependencies.

Feishu bridge for DeepSeek Harness (derived from dsh-im-bridge): WebSocket long connection, approval cards, group @-mention-only replies, streaming card updates, /stop command.

Cordis-native, evidence-driven full-stack engineering workflow: inspect-first planning, explicit verification evidence, and approval-aware gating for sensitive operations.

CDP bridge to an already-running Chrome/Edge for DSH: screenshots, pixel assertions, DOM/CSS checks, and page JS evaluation over HTTP + WebSocket, with zero child processes, zero npm dependencies, and zero per-use approval.

Browser operation by accessibility refs: navigate, snapshot the page as a ref tree, act on elements, and wait for conditions; the origin policy follows the session approval stance and is enforced by request interception.

Reuse-first capability evolution for agents: resolve existing tools and skills, discover and review exact-commit DSH plugins, install with one-time approval, verify real tool round trips, and minimally adapt partial matches instead of rebuilding from scratch.

Gives an agent its own email inbox through AgentMail — eleven tools for sending, reading and labelling mail, plus inbound mail delivered into one harness session per email thread, with an approval gate and recipient allowlist on everything outbound.

Native per-workspace memory on the harness's own seams: facts and a bounded always-on profile on the storage-domain JSON unit, approval-gated writes with `(sessionId, seq)` citations, deterministic recall plus session-query FTS over past sessions — no external server, no custom SQLite.

DSH审批汉化 — approval dialogs translated to Chinese before they render: DeepSeek-powered, host-side, nothing for React to revert.

Ein automatisches Sicherheitsnetz: vom Agenten gelöschte Verzeichnisse landen zunächst in einem Papierkorb-Ordner, und Symlinks werden nie verfolgt — ganz ohne Genehmigungen.

Übernimmt die Kontrolle über Ihre tmux-Panes: list/send-keys/capture, lange Jobs in einem Pane mit Watch-Modus ausführen sowie genehmigungspflichtige destruktive Befehle.