Plugins

Evidence-first frontend release checks: real-browser content, accessibility, runtime, network, and baseline regression reports with screenshots.

Mine local DSH session logs (JSONL) into personal usage & impact receipts: Markdown day/week/month reports plus a self-contained HTML receipt, cross-referenced with local git log — zero-network, privacy-first.

DSH web plugin: open .docx/.xlsx/.pptx in the better-sidebar editor through a self-hosted ONLYOFFICE Document Server (JWT-signed config, in-network document/callback routes, save-back to disk).

dsh plugin: bounded retry for gateway network_error failures the stock retry policy cannot classify (e.g. OpenCode Zen finish_reason: network_error)

SoulMirror network for DeepSeek Harness: A2A identity, friends and end-to-end encrypted chat as dsh sessions -- host plugins + browser UI bundle, backed by the soulnet light peer (shipped as a platform package)

Switch DSH between localhost (127.0.0.1) and LAN (0.0.0.0) bind from the Settings page (LAN access off by default), with a crypto.randomUUID polyfill for non-secure LAN origins.

Trusted Iroh mesh networking for DSH hosts, with encrypted peer discovery, remote session delivery, and reachability status.

Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.

Egress policy for DeepSeek Harness: a host allowlist on web_fetch and web_search enforced at connect time, audit-mode by default, with OCSF Network Activity records

DeepSeek Harness (dsh) connector for OpenAgentNetwork (OAN): Gofer messages land in a connector-managed inbox and the agent answers them with oan_* tools. Join with one command.

Container-isolated backend for the `ctx.codeRuntime` seam: each Code Mode program runs in a fresh container with no network, a read-only rootfs, dropped capabilities, and kernel-enforced memory, CPU and pid ceilings.

Installation safety gate for DSH plugins: antivirus-style scan of install scripts, permissions, secrets and network callbacks on local directories or npm tarballs, returning a BLOCK/WARN/PASS verdict before "dsh plugin add".

Short Web Audio cues when a session needs your attention (approval, question, or plan review) and when a task finishes; synthesized inside the page in two selectable styles with a volume setting — no popups, no OS notifications, no audio files, no network — and one bundle that covers DSH 0.1.7+ (desktop & web) and 0.1.0-rc.6.

Ein LAN-Passwort-Gate für die Web-UI: Smartphones und Tablets im selben Netzwerk melden sich mit einem gemeinsamen Schlüssel an und sehen dieselben Sitzungen in Echtzeit, mit integriertem randomUUID-Polyfill für reine HTTP-Origins.