Plugins

Read-only Raindrop.io dashboard in the sidebar with collection and tag distribution, top source domains, content types, a 12-month trend and a cleanup backlog, plus two read-only agent tools for analyzing saved bookmarks. Requires a Raindrop.io API token (create an app and paste the token).

NewAgentUniverseByDeepSeek nodes inside DSH: five read-only tools covering provenance (both upstream releases this build names), a data directory's restored state and ledger audit, the conformance vectors, exact decimal conversion, and node reachability. Driving the node -- starting or stopping a daemon, depositing funds, sending bus messages -- is deliberately not exposed, because those are audited privileged operations in this project.

DSH hardware sandbox plugin: assemble a 3D scene of ESP32 / BME280 / PIR / LED components with protocol- and voltage-checked port wiring, run real Python project code in the loop against simulated I2C/GPIO hardware with fault injection, let networked device simulators report over HTTP to a real backend (validated end-to-end against a live seat-reservation system), observe a real device read-only and map its state onto the scene, and add support for new boards through data-driven pin definitions. Ships 16 hw_* agent tools plus a bundled SKILL.md.

Read-only attachment library: lists every image and file attachment stored on this machine, its size, and which conversations (including those in the session trash) still use it, with Show in Finder and Open in Preview.

Read-only clinic for DSH session logs: 22 named diagnostics (token waste, retry and failure loops, context bloat, cross-session amnesia, idle MCP servers and skills), each reported with a replayable evidence locator such as session.v4.jsonl.zstd#L101-L110, and each finding turned into an executable prescription — a profile-patch YAML snippet or a command with current to suggested values, risk, verification and source — plus a feedback command that retires a prescription you reject, after which the report states it was removed by your feedback. Zero dependencies, default zero egress, session files are never written.

Adversarial review for DeepSeek Harness: put one settled plan on the stand, send read-only red-team experts at it by dimension, then split their findings into single defects you endorse or reject one by one. It never rewrites the plan and never fixes code.

Git workflow for DeepSeek Harness: confirmed Web Git actions, slash commands and read-only tools

Shows subscription quota and account balance beside the DeepSeek Harness model selector for 28 provider entries, with a shared settings page and a read-only quota tool.

Read-only work report rebuilt from local session logs: tools used and how often, commands run, files read and written, whether tests passed, failures and their causes, token usage, and whether the task finished.

Read-only Windows registry access from WSL, restricted to an allowlist of key prefixes; list a key's values or its child keys.

Replaces the sidebar workspace region with a two-tab browser: several workspace roots stay registered side by side while conversations are filed under the real working directory of each session, with a read-only resource tree that previews files in the right sidebar. Hiding is per tab, display-only and fully reversible; a resource folder or file can be copied as a path or dragged into the composer as a native reference, and @ completion covers every registered root rather than the working directory alone.

Read-only Skill inspector for DeepSeek Harness. It shows which Skills a conversation actually loaded — from observed loading evidence only — and which Skills the current environment can discover, and gives each Skill a detail page whose left column switches between the framework, the evidence, validation, evaluation, step evidence, run logic, the before/after of a modification when there is one, the definition facts and the raw SKILL.md. Declaration and run stay apart: the body is split into structure, declared workflow and progressive disclosure, the run logic is read from local receipts, and every declared step carries its own evidence — no observed evidence is reported as exactly that, not as executed or not executed, and the run's instruction hash sits beside the current definition as match, mismatch or unavailable. The evidence view gives each subject one of three states (declared, observed, unavailable), walks definition → load → use → outcome, names what each stage cannot reach, declines to attribute an outcome to the Skill, and can copy the snapshot out as byte-stable JSON. Validation checks the Agent Skills open standard and the platform profiles separately, each finding on a rule id and labelled standard compliance or platform compatibility. Evaluation keeps repeatable cases with the conditions each run was recorded under and the four stages of runtime evidence, comparing two runs of one case item by item without scoring them. The trigger boundary keeps should-trigger and should-not-trigger prompts, has you run them in a real new session, then records what was observed — whether a load record appeared and whether it was model-invoked or user-explicit; a typed /name is not a natural trigger, and an absent load record is reported as not observed, not as not triggered. The same projections are exposed to the agent as a read-only skill_review tool, which returns a structured review packet and says what it omitted when the packet will not fit whole. The inspector, the evidence chain and these reviews are computed on this machine from the definition and the session receipts; the Chinese reading version sends the body through the host's model when you ask for it, keeping code fences, paths and frontmatter verbatim and storing the result on this machine. A Skill can also be cloned into a local copy. It does not write back to the source Skill and does not run its scripts.

Read-only side branch in the right sidebar: quote text to ask follow-ups without polluting the model context of the main session; every follow-up rebuilds the branch from the latest settled turns of the main session, and writes are refused at the tool-execution layer so the prompt prefix stays cacheable.

Read-only, scriptable session playback for the DeepSeek Harness WebUI

Read-only tmux list + capture-pane.

Read-only systemd --user list / show / journal.

Sandboxed jq / yq / read-only sqlite3.

Read-only pass / age secrets with allowPrefixes; reveal defaults to false.

Read-only rclone listremotes / lsf / about.

Read-only kubectl get / describe / logs / contexts for dsh on WSL (configurable log tail).

Read-only Helm list / status / history.

Read-only glab MR / issue / ci status.

Read-only psql + redis-cli probes.

Read-only khal calendar list.