Plugins

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Watches a turn's thinking and output streams and cancels the turn when the model starts repeating itself. Four detectors: a verbatim cycle, a counting loop whose lines differ only by a number, repeated lines separated by other text, and a user-supplied phrase list. A catch raises a manual-dismiss alarm card in the global overlay with an optional tone, and a Monitor tab holds the switches, thresholds and hit history. Detection is local string comparison with no model calls, so it costs no tokens.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

GitHub issue service for DSH: turns a telemetry failure analysis into a uniform issue report, builds a pre-filled new-issue URL that is shortened when it would exceed a configured length budget, and rewrites a plain description into a structured issue with the deployment's model.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.

DSH Cordis computer-use provider for the ZTE Nde desktop. npm install auto-fetches the musl binary built by computer-use-linux-zte-nde (v0.7.7-nde.3) into the package's own bin/ via postinstall; resolveCommand() resolves the cordis command path against import.meta.url so the mount works regardless of dsh web's cwd. Reserves the shared computer-use slot via ctx.computerUse.register and exposes MCP tools under mcp__computer-use-linux-nde-mcp__* (screenshot, list_windows, click, type_text, doctor, etc.). Two notable Nde fixes upstream of this provider: KWin caption+coords fallback for window targeting, and SnapshotCache that keeps AT-SPI single-wake per (app, pid) so Chrome is not repeatedly disturbed.

System notifications, a tab-title dot and a PWA taskbar badge when a reply finishes in the background or a session waits for your approval, plan review or answer, all cleared when you return to the window.

Opens the Obsidian vault a DSH session is working in, on the first human message — so your sync plugin (Nutstore sync, Obsidian Sync, Obsidian Git, …) starts running and the files the agent edits actually get synced. Skips a vault that is already open, and opens a new window behind the current one instead of stealing focus. Also serializes writers per vault — a second conversation's write is refused before it runs and queued until the holder is done, so a sync client cannot splice two conversations' edits together. Windows only.

Send local files to WeChat from any DSH session by reusing an installed IM plugin, plus cron-scheduled tasks that run in fresh sessions, a workspace activity glow, a header activity indicator, a completion chime, a macOS sidebar vibrancy toggle and a one-click host restart.

Windows balloon notifications for session lifecycle events (new / running / finished / error) across all workspaces, with a session-store watch that catches headless and A2A dispatch sessions whose events never reach the host bus. Windows only.

Persistent WeChat bridge for DSH: one WeChat user maps to one persistent agent session via the official iLink channel, with context and the user-to-session registry surviving restarts. There is no sender allowlist — anyone who can message the paired WeChat account can start a conversation with a session that has tool access, and the working directory defaults to the home directory; use a dedicated account and set WECHAT_PERSISTENT_CWD.

Local Git workbench for DeepSeek Harness: branch search and switching, hunk-level staging, commit graph, file history and blame, stash and worktree management, conflict resolution, and eight git tools for the agent.

VSCode-style Source Control page in the DSH Web right sidebar: a paged commit lane graph with ref markers and per-commit diffs, grouped working-tree changes with stage/discard/unstage, a commit box with amend and AI-generated messages, a side-by-side and unified diff page, GitHub repository and pull request creation through the gh CLI, and bidirectional HTTPS/SSH remote switching.

Agent-facing GitHub repository tools: binds an account through a first-run prompt, then clones into the workspace and reads, exact-replaces, commits and pushes files, with writes off by default.

Codex-style Git panel for DeepSeek Harness: a header button opens a menu with commit, push, branch switching and creation, and repository initialization; shows the current branch and the total additions and deletions of uncommitted files.

Zagent — unified three-role self-improvement loop with three operators. Data-RSI (daily cross-sectional cleaning: winsorize → cross-sectional standardization → median fill, plus experience extraction), Harness-RSI (evolves system prompt / memory / skills), and Model-RSI (evolves alpha training recipes via framework-native walk-forward with 2-day gap and multi-seed). Offline one-command run, GPU auto-detect. Ships one skill.

Verified-progress ledger: three tools record a claimed step as progress only after an independent subagent with a fresh context confirms it against the workspace. The declared scope is fingerprinted before and after each verification, so a verifier that changed anything has its verdict voided and the round cannot become progress.

Persistent Bots and group rooms inside DSH — each Bot keeps its own model, permission preset, workspace and session across restarts, and every answer is a run written to a ledger the sidebar panel replays.

An agent preset (Hermit/小寄) that turns DSH into an always-on personal hub: a scoped butler persona, a dispatch tool that delegates multi-step tasks to background sub-agents with per-task model routing, async completion reports woven back into chat, plus a credit budget gate, a P/M confirmation chain and an M1 event log.