Plugins

Static and runtime security guard for dsh: rule-based scans for malicious code, prompt injection and token waste, runtime interception of dangerous tool calls, /scan command, plugin_scan tool, web panel, and allowlist.

Gives an agent its own email inbox through AgentMail — eleven tools for sending, reading and labelling mail, plus inbound mail delivered into one harness session per email thread, with an approval gate and recipient allowlist on everything outbound.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Visual web settings panel for the official @tencent-connect/dsh-qqbot plugin: manage the QQ Bot AppID/AppSecret, c2c & group access modes/allowlists, cwd and requireMention directly in the DSH web settings page (reads/writes the qqbot profile's cordis.pat

IP/domain allowlist web_fetch provider for DeepSeek Harness: lets web_fetch reach allowlisted hosts/IPs freely (incl. proxy fake-IP addresses like 198.18.x.x) while keeping the default public-IP safety check for everything else.

Continue an existing PC DSH session from WeChat: polls WeChat iLink messages, injects into a running session via followup or resumes a closed one, and sends the reply back. Supports /会话 to list/bind sessions and /新会话 to unbind. Requires the wechat-acp daemon; only allowlisted WeChat senders are handled (empty allowlist denies everyone).

Adds a workspace-write++ permission that keeps file tools inside the workspace while skipping the Windows process sandbox for wildcard-allowlisted executables such as Git Bash.

Auto-approval agent for DSH permission requests: rule layer (denyAlways/allowlist) plus Hermes Pro semantic adjudication with quick-fail retries, fail-closed to human when Hermes is unavailable, rejection feedback returned to the requesting session, and approve tasks enqueued into the task queue with a shared busy mutex.

Source-filtered HTTP/SSE/WebSocket gateway for using the DSH Web UI behind an authenticated reverse proxy, with loopback trust adaptation, in-app host directory selection, and an allowlisted health endpoint.

Configurable non-public address allowlists for DeepSeek Harness web_fetch

Windows process-tree reconciler for the DSH host: samples the host process tree and the job ledger, attributes each process to the job that created it, flags unattributed and orphaned processes with a confidence level, and offers guarded termination of a whole tree. Termination is refused unless the target belongs to the DSH host tree, is re-sampled and re-checked immediately before the kill (creation time included), and contains no protected descendant, so an allowlisted PID cannot widen the kill scope.

Egress policy for DeepSeek Harness: a host allowlist on web_fetch and web_search enforced at connect time, audit-mode by default, with OCSF Network Activity records

dsh-shell for DeepSeek Harness: runs cmd / PowerShell commands on Windows (and bash-like shells on POSIX) with a bash-inspired safety model — timeouts, output truncation, exit codes, background jobs and a cwd allowlist

Injects allowlisted GitHub Actions and GitLab CI run metadata into agent context without reading logs, credentials, or provider APIs.

Herramientas avanzadas de memoria: inyección de contexto de sesión (perfil + recuperación), decisiones recientes, informe de salud, lista de permitidos de espacios de nombres, grafo de relaciones de memoria y búsqueda de entidades; complemento de dsh-memoria.