Plugins

Tiered persistent memory (user/env/project) with per-tier char budgets and semantic query routing; full layers refuse writes instead of silently evicting.

Knowledge base with a corrective acquisition loop for DeepSeek Harness: when the agent keeps hitting the same failure, a background worker fetches the web under a rate limit, distills the result into a staging area, and only a two-stage commit makes it recallable — pages without sources are refused.

A tiny behavioral mood ring for AI coding agents — folds session behavior (consecutive failures, repeated calls, activity) into a four-state Mood (GOOD / CONFUSED / FRUSTRATED / OVERWHELMED) shown as a low-friction session-header status light.

Observabilidad con Langfuse para DeepSeek Harness (DSH): árboles de trazas por turno agregados por id de sesión, con versionado de prompts y evaluación.

Tavily-backed search provider for the DeepSeek Harness web seam (ctx.web): keyless-first credentials, a cooldown after the keyless tier refuses, and a user-visible notice when it falls back to the key.

Read-only side branch in the right sidebar: quote text to ask follow-ups without polluting the model context of the main session; every follow-up rebuilds the branch from the latest settled turns of the main session, and writes are refused at the tool-execution layer so the prompt prefix stays cacheable.

OpenTelemetry (OTLP/HTTP) + Langfuse trace exporter for DeepSeek Harness — GenAI semconv, sanitized before send, batched with retry, off by default.

Nushell-only shell executor, dialect preflight, and Nushell syntax teaching for DeepSeek Harness (dsh 0.1.7-rc.1): every ctx.shell execution runs as `nu --no-config-file -c`, other shells are refused, bash/PowerShell habits are refused before they spawn (

Long-term memory for DeepSeek Harness, read-only as of 0.1.0: a scribe_recall tool that reads a plain-markdown memory room, path rules that refuse directory traversal, Unicode smuggling and NTFS alternate data streams, and a bounded index whose truncation is always reported rather than silent.

Rapid-refill circuit breaker for DeepSeek Harness automatic compaction. It refuses a compaction that would be futile — the context refilled within fewer than N tool turns M times in a row, which the unbounded step-pressure trigger cannot detect — and instead of burning a summarization call on every step it reports the situation with advice, usually that a single read or tool output was too large. Shows state and re-arms through /compaction-breaker, and injects one prompt section so the model relays it to the user. Covers host-plane sessions through its profile bundle; ordinary sessions need one row replaced inside an agent preset.

Session cleanup for the DSH sidebar: drag a conversation row onto the balance widget's whale and it eats the row — the session directory goes to a recycle bin, not to rm. Deletion asks one short question first (how many tokens it burned, and that prompt can be turned off in Settings). Undo from the persistent toast or the 12-entry log in Settings. Clicking the whale jumps straight to the plugin's Settings, where you can swap the avatar, drag the mouth into place and rewrite all 17 UI strings; blank, currently-open and running sessions are refused in place with a reason.

Dead-loop brake for DSH agent sessions: detects repeated identical tool calls, repeating call sequences, and duplicate text, then reminds the agent or refuses the call before it runs.

Computer Use for macOS desktop applications: reads any app's accessibility tree as text with element indices, then clicks, types, pastes, scrolls, drags, selects text and sets values through it, plus screenshots read back as images. Driven by a persistent JavaScript REPL — the agent gets two tools (`js`, `js_reset`) and calls an `sky` API inside them, so state survives between calls and the tool schema stays fixed as capabilities grow. Accessibility trees come back as diffs after the first read; actions address elements by index and indices from a stale read are refused rather than misapplied; typing waits for keyboard focus and reads the field back; paste restores the clipboard. Requires macOS 14.4+, Accessibility permission (Screen Recording only for screenshots) and Node 20+; ships a prebuilt native module, so nothing compiles at install time.

A draw.io editor as a .drawio file viewer in the DSH sidebar: diagrams are ordinary workspace files (new ones default to docs/diagrams/), edits autosave, and a file changed outside the editor is refused with a conflict bar instead of being overwritten; the editor is downloaded once from a pinned upstream release with a SHA-256 check and then runs fully offline.

Adds a restart row to Settings → General that relaunches dsh web with the same invocation through a detached helper, refuses under a detected systemd supervisor unless allowRestart is true, and tests whether the listening port is free by connecting to it rather than binding it.

Fuse v1.2.1 — an all-in-one UI design + code style plugin (the upgraded ui-aesthetics skill): design tokens in theme.json (with the brand color as the single source of truth) + code style in code-style.json + dsh-fuse-english fence page-level rendering +

Reorder the messages queued while a DSH agent is busy, from inside the official queue dock: a drag handle and per-row ↑ / ↓ buttons on the dock's own rows, applied on the host as one concurrency-checked inbox splice. The dock is decorated rather than replaced, so previews, inline editing, steering, removal and attachments stay as shipped. A move is refused when the queue has changed since the caller last saw it, when the row is not a user prompt (a goal round prompt, for example), or when the queue belongs to a subagent session.

Browse the awesome-dsh-plugin catalog from a page in DSH Settings: filter by category or by installed state, search by name or description, sort by stars, downloads, name or date added, and install a plugin into the current profile. Two further tabs list what is already installed and which of those have a newer version in the catalog, with an update button on each row. The update view reports installed plugins whose update status cannot be determined, and overlapping install requests are refused. The catalog is cached locally for an hour with a mirror, a CDN and the npm registry as fallbacks when the official source is unreachable.

Turn-level workspace undo for Git worktrees: every agent turn gets a private snapshot, /undo previews a red/green diff card that is confirmed in place, files changed after the turn are refused with a conflict diff unless --force or --skip-conflicts is passed, and HEAD, index, stash and commit history of the user repository are never written.

Keeps every model request inside a per-provider allow-list, enforced at the agent/request waterfall: disallowed models are redirected to a fallback or refused; subagents stop inheriting stale creation-time routes; warns when consecutive requests would make a --models-max 1 llama.cpp router reload models. A one-entry list is a global single-model mode.

Windows process-tree reconciler for the DSH host: samples the host process tree and the job ledger, attributes each process to the job that created it, flags unattributed and orphaned processes with a confidence level, and offers guarded termination of a whole tree. Termination is refused unless the target belongs to the DSH host tree, is re-sampled and re-checked immediately before the kill (creation time included), and contains no protected descendant, so an allowlisted PID cannot widen the kill scope.

Session management for DeepSeek Harness: list every stored session with its on-disk size, search by title, session id, kind tag, workspace or agent preset, and group them by age or by workspace. Permanently delete one or many at once — the log artifact, the workspace account entry and the search index rows — behind a two-step confirm, with a re-check after every deletion. Subagent sessions can be shown on demand; Side Chat threads stay hidden, and sessions live in the current app run are refused until restart.

Comfort layer for the DSH Web UI: gentler phase/composer transitions, fused composer+stats card, auto-collapsed tool cards. Every rule is gated on <html data-dsh-comfort>; the in-UI pill toggles that attribute, so off == the stock UI exactly.

Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.