Plugins

Deterministic aggregate media budgets and safe request projections for DeepSeek Harness (DSH)

Egress policy for DeepSeek Harness: a host allowlist on web_fetch and web_search enforced at connect time, audit-mode by default, with OCSF Network Activity records

Industrial-grade 4-tier cognitive memory, red-light guard, and vector semantic engine for DeepSeek Harness (dsh).

DeepSeek peak-pricing cost guard for DSH: during peak hours (Beijing 09:00–12:00 / 14:00–18:00, ×2) the agent automatically switches to ultra-compressed caveman-style output to save tokens, and a header badge + toast keep you posted on every peak/valley t

Data-loss-prevention plugin for DeepSeek Harness: a non-configurable tool guard floor, tool-result redaction, and fail-closed telemetry redaction

Pre-install supply-chain poison scanner for DSH plugins: AST (JS-X-Ray) + deobfuscation + regex heuristics, exits non-zero on findings for CI gating.

Zero-interruption audit and fuse blocking for DeepSeek Harness: silently records every tool call with deterministic risk scoring, cumulative-risk bonuses, risk-level breakdowns and retention-based cleanup; blocks irreversible catastrophes (protected-path deletion, disk wipe, force-push to protected branches/refs, credential exfiltration), and renders a redacted /risk-guard operation bill with --since filtering.

Blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe sg_* inspection tools that never print raw values.

Aborts startup when another live dsh instance holds the same DSH_HOME data directory, preventing the concurrent session-log writes that corrupt transcripts.

Configurable per-turn budgets for supported file mutations, limiting distinct files, mutation calls, and UTF-8 payload bytes before tool execution.

Transparent image guard for text-only routes: paste images without the 400 session deadlock, plus a vision_analyze tool for OCR/PDF/docx/pptx/video.

Expands #tag shorthand into snippet-library text before messages are sent; multi-library, aliases, variables and recursion guards.

Guards the persisted session-projection cache: per-row JSON degradation so one misbehaving projection unit (e.g. a third-party plugin storing a Map) can never stall session titles or the whole cache again, plus a startup self-heal that backfills missing titles.

Un kit de seguridad para el desarrollo: instantáneas continuas de configuración, reversión automática ante fallos de plugins, rescate en caso de fallo de arranque, y un panel de gestión dentro de ajustes.

Guardián de deriva de premisas tras la compactación: inyecta un aviso de un solo uso cuando un resumen de compactación pierde un anclaje literal crítico.