Plugins

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Conflict diagnosis and repair for DeepSeek Harness plugins. Builds a capability graph of the running Loader profile and of the on-disk cordis.patch.yml layers, comparing imports, peer ranges and config against the host that is ACTUALLY running rather than the profile's possibly-stale copies, and reports the conflicts that fail silently: a fiber stuck PENDING on a service no plugin provides, a browser half injecting a client module nothing provides, a tool id two plugins both register, duplicate Loader entry ids, a row disabled by one layer and re-inserted by another, an import of a host subpath the running host does not export, and a cycle among inject declarations. Every finding carries its evidence, a confidence grade for who owns a name, and a repair with a risk grade — verify it with a dry-run difference table, or take the individual .patch.yml files that --fix-out writes (never auto-loaded, so picking wrong breaks nothing).

DSH Cordis computer-use provider for the ZTE Nde desktop. npm install auto-fetches the musl binary built by computer-use-linux-zte-nde (v0.7.7-nde.3) into the package's own bin/ via postinstall; resolveCommand() resolves the cordis command path against import.meta.url so the mount works regardless of dsh web's cwd. Reserves the shared computer-use slot via ctx.computerUse.register and exposes MCP tools under mcp__computer-use-linux-nde-mcp__* (screenshot, list_windows, click, type_text, doctor, etc.). Two notable Nde fixes upstream of this provider: KWin caption+coords fallback for window targeting, and SnapshotCache that keeps AT-SPI single-wake per (app, pid) so Chrome is not repeatedly disturbed.

Live skill provider that reads every Xiaomi MiMo (MiMo Desktop / MiMoCode) skill into the DSH session catalog: the engine-bundled skills under engine-config (unpacked from app.asar when that directory is absent), the MiMoCode global and project roots, extension-contributed skill directories declared in extensions.json, and the brand compatibility roots MiMo's own skillPathCompat setting enables.

Adds an Omni-modal settings section to DeepSeek Harness that points the harness at any OpenAI-compatible image and video endpoint: switchable config profiles with separate endpoint, API key, model, path and size for each side, free-form extra request parameters, a connectivity test that does not spend generation quota, and three model-visible tools — generate_image, generate_video and check_video — with async video tasks that survive restarts.

Attach files and folders in the composer via clipboard paste, a native file/folder picker, and @-mention path search; folders are converted to paged Markdown for the agent to read page by page. macOS only (clipboard and picker go through osascript).

Code retrieval engine exposed as an MCP server: four tools (code_search, code_outline, code_index, index_status) over a SQLite FTS5 index with BM25 ranking, CJK bigram indexing, declaration-aware tree-sitter chunking, incremental reindexing, and a three-layer secret filter. The bigram index matches Chinese-language queries against English code, and the default path needs no vector store or embedding model. Requires a local Python 3.10-3.12 engine installed by scripts/install.sh, and CODERAG_ROOT set in the profile patch.

Agent mode picker for DSH: pick an external Agent CLI (Claude Code, Codex, Qwen Code, Gemini CLI, Aider, Goose, Hermes…) as the session's default executor from a control next to the input box, instead of editing configuration files. The agent roster is data-driven, and installed CLIs are discovered automatically from PATH, the managed CLI directory and a drop-in convention directory. Agents that are installed but still missing credentials or a required background service are shown as "needs setup" rather than silently hidden.

Injects your existing markdown documents (notes, rules, knowledge-base files) into every dsh session's system prompt as read-only memory — list file or directory paths in `files`; no database, no service, no write path; UTF-8 byte-budgeted truncation with line-boundary fallback, total budget, YAML front-matter stripping, and freshness timestamps.

Archives the sessions of a workspace when its folder is deleted or moved away, or when its registration is removed, and restores them when it returns: unarchives only the sessions it archived itself, re-attaches every member its ledger recorded (including sessions you archived manually, whose archived state is left unchanged), and adopts ungrouped sessions whose working directory is that workspace path.

Inlines an image block as base64 only in the one request where it first appears, and marks that same block offloaded on every later request so DSH's own image-offload projection renders it as the placeholder text carrying the read-only local path. An occurrence is keyed by session id, message id, content-tree path and attachment id, and a request is only counted after it produces its first chunk, so retries do not count as sent. Requests carrying a purpose are neither rewritten nor counted, a later read_image of the same file is a new occurrence and inlines once more, and only that request's copy is rewritten, so nothing is written back to the session.

Local-folder wallpaper for the DSH Web UI: it defaults to your Pictures library (C:\Users\<you>\Pictures) and the host serves those images over same-origin HTTP, rotating one every N minutes (0-1440, default 5) in a shuffled pass with no repeats; the settings page under Plugins picks a different folder through the native system dialog, and tunes image opacity (100%), darkening scrim (25%) and panel opacity (15%) with changes applied live. Dialogs, modals and menus keep the default opaque background so text stays readable. Reads .jpg .jpeg .png .webp .gif .avif .bmp straight from disk, and keeps per-user settings under $DSH_HOME so upgrades never ship your folder path.

Adds a four-pointed-star button left of the composer's model selector that rewrites the unsent draft in place — grammar, wording, punctuation and execution order — preserving code, commands, paths, identifiers, numbers and URLs byte-for-byte, answering nothing and never overwriting text typed while it runs. A pencil under every user message reopens that message for editing without touching the draft; because the Harness session log is append-only, an edit forks the conversation before that message rather than rewriting it. A circular restart icon under every reply asks that one question again in a fresh conversation that carries none of the earlier turns. Both are refused while a turn is still answering, and disabled when the reply used a tool that can leave a trace or when the files the message named have since changed. A right-sidebar memory tree draws the conversation as turns, showing what was actually asked and answered, every answer to one question on its own line labelled original, edited or memory-free, newest first, with arrows that re-read an answer in place; right-clicking jumps to a branch or removes it from the plugin's own history.

Workspace file tree and code editor in the DSH right sidebar: browse the workspace of the session it belongs to, create, rename and delete files and folders (to a trash folder by default), edit in place with line numbers and syntax highlighting (Ctrl+S saves, Ctrl+D duplicates the current line), preview images and play audio or video, list and unpack archives or pack a folder into a .zip through the system tar, search by file name or jump by a pasted path, and draw file rows with the icons Windows itself uses (SHGetFileInfo, Windows only).

Enhances the DSH Web GUI file tree with inline sizes and modification dates, plus a right-click menu for download, upload, and copy-path actions.

Adds a right-click menu to the DSH web UI for files and for links: a file-tree row, a file path or file mention in a chat message, or a hyperlink opens a menu that previews a file in DSH, opens it in the default application or a chosen associated one, reveals it in the file manager, copies the path, the workspace-relative path, the file name, the link address, the link text or the file contents, saves a copy elsewhere, and opens an HTTP(S) link in the sidebar browser or in the system browser, while a right-click that is not on a file or a link keeps the browser's own menu.

Session-scoped research evidence ledger with sources, linked claims, open questions, and explicit user review; provides a tool, slash command, and conversation panel, with selected-claim Markdown export that omits excerpts, review notes, and local paths by default; does not fetch sources or verify their truth.

Gives DSH the full 33-tool browser surface (ctx.browser seam -> a self-hosted headless moli browser over CDP: one 127.0.0.1 daemon with Bearer-token auth, request-path whitelist and WebSocket rewriting, no root/GUI/Electron needed; single-engine moli serve with auto LD_LIBRARY_PATH/FONTCONFIG_FILE injection and a persistent profile dir for logins), plus a web panel — a real page you can click, scroll and type in, operation/console/network logs with one-click cleanup, a customizable window (border color, transparency, glass, fit-to-picture with no black bars, top-inset and self-centering) and an adjustable page size (1920x1080 by default) — plus a collapsed pill that can be dragged to any spot on the screen (free position), a live view that auto-resumes when you switch back to the web tab, and a 1920px default max edge for the live frame — and two bundled skills (browser, browser-runtime) served through the plugin built-in skill provider, so the skill centre lists them as system-level by default without writing into $DSH_HOME/skills.

Sweeps AI byproducts (scratch files, backups, logs, caches) into a reversible trash per project, and on project close classifies deliverables, archives reference results and writes a cleanup report. Requires Python 3 on PATH (the cleanup engine is a Python script; python3 / python / py are auto-detected, and without one cleanup cannot run and says so).

Copies a session log path (or a paste-ready handoff block) and turns the multi-frame zstd log into a readable file another session can continue from.

Automatically group every DeepSeek Harness (DSH) Web GUI tab into one browser tab group. One package, two faces: the Chromium extension owns all grouping behaviour, and the DSH plugin mirrors it to a fixed path, detects it in the Web GUI, guides installat

Replaces the built-in bash executor so every command gets an environment resolved from its own working directory: configurable PATH prepends, Python venv activation and mise shims, with a dedicated section in the Web UI settings.

Pack a directory into a deterministic tar, read an archive's contents without extracting it, unpack while refusing every member that could reach outside the destination, and verify what came out against what went in by SHA-256. No external dependency — the tar format is written and read in this plugin. Extraction is deliberately more permissive on reading than on writing, because a reader's job is to report what an archive says, while a writer must never emit what it cannot read back. A tar has no central index, so the walk tracks whether it reached the end-of-archive marker: without that, a half-file checksums fine and reads as complete.