Plugins

Publishes whichever model the profile has selected in chat or on the Models page as an OpenAI-compatible HTTP endpoint: /v1/models, /v1/chat/completions (streaming SSE and non-streaming), /health. A request may name any routable model; one that omits `model` gets the current chat selection, so switching model in chat switches the endpoint. Switched on, it can also lend the model the Harness tools switched on individually, run those calls through the Harness tool runtime and feed results back up to a round limit. The listener is the plugin's own, so 127.0.0.1, 0.0.0.0 and a NAT-forwarded port all behave the same with no change to the request path. Settings cover bind address, port, API key with a generator, fallback provider and model, reasoning effort, CORS origin and timeout.

Endpoint of a companion mobile app that also runs headless, with no desktop shell or Electron required: it serves a restricted mobile API over a relay tunnel or LAN pairing, for listing, opening and driving DSH sessions, following the live device event stream, and authenticating with revocable per-device credentials.

Control Proxmox VE virtual machines from the conversation: 16 tools for the VM console over VNC (screenshots, mouse, keyboard, batched actions, Unicode text and clipboard) and for running commands and reading or writing files through the QEMU guest agent, all over one ssh connection to the node, so the host needs no X11 or Wayland.

Launch Android apps on a virtual display and drive them with screen reading, taps and swipes, leaving the main screen untouched.

OpenAI-compatible HTTP endpoint for DSH sessions plus a phone panel that reads transcripts, browses files, sends or queues messages, and answers approvals and questions.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Watches a turn's thinking and text streams and cancels the turn when the model starts repeating itself.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Puts sessions into the built-in Auto review permission preset: new sessions at creation, existing root sessions when they are restored.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Conflict diagnosis and repair for DeepSeek Harness plugins. Builds a capability graph of the running Loader profile and of the on-disk cordis.patch.yml layers, comparing imports, peer ranges and config against the host that is ACTUALLY running rather than the profile's possibly-stale copies, and reports the conflicts that fail silently: a fiber stuck PENDING on a service no plugin provides, a browser half injecting a client module nothing provides, a tool id two plugins both register, duplicate Loader entry ids, a row disabled by one layer and re-inserted by another, an import of a host subpath the running host does not export, and a cycle among inject declarations. Every finding carries its evidence, a confidence grade for who owns a name, and a repair with a risk grade — verify it with a dry-run difference table, or take the individual .patch.yml files that --fix-out writes (never auto-loaded, so picking wrong breaks nothing).

Records the version of the edit target as an observation when the agent inspected the file with bash instead of the read tool, so the filesystem observation policy stops rejecting edits with FS_NOT_OBSERVED. Applies to edits only; blind whole-file overwrites stay guarded.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.

SSH and JumpServer terminal plugin: real-machine read tools, human-initiated read-write operations, and session management from inside DSH.

DSH Cordis computer-use provider for the ZTE Nde desktop. npm install auto-fetches the musl binary built by computer-use-linux-zte-nde (v0.7.7-nde.3) into the package's own bin/ via postinstall; resolveCommand() resolves the cordis command path against import.meta.url so the mount works regardless of dsh web's cwd. Reserves the shared computer-use slot via ctx.computerUse.register and exposes MCP tools under mcp__computer-use-linux-nde-mcp__* (screenshot, list_windows, click, type_text, doctor, etc.). Two notable Nde fixes upstream of this provider: KWin caption+coords fallback for window targeting, and SnapshotCache that keeps AT-SPI single-wake per (app, pid) so Chrome is not repeatedly disturbed.

Runs the local Cursor CLI as a child coding agent from DSH - a `cursor_code` tool plus the native one-shot `cursor_subagent` tool, one mirrored DSH sub-session per run, per-task model choice, resumable conversations, a step timeline with real file diffs, and a usage, model and session panel.

Periodic water, stand-up, eye-break and stretch reminders on your own work schedule, with daily and 7/30-day statistics and multiple switchable reminder plans.

Opens the Obsidian vault a DSH session is working in, on the first human message — so your sync plugin (Nutstore sync, Obsidian Sync, Obsidian Git, …) starts running and the files the agent edits actually get synced. Skips a vault that is already open, and opens a new window behind the current one instead of stealing focus. Windows only.

Windows balloon notifications for session lifecycle events (new / running / finished / error) across all workspaces, with a session-store watch that catches headless and A2A dispatch sessions whose events never reach the host bus. Windows only.