플러그인

타입이 지정되고 가드가 적용된 컨테이너 제어: ps/logs/inspect/exec/start/stop과 compose up/down을 JSON 출력, 프로젝트 인식 타겟팅, 승인 게이트가 적용된 파괴적 작업으로 제공

Auto-approval permission guard: a middle tier between workspace-write and danger-full-access — auto-allows safe operations inside trust directories, always asks a human for destructive ones, with 11 per-category switches and an audit trail.

Codex-inspired managed approval for DeepSeek Harness: risk-based MCP review, one-time grants, explicit denials, and human fallback on reviewer failure.

DeepSeek Harness plugin: Windows toast notification with sound when a session requests elevation approval — shows which session, why, and what is being elevated

Make Git Bash the only terminal tool for DeepSeek Harness on Windows: enables the bash executor and tool on win32, disables PowerShell (pwsh) everywhere, ships standard-bash/code-bash/cordis-bash agent presets, and sets the sandbox/approval defaults Git B

Automated approval review: auto-approve read-only tools, auto-deny dangerous commands, fail-closed policy engine.

System-level desktop notifications: turn-completion and workflow-end banners, plus a modal alert when an approval is needed (macOS osascript / Linux notify-send).

Approval/completion/error event notifications: browser Notification plus native toasts (PowerShell WinRT on Windows, notify-send on Linux/macOS), quiet hours, same-kind error merging, and an independent switch for subagent completion.

Ambient fullscreen status grid for DeepSeek Harness sessions with token/rate graphs, plus ntfy push and alarm notifications when a turn ends, errors, or waits for approval.

Short Web Audio cues when a session needs your attention (approval, question, or plan review) and when a task finishes. No popups or OS notifications.

Desktop notifications and tones when a task finishes, waits for approval, or errors — native on macOS, Windows and Linux with zero runtime dependencies.

Feishu bridge for DeepSeek Harness (derived from dsh-im-bridge): WebSocket long connection, approval cards, group @-mention-only replies, streaming card updates, /stop command.

Cordis-native, evidence-driven full-stack engineering workflow: inspect-first planning, explicit verification evidence, and approval-aware gating for sensitive operations.

CDP bridge to an already-running Chrome/Edge for DSH: screenshots, pixel assertions, DOM/CSS checks, and page JS evaluation over HTTP + WebSocket, with zero child processes, zero npm dependencies, and zero per-use approval.

Browser operation by accessibility refs: navigate, snapshot the page as a ref tree, act on elements, and wait for conditions; the origin policy follows the session approval stance and is enforced by request interception.

Reuse-first capability evolution for agents: resolve existing tools and skills, discover and review exact-commit DSH plugins, install with one-time approval, verify real tool round trips, and minimally adapt partial matches instead of rebuilding from scratch.

Gives an agent its own email inbox through AgentMail — eleven tools for sending, reading and labelling mail, plus inbound mail delivered into one harness session per email thread, with an approval gate and recipient allowlist on everything outbound.

Native per-workspace memory on the harness's own seams: facts and a bounded always-on profile on the storage-domain JSON unit, approval-gated writes with `(sessionId, seq)` citations, deterministic recall plus session-query FTS over past sessions — no external server, no custom SQLite.

DSH审批汉化 — approval dialogs translated to Chinese before they render: DeepSeek-powered, host-side, nothing for React to revert.

손댈 필요 없는 안전망: 에이전트가 삭제하는 디렉터리는 먼저 휴지통 폴더로 이동하고 심볼릭 링크는 절대 따라가지 않음, 별도 승인 불필요

tmux 창을 직접 제어: list/send-keys/capture, watch 모드로 창에서 장시간 작업 실행, 승인 게이트가 적용된 파괴적 명령