dsh-ui-stronger

DSH UI Stronger

DeepSeek Harness 原生界面与能力扩展。黑、白、淡灰和少量淡紫；可编辑工作模块、启动与交互动效、本机背景、上下文和模型用量、知识库、长期记忆、人设、模型可调用技能，以及执行前审查与微信 ClawBot。

适配 DSH 0.2.1-rc.3 / Node 24。模型、订阅、会话、压缩、原生技能、子智能体、权限和设置由 DSH 驱动。没有第二套聊天引擎。

安装与发现

在 DSH 官方自定义插件市场添加：

https://cdn.jsdelivr.net/gh/liyuxuan20111101/dsh-ui-stronger@main/.market/index.json

备用源：https://raw.githubusercontent.com/liyuxuan20111101/dsh-ui-stronger/main/.market/index.json。在发现页搜索“界面与能力增强”。CDN 可能短暂缓存旧索引。自定义发现源不等于默认社区目录。

也可从 Releases 下载 .tgz，通过 DSH 原生 plugin --profile desktop add <归档绝对路径> 安装。依赖从 npm 解析，安装不是完全离线。

工作台与背景

• 首页“编辑工作模块”支持增删、排序、隐藏、修改标题与说明。最多12个模块，可指向已注册的原生面板、扩展功能或提示词。提示词只进入原生草稿，不自动发送、不执行任意网址或脚本。
• 扩展→背景支持 PNG/JPG/WebP、GIF、MP4/WebM，单文件64MB以内；提供可见度、模糊、铺满/完整显示。文件存在当前浏览器/桌面窗口的 IndexedDB，进入模型的上下文中不含背景。换浏览器、端口或清除站点数据后需重新选择。
• 视频静音循环，隐藏窗口、关闭动效或系统减少动效时暂停；关闭动效时GIF隐藏。视频编码是否可用取决于宿主浏览器，解码失败退回纯色背景。
• 有限入场、控件回应与新消息过渡。加载画面通过原生 HTML 注入，在应用脚本之前出现；实际连接与输入界面就绪后退出，没有打开后的定时重播。可隐藏、关闭或减少动效，异常时20秒回收。使用原生插槽与动态入口目录，宿主缺少服务时显示不可用，避免假装支持。部分布局仍使用DSH当前原生选择器，宿主升级后可能需适配。

模型与供应商入口（0.13.2）

• 侧栏“模型”进入统一管理页；“配置供应商”打开 DSH 原生设置，保留已有供应商编辑、模型列表、添加预设供应商与“自定义模型 API”。预设目录随宿主更新，本次实际宿主提供41项；不是本插件维护另一份认证或供应商驱动。
• 模型只在输入框的原生选择器切换，管理页保留可用供应商、模型与调用开关，不再放另一套切换器。下次会话模型、最后实际请求、新会话默认分开显示；没有请求时不伪造“实际模型”。原生选择也遵循其后台保存默认值的行为。
• 供应商目录读取分别限时8秒，超时项不拖住其他供应商；同时读取合并、失败可重试。配置变化后重新读取，不持久化模型目录或凭据。浏览器传输另有16秒等待上限，过期响应不能覆盖新连接。目录、选择状态和开关独立显示，保留已经取得的信息。
• 界面统一更柔和的圆角，修复侧栏底部文字裁切与小窗口输入区高度；保留黑白灰与少量淡紫。
• 调用开关保存在本机 model-access.json。停用供应商或模型会在后续 LLM 流派发前拒绝，不删除配置、不改密钥、不自动替换模型、不取消已在途请求。原生选择器仍可能显示停用项；本插件卸载后此附加调用开关不再生效。它不是跨插件或操作系统安全边界。
• 修复压缩操作客户端15秒超时，改为150秒，与实际长摘要操作相符。保留原生取消和维护锁。

上下文与用量

扩展→上下文与模型，明细默认折叠：

• 使用原生 Token Meter 与路由声明容量。区分 API 用量基线和估算，模型没有声明的容量显示未知。上下文估算不等于提供商账单。
• 显示系统提示、工具定义、消息的估算成分。“立即压缩”直接执行本会话的 DSH 原生 /compact，不占用或发送聊天草稿；忙碌时由原生维护锁拒绝。可跟随宿主、自动管理或仅手动；自动管理阈值50%–90%，保留最近约20%的消息预算。保留原始日志、溢出恢复与工具配对，不另建会话引擎。
• 当前会话的历史回复按模型汇总，不重复计算继承的祖先事件。独立本机观测账本按提供商/模型记录LLM流调用次数、失败/取消、已报告输入输出/缓存用量和审查请求数，不记录提示词、命令、令牌或回复内容。
• 观测自本版本启用后开始，包含摘要、标题、审查等辅助调用。没有对应数据的历史请求不会补造；提供商内部HTTP重试不一定可见。缺失usage或cache字段显示未报告，不冒充零消耗；不根据固定价格假算订阅账单。

记忆、知识与技能

扩展包含知识库、记忆、技能、人设、跨会话与安全：

• 用户明确接入的本机资料文件夹，支持 Markdown/TXT/CSV/JSON。词法检索附文件与行号；跳过链接、隐藏/秘密/依赖目录，限制文档尺寸、数量与深度。索引本机保存，模型调用时命中片段会发送给当前模型。断开不删除原资料。
• 长期记忆先确认再使用。借鉴 Hermes 的简洁记忆快照和按需历史检索分层：每个会话冻结一份确认记忆，压缩后刷新；需要立即更新时点“刷新会话记忆”。核心记忆摘要预算3600字符，未注入条目仍保留并可检索，不自动删除事实。
• 跨会话检索默认关闭。用户开启后，只查询当前工作区最近24个会话，最多12条对话片段；不取其他工作区、思考过程、工具输出或认证配置。没有可靠工作区时拒绝检索。历史结果是参考，不能代替用户授权。
• 人设管理为公开功能，所有个人内容由使用者自己提供。人设不能覆盖真实用户指示和权限。
• 八个原生技能支持 / 与模型按需调用：workspace-recall、knowledge-research、workflow-distill、task-orchestrate、careful-change、context-handoff、adversarial-answer、task-models。模型工具包含 workspace_recall、workspace_knowledge、workspace_history、workspace_memory、workspace_skill_draft、workspace_checkpoint、workspace_skill_revise、workspace_answer_review、workspace_archive、workspace_task_profile、workspace_skill_catalog。模型固化记忆/流程先进入待确认草稿，不能自行启用。
• 内置技能可逐项开关；自建技能可新增、编辑、停用、恢复及删除，删除前需停用，最近12份本机备份仍保留。可关闭模型主动学习，后端也拒绝新的模型技能草稿/修订。自建技能审核后进入DSH目录；已有会话的/菜单可能缓存，需新会话、切换或刷新。归档可恢复；本机原子写入、版本号、最近12份备份，损坏文件不覆盖。

执行审查

使用 tools/pre-execute + tools.guard 核对实际工具、参数与用户意图，默认调用同会话模型审查，也可显式指定审查模型。执行动作与日志必须一致，最终指纹必须未变化。拒绝、超时、取消、格式错误、缺少来源、授权截断或日志写入失败均阻止执行。最新用户限制优先保留，文档/记忆/摘要不能变成授权。原生权限仍可拒绝，本插件不会强制放行。

这是附加执行门，不是操作系统沙箱，也不能隔离恶意宿主插件的原生代码。停用整个插件会移除此附加审查层。DSH原生Auto review可同时运行，会增加请求、延迟和用量。

微信 ClawBot

扩展→微信，指定专用工作目录并启用，点击扫码绑定，在手机微信确认。微信账号须具有 ClawBot 入口。

• 使用固定版本 dsh-plugin-clawbot 的协议管理器及原生会话适配器；不加载它的默认组合包或额外HTTP管理路由。扫码和状态只经DSH已认证RPC传递，二维码由本机生成。
• 初次绑定前、重新扫码期间和停用后拒绝联系人消息；确认后仅允许该账号本人发起任务。不提供全联系人放开开关。
• 文字、图片、可用语音转写交给当前DSH模型。执行审查和DSH权限保持生效。通道不因安装自动启用；扫码确认后才连接，不声称安装等于微信已授权。
• 登录凭据由协议依赖保存在本机OpenClaw/Weixin账号目录；本插件仅保存选定账号引用、工作目录、启用开关及私有会话映射，不将令牌回传到界面或模型。已绑定账号可能与本机其他OpenClaw通道共用认证；停用只断连，保留认证与会话。

可选本机语音与桌宠

支持自己的 GPT-SoVITS loopback 服务、参考音频和对应文字，以及 PNG/WebP/JPG 形象。模型、音频、角色素材、人设及偏好不随公开包分发，也不会自动下载。

隐私与发布

公开包固定15文件白名单；实际tar条目与源码逐项核对SHA256。不要打包整个项目或插件数据目录。workspace.json、知识索引、审计、连接配置、工作台与用量记录、微信设置/状态和本机适配器都是用户数据，不得提交。

2026-10-26逐版本审计覆盖全部可达Git历史、分支/标签与旧归档。未发现模型、声音、角色图片、人设正文或用户偏好原文；已将旧历史提交身份改为GitHub隐私身份，将检查脚本改为通用规则，并替换两套旧发行附件。清理可达历史不保证消除GitHub缓存、旧SHA链接、fork或别人已下载的副本；这类残留需要平台处理。后续提交须使用GitHub隐私邮箱。

开发

npm ci --ignore-scripts
npm test
npm run check
node lib/check-public.js
npm pack --ignore-scripts
node lib/check-public.js --archive dsh-ui-stronger-0.13.0.tgz

方法参考：Remotion Skills、Hermes。微信协议依赖：dsh-plugin-clawbot，MIT；二维码生成：qrcode，MIT。

MIT License.

0.11: focused workspace and continuity

The empty conversation keeps a quiet canvas. Work modules are collapsed until requested; extension management uses one grouped selector. Native DSH plugin, model, permission and session controls remain available.

• Default workspaces: Extensions → Workspaces creates a real folder inside the current DSH home's workspaces directory (default name: default), then registers it with DSH's native workspace service. Existing custom folders are never overwritten.
• WeChat: choose an explicit workspace allowlist and the default for new WeChat sessions. After changing the default, send /new in WeChat. Existing sessions keep their original directory; revoked directories are blocked. Only channel-created sessions can be listed or prompted. Existing pre-upgrade WeChat sessions may require /new.
• Memory sharing: disabled by default. The checkbox shares confirmed long-term facts/persona references with desktop conversations; workspace-scoped facts stay scoped. Conversation history search still requires its separate opt-in. Turning sharing off cannot retract text already placed in older conversations. Confirmed procedural skills are a separate, profile-wide catalog; keep private details out of reusable procedures.
• Long tasks: the model-callable context-handoff skill uses workspace_checkpoint to persist goals, constraints, verified evidence, next steps and pitfalls. A bounded reference is restored after native compaction, alongside a recent direct-user excerpt without a per-step token-pressure number. These notes are reference data, never permission to execute. This improves continuity without guaranteeing that a model will never drift.
• Learning procedures: workflow-distill asks the model to save validated repeated or corrected processes as pending skills. workspace_skill_revise can propose an update by skill name; the active procedure is replaced only after human approval, and stale revisions are refused. No background paid model review is started by this plugin.
• Safety: missing agent provenance fails closed; WeChat child sessions inherit channel memory boundaries. Native execution permissions and the existing exact-action model review remain active. This plugin is not an operating-system sandbox.

Hermes references: skills, context compression.

0.12: easier use and observable assurance

Open Extensions for a short start page: use a default workspace, connect your own materials, or prepare a reliability check. Preparing a skill only adds a draft; it never sends the message automatically. The last extension page stays selected while the client remains open.

/adversarial-answer is model- and user-invocable. It creates a bounded, read-only challenge task for a real native child agent. The parent records the completed child's report through workspace_answer_review, which checks the parent/child relationship, task fingerprint, current human question, normal completion and strict report schema. A challenged conclusion must be investigated and revised; at most two rounds are allowed per human question. If evidence remains insufficient, report uncertainty. Agreement between models is not proof of correctness, and the parent still has to verify the listed checks. This optional workflow consumes extra model calls and time. If native child tools are unavailable, explicitly report that independent verification was not completed.

The Process and Evidence page shows native tool/context event order, task handoff notes, critique reports and execution-review status. Actual reasoning traces, credentials and raw tool arguments are not copied into this view. Original DSH tool cards remain available. Progress notes are labeled as model-written references rather than verified accomplishments. Records are local and are not packaged in the public plugin.

0.13: loading, compression, and task models

• Loading markup precedes the main client bundle through DSH's structured index injections (also carried by desktop boot). Connection and editable-shell readiness dismiss it; there is no staged post-open presentation or replay button. A fail-open deadline prevents a broken client from trapping the window. This does not patch the native executable or its earlier OS/window splash.
• Manual compression uses the scoped native command registry, including command lifecycle, maintenance locking and persistence. The automatic policy adapter observes native isolated compaction service instances; it changes bounded pressure/retention budgets with one attempt per pressure check to avoid redundant summaries, while retaining the native algorithm and cache-aware summary prefix. It restores methods when unloaded. A different compaction backend can keep its own native/manual behavior; automatic policy controls require the current Basic engine.
• Original current-session text can be recovered on demand with workspace_archive, including shadowed pre-compression messages: up to 2,000 events per page, eight bounded matches, with a continuation cursor. Reasoning and tool results are excluded. Cross-session search remains separately opt-in and workspace/channel scoped. This is original-log retrieval, not lossless model recall or an unlimited external vector database.
• Stable confirmed-memory snapshots and removal of the changing per-step pressure counter reduce avoidable system-context churn. Native prompt-prefix reuse and provider-reported cache metrics remain authoritative. Compression, model changes and provider cache expiry can reduce hit rates. No fixed daily token budget, unchanged quality across months, or zero information loss is guaranteed; original logs and selected facts remain available to re-check.
• In Extensions → Context and models, optionally assign registered provider/model pairs to subagents, research, operations, summaries and execution review. Unassigned tasks inherit their current model. A task category selects the agent doing the work, not the search service or shell implementation. Model-callable workspace_task_profile can choose only the caller's configured category after the user enables routing; it cannot alter a parent or configure credentials. Native request headers record the resulting model. Route-owned reasoning/output limits reset when switching models. Prefer fresh child contexts for specialist work; models still have their own capacity, tools and quality limits.
• Automatic learning runs inside the existing model workflow: verified repeated/corrected procedures become pending drafts or revisions, with catalog checks to avoid duplicates. Human confirmation enables reuse via native / or model skill loading. No unsolicited paid background distillation job is added. Turning a skill off removes its registration; it cannot retract instructions already present in conversation history.

All private configuration, task-route choices, learned skills, memory and original conversation content stay outside the public package. Explicitly selected model providers receive the context needed for their task; provider changes should be treated as a data destination choice.