Plugins

Three-tier deny/ask/auto gate for the computer-use (cua-driver) tool family: each tool category gets one segmented control in Settings, and an allow list or deny list overrides the tiers per tool name.

DSH 邮箱管家：静默后台收信、缓存优先的即时双邮箱报告；明确同步失败与旧结果，邮件仅在本机处理。

Guards session logs from malformed model tool calls (empty id/name, non-string arguments) so a bad call can never make a session unloadable.

Tell your deepseek-v4.1-flash: "shut up! Stop looping!"

0.8.6 fixes a startup crash: the host runtime package is an optional peer, never an installed dependency. TypeSafe Jev (System One decision model) wired end to end into DeepSeek Harness (0.8.6). Seven tools: jev_decision (1-25 parallel atomic verdicts in one call; noul/choice/score; typed answers with calibrated confidence; measured median 266-484 ms; verdicts only, never prose), jev_choose (rank 2-10 candidate approaches - fit 0-3 and risk - into an explicit composite with a recommended pick), jev_batch (NEW in 0.8.6: one set of 1-5 judgments over 1-20 texts, one real call per text at bounded concurrency, returning a paste-ready markdown table sortable by a judged dimension; built-in sentiment/priority/intent/pii/spam presets; a failed row is reported as failed with the raw error, never guessed), jev_usage (locally measured usage: calls, tokens, estimated cost, latency median and p95, per-tool mix, rolling windows, projected burn rate, optional local hard budgets, and a declared-balance remainder), jev_overview (session ledger), jev_guard_status (guard counters plus a registrations block that surfaces per-surface registration failures) and jev_verify (frozen 27-question live benchmark at concurrency 6: 96.3%, 26/27). WHAT IS NEW IN 0.8.6 - the ledger survives a restart, the remainder is derived instead of invented, and the plugin can now do batch paperwork. (1) The local ledger persists to $DSH_HOME/jev-usage.json BY DEFAULT, so the cumulative total no longer resets when the host restarts. Two real bugs behind the old silent zero were found and fixed: the ledger path only honoured DSH_HOME (absent inside the host process, so persistence was silently disabled and the file name was null), and save() wrote the still-empty in-memory ring over the history file because it ran before the first load while the debounce window swallowed the follow-up write. (2) Remaining is derived, never invented: TypeSafe exposes no balance endpoint - /v1/usage, /v1/quota, /v1/account, /v1/account/balance, /v1/balance, /v1/credits, /v1/billing, /v1/me, /v1/limits and a dozen more all return 404, and only /v1/models answers, with no balance headers - so the panel shows the remainder as your declared balance (quota.declaredBalanceUsd) minus locally measured spend since quota.balanceSince, and says plainly that it cannot be fetched instead of printing a number. (3) The composer pill re-reads every 20 s instead of every 60 s, so a call you just made shows up while you are still looking at it. (4) The collapsed pill leads with the remainder once you declare a balance, and the cumulative row is renamed when the ledger is on disk. Every tool has an in-conversation structured view; the Settings > Plugins card covers credentials, tool switches, the auto-guard, the dashboard, the prompt section, usage/quota and auto-triage. Honest by design: no API key means an explicit error, never fabricated results; every registration is quarantined so a failure degrades one surface. Tests 38/38 (npm test, ~2.5 s). Client half applies on refresh; server half needs a host restart.

Search, read and write an Outline knowledge base from conversations, with whitelist-guarded approval for every document write.

Auto-archives sessions idle beyond a configurable threshold, with safety guards (never touches live or running sessions), plus a full archived-session management UI: list, unarchive, safe delete and content preview.

Connects DeepSeek Harness to FitMeet through per-user OAuth with 17 tools for people search, gatherings, notifications, personal items, connection feedback, Hall publishing, and direct messages, with preview-and-confirm guards for write actions.

Polaris Memory: local-first project memory plugin for DeepSeek Harness. Uses per-project .dsh-memory.json; provides memory_read/recall/write/update/delete tools, /memory command and settings UI, with tiered injection (resident user profile + scene-triggered memories with P1/P2/P3 importance), semantic recall (IDF + synonym layer), and a hard-guard mechanism for bottom-line memories (detect deny-semantics -> authorize -> block AI deletion; user can confirm-override).

Automatic model-tier routing for DeepSeek Harness: one user instruction enters, one tier decision comes out — complex intent is planned on the strong tier and implemented on the cheap tier, simple intent stays cheap throughout, with a deterministic guard and a TTL escalation fallback.

Crash protection plugin that auto-isolates plugins causing startup crash or hang, with independent watchdog process for total hang recovery.

Smart checkpoints, workspace safety guards and instant rollback for DeepSeek Harness.

Search, read and write an Outline knowledge base from conversations, with whitelist-guarded approval for every document write.

Install-time patch guard for cross-machine DSH group chat: fixes dsh-weave rc.14 defects (inject crash, random UDP port, 4KB ack frame limit) with four idempotent patches, alongside setup, mechanism and ops docs for the dsh-chat x dsh-weave x dsh-bridge chatroom stack.

Service control panel in DSH Web settings: live host info (PID, versions, uptime, memory/CPU trends, active sessions), npm update banner, and a confirm-guarded graceful stop that warns when tasks are running and can wait for them to finish.

Deterministic loop guard: denies a tool call repeated with identical arguments and caps per-agent calls, in code outside the model; incident log lets a parent interrupt a stuck subagent.

Plugin Guard for DeepSeek Harness (DSH): isolate broken plugins so the web UI never goes down, with one-click self-update from npm.

Local and remote SSH terminals for DeepSeek Harness Web with three permission levels, human approval for risky AI commands, and encrypted credential storage.

Mandatory cross-review for design proposals and lessons-learned: auto-detects design doc writes and enqueues them (tier=review) into the task queue, delivers the external reviewer verdict back to the initiating session, and appends approved preventive measures to OPS-GUARDRAILS.md (append-only, conflict-checked).

WebUI panel for the dsh-guardian watchdog: start, stop and inspect two macOS LaunchAgents with status, log tail and explicit failure states.

Neutralize tool calls with invalid JSON arguments on the wire so one malformed model generation cannot brick a session against strict OpenAI-compatible servers.

Stavros RedTeam for DeepSeek Harness (DSH) — authorized red-team persona + scope-guarded pentest tooling (persona, 24 subagents, methodology and 78 zero-dependency guard tools).

White-box causal guardrail for dsh: every tool call is adjudicated before execution along a deterministic causal logic chain — blocks destructive and credential-file operations, escalates repeated boundary violations, cuts faulting links until verified-fixed, and gives risk verdicts on un-auditable execution; runs fully local with zero API cost, plus 6 white-box self-check tools.