Plugins

A project-agnostic multi-agent collaboration protocol for the DeepSeek Harness: loop guards that stop runaway agent loops, a six-field handoff format, risk-tiered review routing, and a fixed verify→commit→push→review→close sequence. One skill instead of the same rules copy-pasted into every agent's instructions.

Mojibake guard bundle for DSH: feature-based garbled-text detection before writes with review-then-release (an identical retry passes), plus pre-execution pwsh encoding audit (ANSI/GBK/UTF-16/Default), Windows and Chinese first.

Guards the persisted session-projection cache: per-row JSON degradation so one misbehaving projection unit (e.g. a third-party plugin storing a Map) can never stall session titles or the whole cache again, plus a startup self-heal that backfills missing titles.

Git-aware write guard plugin for DeepSeek Harness: blocks whole-file writes that would overwrite the user's uncommitted changes, and reports what happened to protected files at turn end

Adds dangerous-operation policy checks, output redaction, and a security-review workflow.

Scans skills and MCP configs for prompt injection, homoglyphs, hidden Unicode, dangerous shell, and credential leaks.

Typed, guarded container control: ps/logs/inspect/exec/start/stop and compose up/down with JSON output, project-aware targeting, and approval-gated destructive ops.

Pre-boot guard that intercepts malformed client plugins before they break startup, names the offending plugin in the error instead of failing anonymously, isolates it in place so the app still boots, and ships an offline dsh-rescue CLI for profile recovery.

Three-tier model collaboration pipeline for DSH: the L1 you pick plans and accepts, long-lived L2 module leads write code, and cheap L3 executors handle tiny tasks, with strict adjacency, quality gates that run assertions, budget guards, and a live GUI board.

Lifts the built-in cap of three @ referenced sessions per message by rewriting the reference resolver's config after it is instantiated, defaulting to 8 with an aggregate context budget guard; no app.asar changes.

Denies tool calls and shell commands that reference credential files before they run, then redacts API keys, JWTs, private-key blocks and connection-string passwords from tool results before the model sees them.

Deletes the dsh-auth-* login cookies DSH Desktop appends on every launch, which otherwise pile up past the 16 KB request-header limit and make the app fail with HTTP 431.

Externalizes oversized assistant and tool messages in long sessions into project files while keeping a recent window, and archives reasoning from empty turns as a visible message so long tasks do not stall on context size.

Drops text blocks that carry nothing but leaked DSML tool-call tags, then rewrites the resulting empty turn into a retryable error so the host's built-in retry re-issues the request; prose that merely contains tags passes through untouched.

Permanently delete DSH session records from the sidebar context menu, removing the session log directory, the projection cache entry and the workspace registration in one action. A confirmation dialog guards every delete. Its /dsh-session-purger routes, including permanent delete, are mounted with webServer.register and carry no DSH Host/Origin admission check, so a web page open in your browser can delete session records through them.

Peer sessions between DeepSeek Harness instances on a LAN: UDP discovery, an explicit one-way allow list with open or confirm approval, HMAC-signed HTTP with a ±60 s window and nonce replay protection, a `跨端 · <peer>` session for delivered prompts, two-phase file transfer up to 100 MiB with SHA-256 receipts, and seven agent tools that call the named tools listed in `exposedTools` on the receiving side. Its local /cross-agent panel routes are guarded only by a loopback check, without DSH's Host/Origin admission.

Security guard for DeepSeek Harness (Cordis): reviews every tool call in pre-execute against SlowMist agent-security rules, denying or flagging risky commands, MCP servers and skill loads, external URLs and repositories, untrusted documents, and EVM or Solana addresses; scans tool results for prompt injection after execution and ships a slowmist_scan audit tool plus an injected security policy prompt. Rules follow the open-source SlowMist Agent Security Skill (MIT).

Adds budgets to agent waiting: caps job_output waits, refuses runaway foreground commands inside run_code, breaks status-polling loops after four no-progress probes, and explains run_code deadlines and parse errors.

Moves reasoning that a provider leaks into the visible text channel back into the reasoning channel, and emits a text block when a whole turn of answer text lands only in the reasoning channel. Catches three shapes: `<thinking>`-tagged text, text that continues a reasoning tail which ended mid-token, and an answer-only reasoning turn that stops. Healthy streams pass through unchanged, block order is preserved, and each of the four rules can be switched off in one JSON config.

Detects repetitive loops in an agent's reasoning output and records, nudges, or cuts them, with a history report. Defaults to a nudge (a reminder injected into the next request); cutting and auto-resuming is opt-in, and should not be combined with another plugin's cutting such as dsh-loop-rescue. Needs DSH 0.2.1+ and Node.js 22.15+.

Puts a domain bar under the session header — a domain groups skills and tools and toggles as one block, so one click loads or unloads every member. Hovering a chip lists its members (skills, then tools) in a height-capped panel that scrolls. The right end of the bar is a compaction-threshold counter (− 5 +, 100k tokens per step) that rewrites the live compaction engine policies, so the compaction trigger line changes on the next turn without restarting dsh; a degraded fallback turns the number amber and is reported in the snapshot. Settings maintains domains and members with search, skill/tool tabs, all/selected/unselected filters and a copyable AI grouping prompt. Tool removal uses tools.restrict plus a guard; hiding a skill re-registers it with modelInvocable false, so it leaves the model catalog while /name still works. Sessions of another preset are left untouched.

Cites one specific message from another conversation: the @ menu inserts a chip, and at send time the quoted text is injected as untrusted background; a conversation_history tool also lets the model search and read other sessions of the same workspace. The @ menu searches the indexed sessions of every workspace (only the model tool is limited to the current one), and its HTTP routes (/dsh-message-cite/api/…) are guarded only by a marker header, not by a DSH access check.

Per-task cost dashboard and budget guard that prices each model call at peak or off-peak rates, turns the remaining budget into a per-turn work envelope in the system prompt, and stops the task at its cap until the user replies. The default cap is ¥0.5 per task.

allow/ask/deny permission gates for DeepSeek Harness tools: path/params/agents surfaces, argv decomposition, network rules, redaction, grants, dry-run, fail-closed config