Plugins

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Staleness keeper for the Codebase Memory knowledge graph: it compares the graph Branch node head_sha with git rev-parse HEAD and reports an exact behindBy, rebuilds only the stale projects through the codebase-memory-mcp CLI so the MCP tool 60-second cap does not apply, watches each project for edits, and mirrors the same state into a settings card and a REST control surface.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

SSH and JumpServer terminal plugin: real-machine read tools, human-initiated read-write operations, and session management from inside DSH.

DSH Cordis computer-use provider for the ZTE Nde desktop. npm install auto-fetches the musl binary built by computer-use-linux-zte-nde (v0.7.7-nde.3) into the package's own bin/ via postinstall; resolveCommand() resolves the cordis command path against import.meta.url so the mount works regardless of dsh web's cwd. Reserves the shared computer-use slot via ctx.computerUse.register and exposes MCP tools under mcp__computer-use-linux-nde-mcp__* (screenshot, list_windows, click, type_text, doctor, etc.). Two notable Nde fixes upstream of this provider: KWin caption+coords fallback for window targeting, and SnapshotCache that keeps AT-SPI single-wake per (app, pid) so Chrome is not repeatedly disturbed.

Jenkins CI integration with a live build-progress panel in the right sidebar, a multi-instance settings page, five model-facing tools (list jobs, build status, console log, workspace, trigger build), and a failure wake that hands a failed followed build to the conversation that followed it.

Installs a self-evolving development-constraints rule library, exposes it to the agent through a constraints tool and a once-per-session reminder, and audits AI token cost and context usage.

Persistent WeChat bridge for DSH: one WeChat user maps to one persistent agent session via the official iLink channel, with context and the user-to-session registry surviving restarts. There is no sender allowlist — anyone who can message the paired WeChat account can start a conversation with a session that has tool access, and the working directory defaults to the home directory; use a dedicated account and set WECHAT_PERSISTENT_CWD.

Agent-facing GitHub repository tools: binds an account through a first-run prompt, then clones into the workspace and reads, exact-replaces, commits and pushes files, with writes off by default.

Verified-progress ledger: three tools record a claimed step as progress only after an independent subagent with a fresh context confirms it against the workspace. The declared scope is fingerprinted before and after each verification, so a verifier that changed anything has its verdict voided and the round cannot become progress.

A resident assistant for DeepSeek Harness that is deliberately not another chat box: one floating window plus one standing conversation, both independent of every other session. The heartbeat is held back by four gates — an authority grant, a daily turn budget, quiet hours and a pacing cooldown — and it keeps working across restarts through a lease it has to hold. Each wake is decided by a model that must answer SKIP or a short message, so silence is a decision rather than a failure. The window shows the standing conversation's real message flow, read from the host session store, or from the on-disk session log when the host does not publish that session, and it can send into that conversation directly. den carries the same reach as the person it stands in for, with one limit: read-only. It may read every session, this machine and work channels such as GitHub, but it does not write, send or publish, it never asks anyone for permission, and it never gates another session's tool calls. `npm run digest:github` turns GitHub notifications and your own open pull requests into three Chinese sections — waiting on you, waiting on your review, and yours — with reply drafts that are explicitly marked as unsent.

Spring Boot admin toolkit: EasyExcel batch import/export code generation and Thymeleaf + LayUI template safety guard.

Publishes HTML pages and Markdown documents written by the agent to GitHub Pages as shareable links, with tools to update them in place, list, read back, and delete them; adds an Artifacts sidebar panel and a bundled page-design skill.

Adds an Omni-modal settings section to DeepSeek Harness that points the harness at any OpenAI-compatible image and video endpoint: switchable config profiles with separate endpoint, API key, model, path and size for each side, free-form extra request parameters, a connectivity test that does not spend generation quota, and three model-visible tools — generate_image, generate_video and check_video — with async video tasks that survive restarts.

Keyless web powers for any MCP client: web_search, JS-rendered web_extract over dual CDP Chrome with proxy failover, and 7 real-browser page_* tools in an isolated context.

OpenAI-compatible web search provider for the built-in web_search tool: one baseURL/apiKey/model config powers Qwen Token Plan, OpenAI and any Responses API gateway.

Chat with the DeepSeek web app (chat.deepseek.com) in a native DSH panel — a real browser drives the site on your existing web login, with streaming replies, deep-thinking and smart-search toggles, and image or document attachments. Conversations can be recovered from the web side, exported as Markdown, and distilled or replayed into a harness session, and the agent reaches the same web chat through six tools (dschat_status, dschat_send, dschat_stop, dschat_recover, dschat_import, dschat_transfer).

Panel for MCP servers registered by @deepseek-ai/dsh-mcp-client: toggle each server on or off with live effect, see the registered tool count and estimated context-token cost of each server, and persist the choice to the home cordis.patch.yml with a timestamped backup before every write. The panel itself can sit either as a page inside Settings or as an icon row in the left sidebar, one seat at a time, with the switcher on the plugin page in Settings. Maintained fork of dsh-mcp-toggle.