Plugins

qqbot 增强层：群聊关键词放行 + 续聊窗口（场景判定、合并/逐条回复、刷屏保护、可选引用）+ 历史上下文 + 设置页可视化配置（进程内补丁，不改 qqbot 文件）

Watches the Agents Anywhere bridge and notifies you when it wedges and leaves your phone offline; a crashed Connector is relaunched by default (guarded), restarting a wedged one is opt-in. Needs the Agents Anywhere bridge plugin; macOS tested, Windows untested.

Derivative of cheesehaqi/dsh-qq-onebot-bridge with the same package name, so the two cannot be installed together. Bridges a personal QQ account into DeepSeek Harness over OneBot 11: private and group messages become per-conversation agent sessions and replies are sent back to QQ. Ships a reverse WebSocket server, allowlists (empty = deny all), @ parsing, image and SILK voice handling, and a separate local console on 127.0.0.1:8880 with the decision trace, offline replay, event injection, a read-only preflight and host/Waylay start-stop controls. Needs a separate OneBot v11 implementation (a third-party unofficial QQ client): the default, Waylay, injects into the official Windows QQ.exe (Windows 10/11 x64 only) and is distributed as a separate release archive, not bundled in this repo. botQqAllowed and replayGuardEnabled are edited in DSH Settings > QQ助手, and the replay guard is armed automatically when the logged-in account changes.

Checks a DSH profile manifest for JSON errors and dependency/bundle/patch mismatches, reads recent startup crash logs (Windows DSH Desktop only), and can back up or roll back the manifest files.

Standalone rescue for a broken DeepSeek Harness profile: a CLI that runs without DSH diagnoses the crash logs (six classified causes, from real incidents), pre-flights the profile for command-name collisions and files plugins read at construction time, arms a safe mode that loads only official bundles until a healthy boot restores them, and keeps manifest snapshots for rollback. A resident watcher watches the crash-log directories via OS file events — idle costs nothing, and when the loader dies the report is written within seconds, one file overwritten per crash. Windows only: crash logs are read from %APPDATA% and the watcher autostarts from the Windows Startup folder.

DSH prompt-cache health guard and cost coach: install from npm as dsh-prompt-cache-guard (not the unrelated dsh-cache-guard package). cache_guard_health returns green/yellow/red health, a one-line hint and a PTC suggestion; cache_guard_config reads or updates settings.

Blocks tool calls whose description argument is not written in both Chinese and English: adds a system-prompt section stating the 中文:“…” 英文:“…” format and a tool guard that rejects English-only calls before they run. By default it checks every tool that declares a description parameter; set DSH_BILINGUAL_DESCRIPTION_SCOPE=shell to limit it to shell tools.

Per-turn cost meter and tool-loop guard for the DSH web GUI. It records model, tool and idle time for every turn, blocks runaway tool calls with a dynamic step gate, a retry breaker and a slow-command block, and renders the breakdown as a card under each reply plus a ledger view.

Hospital-triage board for the DSH sidebar: sessions whose latest turn ended in an error (red = fatal, amber = 429/rate-limit) or is waiting for approval are grouped under an Attention tab, next to Working and Finished tabs, with ticking durations, dismiss with undo, unseen markers and EN/中文 auto-locale. An eye icon hides the session list (the header then shows Workspaces · N) and a Duty-gated chevron folds the nav bar; clicking a row opens the session across workspaces. Needs the zstd tool (zstdcat) on PATH. On-request log scan through a guarded same-origin route — no background daemons, zero core edits.

Crash-recovery guard for DeepSeek Harness: records plugin install/update recency plus declared compatibility metadata, blocks the offending suspects before the next boot after a crash, and rolls back to the pre-crash plugin startup state when the disable escalation tops out (keeping only the head suspect disabled). Ships a management panel with an interactive capability graph, impact analysis, an execution log of every guard action, early-warning indicators that only observe (they never disable anything), per-project partition isolation, archive-and-reset, and an offline rescue CLI.

Delegates coding tasks from DeepSeek Harness to Codex CLI in WSL, with required acceptance criteria, background progress and cancellation, thread resume, per-criterion reports, change tracking, and optional workspace guardrails. Requires Windows with WSL2, Python 3.11+ and a logged-in Codex CLI in WSL.

Expires the dsh-auth-* cookies that earlier launches bound to other ports once a response already carries more than four of them, and answers an HPE_HEADER_OVERFLOW rejection with a redirect that clears them, so a desktop profile that reached the HTTP header limit opens again without clearing its cookies by hand. Derivative of jitianjiyan/dsh-auth-cookie-guard (already listed); it declares the same npm package name, so the two cannot be installed alongside. Requires DSH 0.2.1-rc.5 or newer.

Read and edit a Notion workspace from the agent: 10 tools over pages and databases, content handled as Notion-flavored Markdown, and writes guarded by a content-hash version check, a preview diff and one-step undo, so an edit made by hand in Notion is never silently overwritten. Installs with dsh plugin add; no build step. Requires a Notion integration token (or a personal access token) and sharing each target page or database with the integration.

Watches the turn endings of the models you select and asks a second model whether the turn was actually finished: if the assistant stopped after text with no tool call, a three-way verdict of continue, finished or uncertain is recorded and shown in a sidebar panel. In suggest mode it only reports; in auto-continue mode it calls agent.followup() once the turn is idle to send a continuation message, up to a per-turn limit. Single-step turns are always rechecked, watched models can be picked exactly or matched by case-insensitive regex, and the resume text is configurable.

One image behind the whole DSH shell. The image layer sits at z-index -1 and the shell's two --dsw-* tokens are repointed at translucent tints, so the picture shows through the frame, sidebar and composer. Ships a bundled default picture so it works with zero configuration, plus a floating panel with five sliders, presets, upload, and an SSRF-guarded URL import; changes persist to a local settings.json and the client self-heals when the SPA replaces its stylesheet.

Copilot-style file review for DeepSeek Harness: inline per-edit diffs, whole-file Changes sidebar, shell write guard, Keep/Undo and persistent per-turn Restore Checkpoint.

A self-justification gate for outbound claims: a claim needs a checkable source (an http(s) URL plus a quote of at least 8 characters), every number in the text must appear in a quote, and a quote whose vocabulary overlap with the post is under 10% counts as an invalid citation; absolute wording is rejected when the only evidence is second-hand. All verdicts come from deterministic rules — no model call, no network. The guard subcommand refuses to run the publish command when the gate fails (fail-closed), explains what is wrong and how to fix it, and requires an --ack note on the second attempt stating what changed; after three attempts it stops and hands back to a human. Ships check / explain / fix / guard, with 30 tests.

Layered context management: at each turn end older tool output becomes a deterministic card, the model can fold older ranges into its own summaries in up to three tiers (compress), and every original is archived locally for decompress and search_context. Works alongside DSH-Mem0: superseded runtime-context snapshots (such as recalled memories) are never archived, carded or folded, and are replaced by a one-line placeholder at turn end when the prompt cache is already broken, when the saving outweighs the cache miss, or above 75% of the window; a strataBudget service (pressure, allowance, countTokens) and a strata/fold-landed event are provided for other context plugins; strata_status warns when DSH's automatic compaction is off or its official summary keeps failing. Its L1 layer, archive rotation, prune guard and preset takeover are forked from dsh-live-compact 1.0.6 (MIT); uninstall dsh-live-compact or billion-context first — they replace the same compaction rows and Strata will not take over while either is installed.

QQ (OneBot 11 / NapCat) channel for DeepSeek Harness: bridges QQ private chats and group chats into their own dsh sessions. Ships group guardrails (mention-only, quiet hours, cooldowns, daily quota, peak-hour mute), a tool gate with write-action audit, an outbound filter that stops the model from echoing input tags, voice transcription, media and forwarded-card support, dryRun and usage stats. Forked from dsh-onebot-qq 0.9.4. Cannot be installed alongside the upstream dsh-onebot-qq (two QQ channels on one NapCat crash-loop DSH). Private chats answer admins only (an empty admin list means nobody); group chats default to all groups and answer any @-mention, so set groupPolicy to allowlist to restrict who can drive the agent.

Pauses running DeepSeek tasks when peak billing starts and automatically resumes them after the off-peak window begins, with model-aware guards, an off-peak planning queue, and a sidebar countdown clock.

一份能交出去的自查表、整改说明和合规证明

LAN access for the harness process: writes the authenticated links for the harness port, one per local IPv4 address, to a token file and registers DSH_LAN_LINK in the shell environment, and can run a gateway on a fixed LAN port that holds the browser session on this machine, so devices need no token; forwarded requests get Host and Origin rewritten for the same-origin guard, and a host-claim marker is injected so the page renders as the full desktop UI instead of remote-visitor mode. Devices are admitted by CIDR, with optional Basic auth.

DSH host bundle for the ShyPie privacy-first workflow: extracts attached images and PDF/Office files locally before they enter the session log (requires poppler pdftotext/pdftoppm on PATH and a local OCR engine — Windows OCR on Windows, optionally tesseract; without them attachments are rejected, not forwarded); default filter mode keeps text local (optional local masking); blocks unmaskable media/BLOB; provides local privacy_extract, privacy_ocr, privacy_scan and privacy_rehydrate tools; denies read_image and binary/document reads outside allowPaths; and enforces a fail-closed llm/stream egress guard before DSH dispatches a model request (the default provider allowlist is the local Magpie gateway).

PTC agent preset whose tools.guard refuses tool calls until the session holds an active goal and an in-progress todo.