Plugins

Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.

Drive DeepSeek Harness from WeChat: scan a QR code to sign in, send instructions in WeChat, and the agent reply lands back in the same chat window. Several agents can share one WeChat account, each with its own model, preset and context, switched from the chat with /use. Only the configured owner WeChat account can drive the agent; other senders are rejected by default and require explicit approval.

Session-level root privilege bridge for DeepSeek Harness: ask mode with per-request web approval, full root mode (polkit password entry in the web UI) and fakeroot mode, with sudo or run0 --empower escalation and a configurable subagent sudo policy. It escalates real commands with sudo or run0: in ask mode each request waits for your approval; in full root mode every bash command of the session runs elevated after one password entry in the web UI. Delegated subagents need per-request approval by default (subagentPolicy: request).

Configurable model-based approval review with workspace sandbox modes and review history.

Generates DSH host-side plugin skeletons — tool registration, an approval hook, a dsh.bundle manifest and three test layers — and registers a plugin_kit_new tool so the agent can scaffold a plugin from inside DSH without a shell.

Desktop notifications when a DeepSeek Harness session finishes a turn or needs your approval.

Lightweight cross-session reflection: at the end of each turn it writes 3-5 reusable facts (tool chain, file paths, config items, pitfalls) as a card in .dsh/reflections/{date}.md, and on a new session it injects the last 3 cards at the end of the system prompt. Extraction uses the real ctx.llm.stream; when no model route is available it falls back to a heuristic built only from the session log and labels the source honestly on the card. No timers, no quarantine, no approval flow; cards are plain Markdown you can edit or delete.

Desktop dynamic island for DeepSeek Harness showing live agent status, approvals and questions, workspace switching, and usage stats.

Adds a Plan/Build switch to the composer chip and to the Tab key, keeping a separate model and reasoning effort per mode and restoring them on every toggle, /plan, and plan approval.

A draggable dock in the top-left corner of the DSH window that stacks three groups in one fixed order: sessions blocked on a person (a tool waiting for approval or the model waiting on an answer), then sessions running right now, then results that finished while you were not looking. Each row opens its session, the collapsed chip shows one count per group, dragging the chip or the title bar moves it anywhere while rows stay clickable, and a single Settings row can switch the whole dock off. It observes only: the Host half records the two blocking paths and hands the request straight to the real answerer without changing the decision.

Shows a Windows toast notification when a DeepSeek Harness run finishes, a tool approval is requested, or a question is waiting for an answer.

Translates the English text of DSH approval prompts and ask_user_question cards into Chinese for display only: approval outcomes, option labels, tool names and JSON arguments stay unchanged, and approval audit records keep the original English. The text is sent to Microsoft's Edge translation endpoint (edge.microsoft.com) to be translated, so the content of approval prompts and questions, including command text, leaves your machine.

Peer sessions between DeepSeek Harness instances on a LAN: UDP discovery, an explicit one-way allow list with open or confirm approval, HMAC-signed HTTP with a ±60 s window and nonce replay protection, a `跨端 · <peer>` session for delivered prompts, two-phase file transfer up to 100 MiB with SHA-256 receipts, and seven agent tools that call the named tools listed in `exposedTools` on the receiving side. Its local /cross-agent panel routes are guarded only by a loopback check, without DSH's Host/Origin admission.

Adds a “why does this need escalation?” button to every DSH approval card: it opens a panel with the permission requested, the risk, what refusing means, the exact tool arguments and whether the named paths fall outside the session workspace; the card also keeps a one-line risk and refusal consequence visible under it, and the model’s original reason is split into labelled paragraphs instead of a run-on block.

Local CLI bridge for Codex or terminals to create and continue conversations in the running Harness desktop/Web Host, query progress, wait for output, and cancel tasks. Needs Harness 0.2.2-rc.1 and Node.js 24.9+. Requests travel through a per-user file queue in the Harness home (no network port), and approvals and questions stay in the Harness UI.

Team presets for AgentTeams: ships audit6 / impl5 / lite2 rosters with seed task DAGs and a per-role report contract, plus a captain doctrine section, so a fresh session opens the right team in one approval instead of a pasted prompt. Needs the engine @nanmicoder/dsh-agent-teams added to the same profile first; the team patch targets that engine's entry by id and replaces its whole agent-teams config.

Configuration bundle that connects Microsoft's official @playwright/mcp to your running Chrome through the Playwright extension, so the agent can drive your logged-in tabs. Install from a local copy: put your extension token in cordis.patch.yml first (with the token, connections skip the extension's approval prompt, so keep it private). Needs Node.js and the Playwright Chrome extension; the default command is the Windows form (cmd.exe /c npx), so change it to npx on macOS or Linux. It starts @playwright/mcp@latest through npx.

Add-on layer over the official QQ bot plugin @tencent-connect/dsh-qqbot: gates group messages before they reach the agent (probability, debounce with backlog, invalid-message filtering, admin approval before reading attachments), greets idle private chats, and adds emoji stickers via dsh-meme, TTS/ASR voice replies, image generation and one settings page. Needs the official QQ bot plugin installed (plus dsh-meme for stickers). Group gating defaults to a 25% chance and only applies when mentions are not required; the private-chat greeting is on by default (22:00-08:00, at most 3 a night, only to chats that wrote first); voice and image generation call endpoints you configure; with no admins configured nobody can approve attachments.

Task completion, question and approval reminders: a Dafeiyu big-fish notice with a DingTalk-style sound

Six native macOS notification switches for DeepSeek Harness Desktop: approvals, questions, task completion, subtasks, errors, and turn end.

Phone-first web client for DeepSeek Harness whose /m/ page serves a compact mobile UI instead of proxying the full desktop UI, with approvals staying on the phone when the phone started the turn and Mermaid rendered on the device.

Forces every active session into the full-access permission preset (this disables the approval gate) and appends approval, sandbox and tool-call events to a local JSONL for after-the-fact review. Audit path is configurable; it never uploads anything.

Read-only behavior audit for DSH sessions: flags unsafe actions in 8 categories (A–H) with rules for 14 subclasses (the 41-subclass taxonomy file is not shipped, so a built-in 14-subclass fallback is used), anchors every finding to a real event seq, and gives deep links plus the full tool-call / data-access chain of any assistant reply (parameters, results, files read and written, domains, sandbox and approval context). Every finding is drill-downable.

Non-blocking approvals and timed questions: permission requests park as pending items while the model keeps working and the approved call can be retried, and ask_user_question runs in timed mode (20 s) through an override of the whole standard agent preset that applies to new sessions after a restart.