Plugins

Compaction integrity: directive lines (never/must/必须 style markers) extracted from the compacted range are verified against the summary — verbatim or by content-word coverage — and every constraint the session silently forgot is reported and written to a JSONL ledger; pinned constraints from config are checked on every compaction.

Registers one agent tool, plugin_guard, that statically scans a DSH plugin package before it is installed and reports a verdict with the reasons: a missing or broken dsh.bundle.patch, a missing dsh.permissions block, install scripts, dangerous APIs and obfuscation, dependency risk, and source that is not indexed and therefore cannot be verified. Read-only: the scanned code is never imported, installed, evaluated or run.

Pre-execution guard: a `tools.guard` predicate decides allow, ask or refuse per permission preset for dangerous shell commands (git hook bypass, catastrophic `rm`, download-and-run, git history rewrites) and for edits to credential paths or to files the turn never read, and hands the model the reason plus a working alternative.

Replaces detected secrets (OpenAI, AWS, GitHub, PEM, Bearer) with deterministic, structurally valid honey tokens before they reach the model or the session file; adds manual marking for values the detectors miss, explicit user-visible restore, a cross-session canary alarm, and an opt-in JSONL log of substitution counts that never records the underlying values.

Pre-publish credential audit: walks a directory tree and flags API keys, tokens, private keys, database connection strings and hard-coded passwords before you commit, publish or ship. Zero dependencies, fully offline, findings are redacted to the first six characters.

Milestone progress soft-enforcement guard: injects persistent system-prompt rules and post-execute notices when tool calls omit visible progress text, with a Web settings form.

Extends the composer model selector menu with a third Context window row, preset capacities (64K–2M), custom input, provider-wide sync, and adaptive compaction guard.

Injects a very short conventions reminder (absolute INDEX path + version) once per session per version; when the conventions version changes, the next turn re-injects it (chat turns included). Optional hard guard: on operation-like turns, write/edit tools are rejected until the session has read the index (chat turns and shell are not blocked by default). Ships example checklists or points at your own directory; zero dependencies, configurable paths. Solves: conventions are written down but never pulled up when the work starts.

Coordinates PUA and Completion Guard tasks from /task-run or a CLI, requiring frozen acceptance and a current candidate/Goal certificate before completion, with an 8-round and 90-minute ceiling. Verified on macOS Desktop 0.2.0-rc.2. Since 0.3.7, PUA 0.3.27, Completion Guard 0.9.0 and SpecWorkflow 0.1.1 are bundled, so only Task Runner itself needs installing.

Pins a Chinese (zh-CN) thinking and answering constraint into the system prompt, and registers a per-step runtime reminder so the agent does not drift back to English after tool output. Zero runtime dependencies, single file; falls back to a second registration path and only logs a warning when the host API changes.

Semantic workspace search: three model tools (`zg_search`, `zg_index`, `zg_status`) drive the `zg` CLI for hybrid BM25 + vector + RRF retrieval, with a search-first guard that makes `grep`/`rg` require a prior successful search in an indexed workspace.

Five production-grade DSH tools bundled into one plugin (8 tool slots total): git regression finder (find introducer, recent changes, bisect, blame age), stack-trace decoder with local code context, YAML/ENV/properties config validator with typo suggestions, cross-platform shell escape (POSIX/PowerShell/cmd), and MyBatis Plus SQL static auditor (N+1, missing @Transactional, LIKE leading %, SELECT *, missing WHERE). Zero npm dependencies, all offline; concurrency-safe except the bisect tool (dsh-when-broke). Each sub-plugin is also installable standalone (dsh-when-broke, dsh-stackdecoder, dsh-config-guard, dsh-cmd-shield, dsh-mp-auditor).

Local BM25 auto-recall, a fail-closed write guard, a static doctor and a memory panel for an Engramory markdown store. No network, no daemon and no model calls unless you opt in; recall quality is measured by a reproducible benchmark in the repository.

Turns guard denials, gate failures and human thumb-downs into project lessons, and injects only the rules a human has armed into each new session of that project; it registers no model tools and is reviewed through its settings card.

Write guard for the Akasha Book store: blocks tool calls that write into the memory data directory, and injects the store usage contract and self-layer sections into the system prompt. Companions: Hindsight (repo memory), OpenViking (user memory), and the built-in session search (see repo README). Setup: clone the repo, copy core/ aside, then replace <AKASHA_DIR> in cordis.patch.yml with its absolute path (or set the AKASHA_DIR env var); plugins fail loudly while the placeholder remains.

DSH guard against self-repetition in streamed model output: detects a degeneration loop in reasoning or visible text, aborts the runaway turn and wakes the agent with a corrective notice.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Watches a turn's thinking and output streams and cancels the turn when the model starts repeating itself. Four detectors: a verbatim cycle, a counting loop whose lines differ only by a number, repeated lines separated by other text, and a user-supplied phrase list. A catch raises a manual-dismiss alarm card in the global overlay with an optional tone, and a Monitor tab holds the switches, thresholds and hit history. Detection is local string comparison with no model calls, so it costs no tokens.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

A mandatory 7-step plan on every request, each step with a binary acceptance criterion, executed through worker subagents and validated by independent memoryless verifier subagents that report PASS or FAIL with evidence.

Spring Boot admin toolkit: EasyExcel batch import/export code generation and Thymeleaf + LayUI template safety guard.