Plugins

Trims historical images in outgoing chat requests down to a recent-image count, learns the provider per-prompt image cap from HTTP 400 responses, and retries with fewer images so image-heavy sessions keep working.

Multi-pet desktop companion: four MAM status lights watch every active session (approval / running / done-unread / error) and each card click-through to its conversation; four voice groups speak on state changes with duration-timed subtitles; import pets from four sources (folder / zip / Codex dir / Petdex registry) with card-style hot-swap and an integrity guard; five action bindings, drag physics, three scales. The built-in fox Foxbell ships in the package — install and go.

Self-media workbench plugin: 8-tab dashboard (daily brief, narrative lines, topics, drafts, knowledge-card distill review, sources, publish, advice) with hard guards (48h window, event dedup, card/line existence, read-only advice) and a read-only intel module following the four red lines.

DSH plugin security guard: 28-rule static scanner, risk scoring, whitelist/blacklist policy, local web dashboard and in-DSH risk popups.

Authored pull request feedback inbox with paginated GitHub collection, priority favorites, and version-bound local progress shared by the DSH panel and CLI.

Prevents concurrent-write session corruption: takes a per-session advisory lock on session start and every step, so a second dsh process fails loudly instead of writing a duplicate-seq gap; dead owners are taken over automatically.

Workspace-scoped Git graph with history search and diffs, multi-worktree WIP and agent-session views, and guarded Git operations with recovery refs.

Runtime security guard for DSH: loader import confinement, HTTP Host header validation, and source patch for VM sandbox escapes (4 CVEs). AI-assisted.

Tools guard that moves agent-issued `rm` targets to the macOS Trash instead of deleting, with a shell-aware lexer covering compound and disguised commands; a switch in Settings → General turns it off.

dsh port of the shared handoff kit: handoff and task-id-bootstrap skills plus host-side automation — baseline state injection, per-turn snapshots with an Auto Log trail, task=<id> routing, continuation re-injection, a compaction guard with clear-required alerts, and read-only subagent handling — all writing the same .agents/state/ as the Codex, Claude, and pi editions for one-repo multi-agent handoff.

Cloudflare D1 tools for agents: d1_list/query/exec/schema/stats/health over the D1 HTTP API, read-only by default with a SQLite-accurate lexical guard, LIMIT row cap, CSV/JSON query output and an approval-gated write path.

DSH Desktop plugin safety guard: self-repairs plugin load crashes and runs 8 core safety checks (2 optional: deep-config & smoke), prompting you when a plugin changes. Non-commercial source-available.

File-change diff bar with keep/undo summary, plus dangerous-command approval and red highlighting for bash/pwsh.

DeepSeek Harness (dsh) Windows 环境防坑守则 skill 插件（纯数据）：GBK/BOM/UTF-16 编码坑、PowerShell 引号转义、长路径/文件占用/EACCES、进程与端口、CRLF、stderr 误判、乱码识别——预防性规则，无修复工具。纯技能载体，零运行时依赖，零构建。

LaTeX and BibTeX guardrails for DeepSeek Harness: compile checks with automatic xelatex/lualatex detection, BibTeX entry deduplication and field filling from Crossref, and \cite key audits against the .bib file.

Curated file-based long-term memory for DeepSeek Harness — human-readable markdown notes, one plain-file store shared across hosts (git-ignored when it lives inside a project repo), and a deterministic index cap enforced by ctx.tools.guard()

Windows process-tree reconciler for the DSH host: samples the host process tree and the job ledger, attributes each process to the job that created it, flags unattributed and orphaned processes with a confidence level, and offers guarded termination of a whole tree. Termination is refused unless the target belongs to the DSH host tree, is re-sampled and re-checked immediately before the kill (creation time included), and contains no protected descendant, so an allowlisted PID cannot widen the kill scope.

Normalizes malformed token-usage samples so broken session histories remain loadable.

AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.

deepseek harness中workspace write权限的增强插件。使用前请自行评估风险。

One install for SpecFlow, GitFlow, Guardian, and Code Intel on DeepSeek Harness.

Local tool-call failsafe for DSH: blocks a fixed list of high-risk shell patterns and credential-file reads before execution, with a per-session hash-linked JSONL audit log, and an optional external Gateway for centralized policy.

Honesty guardrails on the tool pipeline: blocks a coding agent from weakening tests, swallowing errors, stubbing type checks, or deleting tests through the shell — nine deterministic hooks, each backed by a planted-failure test proving the guard can fail.

Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.