Plugins

Restore syntax highlighting of read/write tool envelopes inside run_code (PTC / Code Mode) result cards

Per-workspace custom system prompts for DeepSeek Harness (DSH): set one active prompt per workspace, captured into a session at creation time, editable from a session-header dialog. 给 DeepSeek Harness 的「工作区自定义提示词」插件：每个工作区一条生效提示词，新建会话时固化注入，会话头部弹窗增删改查。

Cross-session knowledge for DeepSeek Harness: ctx.knowledge service + knowledge_* tools, SQLite FTS5 trigram retrieval (CJK substring) with L1 query expansion. V1.11 contract (write/update/search/list/delete + budget + events + error codes).

为 DeepSeek Harness 打造的液态玻璃 UI 主题：磨砂玻璃+边缘折射、可调透明度/模糊/色调、自定义字体、背景图与动态壁纸（多图轮播）、自定义 CSS、柔和动画。

Local and remote SSH terminals for DeepSeek Harness Web with three permission levels, human approval for risky AI commands, and encrypted credential storage.

Mobile UI adaptation plugin for DeepSeek Harness - overlay drawer navigation, glassmorphism design, safe-area coverage, PWA support.

Teaches Herdr about DSH panes: reports agent working/idle/blocked state — including the blocked state DSH itself lacks — enabling panel jump and --wait. (Herdr integration / agent state display / panel jump)

Bridges WeChat private messages to DSH with two-way text, image, file, and media transfer, aiming to restore the native DSH experience in WeChat.

Standalone mobile surface for dsh: scan-to-pair device trust, realtime SSE sync, three-channel completion notifications (in-app / Web Push / Server酱·Bark·Telegram), offline outbox, approval & question panels, per-provider usage meters, PWA; a native narrow-screen phone UI.

Audits every plugin HTTP route in a profile for a browser-trust fence: plugin routes win the web server's longest-prefix match ahead of the /api gateway, so they never see its trust check and must pin the Host to loopback themselves. Grades PASS/WARN/FAIL per route and fails a fence that compares Origin to Host without pinning it (bypassable by DNS rebinding). Ships as a CLI for CI and a route_fence_scan tool.

Tools guard that moves agent-issued `rm` targets to the macOS Trash instead of deleting, with a shell-aware lexer covering compound and disguised commands; a switch in Settings → General turns it off.

Background security auditor for DeepSeek Harness: scans agent outputs for secret leakage, checks command safety before execution, and surfaces findings in a persistent audit log.

Crash protection for installed plugins: crash cards with one-click disable, static pre-flight inspection, black-box crash telemetry, and a safe-mode rescue profile for a broken UI.

Auto-adjust model reasoning effort per task (off/low/high/max): task classification, \[effort=...] markers, in-turn error escalation, DeepSeek peak-pricing-period capping with countdown notices, and manual-selection priority.

WSL (Windows Subsystem for Linux) bridge for DeepSeek Harness: run Linux commands, manage distros, convert paths, and copy across the Windows/Linux boundary.

Microsoft Agent Framework (MAF) plugin for DeepSeek Harness: validate, run, and scaffold declarative agents and workflows (YAML).

Real AST-based scan of installed plugins for malicious-intent patterns (dynamic eval, cross-plugin writes, exfiltration-shaped network calls), with an optional periodic schedule and auto-quarantine on critical findings.

Tiered task queue as the single source of truth for DSH↔Hermes work (reset > approve > review): enqueue tools for all submission paths, lease/claim model with concurrency 1, priority aging against starvation, atomic busy mutex, and a Hermes-side consumer (cron */1 + monitor gating) that drains tasks, writes review-handoff requests with single-slot checks, and invokes the reset agent.

Hands DSH reset requests to an external ops agent via a versioned JSON protocol: preflight snapshot, pre-restart maturity gate (no pending approvals, free disk, cooldown), restart, health check, and interrupted-work recovery, with the result delivered back to the requesting session.

Auto-approval agent for DSH permission requests: rule layer (denyAlways/allowlist) plus Hermes Pro semantic adjudication with quick-fail retries, fail-closed to human when Hermes is unavailable, rejection feedback returned to the requesting session, and approve tasks enqueued into the task queue with a shared busy mutex.

Replaces the headless startup to add --model provider/model, --resume <id|latest>, --continue and --session-info flags to dsh headless runs.

Quality suite: background tsc --noEmit diagnostics fed back after the agent edits TypeScript, plus a /code-review command running five parallel review lenses with confidence scoring; absorbs dsh-code-check and dsh-command-code-review.

Evidence-first attention supervision for DeepSeek Harness with C0–C3 policy, deduplicated Inbox alerts, quiet hours, and redacted outcome records.

ServerChan3 (Server酱) push notifications when a turn finishes — title, model, project directory, git branch, status and a reply excerpt, with subagent filtering and fire-and-forget delivery.