Plugins

Undermind literature search inside DeepSeek Harness. The plugin owns the OAuth authorization-code + PKCE login the remote MCP server requires, refreshes the rotating refresh token before expiry, re-initializes the MCP session when the server drops it, and registers every tool Undermind tools/list returns as a mcp__undermind__* tool, alongside a permanent undermind_auth tool for status, login, logout and retry. Needs an Undermind account and a client id - Undermind accepts a Client ID Metadata Document URL (CIMD) or a pre-registered client id, and does not support dynamic client registration.

Security plugin that intercepts file deletion and write commands, requiring user token authorization.

DSH plugin: a local egress proxy bridge. Hands a credential-free HTTP(S) proxy URL to consumers that reject credentials, and injects the upstream auth on the hop that needs it. Fail-closed by default: if the upstream fails, traffic is refused rather than falling back to a direct connection. Zero build, zero runtime dependencies.

DSH plugin: a "No API key required" toggle on saved hand-declared provider cards that writes Authorization: Bearer none so keyless local/self-hosted endpoints stop aborting with "No API key for provider"

Douyin patent and trademark complaint workflow for DeepSeek Harness with a left-sidebar task panel: checks user-supplied links, materials and organization identity in a dedicated browser, records each submission state, queries platform history read-only, and shows local task counts in the sidebar; never discovers targets or submits without explicit authorization.

Bridge a WeCom (企业微信) smart bot to DeepSeek Harness: user groups own a Workspace, a model and an agent preset, members get their own Session, refused senders are told to ask an operator and wait in an authorization list on the plugin page, administrators

Beta 0.2.0-beta.2 for DSH 0.2.1-rc.2 only, for Host-owner use. Search original user and assistant text in the current session or same-directory workspace, with source coordinates and context. Non-owner session authorization is not supported.

Manage Codex subscription (ChatGPT OAuth) authorization from the DSH settings panel, so Codex GPT models work without an API key.

Optional JEV decision mode with deterministic project reads, bounded semantic selection, native authorization checks and desktop credential settings.

One settings page that lists every subscription sign-in the harness can offer and walks you through it — ChatGPT (Codex), Claude, GitHub Copilot, OpenRouter, Kimi and xAI — reading the list from the authorization seam instead of hardcoding providers, and showing credential records no registered flow claims any more.

DSH remote-access authorization page that shows the current process browser-session URL as a clickable link or QR code, behind an optional authority/subnet allow-list and PIN.

Keeps what the agent builds at runtime: turns a `cordis_define` dynamic package into a real installed plugin that survives restart, writing the bundle and registering the profile layer with no pnpm, no network, and no build authorization.

Email assistant forked from dsh-email with host-side 163 IMAP monitoring that creates DSH conversations for summaries and reply suggestions, manual suggestions for selected messages, and persistent automatic/manual processing records with session links. Includes multi-provider mailbox browsing; automatic monitoring currently supports 163 IMAP only. Install it instead of dsh-email, not alongside (both mount the same tool-email row). It registers no send or draft tools; mail text goes to your configured model and is kept in the session logs; monitoring needs DSH running continuously and a 163 IMAP authorization code.

Multi-workspace agent federation with persistent ticket trees, parallel worker sessions, structured evidence reports, independent acceptance checks, retry/stop and restart recovery. Workers get shell and file tools in the ticket's directory, company_verify re-runs the ticket's acceptance commands in a shell on the host, and scope lists are task authorization rather than a sandbox. State is stored in ~/.dsh/ai-company; the optional company_repo_* tools run separately installed aoci/codegraph commands on any path they are given.

SMTP/IMAP email bridge with five tools: send, list, read, download attachments, and list folders. Needs Python; the send tool sends real email from your account, and the mailbox authorization code is kept in the profile's cordis.patch.yml.

Zotero bridge: search, read, add, update and trash items in a local Zotero library, read PDF annotations and notes, pull indexed full text, and find related papers by DOI. Needs Zotero 7 or later with its local API enabled; the first write triggers a Zotero authorization prompt (the key is stored in plugin-data/dsh-zotero/auth.json) and permanent deletion asks for confirmation. Finding and adding items query OpenAlex, Crossref, arXiv, PubMed and Open Library. Uses the same package name (dsh-zotero) as Vncntvx/dsh-zotero, so only one of the two can be installed per profile.

Configure automation Hooks for user and project scopes to run commands on session, tool, permission, and context-compaction events. Manage Hook authorization manually in Hooks setting.

Give it one URL and it traces the whole chain itself — DNS, reverse proxy, upstream, container, host and dependencies — then reports a root cause with evidence, so incident triage and routine operations run without anyone reciting where the machines or logs are. The chain comes from resource records it builds and keeps in your workspace; it is read-only by default and any change needs your explicit authorization.

Read-only QQ Mail over IMAP: list, search, and read messages; the settings page verifies the account before saving. Needs IMAP enabled on the mailbox and its 16-character authorization code (not the QQ password); the server is fixed to imap.qq.com.

Cross-session task ledger for DeepSeek Harness: one item per request with a step chain, an accordion strip above the composer, unfinished items injected into every step, staleness review with artifact fingerprints, clickable choices that learn repeated decisions, a grant ledger whose four-mode control sits inside every authorization-blocked card, blind-work backfill checklists, and a scheduler that re-judges an item only when a new assistant answer mentions it.

Fork of Yuuz12/dsh-webui-auth adding a deny-by-default allowlist route gate over resources, plugin bundles, /api and WebSocket upgrades; password and OIDC/SSO login with an SSO-only mode; server-side sessions with HttpOnly cookies plus a per-browser session list and selective revocation; an OAuth 2.1 device authorization flow (RFC 8628) for app and CLI access, with independent device sessions that expire only on explicit revocation; and a core session bridge that exchanges the launch cookie on the server without exposing the launch token. It is a fork of Yuuz12/dsh-webui-auth and cannot be installed alongside it — remove the original from the profile's bundle list first.

LibTV canvas and media tools for DeepSeek Harness, with three director skills bundled and one-time WeChat QR authorization.

Plan-native multi-agent workflow for DeepSeek Harness: plan directs, work coordinates, code writes, and review audits read-only. Ordinary tasks need no authorization card or budget form. Includes 14 chain_* tools for explicitly authorized controlled rounds, with a frozen T0 baseline, layered evidence, and blocking close gates. Provides per-role model settings. Requires the sibling l1-presets bundle. For new installs, Weihao654/dsh-workflow#role-chain provides this runtime and the four presets in a single bundle. Do not enable role-chain alongside either legacy l1-presets or l2-protocol.

Bilibili companion for DSH (MIT fork of Alterssss/dsh-bili-whale; do not install alongside the upstream — both register the same `/dsh-bili/` settings routes and share `~/.dsh/bili-whale.config.json`): wakes on a schedule, reads videos through subtitles, danmaku, hot comments and covers, writes two diaries, and shares at most one pick per wake by commenting on the video and @-mentioning the owner (daily quota 3; DM when `share.via=dm`). Inbound DMs, commenter names, summary requests and live danmaku are normalized and scanned for injected instructions before they reach the model; only the owner DM channel can carry an authorization prefix.