Plugins

Raises the local Host's HTTP header budget to 128 KiB and prunes stale dsh-auth cookies only on the launch-token response that mints the replacement, so an already-locked-out desktop profile recovers and later random-port launches stay at one cookie.

Redacts secrets, cookies and personal data in every model request at the host process undici dispatcher and restores the placeholders in the reply, so one interception covers every provider, adapters that plugins add included; per-kind actions mask / warn / block, an optional same-shape fake key, records written to disk by the day and a statistics card.

Windows-only guard against the desktop shell locking itself out: it counts the dsh-auth-* launch cookies the shell has accumulated, reports how much of the 16 KiB request-header budget they consume, and once the count passes 40 it backs up the whole Cookies database and lets DSH rebuild it, so every cookie in that profile is cleared. Install is one command: on load the plugin registers its own weekly scheduled task pointing at the scripts inside the package, and uninstalling it removes that task — nothing to copy into your home directory and no schtasks line to run by hand. The check itself runs while the app is closed (it waits up to 3 hours for the shell to exit). It does not raise the header budget or keep a floating panel; scripts/ can also be run standalone without the app installed.

Bilibili curation floating panel for DSH: learns your interests on a probability schedule and decays them by half-life, picks videos inside a token budget derived from a daily money cap, and mentions you only when a fit score passes a threshold. Comments are off by default; once enabled they run in draft-and-confirm or self-checked auto mode under a daily quota, with a hard no-comment rule for political, government and frontier-science topics, and comment text is scrubbed for account identifiers before it can be posted. It signs in through your own Bilibili account cookies; a separate posting account is recommended.

A-share holdings contribution card for DeepSeek Harness: today's P&L and portfolio return next to the Shanghai Composite, the top five contributors by P&L with each stock's strength versus the index in pp, and a 15:00 close-summary PNG export with the contributor list, intraday chart and a numbers-only summary. Holdings come from a local holdings.csv/holdings.json and quotes from the public Tencent market-data API; the plugin never reads cookies or broker credentials. Requires DSH 0.2.x; the card and the export are covered by a test suite that runs in CI.

Fork of Yuuz12/dsh-webui-auth adding a deny-by-default allowlist route gate over resources, plugin bundles, /api and WebSocket upgrades; password and OIDC/SSO login with an SSO-only mode; server-side sessions with HttpOnly cookies plus a per-browser session list and selective revocation; an OAuth 2.1 device authorization flow (RFC 8628) for app and CLI access, with independent device sessions that expire only on explicit revocation; and a core session bridge that exchanges the launch cookie on the server without exposing the launch token. It is a fork of Yuuz12/dsh-webui-auth and cannot be installed alongside it — remove the original from the profile's bundle list first.

Expires the dsh-auth-* cookies that earlier launches bound to other ports once a response already carries more than four of them, and answers an HPE_HEADER_OVERFLOW rejection with a redirect that clears them, so a desktop profile that reached the HTTP header limit opens again without clearing its cookies by hand. Derivative of jitianjiyan/dsh-auth-cookie-guard (already listed); it declares the same npm package name, so the two cannot be installed alongside. Requires DSH 0.2.1-rc.5 or newer.

Expires stale dsh-auth sign-in cookies once the Cookie request header passes 4 KiB, so per-port cookie accumulation can never reach Node's 16 KiB header limit (HTTP 431).

Zero-dependency browser hand & eye over CDP: drives your own Chrome/Edge with real clicks, Chinese IME typing, scrolling and text/selector element picking, and captures whole-page evidence into one replayable folder — DOM, accessibility tree, screenshots, cookies, storage, console, HAR, resource waterfall and perf metrics.

Feishu OAuth login reduces the need to distribute the DSH owner token while retaining token login; authorized users receive native owner session cookies with shared owner privileges, without per-user isolation.

Keeps DeepSeek Harness desktop dsh-auth-* session cookies bounded by deleting stale ones during the token exchange performed on every launch, so random-port accumulation cannot reach the 16 KiB request-header limit and cause an HTTP 431 startup failure.

Browser takeover for sign-in-gated sites: keeps a list of addresses that need a login (URL and date only, no credentials), answers before a visit whether an address is already on it, reports whether the debug browser is signed in there from the session-cookie names of that site (certain, likely, or not signed in — anonymous cookies such as _gh_sess never count), and opens saved addresses in that browser by navigating and clicking one element by its visible text, searching every iframe. One click per call, no crawling.

Compile a video link into timestamped Markdown knowledge cards with back-links to the exact moment. Requires your own Python 3.10+ and yt-dlp (ffmpeg + faster-whisper only for videos without subtitles; Bilibili login cookies for members-only subtitles).

A reflection layer for DSH sessions that slowly rewrites a 3-7 entry worldview across value, preference and habit layers, tracks spirit, health and account balance, ingests Bilibili/Douyin videos, and keeps an auditable growth archive. Video intake is optional and needs site cookies; Douyin parsing also needs Edge/Chrome and yt-dlp.

Drives the DSH right-sidebar built-in browser from the agent side with 38 tools (open, navigate, read page text and interactive elements, accessibility tree, click, fill, select, check, key press, scroll, resize the browser frame by dragging its corner, with the page inside reflowing responsively so a narrowed frame shows the mobile layout, screenshot, full-page screenshot, PDF, markdown export, scrape to JSON, download, cookies, per-step operation records with replay and action whitelisting), serves the built-in web_search from a self-hosted SearXNG over an SSH tunnel with Tavily and a real-browser fallback, and registers a fetch provider that retries blocked GitHub URLs through measured mirrors and sniffs charset from the response header so GBK and GB2312 pages decode correctly.