Plugins

Kimi Coding web search and web fetch providers for the DeepSeek Harness — one coding-plan key fills both ctx.web seams (POST /v1/search and /v1/fetch), a settings card in the GUI stores it via the credentials service, and the fallback chain reads the Kimi CLI config for zero-setup installs.

Re-validates Cloudflare Access JWTs at the DSH origin so Settings, Credentials, Agent Preset management, and model discovery work from a remote hostname.

DeepSeek account balance in the sidebar footer plus spend per session, today, this month and all time, priced by a configurable time-of-day price table per currency (DeepSeek CNY/USD defaults included). Two read-only remote methods, no host routes, key read through the host credentials seam on every call, egress only to the configured provider origin.

Named user credentials the model uses by reference: values are entered on a Settings → Credentials page and injected into each shell execution as DSH_CM_* variables instead of being printed into the transcript, with credential_read as the documented last resort.

macOS desk pet forked from anneheartrecord/dsh-desk-pet, in a real always-on-top window that covers fullscreen Spaces: the pose follows whatever the local DSH is doing across six states, the right-click menu is a real AppKit one carrying quiet mode and a session list, and seven skins ship with it. Two of the seven are drawn from geometry by a script in the repo rather than generated, so making a skin needs no image model and no API credits; the bundled skill still expands one photo into all eighteen poses on your own image tool and credentials. There is no Electron and nothing to install alongside it: the window is driven through ctypes on the Python that ships with macOS.

Screen capture and external vision recognition: take_screenshot, list_windows, analyze_image and view_image tools with a configurable GPT vision channel (gpt-5.5 / gpt-5.6-sol / gpt-5.6-terra), API key via the credentials service, and a settings card; view_image shows the screenshot in the Web UI while the model context keeps text only.

Runtime security gate on the tool pipeline: denies calls naming hosts outside an egress allowlist, redacts credentials from results at the canonical value rather than only the rendered content, and appends every decision to a JSONL audit log; ships in monitor-only mode.

Blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe sg_* inspection tools that never print raw values.

Qichacha (企查查) enterprise data source as a dynamic Cordis plugin: 5 agent tools (auth with QR login, company search, knowledge search, tool search, tool execute) covering 100+ data dimensions (business registration, shareholders, judicial, IP), plus a settings-page account manager; network/file IO via DSH subprocess spawning node -e, credentials interop with the local BizOwl client.

DeepSeek Harness ACP bundle for editor delegation: a one-command Agent Client Protocol stdio server profile that shares dsh credentials and session logs.

Read-only agent-fleet credential hygiene audit: credential-file permissions, embedded credentials in git remotes (masked in output), and provider token literal counts; zero-dependency and deterministic.

Tavily-backed search provider for the DeepSeek Harness web seam (ctx.web): keyless-first credentials, a cooldown after the keyless tier refuses, and a user-visible notice when it falls back to the key.

Gemini provider for DeepSeek Harness on Google Cloud Vertex AI, with Application Default Credentials, streaming, and thought-signature replay across tool calls.

DeepSeek Harness (dsh) plugin that connects Sber GigaChat models: a built-in local OAuth proxy (client-credentials -> OpenAI-compatible endpoint, upstream serialization, legacy tool-calling translation) plus automatic provider-route bootstrap, so GigaChat

Pure JavaScript macOS Keychain credentials provider for DeepSeek Harness, replacing plaintext .credentials.yaml storage and fully supporting both refs and records without native builds, signing, or Xcode.

OpenCode Go provider that verifies a model against the gateway rather than treating a recommendation as a measurement: the models.dev protocol suggestion is probed before it is used, reasoning levels follow a measured contract, and requests run through an ordered protocol fallback chain. Context window, max output and image-input numbers are declared by a runtime-refreshed models.dev layer rather than probed, with operator overrides above both. Several OpenCode Go credentials can be stored and switched from the settings page.

Sync your DeepSeek Harness (DSH) configuration between machines over a private git or WebDAV channel: settings, plugins, MCP servers, skills, agent presets, workspaces and provider credentials. DSH 配置远程同步插件（私有通道，明文自用）。

Use your DSH models in [Libre WebUI](https://github.com/libre-webui/libre-webui) for chat, sandboxed Work and usage tracking, with provider credentials kept in DSH. Requires Libre WebUI 0.37.0 or later.

A full-page console panel opened from the sidebar, with eight tabs: an overview; a session list read from the sessions service (title, directory, running state, updated time, with filters); installed bundles and Loader entries from pluginInventory and pluginManager, with per-bundle enable switches; a plugin market listing public topic:dsh-plugin repositories from the GitHub search API; a model and provider editor that writes the llm-pi-ai settings namespace through remote.settings.mutate (switch a session model, add or edit providers and their model lists, and store API keys via remote.credentials, merging over the stored profile so fields the form does not expose survive an edit); MCP and skills tabs; and a usage tab that reads the host's loopback /api/dsh-usage/overview document. Services are declared through ctx.inject, so a deployment that omits one mounts without the console rather than crashing.

Feishu (Lark) OpenAPI MCP connection for DeepSeek Harness: drives the official @larksuiteoapi/lark-mcp stdio server with your Feishu app credentials, exposes Feishu API tools (IM messages, Bitable, docs, calendar, drive) under mcp__feishu__*, and a web se

Alibaba Cloud MCP connection for DeepSeek Harness: static AccessKey credentials + local Alibaba Cloud MCP Proxy (uvx alibabacloud.mcp-proxy) connecting to the official OpenAPI MCP Server, with tools under mcp__aliyun__* and a web settings panel

Phone and remote access to the DSH Web UI: scan a LAN QR code, or reach your PC from anywhere through a self-hosted relay server you run yourself instead of a cloudflared tunnel. Per-device credentials that pair, list, and revoke individually, and several PCs sharing one relay with automatic failover.

LLM provider plugin for the DeepSeek Harness (dsh): streams Claude through your Claude Code subscription (claude.ai OAuth credentials), no Anthropic API key required.

Web management panel for Docker on DeepSeek Harness: manages Docker MCP servers (deploy/remove, official catalog search/pull, gateway start-stop-restart, custom deploy) and containers/images (list, start/stop/restart, remove, logs, inspect, interactive terminal, create, pull, build, load) across local CLI and SSH remote targets with one-click switching. Credentials are encrypted with Windows DPAPI, HTTP is loopback-only, and command parameters are whitelist-filtered. Build-free pure ESM; client is zero-dependency.