Plugins

Router and artifact gate for DeepSeek Harness: a per-turn skill router that ranks the live catalog, plus a write gate enforcing read-before-write, dedupe and a four-line audit on every file write.

Blocks AI coding agents from editing files without evidence and from running unapproved high-risk commands, and tells quoted dangerous strings apart from commands actually being executed.

0.8.6 fixes a startup crash: the host runtime package is an optional peer, never an installed dependency. TypeSafe Jev (System One decision model) wired end to end into DeepSeek Harness (0.8.6). Seven tools: jev_decision (1-25 parallel atomic verdicts in one call; noul/choice/score; typed answers with calibrated confidence; measured median 266-484 ms; verdicts only, never prose), jev_choose (rank 2-10 candidate approaches - fit 0-3 and risk - into an explicit composite with a recommended pick), jev_batch (NEW in 0.8.6: one set of 1-5 judgments over 1-20 texts, one real call per text at bounded concurrency, returning a paste-ready markdown table sortable by a judged dimension; built-in sentiment/priority/intent/pii/spam presets; a failed row is reported as failed with the raw error, never guessed), jev_usage (locally measured usage: calls, tokens, estimated cost, latency median and p95, per-tool mix, rolling windows, projected burn rate, optional local hard budgets, and a declared-balance remainder), jev_overview (session ledger), jev_guard_status (guard counters plus a registrations block that surfaces per-surface registration failures) and jev_verify (frozen 27-question live benchmark at concurrency 6: 96.3%, 26/27). WHAT IS NEW IN 0.8.6 - the ledger survives a restart, the remainder is derived instead of invented, and the plugin can now do batch paperwork. (1) The local ledger persists to $DSH_HOME/jev-usage.json BY DEFAULT, so the cumulative total no longer resets when the host restarts. Two real bugs behind the old silent zero were found and fixed: the ledger path only honoured DSH_HOME (absent inside the host process, so persistence was silently disabled and the file name was null), and save() wrote the still-empty in-memory ring over the history file because it ran before the first load while the debounce window swallowed the follow-up write. (2) Remaining is derived, never invented: TypeSafe exposes no balance endpoint - /v1/usage, /v1/quota, /v1/account, /v1/account/balance, /v1/balance, /v1/credits, /v1/billing, /v1/me, /v1/limits and a dozen more all return 404, and only /v1/models answers, with no balance headers - so the panel shows the remainder as your declared balance (quota.declaredBalanceUsd) minus locally measured spend since quota.balanceSince, and says plainly that it cannot be fetched instead of printing a number. (3) The composer pill re-reads every 20 s instead of every 60 s, so a call you just made shows up while you are still looking at it. (4) The collapsed pill leads with the remainder once you declare a balance, and the cumulative row is renamed when the ledger is on disk. Every tool has an in-conversation structured view; the Settings > Plugins card covers credentials, tool switches, the auto-guard, the dashboard, the prompt section, usage/quota and auto-triage. Honest by design: no API key means an explicit error, never fabricated results; every registration is quarantined so a failure degrades one surface. Tests 38/38 (npm test, ~2.5 s). Client half applies on refresh; server half needs a host restart.

Mandatory cross-review for design proposals and lessons-learned: auto-detects design doc writes and enqueues them (tier=review) into the task queue, delivers the external reviewer verdict back to the initiating session, and appends approved preventive measures to OPS-GUARDRAILS.md (append-only, conflict-checked).

White-box causal guardrail for dsh: every tool call is adjudicated before execution along a deterministic causal logic chain — blocks destructive and credential-file operations, escalates repeated boundary violations, cuts faulting links until verified-fixed, and gives risk verdicts on un-auditable execution; runs fully local with zero API cost, plus 6 white-box self-check tools.

DeepSeek Harness (dsh) approval answerer backed by the agent-governance sidecar — every approval/request is decided by the deny-by-default gate, L0–L4 rules and the organizational audit chain.

Commitment write-gate: operator-authored rules enforced before a tool call runs — a deterministic guard tier plus an LLM-judge tier, fail-closed by default, every block written to a contradictions log.

Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting

Configurable per-turn budgets for supported file mutations, limiting distinct files, mutation calls, and UTF-8 payload bytes before tool execution.

Blocks tool calls whose description argument is not written in both Chinese and English: adds a system-prompt section stating the 中文:“…” 英文:“…” format and a tool guard that rejects English-only calls before they run. By default it checks every tool that declares a description parameter; set DSH_BILINGUAL_DESCRIPTION_SCOPE=shell to limit it to shell tools.

Delegates coding tasks from DeepSeek Harness to Codex CLI in WSL, with required acceptance criteria, background progress and cancellation, thread resume, per-criterion reports, change tracking, and optional workspace guardrails. Requires Windows with WSL2, Python 3.11+ and a logged-in Codex CLI in WSL.

QQ (OneBot 11 / NapCat) channel for DeepSeek Harness: bridges QQ private chats and group chats into their own dsh sessions. Ships group guardrails (mention-only, quiet hours, cooldowns, daily quota, peak-hour mute), a tool gate with write-action audit, an outbound filter that stops the model from echoing input tags, voice transcription, media and forwarded-card support, dryRun and usage stats. Forked from dsh-onebot-qq 0.9.4. Cannot be installed alongside the upstream dsh-onebot-qq (two QQ channels on one NapCat crash-loop DSH). Private chats answer admins only (an empty admin list means nobody); group chats default to all groups and answer any @-mention, so set groupPolicy to allowlist to restrict who can drive the agent.

Reviews destructive shell commands with a model before they run, asks you to confirm or blocks them, and aborts a running command once it has deleted too many files.

Jev (TypeSafe System One) judgments at the DeepSeek Harness agent-loop gates: pre-step, pre-execute, post-execute, and turn-stopping. No UI dependencies; mount it in any Harness composition.

LaTeX and BibTeX guardrails for DeepSeek Harness: compile checks with automatic xelatex/lualatex detection, BibTeX entry deduplication and field filling from Crossref, and \cite key audits against the .bib file.

AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.

Local tool-call failsafe for DSH: blocks a fixed list of high-risk shell patterns and credential-file reads before execution, with a per-session hash-linked JSONL audit log, and an optional external Gateway for centralized policy.

Honesty guardrails on the tool pipeline: blocks a coding agent from weakening tests, swallowing errors, stubbing type checks, or deleting tests through the shell — nine deterministic hooks, each backed by a planted-failure test proving the guard can fail.

Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.

Pre-execution guardrail: vetoes dangerous shell commands and blocks secret/credential leaks before they run.