Plugins

Configurable per-turn budgets for supported file mutations, limiting distinct files, mutation calls, and UTF-8 payload bytes before tool execution.

Blocks tool calls whose description argument is not written in both Chinese and English: adds a system-prompt section stating the 中文:“…” 英文:“…” format and a tool guard that rejects English-only calls before they run. By default it checks every tool that declares a description parameter; set DSH_BILINGUAL_DESCRIPTION_SCOPE=shell to limit it to shell tools.

Delegates coding tasks from DeepSeek Harness to Codex CLI in WSL, with required acceptance criteria, background progress and cancellation, thread resume, per-criterion reports, change tracking, and optional workspace guardrails. Requires Windows with WSL2, Python 3.11+ and a logged-in Codex CLI in WSL.

QQ (OneBot 11 / NapCat) channel for DeepSeek Harness: bridges QQ private chats and group chats into their own dsh sessions. Ships group guardrails (mention-only, quiet hours, cooldowns, daily quota, peak-hour mute), a tool gate with write-action audit, an outbound filter that stops the model from echoing input tags, voice transcription, media and forwarded-card support, dryRun and usage stats. Forked from dsh-onebot-qq 0.9.4. Cannot be installed alongside the upstream dsh-onebot-qq (two QQ channels on one NapCat crash-loop DSH). Private chats answer admins only (an empty admin list means nobody); group chats default to all groups and answer any @-mention, so set groupPolicy to allowlist to restrict who can drive the agent.

Jev (TypeSafe System One) judgments at the DeepSeek Harness agent-loop gates: pre-step, pre-execute, post-execute, and turn-stopping. No UI dependencies; mount it in any Harness composition.

LaTeX and BibTeX guardrails for DeepSeek Harness: compile checks with automatic xelatex/lualatex detection, BibTeX entry deduplication and field filling from Crossref, and \cite key audits against the .bib file.

Honesty guardrails on the tool pipeline: blocks a coding agent from weakening tests, swallowing errors, stubbing type checks, or deleting tests through the shell — nine deterministic hooks, each backed by a planted-failure test proving the guard can fail.

Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.