Plugins

DSH plugin: 29 deterministic, offline tools for JSON validation with exact line/column, JSONPath queries, YAML/CSV conversion, text diff, regex capture, encodings, hashes, Unicode, CIDR, JWT structure and timestamps. Every call returns a { result, meta }

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

SillyTavern-style prompt rules for DSH: layered system-prompt anchors, constant/keyword entries, reproducible probability gates and regex rewriting.

Resident search index living in the host process: hot_find (fuzzy filename and path match, with frecency and git status), hot_fuzzy (content search that tolerates typos, including in Chinese), hot_grep (literal and regex content search), hot_plan (groups hits per file so a batch of files can be read in order) and hot_stats. One in-memory line index is built once and rebuilt on demand, so a query does not spawn a process.

Preventive content policy for DeepSeek Harness tool results: rewrite matched text with regex rules, or drop/truncate unpredictable payloads by field path before they are normalised, rendered, or persisted. The upstream counterpart to dsh-plugin-redact.

Time-traveling stream rules for DeepSeek Harness — project rules stay dormant until a regex matches the live token stream, then the request is aborted, the rule injected as a system reminder, and the request retried from the same point. Zero per-turn cont

The small deterministic operations an agent needs mid-task. JSON/YAML round-trip, JSON Schema validation, text diff, JWT decode, regex testing, SQL dialect transpiling, QR codes, timezone and unit conversion, page screenshots.

Developer quick-reference toolbox for DSH: 12 themed categories (195 entries) plus zero-dependency tools — regex tester, JSON formatter, timestamp converter, Base64/URL codec, cron generator and line diff, in a searchable settings panel.

Pre-install supply-chain poison scanner for DSH plugins: AST (JS-X-Ray) + deobfuscation + regex heuristics, exits non-zero on findings for CI gating.