Plugins

Stages exact DSH tool calls without dispatch, presents complete canonical arguments in a durable Batch Review Inbox, invalidates approvals after edits or restarts, and commits only a matching SHA-256 digest plus single-use nonce through the normal DSH tool pipeline.

给每次 AI 对话装一根 Token 保险丝：为每条用户消息设置独立总预算，统一约束输入、缓存、思考与回答。A per-conversation total-token safety fuse for DeepSeek Harness, with a whale slider and automatic reset on the next user message.

Windows desktop automation for DeepSeek Harness: accessibility-first observe/act loop with 30 standard tools (element/coordinate targets, auto/a11y/event strategy routing), superseded-observations and no-replay safety semantics, persistent kill switch, RuntimeId/rect-drift stale protection, chat cards and a floating panel (live ops, frame wall, env auto-detect settings), tiled vision describe for low-res models, JSONL audit trail and a pid allowlist. Requires Windows 10+ and Python 3.9+ with uiautomation and pillow (installable from the settings page).

Static capability disclosure for DeepSeek Harness plugins: a Settings page and CLI that list installed plugins' capabilities, literal destinations, install scripts, and injection shapes (prompt registrations, shipped skill text, bundle patch), each with file:line evidence. Code-determined, reproducible, zero-token. Disclosure only — not a security verdict, never a safety claim.

Stages exact DSH tool calls without dispatch, presents complete canonical arguments in a durable Batch Review Inbox, invalidates approvals after edits or restarts, and commits only a matching SHA-256 digest plus single-use nonce through the normal DSH tool pipeline.

Skill that fact-checks a claim against the open web rather than model memory: it splits the claim into independently checkable fact points, routes each point to the primary-source ladder for its domain (policy, academic, medical, financial, disaster and accidents, food safety, science, education, sports, entertainment, judicial, and more), searches domestic and international ecosystems in parallel, fetches primary pages, grades sources by type, re-searches with debunking keywords, and reports conclusion-first with a full URL and citation position behind every statement, keeping unverified and undecidable points separate from confirmed ones. Three factual judgements can be routed to a TypeSafe Jev (System One) decision model when a key is configured, falling back to the skill's deterministic rules when it is not; a model verdict can only lower a confidence tier.

Manage VPS servers over SSH key login: 21 zero-token /vps- commands (status queries, recipe installs with a plan and /vps-yes confirmation, reboot that waits for the machine to come back), an in-conversation terminal (xterm.js over ssh -tt) for interactive programs, 5 agent tools with risk-tiered confirmation, file backup with automatic restore and a firewall/SSH safety net, 29 built-in recipes, and a settings page for adding machines.

Per-turn file changes, per-file diffs and deterministic safety verdicts for DSH sessions, plus a preview-first rewind that refuses when the worktree has drifted since the preview.

Windows system-drive (C:) cleanup for DSH: rule-based scan, five-tier safety grading, a staging area with a rollback ledger, UAC elevation, and migration to another drive — a model tool plus a Web GUI panel.

Safety filter.

Smart checkpoints, workspace safety guards and instant rollback for DeepSeek Harness.

Policy plugin that gates kubectl by kubeconfig context: hard-deny irreversible verbs outside local clusters, ask for the rest.

Owner-governed long-term memory bundle for DeepSeek Harness

Commitment write-gate: operator-authored rules enforced before a tool call runs — a deterministic guard tier plus an LLM-judge tier, fail-closed by default, every block written to a contradictions log.

Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting

Agent- and GUI-controlled DG-LAB Coyote e-stim plugin: eight `coyote_*` tools plus a DSH web panel behind one safety envelope (soft limits, asymmetric rate limiter, session cooldown, playback caps, disconnect fail-safe); optional auto-stim layer maps agent events (tool calls, errors, turn end) to bounded pulses; official V3 socket protocol with QR pairing, programmable waveforms. Adults only.

Destructive-command interception gate for dsh: parses shell semantics, judges risk against 41 built-in rules, and holds irreversible rm -rf, git reset --hard, and git push --force style commands at a confirmation gate.

Configurable per-turn budgets for supported file mutations, limiting distinct files, mutation calls, and UTF-8 payload bytes before tool execution.

A hands-off safety net: directories the agent deletes go to a trash folder first and symlinks are never followed, with zero approvals.

Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.

Pre-execution safety valve for DSH that judges with TypeSafe Jev: it hooks tools/pre-execute and decides every bash/pwsh call by first applying offline static rules, then by asking the Jev model — the System One model from TypeSafe, which returns a structured decision instead of prose — one yes-no question ("will this command irreversibly delete or overwrite real data?"), turning the answer into allow, revise, block or escalate; revise hands the model a safer rewrite, escalate offers a one-shot human token; exhausted credit or a missing API key degrades loudly instead of failing silent, and a missing key is requested in the conversation itself (`guard key set`, read from stdin); every verdict is appended to a shared audit log and the text people read is bilingual zh-CN/en.

Auto-archives sessions idle beyond a configurable threshold, with safety guards (never touches live or running sessions), plus a full archived-session management UI: list, unarchive, safe delete and content preview.

Adds an "approve for me" access mode whose approval requests are answered by an independent reviewer model instead of a person: the reviewer can read the workspace read-only, a reviewer that cannot run hands the request back to the human, and every decision is recorded with its rationale in an Approvals tab.

IP/domain allowlist web_fetch provider for DeepSeek Harness: lets web_fetch reach allowlisted hosts/IPs freely (incl. proxy fake-IP addresses like 198.18.x.x) while keeping the default public-IP safety check for everything else.