Plugins

Smart Charts skill: turns CSV/TSV/TXT/XLSX/XLS/JSON data files into standalone interactive ECharts HTML - 32 chart types including offline maps, 3 themes, no CDN. A --profile data profile (per-column dtype, cardinality, missingness, samples, statistics, entity grain, insight signals) lets the agent read the data and pick the chart itself; each chart embeds a fact sheet (plot_stats + data_preview) whose numbers are the only quotable values. LLM transform code runs in a restricted sandbox (blacklist + AST whitelist + safe builtins); --doctor self-checks the Python environment. Fully offline, ECharts bundled.

Fine-grained permission gateway: per-category tool-call review (outside-workspace directories, commands, file read/write, subagents, repeated actions) with global & per-project allow/deny exceptions, quick-tool defaults, custom rules, a bilingual approval modal with inline diff details, custom rejection reasons and a sandbox-upgrade flow.

Wenyuan Pavilion: an AI Team workbench for DSH with owned tasks, independent acceptance, an append-only ledger and concurrent projects. Install it into its own profile (dsh plugin --profile ai-team add @suifei/dsh-ai-team), not web or desktop: its patch sets that profile's sandbox to danger-full-access and approvals to never, and the member agents run with full access. The project's PMO acts automatically by default (every 60 s it resolves pending decisions and wakes owners to dispatch the next tasks); turn off PMO auto to send decisions to your inbox.

Connects DSH to a local anet node through a stdio MCP client, with three skills and 14 tools to discover agents on the AgentNetwork, send, track and answer end-to-end encrypted A2A tasks, pay or decline priced skills within the operator's limits, read the local evidence chain and report the node state. Linux/macOS only; requires an anet 0.3.0+ node running locally.

Git Bash shell tool for Windows: runs commands through the bash bundled with Git for Windows, with timeout, sandbox, output truncation, and background jobs, replacing the slow pwsh tool and the WSL-only bash tool.

Windows workspace pre-authorization: adds an explicit full-control DACL ACE (including WRITE_OWNER, required by dsh >=0.1.7 sandbox startup) to user-declared workspace directories, removing the repeated full-access escalation prompt. Grants only on explicit intent — new workspace records or paths added in the plugin settings page; system directories are hard-blocked. Windows only.

Rule-gated automatic approval for DeepSeek Harness sandbox escalations with an optional LLM reviewer and native human fallback.

Model-facing display_file tool that renders 36 file extensions inline in the web UI: images with a click-to-zoom lightbox, seekable video, audio, PDF, Office and OpenDocument files converted to PDF on the host via LibreOffice, and local HTML in a sandboxed frame; bytes stream from a signed HTTP route with range support, and PNG/JPEG/WebP/GIF also enter model context on image-capable routes.

Patch-style file editing: one apply_patch tool accepting git/unified diff (default) and Codex apply_patch syntax (opt-in), applying every change all-or-nothing after a full read-only verification pass, with sandbox-aware delete and move and a dry-run mode.

A web Settings "Loop engine" switch that swaps the agent loop driving every dsh session among five engines — the built-in in-process loop plus hosted Claude Code, Codex, Pi, and Kimi Code — with zero changes to the harness; each hosted engine keeps its thinking and tool calls in the durable session transcript, takes over commands, skills, and the agent preset, and runs sandboxed through the dsh subprocess seam.

Per-directory access gate for DSH: deny / read / full levels for names and paths, roster groups, per-session overrides and an audit log, plus seven model-facing `gate_*` tools whose widening requests must be approved by the owner in the panel. Installs with `dsh plugin --profile desktop add dsh-isolation-gate`; MIT, no network calls, state stays on disk.

Cross-session task delegation for DeepSeek Harness: spawn durable top-level sessions and send them tasks, read or steer them by base62 session alias, and approve their sandbox escalation requests through an approval bridge that refuses destructive deletes.

A dsh-better-sidebar tab that statically parses Qoder Canvas `*.canvas.tsx` files into structured pages in the DSH right sidebar (the source is never executed: no eval, no bundler, no sandbox iframe), with a file-viewer takeover for `.tsx` and a bundled Skill for authoring the format.

Adds a workspace-write++ permission that keeps file tools inside the workspace while skipping the Windows process sandbox for wildcard-allowlisted executables such as Git Bash.

Windows sandbox for DSH Desktop: once set up, the Host is launched through FinSAFE inside an AppContainer sandbox for protection against what agents can reach on the machine. Windows x64 only; on first activation it downloads and installs the matching FinSAFE native runtime (SHA256-checked, with Windows consent) and leaves an updater process running.

DeepSeek Harness adapter for Context Mode: in-process ctx_* tools for sandboxed code execution and an FTS5 knowledge base, plus context-window routing guidance.

Embedded MCP server letting external agents (Hermes, Claude Code, etc.) drive DeepSeek Harness over StreamableHTTP: sync/async task execution, a three-tier file sandbox, a Web-backed approval bridge, session management and search, and path-jailed file tools.

Scan and fix Low integrity labels, non-inherited S-1-4 sandbox ACEs, and related Everyone deny ACEs in DSH workspaces on Windows. Maps live DSH workspaces, defaults to read-only, repairs after confirmation, verifies the result, and keeps one replaceable ACL rollback record per workspace.

PTC runtime for the DeepSeek Harness that runs model-written programs in moejs, a pure-Go JavaScript engine, inside a long-lived sidecar process under dsh's file sandbox

DeepSeek Harness 对话体验增强套件（零源码改动、纯插件注入）。Seeker 双栏执行大盘：右栏任务 / 操作面板 / 子智能体 / 产出物四张卡 + 记忆钉底，左栏只留一行状态卡与贴进对话流的思考卡、问答卡（字号跟随官方「设置 → 字号」）。正文可出卡片：html 沙箱（跑真 HTML/JS）、diagram 流程图、iu 原生交互卡、proto-tabs。另有对话截图、download 下载工具、裸路径转链接，供应商中心（API Key / 网络代理 / 生图识图生视频 / AnySea

DSH plugin for generative UI: the model writes an interface instead of describing one. Declarative DSL compiled and executed in a DOM-less Worker sandbox, then drawn by the host with native DOM; a sandboxed-frame escape hatch for anything the component in

Windows Computer Use for DeepSeek Harness with 21 tools and verified targeting: controls are addressed through their UI Automation identity and patterns, and numbered marks are checked against the live window before input, so a stale target is refused instead of clicked. A known sequence runs in one computer_batch call, one model round trip; incremental observations, compact receipts (normally no more than about 6 KiB extra), bounded handoff waits (HANDOFF_WAIT_TIMEOUT/HANDOFF_HELD_TIMEOUT as continuations), the desktop-block cycle boundary and a deterministic 100 s owner-scoped leave backstop keep context small and prevent a stuck handoff from waiting out the tool deadline. Approval modes settle an unanswerable ask honestly: in a danger-full-access session with no approval card the action runs under that grant, every other sandbox — and every delegated subagent session — refuses and names the unavailable channel instead of reporting a user rejection, and gate diagnostics land in policy.jsonl. Human handoff, a model-visible stop brake and prebuilt native workers.

An independent approval subagent judges every sandbox escalation, with a configurable model and an audit log.