Plugins

Query and manage JumpServer through conversation: assets, users, accounts, permissions, sessions, command audit logs, command filters, and RBAC roles, authenticated with an AccessKeyID/AccessKeySecret pair (HTTP Signature).

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

A continuation of simon300000/dsh-auto: the Auto Approve permission preset for the DSH Web UI reviews each approval with one single-shot model call instead of a reviewer subagent, auto-approves only the actions that pass and hands the rest to human approval, and remembers confirmed decisions as project- and global-scope allow/deny lists, with an approval timeline in the right sidebar.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.

Control panel for a local credential-redaction gateway in DeepSeek Harness: gateway and model health, audit metrics, a dry-run leak tester, an exemption whitelist, encrypted key management, credential-protected model entries and deployment controls.

Native DSH right-sidebar tab that lists the ports this machine is listening on together with the process behind each one, and offers per-port actions to open it, copy its address, reveal its working directory or end the process.

Manage Proxmox VE through conversation: 116 read + 116 write tools covering VMs, containers, storage, nodes, clusters, backups and firewalls, with API-token or username/password (ticket) auth.

Collects and redacts DSH runtime diagnostics before filing structured issues in GitHub or Gitea.

Ships a skill plus six Node scripts for a DSH install that will not come up - walking the boot stages before readiness, the plugin dependency bridges and junctions under a profile, dead or duplicated plugin rows, and the upgrade path. The scripts are diagnostics first; the rebuild helper only writes when it is given --fix.

DSH plugin for bounded agent evaluation: compare an original with candidate prompt or supported configuration changes against user-supplied checks, record evidence and costs, and leave adoption to the user.

Self-diagnosing, self-repairing watchdog for DSH plugins: 15s health patrol, version-switch repair with observe window and auto rollback, unknown symptoms escalated to human.

Scaffold DSH local bundles in the dph format from any workspace and keep a pitfall experience library to steer later development.

Runtime-switchable outbound HTTP/SOCKS5 proxy for DSH with a web settings card.

Sound alerts for the DSH web UI: a chime when an answer completes and a three-tone prompt when your approval or question is pending, with optional custom WAV stored only in the local browser (pure client-side, zero assets).

Bridge a Feishu bot to a DSH session: open a real session in a workspace, run tasks with the existing model and plugins, and report results back.

Runs git init in each newly registered DSH workspace, with an empty initial commit by default, so git-aware plugins have a repository to attach to; directories already inside a work tree are skipped.

33 github_* tools covering REST reads, issue writes, Git data writes, private repo creation, and clone; in-process permission gate and cost-discipline companion skill; no gh CLI required.

A right-sidebar Git panel in the IDEA style — local changes with per-file checkbox commits, a commit tree with per-commit details, branch, remote and stash management, push with a credential fallback, all driven by the plain git CLI.

Git integration for DSH modelled on IDEA's VCS: a git icon beside the permission mode in the composer shows the current branch and the pending-change count, opens a branch switcher on hover and an IDEA-style VCS panel on click (branch tree, commit graph, changes and staging, commit detail, file diff), plus a settings page for commit identity, the git binary and the network flags. Registers no model tools with DSH.

Deterministic engineering orchestration runtime for DeepSeek Harness: the orbit_controller tool and OrbitService run Commander, Executor and Smart Watchdog children through PLAN, EXECUTE, EVALUATE, bounded correction and runtime recovery, with durable state in <project>/.cx/state.json.

Automatically orchestrates complex DeepSeek Harness requests. It detects when delegation is useful, builds a dependency-aware plan, assigns bounded researcher, architect, backend, frontend, tester, and documentation workers, collects structured evidence, and sends the results to a final reviewer. The bundle atomically enables the workflow engine and model-facing subagent tools; disabling the plugin disables its complete tool group as well.

Ships a skill about handing work to subagents instead of doing it inline - which tasks are worth fanning out, how many to run at once, how to send them in parallel, and how to check what they returned instead of trusting the summary.

Parse PRDs and PDFs, ask clarifying questions in batches, consolidate a BRIEF.md system brief, and package deliverables for upload.

Skill routing for DeepSeek Harness: embeds skills and each user task with a local model, keeps the clearly-relevant skills with a gap-based selection rule, and auto-injects their full bodies into the prompt.