Plugins

Turns the right edge of the chat scroll area into a theremin-style strip: the vertical mouse position picks the pitch (higher up, higher note), and blue ticks mark your own messages so you can click one to jump to it. Includes a draggable on/off pill and volume slider.

A piano keyboard in the DeepSeek Harness UI: click a key to play it, or hold and drag sideways for a glissando across the keys. Notes are synthesized live with Web Audio — no samples, no network, no third-party dependencies — and the volume and starting octave are remembered between sessions.

Two games inside DeepSeek Harness where the model supplies intent and a local engine owns the rules: a twin-brain snake that periodically draws a strategy card, and Chinese chess where the model only comments on a move picked from locally generated legal candidates. Both keep running when the model is slow, offline or out of quota.

Adds a checkbox-style switch at the right end of the Installed group header on the DSH Plugins page: it opens a checklist of the unofficial plugins, all checked by default, and toggles only the ones you keep checked. Once everything is off the button flips to enabling them again. Disable/enable only — it never uninstalls a plugin or deletes plugin files and configuration, and its UI copy follows the app language.

Exports the plugin profile together with selected $DSH_HOME files and browser localStorage into one JSON, imports it back after a per-file preview, and can run pnpm install to reinstall the listed plugins; the format is interchangeable with the dsh-market profile backup.

Agent2Agent (A2A) protocol bridge: serves an A2A endpoint with agent card, message/send, message/stream SSE, task lifecycle (get/cancel/resubscribe) and input-required continuation; a2a_discover/a2a_send/a2a_task_status/a2a_cancel tools for calling remote agents; plus a web ops panel with live task board, one-click cancel and a remote agent directory.

Control Proxmox VE virtual machines from the conversation: 16 tools for the VM console over VNC (screenshots, mouse, keyboard, batched actions, Unicode text and clipboard) and for running commands and reading or writing files through the QEMU guest agent, all over one ssh connection to the node, so the host needs no X11 or Wayland.

Connects the DeepSeek Harness agent running on your own computer to the HarnessMate platform, so you can chat with it, exchange files and approve its tool calls from a phone or a browser.

Connects the DSHM Android client to computer-hosted DeepSeek Harness sessions for remote chat, model switching, and approvals with device pairing and revocation.

Adds a local phone pairing, gateway control, and diagnostic panel for Pocket Bridge in DSH Settings.

Launch Android apps on a virtual display and drive them with screen reading, taps and swipes, leaving the main screen untouched.

iOS remote companion for DSH Desktop 0.2.0-rc.2 on macOS Apple Silicon, with pairing, approval notifications, and device revocation.

OpenAI-compatible HTTP endpoint for DSH sessions plus a phone panel that reads transcripts, browses files, sends or queues messages, and answers approvals and questions.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

System-prompt surface drift gate: every section any plugin or preset contributes to the assembled system prompt is hashed and baselined; a silent rewrite of what the model is told fails loud.

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.

Tool-surface snapshot and drift gate: baselines the full visible tool registry (name/description/parameters, MCP tools included) into a committable JSON file and warns loudly when an upgrade adds, removes or reshapes a tool.

Hermetic composition lock: fingerprints the profile's dependencies, bundle order, lockfile and patch layer; booting a drifted composition warns, or fails under strict mode (the --frozen posture for CI).

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Watches a turn's thinking and output streams and cancels the turn when the model starts repeating itself. Four detectors: a verbatim cycle, a counting loop whose lines differ only by a number, repeated lines separated by other text, and a user-supplied phrase list. A catch raises a manual-dismiss alarm card in the global overlay with an optional tone, and a Monitor tab holds the switches, thresholds and hit history. Detection is local string comparison with no model calls, so it costs no tokens.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.