Plugins

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Watches a turn's thinking and text streams and cancels the turn when the model starts repeating itself.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Puts sessions into the built-in Auto review permission preset: new sessions at creation, existing root sessions when they are restored.

Adds a model-written annotation to DSH escalation approval prompts explaining what the code does, what the model intends, how risky it is and why, and what each choice means, plus a diagnostics page at /dsh-approval/diag.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

Registers a janitor_scan tool that returns a deterministic, reviewable cleanup plan for session debris (plan docs, scratch scripts) with per-file verdicts and evidence; scan-only, never deletes.

Local-only telemetry service for DSH plugins: records operation trails and error events into a storage-domain KV table, redacts configured secret patterns before the write, and groups one plugin's failures by their feature-code anchor.

GitHub issue service for DSH: turns telemetry failure analysis into a uniform issue report, builds the pre-filled new-issue URL, and rewrites a plain description into a structured issue with the configured model.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Staleness keeper for the Codebase Memory knowledge graph: it compares the graph Branch node head_sha with git rev-parse HEAD and reports an exact behindBy, rebuilds only the stale projects through the codebase-memory-mcp CLI so the MCP tool 60-second cap does not apply, watches each project for edits, and mirrors the same state into a settings card and a REST control surface.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Conflict diagnosis and repair for DeepSeek Harness plugins. Builds a capability graph of the running Loader profile and of the on-disk cordis.patch.yml layers, comparing imports, peer ranges and config against the host that is ACTUALLY running rather than the profile's possibly-stale copies, and reports the conflicts that fail silently: a fiber stuck PENDING on a service no plugin provides, a browser half injecting a client module nothing provides, a tool id two plugins both register, duplicate Loader entry ids, a row disabled by one layer and re-inserted by another, an import of a host subpath the running host does not export, and a cycle among inject declarations. Every finding carries its evidence, a confidence grade for who owns a name, and a repair with a risk grade — verify it with a dry-run difference table, or take the individual .patch.yml files that --fix-out writes (never auto-loaded, so picking wrong breaks nothing).

Category-based backup of DeepSeek Harness settings, skills, plugins, sessions and storages into verifiable, restorable and downloadable archives, with optional GitHub sync.

Records the version of the edit target as an observation when the agent inspected the file with bash instead of the read tool, so the filesystem observation policy stops rejecting edits with FS_NOT_OBSERVED. Applies to edits only; blind whole-file overwrites stay guarded.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

One-click full-app restart for the DSH desktop client: a sidebar footer button and a settings section with a live config form (master switch, confirm dialog, delay, target executable). Restart is performed by a detached helper that survives the process-tree kill, then respawns DeepSeek Harness.exe; requests are fenced to loopback same-origin.

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

All-in-One MCP and skill manager with feature-based recognition and native OAuth 2.1 authentication.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.

SSH and JumpServer terminal plugin: real-machine read tools, human-initiated read-write operations, and session management from inside DSH.