Plugins

Appends a tiny ice marker to the end of every sentence the model writes, chain of thought included, and plays a short synthesized sound for each one.

It logs how you talk to your AI — the 7th "final version" gets a bold red page, a late-night rewrite request gets underlined, a "thanks" earns a gold star, and a post-AGI verdict decides your fate. All local, rule-based, bilingual.

Adds a draggable lucky-block button to the DeepSeek Harness web UI. Single-click plays zero-cost little performances (popups, a fake blue screen, daily fortune, trivia, cold jokes, music, and a set of visual stunts); a 1.4-second long-press mines the block open and starts a new session to write a random paper, read the news, invent something, or spin a short story. It also appends a "lucky block" choice to the model's multiple-choice questions and rolls a random pick, reversible by saying "rollback". Block appearance and event weights are adjustable in settings.

Writes short plain-Chinese notes for installed dshmarket plugins that have none and shows them on the market cards; hand-written notes are left alone (only entries marked 🤖 may be regenerated with force=ai), and dshmarket is required.

A deliberately small phone remote for a running desktop DSH: allowlisted session read/write, message send and permission approval, host-rendered pages with no build step, QR pairing, and tunnel-URL recovery.

Plain-language trust dashboard for the dsh trust family: aggregates the nine channels (injection interception, write denials, egress blocks, custody-chain verification, tool-surface and prompt drift, leftover scans, forgotten compaction constraints, profile composition) into one right-sidebar panel with a single status light and event cards that translate engine jargon into sentences a non-security user can act on; the read and egress engines run from the package's own npm dependencies so those channels work even without the sibling plugins, and absent plugins simply show as not installed.

Pre-execution guard: a `tools.guard` predicate decides allow, ask or refuse per permission preset for dangerous shell commands (git hook bypass, catastrophic `rm`, download-and-run, git history rewrites) and for edits to credential paths or to files the turn never read, and hands the model the reason plus a working alternative.

Rewrites the model-visible copy of system, developer, user, assistant and tool messages into stable HMAC placeholders before a request leaves the machine, while local session logs, the chat transcript and restored tool calls keep real values.

Restrict the file access of agents in any sandbox mode (read-only / workspace-write / danger-full-access / auto) to the session workspace, and ask the user to rule on cross-border access. Each session can also use the gear selection box next to the composer to relax the cross-border gate to 「 read-only outside workspace 」 or 「 fully release 」.

Client-side performance HUD and always-on recorder for DeepSeek Harness: FPS and worst frame, long tasks with four-leg attribution (React fiber / subtree / DOM writes / scheduler), per-plugin callback rate and sync time, DOM growth and writers, JS heap, host event loop and link RTT, plus a night-watch recorder that keeps the worst stalls and exports incident packs for replay.

Moves a DSH profile to another machine with its plugins, not only its files: packs the plugin bundle selection and the whole settings layer into one JSON file, then on restore writes the configuration back, restores local plugin sources and plugin-owned data, and installs the plugin bundles the backup recorded that the new machine is missing (plugin manager first, pnpm as a fallback).

Injects a very short conventions reminder (absolute INDEX path + version) once per session per version; when the conventions version changes, the next turn re-injects it (chat turns included). Optional hard guard: on operation-like turns, write/edit tools are rejected until the session has read the index (chat turns and shell are not blocked by default). Ships example checklists or points at your own directory; zero dependencies, configurable paths. Solves: conventions are written down but never pulled up when the work starts.

Arms a watch on a directory and delivers a batched, deduplicated diff when the tree goes quiet, filtering out the writes the session made itself; delivery is per watch, either waking a new turn or queueing for the next step.

Shows what each installed skill costs in the model context and hides a skill from the catalog without deleting it. Lists every skill found on disk with the exact catalog line the model receives (description normalized and truncated at the catalog cap), its body size and token estimate; previews the catalog message byte-for-byte as the agent will receive it, compares that with the copy already published in the current session, and reports skills on disk that never reach the catalog (invalid frontmatter, or shadowed by a higher-priority root). Hiding writes disable-model-invocation into frontmatter and keeps the file, so the skill still works via /name. Also imports skills from ClawHub, Skills.sh and GitHub URLs and uninstalls user-owned ones.

Agent skills: browse, toggle and edit skills in the management page, and let the agent write new ones itself.

Reads and writes WPS 365 cloud documents (smart documents and .docx/.xlsx/.pptx) through the locally installed wps365-cli, with conflict checks before writing; requires a WPS 365 enterprise account.

DocChain knowledge base, document conversion and knowledge-graph toolkit — filename, content and metadata search, locate-by-doc_id/name with content reading, topic listing, bulk document upload, document-to-Markdown conversion, image-similarity search, per-document image descriptions saved to a sidecar markdown (flowcharts and architecture diagrams are turned into PlantUML sketches, other images into text descriptions; the original image is replaced by a clickable link), a deep-research workflow, and a knowledge-graph layer (ontology inspection, read-only Cypher, ontology/entity/relation writes). Every script-backed capability also ships as a native DSH tool executed in-process: doc search, content search, filename search, topic info, metadata search, upload, image search, image describe, doc2markdown, plus kg schema / kg cypher / kg upsert node / kg upsert relation / kg delete node / kg delete relation. All graph operations go through the DocChain API, so no Neo4j password is needed. The configuration page keeps several docchain environments (each with its own address and credential), switches between them in one click, and pre-selects topics per environment. Needs a docchain service URL and API key (except doc2markdown); image descriptions additionally need an OpenAI-compatible multimodal endpoint (defaults to an internal gateway model, configurable).

Prose review for human-facing writes. The write and edit tools require a human_facing flag; the plugin reviews the text against layered PROSE.md rules in the background, stages annotations, reconciles them against the full file, and merges them through /humanize, /humanize-loop or post-compaction while the main session keeps working. /humanize-review runs a batch over git-tracked files on demand.

Write, check, and publish a Chinese Quarto Book: nine-step chapter writing, structure/link/figure checks, a consistent theme, and render acceptance. Loads only in type: book repositories; requires Quarto CLI and Python 3.

Adds a logon autostart switch for the DeepSeek Harness desktop app on Windows. It manages a single shortcut in the user Startup folder: no registry writes, no admin rights, no extra background process.

Per-workspace closet for temporary scripts and their run logs, kept in a .dsh-fix directory inside each project. Registers a script with its language and purpose, scans a project for leftover scratch scripts, backups and log files, runs registered scripts with a timeout and writes each run to a timestamped log, and sweeps chosen files into a reversible trash with per-batch restore. Scanning only lists and never deletes; cleanup moves files instead of deleting them; files already tracked by git are refused unless forced. Ships 7 agent tools and a settings panel.

Diverts operation-script writes out of the workspace into a per-session scratch root and collects each one into an inspectable vault outside the workspace, so the workspace holds only real deliverables.

Prompt enhancement: click the star button in the composer to have the current model rewrite the draft more clearly, with one click back to the original; the template is editable.

Adds extra working directories to a workspace, each read-write or read-only, from a folder button next to the composer or the `/add-dir`, `/remove-dir` and `/dirs` commands; the model sees them in its runtime context, and `write` and `edit` calls into read-write directories skip the sandbox escalation prompt by default while shell commands still ask.