Plugins

Adds a reforge control to the DSH composer that rewrites the current draft into a sharper prompt in place, as one undoable edit, with one-click revert and cancellation.

Pinned prompt shortcuts in a single row above the composer — one click replaces the draft with the saved text — plus a searchable panel for pinning, editing and deleting prompts, overflow collapsed into a "More" menu, storage in a Host-side JSON file, and a prompt_shortcuts agent tool that reads and writes the same file.

Adds a sparkle button to the DSH composer that rewrites the current draft into a clearer, more specific prompt with a single tool-free LLM call, then writes the result back into the input.

System-prompt surface drift gate: every section any plugin or preset contributes to the assembled system prompt is hashed and baselined; a silent rewrite of what the model is told fails loud.

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Writes a model-generated annotation into every DSH escalation approval prompt — what the command does, what the model intends, how risky it is and why, and what each choice means — and keeps a searchable history of past approvals at /dsh-approval/history, with a diagnostics page at /dsh-approval/diag.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

Local-only telemetry service for DSH plugins: records operation trails and error events into a storage-domain KV table, applies a configurable redaction rule set before the write and again when the analysis reads back a record stored before a rule existed, and groups one plugin's failures by feature-code anchor, reporting the window it read, the route each group ran on, and the attempts recorded after its last failure in write order.

GitHub issue service for DSH: turns a telemetry failure analysis into a uniform issue report, builds a pre-filled new-issue URL that is shortened when it would exceed a configured length budget, and rewrites a plain description into a structured issue with the deployment's model.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

SSH and JumpServer terminal plugin: real-machine read tools, human-initiated read-write operations, and session management from inside DSH.

Opens the Obsidian vault a DSH session is working in, on the first human message — so your sync plugin (Nutstore sync, Obsidian Sync, Obsidian Git, …) starts running and the files the agent edits actually get synced. Skips a vault that is already open, and opens a new window behind the current one instead of stealing focus. Also serializes writers per vault — a second conversation's write is refused before it runs and queued until the holder is done, so a sync client cannot splice two conversations' edits together. Windows only.

Agent-facing GitHub repository tools: binds an account through a first-run prompt, then clones into the workspace and reads, exact-replaces, commits and pushes files, with writes off by default.

A resident assistant for DeepSeek Harness that is deliberately not another chat box: one floating window plus one standing conversation, both independent of every other session. The heartbeat is held back by four gates — an authority grant, a daily turn budget, quiet hours and a pacing cooldown — and it keeps working across restarts through a lease it has to hold. Each wake is decided by a model that must answer SKIP or a short message, so silence is a decision rather than a failure. The window shows the standing conversation's real message flow, read from the host session store, or from the on-disk session log when the host does not publish that session, and it can send into that conversation directly. den carries the same reach as the person it stands in for, with one limit: read-only. It may read every session, this machine and work channels such as GitHub, but it does not write, send or publish, it never asks anyone for permission, and it never gates another session's tool calls. `npm run digest:github` turns GitHub notifications and your own open pull requests into three Chinese sections — waiting on you, waiting on your review, and yours — with reply drafts that are explicitly marked as unsent.

Answers a hard question with a one-page visual HTML explainer: the model writes a short Markdown draft and the bundled dependency-free `am` CLI builds the layout, CSS and diagram coordinates. Vendors the upstream answer-me-with-html skill verbatim as a skill-only DSH bundle with no Host code.

Write and read Markdown notes: switch between reading, editing and side-by-side preview, with an outline, three preview themes, math and Mermaid, nested folders, and autosave to local .md files.

Turns a streaming assistant reply into short blips, one per character at a configurable minimum spacing, for the reply text only, and keeps sounding when the window is minimized, covered, or in a background tab. Two built-in voices, or a custom one shaped by waveform, or loaded from an audio file.

Panel for MCP servers registered by @deepseek-ai/dsh-mcp-client: toggle each server on or off with live effect, see the registered tool count and estimated context-token cost of each server, and persist the choice to the home cordis.patch.yml with a timestamped backup before every write. The panel itself can sit either as a page inside Settings or as an icon row in the left sidebar, one seat at a time, with the switcher on the plugin page in Settings. Maintained fork of dsh-mcp-toggle.

Turn-level file undo for tool writes and edits: each file is snapshotted before the write lands, and the model (an undo tool), the human (a /undo command) or a button in the assistant message action row can roll back every file a turn changed. Snapshots are written in-process rather than by shelling out, so it needs no extra sandbox permission in sessions confined to workspace-write.

AList v3 file management: browse, search, upload (streamed and multipart), offline downloads, archive listing, task polling and control, plus admin tools for storages, users, roles, meta rules, settings, search index, shares and labels - 75 tools in total; every write goes through the approval flow and passwords are never read back.

Manage Postman cloud collections from dsh with 9 tools — list, browse, add one or many requests, edit and delete them, and export or overwrite a whole collection.