Plugins

Standalone QQ-bot extension pack for DeepSeek Harness — fully independent, no other plugin required. Two-layer SQLite memory with hippocampal recall, a persona that keeps learning from daily chats, group tiers, local-model quick replies with a single-brain arbiter, TTS outbox, sticker library, an approval-gated video studio, and a four-form desktop pet (three custom characters plus the stock fish) playable over a public invite link with access-code login, single seat and brute-force protection. Chat bridging is deny-by-default: c2c/group access defaults to a care mode that only responds to the special-cared people and groups of the owner (shared with the persona system, zero extra config); allowlist, open and disabled modes remain available. Requires QQBOT_APPID and QQBOT_SECRET, and Node.js 22.5 or newer.

Telegram, Discord, Slack, Mattermost, Zulip and Matrix channels in one plugin, with per-conversation sessions that survive restarts, a Settings page that adds, tests and saves channels without YAML, and a fail-closed allowlist that rejects every sender until one is configured.

A deliberately small phone remote for a running desktop DSH: allowlisted session read/write, message send and permission approval, host-rendered pages with no build step, QR pairing, and tunnel-URL recovery.

Union IM bridge for DSH — an independent implementation uniting the capability sets of community peer plugins (xmanrui/dsh-im, MichengAI/dsh-im-connect). Drive your agent session from 15 channel adapters across 12 platforms (including email; WeCom/DingTalk/QQ each contribute two: bot + self-built app or notify tier) — WeChat (official iLink QR bind), Feishu/Lark (long-connection + streaming cards; the voice tier requires system ffmpeg), Telegram, Discord, WeCom intelligent bot & self-built app (signed callback), DingTalk (stream + AI Card and custom-robot notify), QQ official bot (plus notify tier), Slack (Socket Mode), WhatsApp (Baileys QR pairing; the dependency ships as an optionalDependency of the plugin package), Matrix, iMessage (macOS only), Email (IMAP/SMTP thread routing). The cross-version narrow waist auto-adapts settings gen1/gen2/gen3 across hosts 0.1.2-rc.1→0.2.1-rc.2 (12-tag enum; rc.2 verified by a real desktop-profile install with double read-back) using capability probing only, never version branches. In chat: a 25-command panel, tool-approval and question loops answered in the originating chat (deny-by-default, initiator-only, 5-min expiry), image/file input gated on host model metadata, deliverable file return, a delivery log with bounded retry (uncertain is never re-sent), proactive delivery and fragment composition. It also splits the native sidebar into self-owned Tasks / Channels tabs (standing down entirely when another plugin already owns the slot), registers an `im-concise` agent preset plus reply sanitisation that keeps GenUI fences and raw HTML out of text-only chats, renders `svg` fences to PNG images, guards model choice with an allowlist, and mirrors each turn's final answer to notify channels via `/relay` (addressed by account ID or alias, never guessed on ambiguity). Secrets are one-way into the vault and never echoed back. npm: `dsh-im-union`.

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Persistent WeChat bridge for DSH: one WeChat user maps to one persistent agent session via the official iLink channel, with context and the user-to-session registry surviving restarts. There is no sender allowlist — anyone who can message the paired WeChat account can start a conversation with a session that has tool access, and the working directory defaults to the home directory; use a dedicated account and set WECHAT_PERSISTENT_CWD.

Approval-free writes into whitelisted directories — wraps the filesystem fence for write/edit tools and auto-answers bash sandbox escalations that touch whitelisted paths, with a settings GUI.

Visual web settings panel for the official @tencent-connect/dsh-qqbot plugin: manage the QQ Bot AppID/AppSecret, c2c & group access modes/allowlists, cwd and requireMention directly in the DSH web settings page (reads/writes the qqbot profile's cordis.pat

IP/domain allowlist web_fetch provider for DeepSeek Harness: lets web_fetch reach allowlisted hosts/IPs freely (incl. proxy fake-IP addresses like 198.18.x.x) while keeping the default public-IP safety check for everything else.

Continue an existing PC DSH session from WeChat: polls WeChat iLink messages, injects into a running session via followup or resumes a closed one, and sends the reply back. Supports /会话 to list/bind sessions and /新会话 to unbind. Requires the wechat-acp daemon; only allowlisted WeChat senders are handled (empty allowlist denies everyone).

Auto-approval agent for DSH permission requests: rule layer (denyAlways/allowlist) plus Hermes Pro semantic adjudication with quick-fail retries, fail-closed to human when Hermes is unavailable, rejection feedback returned to the requesting session, and approve tasks enqueued into the task queue with a shared busy mutex.

Source-filtered HTTP/SSE/WebSocket gateway for using the DSH Web UI behind an authenticated reverse proxy, with loopback trust adaptation, in-app host directory selection, and an allowlisted health endpoint.

Configurable non-public address allowlists for DeepSeek Harness web_fetch

Windows process-tree reconciler for the DSH host: samples the host process tree and the job ledger, attributes each process to the job that created it, flags unattributed and orphaned processes with a confidence level, and offers guarded termination of a whole tree. Termination is refused unless the target belongs to the DSH host tree, is re-sampled and re-checked immediately before the kill (creation time included), and contains no protected descendant, so an allowlisted PID cannot widen the kill scope.

Egress policy for DeepSeek Harness: a host allowlist on web_fetch and web_search enforced at connect time, audit-mode by default, with OCSF Network Activity records

dsh-shell for DeepSeek Harness: runs cmd / PowerShell commands on Windows (and bash-like shells on POSIX) with a bash-inspired safety model — timeouts, output truncation, exit codes, background jobs and a cwd allowlist

Injects allowlisted GitHub Actions and GitLab CI run metadata into agent context without reading logs, credentials, or provider APIs.

Advanced memoria tools: session context injection (profile + recall), recent decisions, health report, namespace allowlist, memory relation graph, and entity search; companion to dsh-memoria.