Plugins

StartLux Decision: a cheap judgement layer for DeepSeek Harness — all nine decision points (tool authorization, model routing, delegation, compaction, turn continuation, retrieval, skill pick, session title, COT translation) are implemented and individual

Expose local listening ports as public HTTPS URLs via Cloudflare Tunnel, with automatic DNS management and one-click token template authorization.

Code security defense review judge for DeepSeek Harness: detects sessions that are writing code, reviews them against the Code Security Defense Architecture Rules, recommends which security architectures the program needs (one or several), checks conflicts between them, teaches the session AI after repeated failures, and teaches the session AI after repeated failures; once you grant it review authority in its panel, it gates task completion until the review passes (without that authorization it only observes).

In-process ChatGPT Codex authorization, model discovery, and quota display for DeepSeek Harness.

PDF translation for DeepSeek Harness through a yiyide.cc connector account: 12 tools covering authorization, upload with page-level pre-flight, a three-page preview, quote, a confirmation that freezes translation points, job polling, quality confirmation, and download of the translated or bilingual PDF to the local machine.

See your real ChatGPT / Codex subscription quota inside DSH. Reads /wham/usage: 5-hour and weekly windows, reset countdown, extra-usage balance, additional limit groups and the code-review limit; lists and redeems server-issued reset credits with a stable, retry-safe idempotency key; switches between multiple accounts; reads /codex/models to show the account's real model catalog, showing empty rather than a built-in list when unavailable. One-click sign-in from Settings (browser authorization or device code, with a paste-the-callback fallback); credentials stay in DSH's credential service. Model calls reuse DSH's built-in llm-pi-ai Codex route instead of claiming a provider route — it degrades to a pure quota console when another plugin owns it. A remaining-quota chip sits beside the composer.

Full-screen ice-and-fire boot intro for DSH: a frost-to-ember boot sequence with typed bilingual logs and a hairline progress line, then Ygritte's five-step identity authorization. Esc skips, Enter or click fast-forwards, and a settings page switches it off/quick/full or replays it; the host half paints the opening frame while the document parses, so the built-in loading card never shows.

OneDev integration for dsh: an MCP server exposing the OneDev REST API as 61 tools — 57 administration tools (users, groups, roles, projects, authorizations, build agents and tokens, builds with streamed build logs, global settings, access tokens), 3 standalone documentation-query tools for docs.onedev.io, and environment discovery with per-call multi-environment routing — plus a dsh Web settings page that manages per-environment credentials locally and applies them on the next tool call without a restart.

Localizes the DeepSeek Harness approval panel in the web client and translates authorization reasons from English to Chinese, with a built-in phrase dictionary first and a model-router fallback for reasons the dictionary does not cover.

Workspace-aware direnv environment injection for DeepSeek Harness, with user-approved .envrc authorization

Deterministic cross-session transcript retrieval: the `recall` tool full-text searches past session logs with cwd-scoped authorization, a CJK substring fallback and a degraded raw-scan; every hit carries the sessionId plus the newest exported-report path, closing the loop with the export and eval plugins.

QQ Mail (and any IMAP/SMTP mailbox) for DeepSeek Harness: registers qqmail_* agent tools that list, search, read, send, reply to, flag and download mail through IMAP/SMTP with a QQ Mail authorization code (no OAuth, no 2FA redirect), plus a `qqmail` CLI a

Provider-neutral account authorization UI for DeepSeek Harness

Verifiable authorization, execution evidence, and offline delivery verification for DeepSeek Harness

Semantic risk grading and progressive authorization: classifies tool calls into safe/risky/redline, asks before irreversible actions, auto-allows only approved-and-succeeded signatures.

WPS / 金山文档 cloud-docs integration for DeepSeek Harness: official SkillHub MCP (https://mcp-center.wps.cn/skill_hub/mcp), custom browser authorization (auth-guide + exchange-poll token), WPS cloud-doc tools under mcp__wps__*, wps_status/wps_oauth_start/wps

Poll Feishu (Lark) group and direct chats through lark-cli, extract candidate tasks with a review workflow, and two-way sync them with the task-board plugin, with a floating browser panel and one-click device-flow authorization.

AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.