Plugins

Filesystem permissions for shell calls, granted per path and capability rather than per command name. The command line is parsed for the read, write, create, delete and execute effects it needs, a capability it lacks raises the approval card instead of a flat refusal, and the same rules are compiled into the macOS Seatbelt profile the process, its children and the code its arguments never showed all run under. An Approvals tab in the conversation reads the audit log back and shows which rule, automatic reviewer or person answered each call.

Voice or sound cue when a turn finishes and a failure cue when a tool call or turn errors; user aborts stay silent and subagent sessions are skipped by default. Three modes: voice (Volcengine TTS with cloned or preset voices, fingerprint reuse so unchanged text is not re-synthesised), effects (20 built-in sounds assignable to done, fail and approval, with per-row preview and no API key; the approval slot has no automatic trigger, so it plays only manually) and off. Plays through winmm without touching system volume. Windows only. Adapts DSH kernel 0.2.2-rc.1.

Kinich and Ajaw theme for DeepSeek Harness Web with three visual styles, session-state feedback, companion interactions, and configurable ambient effects.

Insurance product comparison & proposal expert — clause analysis, cost-effectiveness, coverage planning, generates verifiable client-facing PDF proposals.

Approval sound effects from the movie NiuLai: plays 「妈妈」 when user confirmation is requested, interrupts it and plays 「牛来！」 the moment the user approves; native Windows playback, zero external dependencies.

Conversation node appearance for the DeepSeek Harness web GUI: configurable per-category and per-tool colors (left accent bar + tinted background), plus a show-thinking toggle; pure frontend rendering, takes effect instantly and persists to the DSH user settings file.

Sprite-sheet workspace on an infinite canvas: slice by grid, row scan or alpha connectivity, matte solid-color backgrounds, compose characters from a 1066-item Liberated Pixel Cup material library, generate seamless backgrounds and 12 procedural effects, then export ZIP or an atlas with Aseprite-format JSON. The LPC character parts are fetched on demand from raw.githubusercontent.com (LiberatedPixelCup), so GitHub must be reachable.

Adds Blue Archive style click and touch effects plus a cursor trail to the DSH Web GUI, with theme color, scale, opacity, glow, speed and on/off switches on a Click FX page in Settings.

DSH SMOOTH: config-only bundle for a lighter DSH UI - compact transcript and usage views, 16 px font and 200 ms job polling out of the box - plus a troubleshooting SKILL.md and opt-in recipes (appended by hand to your own cordis.patch.yml or the profile) to remove the Agents-Anywhere "Reconnect" button, slim the tool list, drop legacy sub-agent bundles and make compaction thresholds take effect. User patches still win; rollback = remove the bundle.

Beelli X UI brings searchable settings to DSH NEXT on Windows. Appearance groups themes, skins, fonts, pets, and effects, while Models has its own page. Use images or MP4 wallpaper, adjust frosted panels, and save skin presets. Switch between pets and upload default and extra animations for each one. Preview, time, or skip MP4 and GIF startup animations. Add model connections from provider presets or a custom endpoint, fetch and select models, or enter model IDs manually. You can also restore or bulk-delete archived chats by workspace and switch or add plugin catalogs on the same page. Replaces the built-in Settings page and sidebar (disables ui-settings-general and ui-sidebar); run only one plugin that takes them over.

A resident bottom-right widget for the DeepSeek Harness Web UI: a sword-cultivator character that reads your account balance and token spend, keeps a local ledger broken down by model, and has 10 switchable sound effects. Reminders cover low balance, a model waiting on your answer, a pending approval, and staying up too late. Ships 23 idle poses plus a 24-frame sword dance, 22 menu-icon skins, six panel tabs, a line-by-line speech-bubble editor, and black or white robes that follow the light or dark theme. Runs entirely locally and registers no agent tools.

Drives a plugin page in the running DeepSeek Harness UI — opens the panel, reads real DOM and computed styles, clicks, types, waits for async effects, collects console errors, then returns to the original conversation.

Adds an Agent docs tab to the conversation view: it lists the AGENTS.md and CLAUDE.md instruction files DSH actually loads for the current session (the ~/.dsh and ~/.agents roots, plus every directory from the project root to the working directory), previews each as Markdown with per-file sizes and the 64 KiB instruction budget, edits and saves them in place after a sha256 version check, and opens the workspace folder from the path button; a saved file takes effect on the next message.

Registers one tool, report_health, that answers whether a scheduled report job actually ran. It judges by side effects rather than exit codes: how old the newest report folder is, how many documents it holds, whether more than one report category is present, whether the audit ledger was synced recently, and how long ago the last log was written. Exits nothing, calls no model, and reads only local paths you can override by config or environment variable.

One-step local model onboarding plus a light harness for DSH. On load it probes loopback and private-network inference endpoints (llama.cpp, Ollama, vLLM, LM Studio), reads each model's context window and output budget from the backend, and registers the provider through settings, so a local model becomes selectable without hand-writing config. It then trims only that provider: masks the tool list through tools.restrict, drops named system-prompt sections and memory contexts, swaps the injected instruction block for a short one while preserving its first 80 and last 96 characters, and truncates tool-schema descriptions without touching structure or required fields. Cloud providers are returned as the same assembly object, untouched. The injected block is re-read from disk on every assembly, so editing the file takes effect on the next request with no reload. The panel in the plugin detail page is a live operations view: it shows whether the takeover is active and by which hook, how many characters the last assembly was trimmed from and to, and which providers are online (probed concurrently, with a real one-shot completion reporting latency and reply text per provider). If a local backend is not running, the panel offers a one-click launch: it probes the port first (never starting a duplicate), then starts the matching server (ollama serve, or a custom command you supply) detached and polls until the endpoint answers, clamping the wait to 3-600 seconds, reaping the child it just spawned if it never answers, and naming the paths it searched when it cannot find the binary. A stop button kills backends this plugin started (SIGTERM, then SIGKILL) and refuses to touch a server somebody else launched. When a model has just been downloaded and no backend exists yet, the panel can also scan the machine for .gguf files with hard caps (300 models, 20000 directory entries, Downloads only one level deep), start llama-server on the chosen one (skipping the .mmproj. vision projection and reusing a server that already answers), register the provider under the model id the backend reports, and run one real completion to prove it works. Before spawning anything it does a fit check that counts only the part of the file the GPU cannot hold: hostBytes = fileSize - VRAM, compared against max(total RAM - 2GB, free RAM). A file far larger than RAM is refused outright; a heavy host-side remainder is refused unless you confirm; the same remainder under mmap is only a warning, because the weights land in reclaimable page cache. A load-mode selector (auto / mmap / none / mlock / mmap+mlock) maps to llama.cpp --load-mode, and the default is whatever the engine picks. From 0.4.2 everything above is derived from the platform instead of assumed: home and data directories come from os.homedir() and the OS conventions (LOCALAPPDATA on Windows, ~/Library/Application Support on macOS, XDG_DATA_HOME elsewhere); backend binaries are looked up in the official install locations of each OS and can be pinned with OLLAMA_BIN, LLAMA_SERVER_BIN, VLLM_BIN or LMSTUDIO_BIN; model discovery walks DSH_LOCAL_MODELS_DIR, ~/models, ~/llama.cpp/models, ~/.cache/llama.cpp and the LM Studio data directory, with the WorkBuddy layout demoted to one candidate among them. VRAM is asked from nvidia-smi, then rocm-smi, then sysctl hw.memsize on Apple Silicon (flagged unified, so the same bytes are not charged twice), and any flip to a unified-memory budget is handled explicitly. Before building a command line the plugin runs llama-server --help once and keeps only the flags that build actually has, so older engines get --n-gpu-layers 99 and no KV quantization while newer ones get auto plus q8_0; anything it cannot probe is passed through rather than dropped. LM Studio is started with lms server start --port N rather than being lumped in with the engines that need a model argument, and vLLM gets its own --model example instead of llama.cpp syntax. Windows, macOS and Linux are all exercised in CI, including a windows-latest and a macos-latest job, because a cross-platform claim that has only ever run on one OS is not a claim. Two of those suites exist specifically to catch this machine's blind spots: one replays the whole suite with process.platform rewritten to each OS, and one deletes every advantage this development box has — no nvidia-smi, no rocm-smi, no sysctl, an empty PATH, a home directory with no models — and requires graceful degradation rather than a crash. That last one caught a real class of bug: several assertions hardcoded 'lms.exe', which cannot pass where the executable has no suffix. Measured on the reference machine: a 16.9GB 27.2B MoE with 14.5GB of VRAM holds a 285-691MB working set and sustains 76 tok/s after a 1000-2000 token warm-up, so file size alone is not a fit signal. From 0.4.3 the scanned models are shown as a table rather than a dropdown (one row per gguf, with its size and any fit warning), so you can see what is on disk before choosing. From 0.4.4 the delete button on the provider table removes the provider entry, not the weights file on disk. That distinction matters: what people actually want to clear out is the dead entry - one pointing at a port that never answered, one registered twice for the same port, one whose model file was deleted long ago - not a 15.8GB gguf. Deleting a config is undone by importing again; deleting a gguf is not. The removal goes through settings.mutate with an unset op on \['providers', id], because update merges layers: writing null there leaves a null provider key that the loader reads as a broken config rather than an absent entry, and only mutate/unset is implemented as Reflect.deleteProperty. The result is read back afterwards, because unset on a key that comes from a lower layer (the profile cordis.patch.yml or a home patch) does not delete it - it restores the inherited value, so the call succeeds while the entry stays. When the entry is still there the panel says so and points at the file to edit instead of reporting success, and a DSH whose settings service predates mutate() is told plainly rather than silently ignored. Deleting takes two clicks and clearing the confirmation is as easy as clicking another row; on success the online and baseURL caches are cleared and the tool surface is recomputed, since the provider list changed. The gguf itself is never touched by this plugin - the scanned-model table is display and selection only.VRAM reporting is driver-dependent. From 0.4.5 model discovery also reads Ollama's own storage: its blobs are named sha256-… with no extension, so extension matching could never list them. Weights are now accepted by extension OR by GGUF magic header (only dot-free files of at least 8MB, capped at 600 header reads per scan; obviously-not-weights extensions like .json/.md/.safetensors/.part are never opened). Ollama models are resolved from their manifests: the model layer is picked by mediaType application/vnd.ollama.image.model (never adapter/mmproj layers), the human-readable name is restored from the manifest path (…/qwen3/8b becomes qwen3:8b, …/latest stays bare), tags sharing one blob merge into a single row, and the metadata kv supplies name, quantization and context length. Adopting an Ollama model does not start a duplicate llama-server over the same weights: it confirms ollama serve answers on 11434 (launching it if not) and registers the provider under the tag the endpoint itself reports — the blob's sha256 name would never match anything, since 11434 lists qwen3:14b, not sha256-a8cc…. Two real-machine-only traps fixed on the way: existsSync('<file>/') returns true on Windows, so manifest-vs-directory branching now goes by parseable content instead of trailing-slash semantics; and the quantization label table had been copied from a stale ggml enum generation, labelling ggml_type 15 as Q5_K_S while ollama show reports Q4_K_M. Same-blob dedup is by (dev,ino), keeping whichever entry has a name. Verified on the reference machine: the scan goes from 1 row to 4 — qwen3:14b (8.64G) and qwen3:8b (4.87G) now appear with Q4_K_M badges — in 4ms; npm run verify exits 0 (launcher 57, portable 35, panel-host green including the linux/darwin simulated-platform runs); the new panel-host suite builds a real miniature Ollama store in tmpdir and points OLLAMA_MODELS at it, so results no longer depend on whether the test machine happens to have Ollama installed. From 0.4.6 the panel shows each model its real name instead of its file name, because some download tooling stores every weight under one generic file name, leaving the real name only inside the GGUF header. The scan now reads each file GGUF KV section - not a fixed-size head buffer, because tokenizer.ggml.tokens (hundreds of thousands of strings on a large MoE model) and the chat template push general.file_type past any window; and GGUF string arrays are interleaved (u64 length plus payload per element), so treating them as a length table walks the cursor off the rails and produces astronomically large reads. Reading and skipping are accounted separately: key names and types are always read, string values over 256KB and string arrays are only walked past without copying, non-string arrays over 64 elements are skipped outright, and a cursor past the file size stops the read, because an out-of-range position means the cursor is wrong rather than that a limit should be raised. The displayed name goes Ollama tag, then general.basename plus size_label, then general.name, then the file name, with the full string kept for the hover text since it usually carries internal build numbers; mmproj files are now identified by general.type as well as by name. A short read (truncated file) no longer feeds half a value into the parser. On the reference machine, reading one file header parses 44 keys in about 16ms, and a whole scan takes about 31ms. From 0.4.7 the smoke test no longer fails the first time and passes the second. The old code gave both request attempts one shared AbortController and one shared 30-second timer, so the total budget covered both rounds: a cold load of a large model burned it in round one, the abort left the signal permanently aborted, and the second round (the Ollama-style reasoning_effort: none retry) could not even be sent - which is exactly why the first click returned This operation was aborted and the second succeeded. Now each attempt gets its own controller and timer, a timeout retries once automatically (retryOnTimeout, on by default) because a first-request timeout almost always means the weights are still being read from disk, and non-timeout errors (refused connection, HTTP error) are not retried at all. Timeouts report themselves: the message says the wait exceeded smokeTimeout, whether a retry already happened, and points at the new smokeTimeout setting (seconds, default 60, clamped to 5-600) - port responding is not the same as tokens coming out, so it is a separate knob from launchTimeout. Unrelated: an example naming one specific model was dropped from the panel copy, since not every machine has that model downloaded, and the explanation now describes the mechanism instead. From 0.4.8 adopting a plain .gguf no longer registers an unrelated Ollama model. The port field used to follow the last click rather than the file: selecting an Ollama entry moved it to 11434, selecting a plain .gguf did not move it back, so a 11434 left over from an earlier click stayed. The server accepted it as given, probed the port, found Ollama answering and borrowed it (the skipped-launch log line about the port already answering is this path), and then the model id - derived from the file name - could not be matched against Ollama's /v1/models, where the fallback was to grab the first entry in the list. Embedding models tend to sort first, so the adopt registered a model the user never selected. Now the port follows the file: a plain .gguf landing on another engine's port (ollama 11434, vLLM 8000, LM Studio 1234) is moved to 8090 and the panel says so. Only ports belonging to a known engine are overridden - a hand-typed 9999 aimed at your own llama-server is left alone. The model-id fallback no longer guesses either: it takes the only entry when there is exactly one (a single-model backend may legitimately report a different id than the file name) and otherwise reports an error listing the ids it did see, rather than registering a wrong provider. From 0.4.9 the panel can no longer vanish. It used to be possible for the whole section to disappear from the plugin detail page while the host stayed up, the HTTP bridge kept answering, and no crash log appeared. The cause was a scope error: a helper was declared inside one component and referenced from another, which is valid JavaScript and passes a syntax check, so it only threw at render time - when the user pressed the scan button and React ran the state updater. The host wraps every slot entry in an error boundary whose fallback is an empty anchor, so the throw was contained silently: the panel was not uninstalled or crashed, it was replaced by an empty div. The helpers now live in the module scope both components share. The client half also gained its own test - a minimal React stand-in loads the real panel module, really calls the components, really runs the state updater at render time, and presses the scan button, so this class of error can no longer reach a release.

Adds a capability panel to the DSH web GUI: browse, install (upload, zip, host path or URL), enable, edit and export skills, and add or edit Claude Code-compatible MCP servers, at global and per-project scope — with project copies, per-project shadow stubs, live mount status and a zero-side-effect connection probe. A session view toggles capabilities for the current conversation only, and a TypeSafe Jev tab scores skills and MCP servers for the session from the input draft. Requires the dsh web shell 0.2.0-rc.2 or later. Forked from chengdb/dsh-plugin-capability-panel; it shares a patch id with that plugin and with pure-craft/dsh-capability-panel, so do not install them together.

Anime theme for DeepSeek Harness: full-screen wallpaper, glassmorphism panels, six color themes, video wallpaper, particle effects, and a random corner sticker.

Composer pill with the DeepSeek account balance, the live peak/off-peak pricing phase, and this session's spend priced request by request at the rate in effect when each request was sent. Subagent sessions' costs are aggregated into the parent session; Search and Fetch fees are charged only for DeepSeek's search engine, while third-party engines (Tavily, Bing, Exa, …) are counted but free. The balance refresh interval is configurable.

Make development more fun. A subtle layer of motion for DeepSeek Harness, with customizable effects and reduced-motion support.

Keeps the DSH desktop window the size you left it: records the last outer frame of the main window in physical pixels and restores it, centred on the work area, on the next start - and it acts before the window is ever shown, so the boot animation plays at the right size. The settings page offers 12 presets (1024x768 to 3840x2160), free-form custom width and height, a centre-on-restore switch and an apply-now action; a choice takes effect immediately and persists. Resizing goes through a small helper executable compiled on the user's own machine: the C# source ships inside the plugin, is built on first run with the in-box Windows csc.exe (measured ~110 ms once, cached next to the state file, ~90 ms to start), and falls back to a short-lived powershell.exe process when that is not possible. The package ships no binary, declares no npm dependencies and makes no outbound network request. Windows only.

Tired of going fullscreen by hand every time you open Harness? This plugin fills the screen for you - auto-maximize (keeps the window buttons) or true fullscreen on launch, then maximize / restore / minimize / always-on-top anytime. It quits only after a native confirmation dialog - Esc, double Esc, or Ctrl+Q; in fullscreen, Esc leaves fullscreen first. The window channel installs itself, so no script or Python is needed; the first install takes effect after two DSH restarts.

Drops a bowl of white rice from the top of the DSH window for every N tokens you spend; the bowls fall and bounce under gravity, can be dragged and thrown, and a vortex button (with a sound effect) inhales them all — or just the one you drop on it. Threshold, bowl size, on-screen cap, auto-righting and artwork are adjustable in an in-app panel.

Session cost in rubles in the composer dock — the tariff in effect with its countdown, the API cost at that tariff, the CBR rate, the total including subagents, cache savings, and DeepSeek Platform balances.