Plugins

Cross-device conversation and task sync for DSH: one machine generates a relay station and the others join with its invite link; every frame is end-to-end encrypted, so the relay routes a hashed channel it cannot read. Peers read each other's full transcripts and task boards, interject into a turn that is running on the owning machine, send a work command that runs in a workspace of the target machine with the model strength chosen by the sender, and can copy a conversation into a new local session and keep working on it here. Ships a token-gated phone page for listing devices, reading tasks and sending a command.

Prove that a local image edit left every pixel outside its mask untouched. Original, generated and mask PNGs go in; a greppable `MASK_PIXEL_LOCK=PASS|FAIL|EMPTY` verdict, a difference heatmap, per-channel statistics, a bounding box and the largest changed pixels come out, plus a self-contained HTML report and `report.json` with a SHA-256 file hash, a canonical protected-pixel digest and a proof digest binding both to the policy. Supports edit and lock mask polarities, a mask threshold, tolerance and alpha-ignoring; PNG color types 0/2/3/4/6, bit depths 1-16, all five filters and Adam7. Zero dependencies, local only — no model call, no network, no upload.

Keeps a local sticker dictionary keyed by content hash so an image already described is recalled instead of re-read, and splits a GIF into evenly sampled frames laid out as one contact sheet so the whole animation is visible.

Drives Proteus 8/9 interactive simulation from the agent through eleven proteus_* tools: connect, simulation start/stop/status, probe readings, a project save that checks the file hash and mtime actually changed, and layout suggestions computed locally; on machines that register the Labcenter.InteractiveSimulation COM server it also places devices from a whitelist and queries and connects pins, while without COM it falls back to a keyboard-driven UI transport covering the simulation lifecycle and saving. Requires Windows with a local Proteus 8/9 installation.

DSH plugin: 29 deterministic, offline tools for JSON validation with exact line/column, JSONPath queries, YAML/CSV conversion, text diff, regex capture, encodings, hashes, Unicode, CIDR, JWT structure and timestamps. Every call returns a { result, meta }

A private diary for your agent: eight zero-dependency tools to write, amend, search and export daily entries kept on date-hashed paths the index never records (inner_find returns a day's path on request).

Runs the upstream Headroom compression toolkit (headroom-ai, Apache-2.0) inside DeepSeek Harness over MCP: headroom_compress, headroom_retrieve and headroom_stats are exposed as mcp__headroom__* tools backed by the upstream server, installed on demand by uvx. Compression is lossy but reversible — originals are fetched back by hash from a local CCR store. Also ships a registrar that adds DeepSeek Harness to Headroom's own MCP registry, and a model-header sanitizer for the upstream proxy.

Semantic context watcher for DSH agents: maintains a journey ledger with flash summarization and MinHash novelty detection, folds milestones, and can inject long-term context with a three-level stall response; injection and the stall-2/3 responses are off by default.

System-prompt surface drift gate: every section any plugin or preset contributes to the assembled system prompt is hashed and baselined; a silent rewrite of what the model is told fails loud.

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Folder time machine for DeepSeek Harness: snapshot any folder, browse its timeline, roll back with one click — Git-like history without needing Git, for folders that never had a repo (game saves, app config dirs, loose documents). Snapshots are content-addressed and deduplicated, and unchanged files are not re-hashed. Automatic snapshots come in two modes: realtime (fs.watch — one version ~8s after the last change, so a save-all or a build counts once) and timed (checks every N minutes, stores only when something actually changed; identical content never adds an empty version). Empty folders are recorded and recreated on restore. Every restore takes a safety snapshot first, so a rollback is itself undoable, and exact-mode cleanup only removes files and empty folders — a non-empty folder is never deleted. Ships a folder_timemachine model tool (status/history/diff need no approval; writes ask first) plus a floating panel with the timeline, one-click restore and mode switching. Pure JS, zero runtime dependencies, 110 tests included.

A shareable delivery receipt for a project hand-off. The `ship_receipt` tool measures what it can and records what it was told, then sorts every line into three zones: verified (evidence this run produced and that reproduces elsewhere — a command that actually ran with its exit code, a file hash for a file that is under version control, a scan that found files, a git ref present in the recorded remote), local-only (true on this machine alone — uncommitted changes, unpushed commits, an artifact no one else can see), and unverified (no evidence, including every sentence a human typed). A claim with no evidence keeps its label and leaves the body blank rather than printing the claim; declares the commit and branch, artifact byte sizes and sha256 with PNG dimensions, and the three pre-push checks.

Chinese summaries for the dsh-skill-mcp-panel skill cards: each expanded card gets a short Chinese overview, a category tag and a few bullet points, while the English description the panel already renders is folded behind a "原文" toggle. Skills missing from the bundled map are translated on demand by the host with your current default model and cached on disk, keyed by a hash of the original text, so a new skill needs no manual entry. Skills whose own description is already Chinese are skipped.

Session-scoped delivery receipts for local artifacts: compare current file hashes with a recorded baseline, keep agent claims separate from explicit user acceptance, flag changed or unavailable files, and export a Markdown receipt through a tool, slash command, and conversation panel.

Model-driven context compaction for DeepSeek Harness. The agent decides when and what to compress, commits durable session-log replacements, and ships reversible tool-result compression with byte-exact hash retrieval.

Training attestation — reproducible, attributable, auditable off-site standardized training for asset pricing. Hard-gates four failure modes (half-refresh, hash mismatch, unknown-read-as-pass, master pollution). Ships one skill.

The rich `edit` tool for DeepSeek Harness (replace / patch / apply_patch / hashline modes) with embedded format-on-write and diagnostics — a standalone plugin with no upstream harness changes required.

Local tool-call failsafe for DSH: blocks a fixed list of high-risk shell patterns and credential-file reads before execution, with a per-session hash-linked JSONL audit log, and an optional external Gateway for centralized policy.

The rich `edit` tool for DeepSeek Harness (replace / patch / apply_patch / hashline modes) with embedded format-on-write and diagnostics — a standalone plugin with no upstream harness changes required.

Password gate for dsh-web: opening the web port requires a username/password login; account credentials are stored salted+scrypt-hashed and AES-256-GCM encrypted in a local config file under $DSH_HOME. Host-only cordis plugin, no dsh source changes.

HashiCorp Vault backend for the credential seam: KV v2/v1, AppRole machine auth, per-operation reads so rotation needs no restart, and compare-and-swap writes.

S3-compatible backend for the spill seam: oversized tool output goes to object storage (S3, MinIO, R2) with hashed session prefixes and unguessable keys, instead of the agent's local disk.