Plugins

Deterministic code security review: 40+ rules, secret entropy detection, staged-diff review, SARIF export, baseline acceptance, SBOM-lite dependency inventory and health self-check. A step-by-step first-run guide (4 steps) now opens inside its settings panel.

Static and runtime security guard for dsh: rule-based scans for malicious code, prompt injection and token waste, runtime interception of dangerous tool calls, /scan command, plugin_scan tool, web panel, and allowlist.

Rules, commands & skills manager for dsh: /rules slash command, settings panel with visual rule editing (add/edit/disable/delete, free-zone support), user-defined custom commands with {input} arguments, skill management, and automatic backup & one-click restore of AGENTS.md.

Capability transform & assembly engine (Qian Xuesen cybernetics/systems framework): static resident layer manages the skill/MCP/plugin registries, auto-absorbs skills and tool metrics, and drives a negative-feedback evolution loop (scan Sick/Weak → mutate → select promote/reject → 30s rollback); includes a Web UI panel and a GitHub dsh-plugin store bridge.

Skill Manager page in the DSH settings panel: browse system / user / workspace / preset skills, expand a skill to its file tree, view and edit files, import skills from a zip, and export or delete them (system skills read-only).

Drive your dsh agent from WeChat over the iLink gateway: two-way encrypted media transfer (auto-decrypt inbox + /send), proactive weixin_send tool, completion notifications, multi-session switching, and a health panel with file logging.

Vision toolkit for text-only DeepSeek: model-invokable `vision` tool, wrapper adapters for deepseek/opencode-go (v4 flash/pro), Antigravity IDE quota (default, flash/pro) / any OpenAI-compatible VLM / Gemini / local Ollama channels, evidence memory with compaction rehydration, content-hash cache, and a bilingual client panel.

Real-time DeepSeek API usage: account balance with low-balance alerts (browser notification on threshold crossing), token & request stats (total/today/last-60s windows, per-model and per-session), estimated cost — a composer dock plus a settings-page usage panel.

MiniMax token-plan quota dock for the Web UI: a drop-shape 5h-usage % chip in the conversation input area, click for a detail panel listing every model's 5h & weekly usage and reset countdown, auto-hidden when the active default model is not a MiniMax model.

Download progress panel: URL downloader, agent shell/SSH transfer tracking and workspace black-box file-growth monitoring, shown in a draggable floating panel with live bytes, speed, percentage and ETA.

Skill manager for the dsh web GUI: a sidebar entry plus a panel listing the skills visible to the current session (split into global / local groups) with per-skill on/off switches, create / import / edit / delete. Disabling a skill removes it from the mod

Right-side developer panel for DeepSeek Harness: files, session history, and git version control

One-click collapse of every expanded section (Think rows, tool cards) with a live-count pill and a customizable hotkey.

Collapsible iOS-style stats pill under the composer: session cost, DeepSeek account balance, cache-hit rate, and token usage in a frosted panel.

Drives a plugin page in the running DeepSeek Harness UI — opens the panel, reads real DOM and computed styles, clicks, types, waits for async effects, collects console errors, then returns to the original conversation.

The cyber-elixir of youth for the desktop client: fixes the `desktop welcome: Web authentication failed` (HTTP 431) launch failure — an Electron random-port launch lets `dsh-auth-*` login cookies pile up per port (70+ of them, ~229 B each), the startup request headers blow past Node's default 16 KB cap, and the client can no longer launch. Two fixes in one: a scriptable cleaner that removes leftover login cookies from the cookie database (Chromium SQLite) — explicit, offline, keeps a `.bak` copy, `--expired-only` narrows the scope — and a `patch` feature on the settings panel that fixes the launch port through the profile `cordis.patch.yml`, so the client always starts from a single port and cookies stop accumulating across different ones (rewrite `port` as a `!!js` expression to keep the `--port` flag in charge; a per-profile snapshot makes one click revert it). Read the README for usage. Interface, CLI output and market metadata in 9 languages. The purge runs from the bundled CLI (`dsh-cookie-cleaner --clean`) only while the client is fully closed; the in-app half is read-only. npm: `dsh-cookie-cleaner`.

Adds an /if slash command to DSH: the first line is a condition and the remaining lines are an instruction. A fork subagent that inherits the session tools, system prompt and message history judges the condition and answers YES or NO, and only on YES is the instruction sent to the main agent as an ordinary user message, while a NO sends nothing. The condition, judge prompt and verdict never enter the main transcript. While the agent is busy the command queues with ordinary messages, editable, removable and steerable from the queue panel, and a setting switches to the 0.2.x background mode. The judge runs read-only, and falls back to a one-shot model call over a plain transcript when the host has no context-inheriting fork provider. Supports DSH 0.2.1-rc.5 and later (verified on 0.2.1-rc.5 and 0.2.2-rc.1) and Node.js 20.3 or later.

Honor of Kings inspired theme for DeepSeek Harness: the Jing · Blazing Sunlight key art is inlined and painted into the window backdrop and both main panels, over an ink night sky with a molten gold sun, frosted mirror shards, drifting embers and a three-level motion switch (full / calm / off). Colours come from overridden design tokens, so panels, bubbles, menus and code blocks follow the theme.

Windows-only guard against the desktop shell locking itself out: it counts the dsh-auth-* launch cookies the shell has accumulated, reports how much of the 16 KiB request-header budget they consume, and once the count passes 40 it backs up the whole Cookies database and lets DSH rebuild it, so every cookie in that profile is cleared. Install is one command: on load the plugin registers its own weekly scheduled task pointing at the scripts inside the package, and uninstalling it removes that task — nothing to copy into your home directory and no schtasks line to run by hand. The check itself runs while the app is closed (it waits up to 3 hours for the shell to exit). It does not raise the header budget or keep a floating panel; scripts/ can also be run standalone without the app installed.

Shows the DeepSeek account balance at the left of the composer status row; clicking it opens a panel with the normal and bonus wallet split, the refresh time and a top-up link. The chip and panel read the host surface tokens, so they follow the dsh-plugin-wallpaper-engine glass settings, theme and wallpaper changes.

Groups the sidebar's panel rows: two stay pinned, the rest fold under a collapsible Tools row, and rows can be dragged between the two groups.

Adds two enhancements to DSH ask_user_question choice cards: right-clicking an option expands a per-option note that is merged into the submitted custom answer, and a footer field asks a side question answered by a fork subagent from the session context, read-only, with no write-back. Keeps left-click, skip, paging and the countdown working as before, and only claims generic choice cards, not plan review or approval cards. Supports DSH 0.2.x from 0.2.0-rc.1 (verified on 0.2.2-rc.1) and Node.js 20+. Derived from buaaflyaway/dsh-question-note (MIT) and inspired by MichengAI/dsh-btw (Apache-2.0); do not install it together with dsh-question-note — both take over the same ask_user_question card.

Right-click menu for the DSH workspace file tree: open a file, expand or collapse a folder, copy the absolute path, relative path or name, and reveal the item in the file manager.

Output gallery in the DSH sidebar: watches your on-disk output folder, shows auto-refreshing image thumbnails with zoom and pan, lists documents, code, data, archives and links that open in DSH native preview, and filters by outputs produced in the current conversation. Zero dependencies.