Plugins

Control Proxmox VE virtual machines from the conversation: 16 tools for the VM console over VNC (screenshots, mouse, keyboard, batched actions, Unicode text and clipboard) and for running commands and reading or writing files through the QEMU guest agent, all over one ssh connection to the node, so the host needs no X11 or Wayland.

Connects the DeepSeek Harness agent running on your own computer to the HarnessMate platform, so you can chat with it, exchange files and approve its tool calls from a phone or a browser.

Connects the DSHM Android client to computer-hosted DeepSeek Harness sessions for remote chat, model switching, and approvals with device pairing and revocation.

Adds a local phone pairing, gateway control, and diagnostic panel for Pocket Bridge in DSH Settings.

Launch Android apps on a virtual display and drive them with screen reading, taps and swipes, leaving the main screen untouched.

iOS remote companion for DSH Desktop 0.2.0-rc.2 on macOS Apple Silicon, with pairing, approval notifications, and device revocation.

OpenAI-compatible HTTP endpoint for DSH sessions plus a phone panel that reads transcripts, browses files, sends or queues messages, and answers approvals and questions.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

System-prompt surface drift gate: every section any plugin or preset contributes to the assembled system prompt is hashed and baselined; a silent rewrite of what the model is told fails loud.

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.

Tool-surface snapshot and drift gate: baselines the full visible tool registry (name/description/parameters, MCP tools included) into a committable JSON file and warns loudly when an upgrade adds, removes or reshapes a tool.

Hermetic composition lock: fingerprints the profile's dependencies, bundle order, lockfile and patch layer; booting a drifted composition warns, or fails under strict mode (the --frozen posture for CI).

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Watches a turn's thinking and output streams and cancels the turn when the model starts repeating itself. Four detectors: a verbatim cycle, a counting loop whose lines differ only by a number, repeated lines separated by other text, and a user-supplied phrase list. A catch raises a manual-dismiss alarm card in the global overlay with an optional tone, and a Monitor tab holds the switches, thresholds and hit history. Detection is local string comparison with no model calls, so it costs no tokens.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Writes a model-generated annotation into every DSH escalation approval prompt — what the command does, what the model intends, how risky it is and why, and what each choice means — and keeps a searchable history of past approvals at /dsh-approval/history, with a diagnostics page at /dsh-approval/diag.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Staleness keeper for the Codebase Memory knowledge graph: it compares the graph Branch node head_sha with git rev-parse HEAD and reports an exact behindBy, rebuilds only the stale projects through the codebase-memory-mcp CLI so the MCP tool 60-second cap does not apply, watches each project for edits, and mirrors the same state into a settings card and a REST control surface.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.