Plugins

Hand a DSH web session to the locally installed Claude Code CLI: a per-session engine selector (DSH | Claude Code), Claude models and reasoning effort in the model seat, Claude permission modes in place of the access-mode selector, and permission requests, AskUserQuestion and ExitPlanMode routed to the native DSH approval, question and plan-review cards. The stream is written as native DSH session events, so the built-in transcript, tool cards and nested subagents render it; Claude slash commands merge into the command palette; the CLI is held by a detached broker, so plugin updates and DSH restarts do not interrupt a running turn.

Claude Code-style permission rules engine: hard/deny/ask/allow tiers with a hard tier above full access, workspace-scoped rules, wildcard path protection, and a visual staged editor; rules persist in settings.yaml.

Control a DeepSeek Harness session from an Android phone: pair over Wi-Fi or Tailscale, follow the live transcript, send prompts, switch model, mode and permission, browse workspace files, run a terminal and change settings.

Feishu/Lark bridge for DeepSeek Harness (dsh): one Feishu topic = one dsh session, in-card approvals and questions, streaming cards, model and permission switching, Web settings page, long connection with no public endpoint.

A separate narrow-screen web surface for DeepSeek Harness rather than the desktop GUI scaled down: it serves its own session list and chat stream behind a random access token over LAN, a tunnel (cloudflared, localtunnel or localhost.run) or an SSH reverse forward through a server you own. On the phone it streams assistant text, thinking, tool calls and results, sends prompts, stops the running turn, answers blocking questions and tool approvals (including ones waiting in other sessions), switches model, thinking level and permission preset, sends up to four photos compressed on the device, and keeps the computer awake.

File-defined command hooks across the session, prompt, tool, permission, Stop and PostCompact seams, with an approval-only GUI: no unapproved command runs, and approval binds the exact definition, canonical working directory and pinned watchFiles. Commands run as the DSH OS user without a hook sandbox, so the trust ledger is explicit.

SSH workspaces for Windows DeepSeek Harness Desktop 0.2: discover OpenSSH hosts, add or browse remote project directories, and route file, search and Bash operations by workspace while the DSH runtime stays local. A Desktop compatibility fork of Yan-Zero/dsh-remote-ssh that preserves local permission defaults.

Registers external ACP (Agent Client Protocol) agents such as Codex, Claude Code and Gemini CLI as DSH model providers: maps each agent's thought_level options to the reasoning-effort selector, forwards images when the agent advertises promptCapabilities.image, and routes permission requests to DSH's approval dialog; ships an ACP Agents settings page that imports Zed agent_servers JSON and discovers models.

Adds an Explain button to the approval card: one model call returns exactly three lines reading the pending operation, covering what it does, which files or system state it reads, writes, modifies or executes, and a risky/attention/safe verdict with a one-sentence justification. It also renders the detail area for `write` and `edit` calls, which the shipped renderer leaves blank because it only reads a `command` field.

Filesystem permissions for shell calls, granted per path and capability rather than per command name. The command line is parsed for the read, write, create, delete and execute effects it needs, a capability it lacks raises the approval card instead of a flat refusal, and the same rules are compiled into the macOS Seatbelt profile the process, its children and the code its arguments never showed all run under. An Approvals tab in the conversation reads the audit log back and shows which rule, automatic reviewer or person answered each call.

Forwards an unattended DeepSeek Harness run's tool-call approvals and ask_user_question prompts to Feishu cards on your phone. The desktop GUI answers first — a card is only sent after `delaySeconds` (120 by default) with no answer there — and a phone approval grants `allowed-once`, so no authority accumulates on the phone. One outbound WebSocket long connection to Feishu: no public IP, domain, tunnel or relay.

Feishu (Lark) integration for DeepSeek Harness: 25 tools for chat messages and history, cloud documents (including knowledge-base pages, generated charts and images), bitable records, spreadsheet ranges and drive permissions, using your own enterprise self-built Feishu app.

Fourth permission preset for dsh: unconfined, GPU-capable sessions (danger-full-access) with per-operation user approval for writes outside the workspace or to protected paths (.git/**, .env*); implemented purely as a bundle over the official tools/pre-execute ask hook, no core edits.

Sidebar registry for SSH servers, expiry dates and service URLs, with Windows DPAPI-encrypted password and private-key storage, explicit host-key verification, login tests, and agent SSH execution that asks per command by default or can follow the session permission.

Delegate DSH tasks to independent Pi, Qoder and MiniMax Code workers through session-scoped MCP, with persistent sessions and a shared WebUI for results, events, approvals and cancellation. By default the Qoder and MiniMax Code workers run with every tool approval bypassed (change it with HARNESS_SUPERVISOR_QODER_PERMISSION_MODE and HARNESS_SUPERVISOR_MCODE_PERMISSION_MODE); DSH workers default to workspace-write with approval.

Native DSH support for context-mode (mksglu/context-mode), intercepting large tool outputs with SQLite FTS5 indexing, BM25+RRF search, and session continuity. On by default: tool outputs over 4 KB are replaced with a short preview while the full text is indexed into ~/.context-mode/context.db, and a section is added to the system prompt. Its ctx_execute and ctx_batch tools run shell, Node, Python, PowerShell or cmd commands with DSH's own permissions and environment (not sandboxed), and ctx_index reads any local file path or fetches any http(s) URL it is given.

Adds an Explain this action button under the permission approval card that asks the session model for a plain-language description of the pending operation — what it does, which files it touches, whether it modifies or deletes anything, and the privacy risk — plus a risk level and an allow or reject recommendation. Explanations are generated in Simplified Chinese.

Ranks models in a ten-slot ladder, routes each subagent by a 1-10 difficulty, and falls back a tier when one fails. Windows only; applies to sessions that opt in. Subagents can also launch local agent CLIs (Codex verified, nine others experimental), and a subagent granted full authority runs its CLI with --dangerously-skip-permissions, --yolo or --force. Run records go to .dsh-supa/ in the workspace.

AI 浏览器模式：在会话右侧打开应用内浏览器（多窗口），AI 可读取页面、点击/输入/滚动、截图和下载文件；提供每窗口四级浏览器权限、风险警告、主动授权越权，下载支持断点续传与进度/速度面板。

Connects Chrome, Edge and QQ Browser to DeepSeek Harness through a local MV3 extension and loopback bridge, exposing 12 browser tools for navigation, snapshots, clicks, typing, extraction and screenshots. The browser extension is loaded manually (MV3, developer mode) and paired with the bridge, and it requests the debugger permission.

Connect one or more Feishu bot apps to the local DeepSeek Harness (DSH): each bot app is a channel with its own model, workspace, permissions and private-chat allowlist, and every chat under it gets its own DSH session. Derived from MichengAI/dsh-im-connect (Apache-2.0) with the other IM channels removed and identifiers renamed so both can be installed side by side.

Floating photo companion for the DSH Web UI with a 15/25/45/60-minute focus timer, water and stretch reminders, Open-Meteo weather, and a session radar listing running, ended, input-waiting and permission-requesting conversations for one-click navigation.

Cleanup Mode agent preset for DSH: read-only scans of leftovers (including duplicate detection), a manifest before anything is deleted, trash-first removal only after confirmation, and a per-session audit log. Cleaning outside the workspace requires a danger-full-access session; under workspace-write it can only inspect and will ask you to raise the permission.

A second, agent-owned cursor with a floating control panel for opacity, colour, size, badge and a permission ladder only a human can raise. It never moves the real pointer. Windows 10 (2004 or newer) only — the overlay is a Win32 program with no macOS or Linux fallback.