Plugins

File-defined command hooks across the session, prompt, tool, permission, Stop and PostCompact seams, with an approval-only GUI: no unapproved command runs, and approval binds the exact definition, canonical working directory and pinned watchFiles. Commands run as the DSH OS user without a hook sandbox, so the trust ledger is explicit.

DeepSeek Harness native SSH terminal and SFTP workspace with direct agent tools and security sandboxing.

Google Antigravity and Cloud Code Assist model provider with Gemini 3.8 Flash, sandbox failover, and multi-account quota management.

Adds a diagram button under every finished reply in the DSH Web UI: the configured model writes a single-file HTML page with inline SVG and the right sidebar renders it in a sandboxed iframe, with diagram, source and original-text views, a per-session replay history that is served from a disk cache instead of calling the model again, redraw, and save to a .html file.

Multi-workspace manager: bind a docs anchor plus ordered code-project repositories into one session, injecting their absolute paths, a recursive file index, a server/client endpoint index and optional coding standards, and syncing writable directories into the sandbox.

Maintained fork of dsh-approval-gate. A neutral operation whose confirmation count has reached the threshold auto-approves when the judge is unavailable, instead of prompting a human again; approver-facing explanations are generated in Chinese from the real sandbox mode, command and paths. Also carries deterministic hard-deny for credential exfiltration and system-path destruction, judge-input redaction, a judge model candidate chain, fingerprint-scoped allow rules, and an approval view with unified diff and one-click revert.

Blaxel sandbox execution plugin for DeepSeek Harness (DSH)

OpenAI Codex CLI wrapper: one-shot exec, repo review and session resume with a default read-only sandbox.

Support for the nono sandbox backend.

Microsoft cross-platform sandbox support.

Adds a Workboard page with a configurable grid of built-in widgets, including agent sessions and jobs, to-dos, ICS calendar, weather, trending lists, RSS feeds, markets and a system monitor, plus sandboxed custom widgets the agent writes from a one-line request.

Native DSH support for context-mode (mksglu/context-mode), intercepting large tool outputs with SQLite FTS5 indexing, BM25+RRF search, and session continuity. On by default: tool outputs over 4 KB are replaced with a short preview while the full text is indexed into ~/.context-mode/context.db, and a section is added to the system prompt. Its ctx_execute and ctx_batch tools run shell, Node, Python, PowerShell or cmd commands with DSH's own permissions and environment (not sandboxed), and ctx_index reads any local file path or fetches any http(s) URL it is given.

External @ file references: extends the Web GUI `@` completion so it can browse and reference absolute-path files and directories outside the workspace, level by level (`@/`, `@~/`), inserting the absolute path (quoted when it contains spaces) for the model to read. Toggleable in Settings; when off, completion matches native behaviour. On by default, and the model's reads of those paths are not limited by the sandbox; POSIX-style absolute paths only (no Windows drive letters).

Tencent Agent Mail client: a sidebar panel for inbox and sent browsing, HTML reading in a sandboxed frame with remote images blocked by default, compose/reply/forward with attachments, search and permanent delete, adjustable font and surface opacity, plus five agent tools (mail_health, mail_list, mail_read, mail_search, mail_send) sending through an OAuth-authorized agently-cli account. Needs a Tencent account (OAuth device-code login); the panel can install agently-cli for you. Tested on Windows only.

Gives each new DeepSeek Harness conversation started from the default workspace its own workspace directory and sandbox root (manually added project workspaces stay shared unless mode is set to all), with a composer toggle for the next conversation.

Isolated mother, essence, and fork workspaces for developing and testing DeepSeek Harness plugins, with hot reload and a shared decision inbox across forks.

Delegates independent tasks from DeepSeek Harness to the local OpenAI Codex CLI and returns the result to the current conversation. Provides four tools (task execution, status check, danger-mode toggle, enable/disable switch), enforces a real-path working-directory whitelist with symlink-escape protection, defaults to Codex workspace-write sandbox mode, passes the task body as a single argv argument to avoid shell injection, kills the whole Codex process group on timeout or cancel, and caps output length. Requires Node.js >= 20 and a Codex CLI build supporting codex exec.

Policy-layer guard that checks tool calls before they run: a read whitelist, a sensitive-path deny list (credentials, browser profiles, chat history, other users' home directories), dangerous-command blocking, subagent isolation, and a static scan that quarantines executables. Every denial is appended to an audit log. It is a text-and-path filter, not a sandbox or antivirus: dynamically built paths, encoded payloads and packed binaries can get past it, and it does not replace the OS antivirus.

Inline visualizer for DSH: the model loads a design contract first, then renders an SVG or a sandboxed HTML card in place inside the conversation, with light/dark tokens and a source/download toggle.

DeepSeek Harness sandbox provider backed by MXC (Microsoft eXecution Containers): wraps ctx.sandbox.confine() argv as `wxc-exec --config-base64 <policy> -- <command>` on the BaseContainer backend. One runtime dependency (@microsoft/mxc-sdk, for the wxc-ex

Runs a fixed set of agent benchmark cases in isolated sandboxes, scores each case with deterministic assertions, and diffs two runs to show which cases regressed after a model, prompt or DSH upgrade.

Evaluation guard for DSH: workspace-only filesystem, no network/subagents, wall-clock limits, and task installation for meow-ai-arena and benchmark tasks.

An independent permission gate above the built-in sandbox. It blocks writes outside the workspace and to protected paths even under danger-full-access, refuses whole-file overwrites without a complete fresh read, and keeps ZIP restore points plus Recycle Bin copies before destructive actions.

Windows-only. Trust a newly added workspace folder once, then grants the NTFS rights the workspace-write sandbox needs and pushes the grant plus the Low integrity label through folders that already exist; repairs show live progress.