Plugins

Mask secrets, local paths, private IPs, emails and phone numbers in session text before you share or commit it.

Privacy guard for git workflows: before git commit, git push or gh repo sync it scans the content that would enter git (local paths, user info, API keys, private keys, connection strings) and blocks anything not approved in the DSH approval UI; approved items go into a manageable, masked whitelist. Native DSH Config schema with live settings, first-push full-repository scan, fail-closed checks, zero npm runtime dependencies.

Automatic approval and audit frame for DSH tool calls: a four-outcome rule table (deny, ask, AI review, allow) over commands, file access, network and tool scope, with security rules, rule-based auto-approve/auto-deny, AI fast/deep review, human approval, permission tiers, workspace boundaries, secret redaction and placeholder restore, a hash-chained audit trail and a simulator. Target files are inspected by metadata only.

An Orchestrate tab in dsh-better-sidebar and 14 orch_* tools to spawn, prompt, fork and cancel agent chats, run command, scrape, http and agent tasks on local, ssh or remote runners, show provider status cards, and serve a secret-protected machine API. Requires DSH >= 0.1.1-rc.1, Node >= 22.5, the web profile and dsh-better-sidebar.

Posts a follow-up prompt into opted-in chats that fall silent, and offers a secret-protected HTTP API that posts a message into any chat. Requires Node.js 22.5+.

Stores the agent's long-term memory as plain Markdown in an Obsidian vault — every memory is a .md file with YAML frontmatter that Obsidian indexes natively, so you can read, edit, link and back up it with tools you already use. Nothing is locked in a database. Ships a sidebar panel (tag filter, sort by recency or importance, edit in place), 7 agent tools, three-tier token-budgeted recall, BM25 ranking (no embeddings, no API key, works offline, CJK bigram tokenization), importance decay with archiving (moved to .archive/, never deleted), and optional GitHub Contents API sync. A note containing a secret is refused rather than redacted, because a redacted memory reads as complete while the important part is gone. Zero runtime dependencies; everything comes from the DSH host.

Tracks token usage and estimated costs for every model call, with daily charts, session and workspace names, provider balances, budgets, and secret-free CSV/JSON exports.

One-off two-person password chat in the DeepSeek Harness right sidebar: end-to-end encrypted (the server sees ciphertext only), with images and screenshots, fully cleared on end.

DSH secretary: triages your unread GitHub notifications by their real state every 15 minutes (closing what is already resolved), remembers dated things you tell it (bills, renewals, document expiries, birthdays) and reminds you when due, and watches your inbox read-only; secrets live in the system keychain only.

Community (unofficial) bridge to Tencent Docs official MCP: one-click mcp-client configuration + self-served space_secret acquisition (scan → local vault → gateway). Zero bundled credentials. · 社区（非官方）腾讯文档 MCP 桥：一键配置官方 mcp-client 连接 docs.qq.com MCP 端点 + 自

Hands secrets and PII to the agent without them entering its context, with checksum-validated extraction and masked content classification.

Trimmed fork of ItQianChen/dsh-github-flow: a floating panel plus a right-column review pane for the pull requests raised in a session, showing CI state, review comments and merge status. It also registers the github_* agent tools (PR merge and review, secrets, raw API), so do not install both.

Turns corrections into permanent rules: explicit remember: triggers and auto-detected corrections pass a confirm bar (save globally / per project / edit / skip) and are written into a marked AGENTS.md section. New rules take effect in the current session and load natively in future ones; writes are deduplicated and version-guarded, and secret-looking content is refused.

DSH plugin: one agent tool that audits a project for release-time infringement risk (licence contagion, copied third-party code, assets, trademarks, secrets) before publishing.

Bridge an official QQ bot to DeepSeek Harness in-process: a QQ message starts or resumes a real DSH session inside the host (it appears in the desktop sidebar when its working directory is a registered workspace) and the answer is sent back to QQ as text, image or file. Requires a QQ official bot application (AppID + AppSecret).

Encrypted local credential vault for DeepSeek Harness: sidebar record management, an info_records tool for pre-sign-in lookups, opt-in chat capture, per-record manual-only mode, and AES-256-GCM storage protected by Windows DPAPI, the macOS Keychain, or the Linux Secret Service.

Replaces detected secrets (OpenAI, AWS, GitHub, PEM, Bearer) with deterministic, structurally valid honey tokens before they reach the model or the session file; adds manual marking for values the detectors miss, explicit user-visible restore, a cross-session canary alarm, and an opt-in JSONL log of substitution counts that never records the underlying values.

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Code retrieval engine exposed as an MCP server: four tools (code_search, code_outline, code_index, index_status) over a SQLite FTS5 index with BM25 ranking, CJK bigram indexing, declaration-aware tree-sitter chunking, incremental reindexing, and a three-layer secret filter. The bigram index matches Chinese-language queries against English code, and the default path needs no vector store or embedding model. Requires a local Python 3.10-3.12 engine installed by scripts/install.sh, and CODERAG_ROOT set in the profile patch.

A delivery receipt panel for a project hand-off. One trigger collects the branch and commit, the test and build results, screenshot dimensions with sha256, and the secret-scan verdict, then assigns every line to one of three zones by evidence alone — verified, local-only, or unverified. A claim in the unverified zone keeps its label and prints an explicitly empty slot instead of the claim itself, because a confidently worded sentence with nothing behind it is the exact thing the receipt exists to catch. Test failures and secret-scan hits are still evidence, so they land in the verified zone with a red tone rather than being quietly dropped.

Provide a LeLogin skill for credential injection and authenticated business applications without exposing plaintext secrets.

DSH 右侧栏的 QQ 邮箱：读最近邮件、看正文、发纯文本（发送需 confirm 门禁）。凭据只从私有 secret.json 读，授权码绝不进 git、不进日志、不回显。

dsh 插件 · 密钥安全输入卡片：AI 需要用户提供密钥（API Key / Token / 密码）时只负责描述「该写到哪个文件、哪个键」；密钥由用户在弹窗卡片中直接输入，由本插件写入配置文件并可选验证是否生效，密钥全程不进入会话记录，AI 只拿到「写入与验证结果」。

GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.