Plugins

Locks the model's reasoning, replies and tool-call descriptions to a chosen target language (Simplified Chinese by default) with system-prompt sections at the head, middle and tail of the prompt, offering three strength levels, an auto mode that follows the DSH interface language, a settings panel that shows the language currently in effect, and a sidebar quick switch.

One-click restart for the DSH desktop client, from five entries you can toggle individually: a sidebar panel, the sidebar footer, the conversation header, a Settings → General row, or the /restart slash command. The app is closed gracefully (only the main process is signalled, so the host can flush session logs) and relaunched by a detached helper that survives the shutdown; optional guards wait for running tasks or an in-progress plugin install, results land in a receipt, requests are fenced to loopback same-origin, and every switch is persisted in the profile config file. Only the four UI entries can be switched off; the slash command is always available.

GLM Mode agent preset for zhipuai/glm-5.3-flash: PTC/Code Mode tool presentation, a reasoning loop guard and a tool spin guard (live-incident driven), and GLM-specific auto-compaction at 75%/22%.

Stops a streaming model call when the same string repeats ten times in a row (threshold configurable), keeps the partial answer as a normal assistant message, and shows a stop notice with the workspace, session name and the repeated string. Repeat counts can vary by unit length through a piecewise table or a JavaScript module, and code regions (fenced, inline, indented) use a relaxed threshold.

Blocks edit/write writes that contain characters matching configurable regex rules, executed before the tool runs, with configurable messages and same-turn pwsh propagation; default rule matches full-width parentheses.

Host-side guard that lets the write tool only create new files: when the target already exists it denies the call before execution and tells the model to use edit instead, applied to all sessions.

Governed long-term memory for DeepSeek Harness: append-only evidence ledger with write guards, 7-tier authority claims, supersede chains, and budgeted pre-step injection with per-domain quotas.

Agent discipline guard for DeepSeek Harness: four gates enforced at the harness boundary — loop circuit-breaker, token-cost fuse, route-switch warning, plan approval — where prompt-level reminders can't reach, so an agent can no longer burn a weekly quota in minutes; one-click 🛡 chip, hot-reloadable thresholds, and presets from invisible-but-armored to warn-only.

Research-debt guard for DeepSeek Harness: nudges coding agents to search docs, GitHub and the web before repeated local trial-and-error.

Instance manager for DSH Web: a Mini Utility Dock panel that lists every local dsh web instance the machine can see (port, PID, uptime, live session count, resident memory, version), starts a new instance on an automatically picked free port in 3080-3129 or on a port you name, opens a row in a new tab, and stops one or all of them through that instance’s own graceful shutdown (appExit). Rows also show what each instance is serving, and read-only instance logs and session summaries are one click away. Where a peer is configured, the same panel lists and queries instances on other machines over a bearer-authenticated link. Every route is loopback-guarded, and a browser-facing action must additionally pass the host’s own browser authentication.

Pre-install static security review and runtime guard for dsh plugins: deobfuscation decoding, supply-chain checks, web one-click review/install/uninstall, and optional runtime tool-call guard.

Engine-enforced guardrails for DeepSeek Harness agent swarms: quality gates reject half-done work, crash-safe checkpoints resume in place — keeps AI teams from breaking, not just running.

Install tab in Settings → Plugins: install, update and remove any plugin by npm spec, `github:user/repo` or local path through the same `dsh plugin add` CLI path; update checks against npm latest or GitHub HEAD with a downgrade guard and resolved-version verification, a pnpm 11 release-cooldown bypass on every add/remove, and service restart via the DSH Desktop shell or a relay process under standalone `dsh web`.

Plugin trust pipeline for DeepSeek Harness: deterministic static scan with verdicts, opt-in runtime guard with honeypot lures, agent audit-protocol skill, and a browser shield status light. Alarm-only, never an enforcer.

Inject rules when needed, without wasting context. DSH port of opencode-stream-rules.

Runtime policy guards that block repeated failing tool calls, oversized shell commands and network commands chained with local ones, composite batch tools (read_batch/edit_batch), a SYSTEM.md mode that replaces the official system-prompt sections with your own file, soft convergence notices, and turn telemetry for DeepSeek Harness.

HarmonyOS delivery orchestration for DSH: freezes a four-dimension acceptance pack whose measurable criteria carry machine-checkable assertions, runs an adversarial pre-review before dispatch, hands the work to DevEco Code in Goal mode, then audits the delivery with independently gathered evidence (screenshots, UI tree, logs, hashed evidence bundle), recomputing assertion verdicts against measured values and filing rework orders; includes a cited rule catalog, a user-confirmation state and a gate calibration ledger.

Windows-only. Counts the dsh-auth-* login cookies the DSH desktop shell has accumulated, shows how much of the 16 KiB request-header budget they eat and how many launches are left before the shell stops opening with "desktop welcome: Web authentication failed". The web UI gets a draggable floating card that re-checks every 10 minutes, keeps one snapshot per local date and can refresh on demand; a standalone Windows checker ships in desktop/.

Adds hover Recall / Delete / Delete-onward actions to every message row: removes content from the model context and the transcript together via durable append-only tombstones, with an empty-content guard so old deletions can never break strict providers. Tested on the DSH 2.0 desktop.

Circuit breaker for idle agent turns: watches agent/assistant-stream and cancels a turn that produces only reasoning — no text and no tool call — after 45s, after 80000 reasoning characters, or on a degenerate repetition pattern (exact repeat unit, sentence-template repeat, sparse repeat, or 6-gram density). On trip it injects a continue instruction that requires the next action to be a tool call, and ships 11 regression cases plus per-gate tuning.

Mounts Microsoft's Playwright MCP through the official dsh-mcp-client so the agent gets its browser tools over stdio; the one-time CDP authorization is guided by a prompt note, a call guard and the /bw-setup command.

Resumes an agent turn that ended after narrating its next action without calling a tool: the guard replays the turn log on agent/turn-stopping, asks a judge model one true/false question, and steers the same turn to run one more step.

Review tab for DeepSeek Harness sessions: workspace changes versus HEAD or any two refs as a filterable file tree with side-by-side diffs, a lane commit graph with blame and file history, three-scope search, line comments back to the composer, and guarded stage/commit/branch/tag/stash/conflict operations.