Plugins

iOS remote companion for DSH Desktop 0.2.0-rc.2 on macOS Apple Silicon, with pairing, approval notifications, and device revocation.

OpenAI-compatible HTTP endpoint for DSH sessions plus a phone panel that reads transcripts, browses files, sends or queues messages, and answers approvals and questions.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

System-prompt surface drift gate: every section any plugin or preset contributes to the assembled system prompt is hashed and baselined; a silent rewrite of what the model is told fails loud.

Deterministic write gate: scope policy denies out-of-scope write/edit calls before they touch the disk, residue rules scan the written text, and every decision lands in a content-hashed JSONL ledger; can reuse the repo's agent-pr-gate.yaml so CI and session enforce one policy.

Tool-surface snapshot and drift gate: baselines the full visible tool registry (name/description/parameters, MCP tools included) into a committable JSON file and warns loudly when an upgrade adds, removes or reshapes a tool.

Hermetic composition lock: fingerprints the profile's dependencies, bundle order, lockfile and patch layer; booting a drifted composition warns, or fails under strict mode (the --frozen posture for CI).

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Signed chain-of-custody for sessions: every watched tool result appends a hash-chained, ed25519-signed record, with commits bound into the chain — tampering with any line or truncating the tail fails deterministic replay verification.

Watches a turn's thinking and output streams and cancels the turn when the model starts repeating itself. Four detectors: a verbatim cycle, a counting loop whose lines differ only by a number, repeated lines separated by other text, and a user-supplied phrase list. A catch raises a manual-dismiss alarm card in the global overlay with an optional tone, and a Monitor tab holds the switches, thresholds and hit history. Detection is local string comparison with no model calls, so it costs no tokens.

Safety guard that makes self-killing commands impossible: a safe_kill tool that always excludes the caller and every ancestor process, a bash pre-execute check for pkill self-matches, sudo -S stdin grabs, rm -rf / and similar patterns, and an extensible rule library with block / warn / hint severities.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Puts sessions into the built-in Auto review permission preset: new sessions at creation, existing root sessions when they are restored.

Writes a model-generated annotation into every DSH escalation approval prompt — what the command does, what the model intends, how risky it is and why, and what each choice means — and keeps a searchable history of past approvals at /dsh-approval/history, with a diagnostics page at /dsh-approval/diag.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

Local-only telemetry service for DSH plugins: records operation trails and error events into a storage-domain KV table, applies a configurable redaction rule set before the write and again when the analysis reads back a record stored before a rule existed, and groups one plugin's failures by feature-code anchor, reporting the window it read, the route each group ran on, and the attempts recorded after its last failure in write order.

GitHub issue service for DSH: turns a telemetry failure analysis into a uniform issue report, builds a pre-filled new-issue URL that is shortened when it would exceed a configured length budget, rewrites a plain description into a structured issue with the deployment's model, and closes the intake loop by listing the open issues that carry a claim label and handing each one to a fresh session as a one-shot automation task on the host's Schedule service, which delivers the rendered prompt into that session when the task comes due and shows up on the Web Automation tasks page (a host with no Schedule service admits the prompt directly instead), skipping issues an earlier pass already dispatched, leaving the local day uncommitted when every dispatch is refused so the next startup tries again, and repeating the pass on the first start of each local day when autopilot is enabled.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Staleness keeper for the Codebase Memory knowledge graph: it compares the graph Branch node head_sha with git rev-parse HEAD and reports an exact behindBy, rebuilds only the stale projects through the codebase-memory-mcp CLI so the MCP tool 60-second cap does not apply, watches each project for edits, and mirrors the same state into a settings card and a REST control surface.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Records every session as one readable Markdown timeline inside the session workspace - the full request sent to the model (system prompt and plugin injections included), user input, replies, reasoning, tool calls and results, file reads and writes, web searches, skill loads, command runs and token usage - with a review page, a per-session tab and configurable capture scope.

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.