Plugins

Irreversible secret-scrubbing guard: rewrites access keys, bearer tokens, and private key blocks into `[REDACTED:<category>]` placeholders before they reach the session log and the model.

Page-level UI generation for DeepSeek Harness: design tokens (theme.json) and code standards (code-style.json) drive a dsh-fuse fence that renders whole pages, with spec pre-validation, a theme contrast guard, a pixel-level style inspector (getComputedStyle), undo history, and a settings UI.

Adds session, project, and global controls in the DSH WebUI for skills, MCP servers, tools, prompt injections, approval escalation, and safety guards; enforcement is scoped to the current agent.

Sidebar skill picker: lists installed skills with Global and repo badges, session checks plus persistent auto-start, optional Guard, Codex/Grok/Hermes user skills, and /skill injection.

Autonomic heartbeat for each root agent: silent pulses diff the session's todos, Agent Team board and goal against what the last pulse saw, and speak only on a signal — L1 report, L2 ask (ask_user_question), L4 escalate — never starting work. Each message carries a why-now line, an optional one-line physiology signature (time since your last message and how many times it has reached out today) and a compact task snapshot (800-char cap); a dedupe window, quiet hours, a daily budget, refractory/restart cooldowns and persisted vitals keep it quiet, while busy-safe followup injection never stacks. It shares one advisory speech floor with dsh-plugin-memory (~/.dsh/proactive-cooldown.json, 180 s) so the two never talk over each other, stays silent while a child subagent or teammate is still working, and surfaces a "subagents working · N" pill in the conversation header (polling pauses while the tab is hidden). v0.8 adds a diagnostics panel that explains recent quiet pulses and names the current speech-floor holder, plus panel controls for the arbitration window, presence suppression and the physiology line; its settings section carries a stroked heart mark (16×16, stroke 1.3, same spec as dsh-plugin-memory). v0.8.1 makes the plugin compatible with DSH 0.2.2-rc.2: the agent registry is read with agents.roots() when available and falls back to agents.list() on rc.2, and every agent/created listener is exception-guarded — on rc.2 an unguarded throw there rejects agent registration and no session can be created, so rc.2 users must upgrade to 0.8.1 or newer.

Rules execution engine for dsh: parses AGENTS.md, hard-blocks rule-violating tool calls, text-based B/D rule auditing, /guard command, version-guard for versioned files, and free-zone support (engine skips free-zone sections).

Folio (兰亭) @nyantused/folio-dsh-tools: 15 schema-validated tools (memory + quality gates) plus an L0 guard of the consulting document-generation engine; pair with @nyantused/folio-dsh-events for the full session protocol.

Loader-independent startup recovery for DSH Web that detects likely broken plugins, temporarily skips them, and restores only Boot Guard-managed changes.

Project-scoped deterministic execution trace memory and zero-token session digest plugin for DSH, compiling session histories into guarded playbooks and behavior summaries with inline session_id lineage. Registers the /tmem slash command, recalls memories only on explicit file-path or error anchors in agent/pre-step (skipping unchanged repeated steps), and intercepts tools/post-execute errors and code edits with same-origin L2 fixes, failure-loop warnings, and statistical L1 co-change partner hints (skipping routine read calls when idle). Needs Python 3 on PATH (or TMEM_PYTHON) and spawns python3 -m tmem.cli with a 5-second timeout; stores all data inside each project's .tmem/ directory (no ~/.tmem/ global store) and makes no network requests. It needs Python 3 on PATH (or TMEM_PYTHON) and runs python3 -m tmem.cli synchronously, with a 5-second timeout, on every agent step and tool result; traces are stored in .tmem/ inside each project and in ~/.tmem/ shared across projects. It makes no network requests.

Inspects the model's streamed reply before it is committed and either discards it or holds it for review when it reads as a refusal, so that text does not stay in the session context. Detection combines built-in phrase rules (an opening refusal, a capability denial, policy wording, first-person intent, refusals quoted in reasoning) with a plain-text word list and optional regular expressions. Interception can sit at the llm/stream waterfall, at the HTTP fetch layer before encryption (not TLS decryption, and it cannot tell which session a call belongs to), at both, or in a preview mode that shows a transient preview while the original chunks stay in memory until the whole reply has been checked. The same plugin also guards tool calls on tools/pre-execute: a command that deletes a drive, filesystem or user-profile root, formats or repartitions a volume, empties the Recycle Bin, fetches and executes a remote script, or writes to a raw device is denied, and a recursive delete outside build directories is recorded by default. Each tier can be set to deny, ask, record, or off, and the disk guard has its own switch. Both halves are heuristics: they can miss phrasings, the disk guard sees the arguments of a call rather than what a running script does, and they fail open.

Guarded decision reuse for the DeepSeek Harness: the model authors already-decided tool actions once, and receipt-supported ones execute through the native tools without another reasoning request. Ships a read-only decision-reuse panel with per-number dat

Password gate for the DeepSeek Harness Web UI that also removes the 403 a reverse proxy causes, with revocable sessions, an admin page and zero dependencies.

WeCom smart bot over the official long connection (Bot ID + Secret, no public callback): persona, sender identity tags, three-layer memory with a forgetting curve, reminders, opt-in proactive chat, owner-only work mode guarded by tools.guard, auto-steer, image input and a wecomSoulBot host service; group chats answer when @-mentioned.

Rearranges the panel entries at the top of the DSH sidebar: drag to reorder or sort alphabetically, hide an entry without unloading its plugin, and split entries into named groups that render as titled separators; group headers collapse on click. A layout guard caps the entry list height and makes it scroll, so a growing list no longer squeezes the session and workspace panes out of view. An optional switch lets the profile's default model propose groups, and the host whitelists the returned ids and labels before they are stored locally.

Reviews side-effecting tool calls against the project rules and the current goal before they run, and denies anything out of scope with a fail-closed verdict and no bypass switch.

Caps the lifetime of DSH desktop's dsh-auth-* session cookies at 7 days, so they stop piling up in the Cookie header until startup fails with HTTP 431.

Strips DSML markers that leak into assistant prose and resumes a turn only when a "continue" genuinely helps — a no-output marker leak, local or upstream network blips, a single-reply output token cap (max-tokens), and empty or stream errors — with message-level classification for codes upstream miscategorises and a default cap of 3 consecutive failures that any normal reply resets; quota, rate-limit, auth and context-window errors, and user aborts, never resume. Requires DSH 0.2.1-rc.2 or newer, below 0.3.0, and Node 20 or newer.

Automatically retries model failures (drops, timeouts, rate limits, 5xx) in-turn. Retry count, delays, backoff, fallback and more are configurable. Rate-limit backoff is capped and jittered, server retry hints are honored, and optional retry-until-success keeps going within a time ceiling. Every option is editable from the plugin config or the sidebar panel: retry count, initial and max delay, backoff factor and jitter, rate-limit delay window, retry-until-success ceiling, fallback trigger and switch cap, dead-route blacklist TTL, log file. When a route keeps failing it can switch to a pinned, allowlist-filtered, or catalog-picked alternate model route, with a 30-minute dead-route blacklist (auth failure, subscription expired, billing) and a stale-assembly guard that keeps retried requests on the switched route. Ships a right-sidebar panel with live retry state, route labels and incident counters, Chinese and English locale, and memory-only logging by default.

Code Workbench for the DSH Web GUI: Monaco (the VS Code editor core) over workspace files in the right sidebar, with a version-guarded save path. TypeScript source.

A plugin for dsh: once ask_user_question times out, the content you entered will remain in the UI or model context.

Omarchy capabilities for DeepSeek Harness: live desktop tools, a package-ownership guard, web cards, and a top-bar panel.

Runs a local OpenAI-compatible gateway so DSH can use the model quota of a logged-in Tencent CodeBuddy (WorkBuddy) account: one-shot installer with SHA256 verification, logon scheduled task with duplicate-launch guard, manage.ps1 for status/start/stop/restart/logs/update/uninstall, and an agent skill that drives setup and troubleshooting.

Code workbench in the right sidebar: a workspace file tree and a multi-tab Monaco editor with syntax highlighting and version-guarded saving, Tab completion from DeepSeek fill-in-the-middle, per-save checkpoints with rollback, codebase search (plus a codebase_search tool for the agent), and reference chips that insert a selection into the chat as an @path mention.

Aborts a DSH reasoning stream that starts repeating itself instead of letting the turn stall: five rules over the streamed reasoning text (periodic unit, repeated block, repeated line above a share floor, 64-gram density, and a long trailing run of punctuation or whitespace), plus a JSONL fire journal, a Web GUI log panel, and opt-in recovery that retries with a corrective message.