Plugins

Runs sessions on your own Claude Code and Codex CLIs from the model picker, and lets a DSH agent hand background tasks to them and follow up. Permission prompts cannot be answered from DSH: Claude Code runs in acceptEdits mode by default, Codex in its workspace-write sandbox, and ACP permission requests are approved automatically by default.

One DSH plugin, two renderers: sandboxed HTML fragments and openui-lang programs drawn as host components, behind a single visualize tool.

Forces every active session into the full-access permission preset (this disables the approval gate) and appends approval, sandbox and tool-call events to a local JSONL for after-the-fact review. Audit path is configurable; it never uploads anything.

Read-only behavior audit for DSH sessions: flags unsafe actions in 8 categories (A–H) with rules for 14 subclasses (the 41-subclass taxonomy file is not shipped, so a built-in 14-subclass fallback is used), anchors every finding to a real event seq, and gives deep links plus the full tool-call / data-access chain of any assistant reply (parameters, results, files read and written, domains, sandbox and approval context). Every finding is drill-downable.

Extra folders registered for a workspace become real workspace roots: the session runtime context lists them, a workspace_roots tool reports each root top-level entries, git branch and AGENTS.md/README/manifests, and file tools read, write, patch, move and delete inside them without approval prompts. Folders are edited per workspace from a sidebar hover action or from Settings. On Windows a confined shell stays inside the workspace, because ACL confinement cannot take extra roots.

Delegates a one-shot task from DeepSeek Harness to a locally installed Reasonix over the Agent Client Protocol, reusing Reasonix's own model, credentials and sandbox settings; exposed as the `subagent_reasonix` tool. Auto-approves every Reasonix permission request.

Adds a DeepSeek Harness agent preset that hands implementation work to Codex subagents (auto-approved, workspace-write sandbox); the session agent only splits tasks, dispatches them and reports results. Requires DSH 0.2.2-rc.1+, the @deepseek-ai/dsh-subagent-codex bundle and a locally installed, logged-in Codex CLI.

Runs a shell command on your machine from the chat box with !cmd or /sh cmd, without sending a model request. The output comes back as your message plus a terminal card with the exit code, run time and a Copy button. While a ! line is typed, a menu offers zsh completions from your own fpath and matching commands from your shell history. Commands run as a login shell in the session folder, outside the agent sandbox, with a 120 s default timeout.

Fast-execution runtime for dsh: context governance with 4 KB tool-result caps and field projection, zero-LLM fast-path templates with idempotency keys, PTC container scripts that keep intermediate results out of context, a three-tier sandbox with file/command/network rules, injection detection, secret redaction, snapshots with a recycle bin, and append-only audit logs; 10 runtime_kit_* slash commands, no business dependencies.

一个轻量级的dsh测试沙箱插件

Wires the local cc-computer-use MCP server into DSH with one process per root session, giving each session its own Xephyr sandbox screen and private AT-SPI bus (requires the cc-computer-use MCP server).

Turns every .pluginlet file under a repo's .dsh/pluginlets/ (directories configurable) into its own sandboxed Conversation View tab, gated by a capability grant bound to the file content hash.

Lightweight visual answers for DeepSeek Harness: one compact visual style, an editable model prompt, dsh-view components, Mermaid diagrams, a sandboxed HTML/JS escape hatch, local-first interactions, and link-only media cards.

Brings the third-party deepseekbase.com index into DSH: eight tools and five DSHIO standard skills (from the @liangjiehappy/dsh-dshio dependency). Search 8,400 plugins with real sandbox install verdicts and risk levels (including red-line warnings where credential access meets network), submit a plugin for a four-stage sandbox test from the conversation, read the verdict, check the remaining free quota, and run a clause-by-clause DSHIO/T 10 conformance check. The skill text is fetched from dshio.org at startup and replaces the bundled copy, so updates need no reinstall. Network: HTTPS to deepseekbase.com and dshio.org, plus an npm registry lookup before a test is submitted; no file reads or writes, no credential access, no shell.

Sandbox rules for DeepSeek Harness: extra writable roots, write-protected path names with a narrow escalation level for them, read-protected paths.

Provision a separate DSH_HOME (minimal profile + launcher) for the AgentRouter relay, and give the sandboxed agent controlled network egress.

SSH remote workspaces for the dsh web GUI, reusing the session sandbox mode and approval flow.

Local tool guard that scores every DeepSeek Harness tool call with an Ollama decision model before it runs; risky calls come back as an approval prompt, and an unreachable model stops all calls. Requires DSH 0.2.x and a local Ollama 0.35.1+ with the default ~6 GB clef-flash model pulled first; without them every tool call is denied.

Advisory permission checks for DSH tool calls: risk tiers, a path sandbox (empty allowed_roots denies every path-like call), a per-minute call limit and a JSONL audit, exposed through gate_check / gate_check_path / gate_policy and ctx.gate — other plugins or prompts must call the gate; it does not intercept tool calls by itself.

Runs DeepSeek Harness bash commands inside the workspace's Nix dev shell whenever a flake.nix is present.

Lets build commands run inside the DSH sandbox instead of asking for elevation on every invocation: redirects pure caches (GOCACHE, NPM_CONFIG_CACHE, BUN_INSTALL_CACHE_DIR, PIP_CACHE_DIR) to a temp root, or grants the real cache directories write access in place so they stay shared with the terminal. Dependency stores (GOMODCACHE, CARGO_HOME) are never redirected, only granted. Adds optional user-directory grants (~/.config and friends, all off by default) and a command allowlist that matches exact strings or per-segment after splitting on &&, ||, ; and |, while rejecting redirects that write files (fd duplication like 2>&1 and /dev/null are allowed), command substitution and backgrounding outright. Settings are per-profile or per-session; file edits apply without a restart.

Per-session switches for which tools a DSH conversation may call, plus a guest mode that keeps file tools inside the workspace and turns off shell and subagents.

Renders a ui-blocks file named by a ::dsh-ui <name> \[res=WxH]:: line in a sandboxed canvas, and turns an element token into a composer chip that serializes back to the token verbatim.

Renders a dsh-view fence in an assistant reply as cards — text, tables, charts, Mermaid diagrams and sandboxed HTML widgets — with an editable model prompt, a render_view tool and a bundled skill.