Plugins

Hard break on repeated tool calls: a synchronous ctx.tools.guard gate that counts semantic fingerprints (net/site/sink/cmd/exact) over a per-agent sliding window, ignoring decoy arguments such as description and timeoutMs.

Keeps one reasoning-only turn from making an entire session unusable. When a turn produces no visible text and no tool call, the assistant message is persisted empty, the gateway then rejects every later request in that session with 'content or tool_calls must be set', and the session is dead with no way back through chat. This plugin registers a single llm/stream waterfall listener and, only when the turn carried nothing visible, injects a small text block immediately before the terminal finish, so the persisted message is never empty. Ships the fixture DSH's own mock cannot express (a strictly reasoning-only SSE server, since llm-mock-server forbids an empty successText and always appends text after reasoning), plus an end-to-end reproduction that replays a real persisted session through DSH's own serializeMessages. Preventive, not a repair. Zero dependencies, one file, no process or filesystem access.

Trims historical images in outgoing chat requests down to a recent-image count, learns the provider per-prompt image cap from HTTP 400 responses, and retries with fewer images so image-heavy sessions keep working.

Removes the queued prompts a DSH fork child inherits from its parent, so the first turn in a new branch runs the prompt typed there instead of the parent's next one.

Fail-closed runtime tool-call loop guard for DeepSeek Harness.

Plugin governance: new/updated plugins stage in a candidate area first, then hot-mount after startup — success promotes, failure auto-disables, repeated failures freeze, one-click safe mode, sidebar diagnostics panel (npm: `dsh-my-guardian`).

Peer communication between conversations in one DeepSeek Harness process: list the conversations the workspace shows, link one under a nickname, message it without waiting for its turn to end, read its progress without waking it, and declare rules for your own tool calls.

Multi-pet desktop companion: four MAM status lights watch every active session (approval / running / done-unread / error) and each card click-through to its conversation; four voice groups speak on state changes with duration-timed subtitles; import pets from four sources (folder / zip / Codex dir / Petdex registry) with card-style hot-swap and an integrity guard; five action bindings, drag physics, three scales. The built-in fox Foxbell ships in the package — install and go.

Self-media workbench plugin: 8-tab dashboard (daily brief, narrative lines, topics, drafts, knowledge-card distill review, sources, publish, advice) with hard guards (48h window, event dedup, card/line existence, read-only advice) and a read-only intel module following the four red lines.

Polaris Memory: local-first project memory plugin for DeepSeek Harness. Uses per-project .dsh-memory.json; provides memory_read/recall/write/update/delete tools, /memory command and settings UI, with tiered injection (resident user profile + scene-triggered memories with P1/P2/P3 importance), semantic recall (IDF + synonym layer), and a hard-guard mechanism for bottom-line memories (detect deny-semantics -> authorize -> block AI deletion; user can confirm-override).

Resumes an agent turn that ended after narrating its next action without calling a tool: the guard replays the turn log on agent/turn-stopping, asks a judge model one true/false question, and steers the same turn to run one more step.

Self-built DSH memory plugin: SQLite persistent storage + database-level audit guard (enforceAudit) + audit log. Auto-captures knowledge after conversations, agents recall via memory_recall, supports Claude Code/Codex/Cursor multi-agent sharing. Zero external dependencies.

Smart checkpoints, workspace safety guards and instant rollback for DeepSeek Harness.

DSH plugin security guard: 28-rule static scanner, risk scoring, whitelist/blacklist policy, local web dashboard and in-DSH risk popups.

Authored pull request feedback inbox with paginated GitHub collection, priority favorites, and version-bound local progress shared by the DSH panel and CLI.

Prevents concurrent-write session corruption: takes a per-session advisory lock on session start and every step, so a second dsh process fails loudly instead of writing a duplicate-seq gap; dead owners are taken over automatically.

Workspace-scoped Git graph with history search and diffs, multi-worktree WIP and agent-session views, and guarded Git operations with recovery refs.

Local and remote SSH terminals for DeepSeek Harness Web with three permission levels, human approval for risky AI commands, and encrypted credential storage.

Runtime security guard for DSH: loader import confinement, HTTP Host header validation, and source patch for VM sandbox escapes (4 CVEs). AI-assisted.

Tools guard that moves agent-issued `rm` targets to the macOS Trash instead of deleting, with a shell-aware lexer covering compound and disguised commands; a switch in Settings → General turns it off.

dsh port of the shared handoff kit: handoff and task-id-bootstrap skills plus host-side automation — baseline state injection, per-turn snapshots with an Auto Log trail, task=<id> routing, continuation re-injection, a compaction guard with clear-required alerts, and read-only subagent handling — all writing the same .agents/state/ as the Codex, Claude, and pi editions for one-repo multi-agent handoff.

Cloudflare D1 tools for agents: d1_list/query/exec/schema/stats/health over the D1 HTTP API, read-only by default with a SQLite-accurate lexical guard, LIMIT row cap, CSV/JSON query output and an approval-gated write path.

WebUI panel for the dsh-guardian watchdog: start, stop and inspect two macOS LaunchAgents with status, log tail and explicit failure states.

Neutralize tool calls with invalid JSON arguments on the wire so one malformed model generation cannot brick a session against strict OpenAI-compatible servers.