Plugins

Reads the session event stream, with no extra model calls, and turns corrections, failures and fixes into pending lesson candidates. Every candidate is judged against written criteria and carries the reason it passed or was refused; only confirmation writes a skill, and only through the single validated writer `learn_skill_manage`. An idle curator marks unused skills stale and archives them by moving rather than deleting, and spares any skill that is still being loaded. Five tools: `learn`, `learn_review`, `learn_curator`, `learn_skill_manage`, `learn_skills`. Registers a prompt section stating the criteria, and a tool guard that refuses direct edits to skill files so the writer cannot be bypassed.

Long sessions get expensive, and the platform compacts the context on its own. This plugin adds an occupancy badge (hover to see how it is computed), writes a handover draft into HANDOVER.md from 45% — files changed, money spent, what recent turns were about — and reminds you once at 60% to wrap up. On compaction it records the reading from just before, so you can check it later. No model calls, nothing added to the conversation; it does not prevent compaction.

Fronts stdio MCP servers with three router tools (list_capabilities, describe_tool, call_tool) so schemas load on demand instead of riding every request; shapes every tool result through a deterministic output ladder that archives the original first (retrieve_spill reads it back); prices tool groups in tokens and can hide built-in groups per agent. Bridges to a standard-library Python router, so Python 3.9+ is required.

Pre-execution safety valve for DSH that judges with TypeSafe Jev: it hooks tools/pre-execute and decides every bash/pwsh call by first applying offline static rules, then by asking the Jev model — the System One model from TypeSafe, which returns a structured decision instead of prose — one yes-no question ("will this command irreversibly delete or overwrite real data?"), turning the answer into allow, revise, block or escalate; revise hands the model a safer rewrite, escalate offers a one-shot human token; exhausted credit or a missing API key degrades loudly instead of failing silent, and a missing key is requested in the conversation itself (`guard key set`, read from stdin); every verdict is appended to a shared audit log and the text people read is bilingual zh-CN/en.

Compaction fallback for compaction-basic: when its LLM summary throws, comes back empty or cannot fit the window, the span is compiled deterministically with a seq pointer on every line (vendored dsh-compaction-instant compiler). Adds recall and search tools, /recall and /context commands, an idle trigger at 45% of the window and an on-disk span archive. The engine mounts as one row in the agent preset (docs/dsh-integration.md).

Removes the queued prompts a DSH fork child inherits from its parent, so the first turn in a new branch runs the prompt typed there instead of the parent's next one.

Policy plugin that gates kubectl by kubeconfig context: hard-deny irreversible verbs outside local clusters, ask for the rest.

Point-and-shoot screenshot capture: a system floating window turns a new screenshot (or copied image) into an Obsidian note with comments and key-point marking, instant OCR through the host DSH multimodal model (no extra API key needed, Tongyi Qianwen as fallback), a duplicate-screen guard, per-day merging, and an optional evening AI organization pass.

Keeps DSH agents from forgetting your requirements during long tasks. It saves important conditions and completion evidence locally, brings them back after context compaction or session resume, and stops partial work from being reported as the whole task done.

Branch-role guard for AI coding agents: configurable integration/preview/production/archive roles, blocking direct push, force-push and delete on protected branches and agent merges into production/archive.

String-matches tool-call input arguments, blocks dangerous tool calls (deny) or allows them with an injected warning (warn), and ships a full rules-management panel.

Floating power dock for the DSH web GUI: one-click restart or graceful shutdown of the dsh host, loopback-guarded and dependency-free.

Static-only plugin gate and clinic for DSH: audit before install, hash-and-capability lock after install, local fingerprint peer search over GitHub topic:dsh-plugin, and mechanical detox. Never executes the target plugin.

Vets local, npm, and GitHub plugin source before installation, blocks configured high-risk tool calls at runtime, audits output secret patterns, and writes HMAC-chained local audit logs.

Source-aware prompt injection guard for DSH: tracks untrusted turn context, detects injection signals, scores sensitive sinks, and blocks high-risk tool calls with explainable audit logs.

GitHub account management plus a local Git workflow for the web GUI with clone, fast-forward pull, status, commit, push, and host-side push guards.

Agent-managed procedural memory: a skill_manage tool that creates, patches, disables and deletes the agent's own skills in user or project scope, with delete guards (agent-created marker, pin, path confinement) and a trigger-discipline prompt.

Clinical documentation and reference bundle for healthcare professionals: SOAP/APSO progress notes, admission H&P, SBAR/I-PASS handover, discharge summaries, Safe Harbor de-identification, patient-instruction readability, completeness checks, and cited lookups against FDA labels, MedlinePlus, PubMed, and ClinicalTrials.gov. Draft-only with a PHI egress guard; not a medical device.

Security and governance for dsh: rule-based tool denial, full tool-call audit trail, and governance reports.

When a dsh turn gets interrupted — by a web restart or an upstream hiccup (rate limit, 5xx, quota error) — this plugin auto-injects a "continue" so your session picks up where it left off, with a dead-loop guard that hands back control if the retry produces nothing.

Static and runtime security guard for dsh: rule-based scans for malicious code, prompt injection and token waste, runtime interception of dangerous tool calls, /scan command, plugin_scan tool, web panel, and allowlist.

Evidence-first guard: warns the agent when it claims success without a matching tool-execution record in recent context.

One-click start/stop button pinned to the window bottom-right corner: restarts DeepSeek Harness in place via a detached helper that relaunches the exact boot invocation (loopback same-origin guarded), with an optional stop-only action.

Share the current session over the LAN as a read-only, token-guarded HTML snapshot with session stats and Markdown rendering.