Plugins

Adds a “why does this need escalation?” button to every DSH approval card: it opens a panel with the permission requested, the risk, what refusing means, the exact tool arguments and whether the named paths fall outside the session workspace; the card also keeps a one-line risk and refusal consequence visible under it, and the model’s original reason is split into labelled paragraphs instead of a run-on block.

Godot game development workbench for DeepSeek Harness. Windows only, preview release: plans a game (GDD, tasks, acceptance checks), changes project files through controlled read/write tools, diagnoses the project and runs it for evidence. Runtime and import checks launch your configured Godot as a normal process with your permissions (the AppContainer sandbox applies only in the restrictedProduction option); the official Godot 4 standard build can be downloaded on request after confirmation (SHA-256 checked), creating a project registers it in Godot's project list, and the selected project context is sent to your configured model.

Lets the agent drive the Chrome tab you @-mention — 13 tools for tabs, snapshots, clicking, typing, keys, scrolling, dragging and screenshots, with input sent as real CDP events so pages see isTrusted true and a pointer drawn inside the page. Needs the bundled Manifest V3 extension loaded by hand in Chrome (developer mode; it requests the debugger and all-URLs permissions), talks to it over a WebSocket on 127.0.0.1 ports 30795-30805, and saves screenshots under ~/.dsh/chrome-tab-shots; the macOS native input channel also needs Accessibility permission and the Xcode command-line tools.

Runs sessions on your own Claude Code and Codex CLIs from the model picker, and lets a DSH agent hand background tasks to them and follow up. Permission prompts cannot be answered from DSH: Claude Code runs in acceptEdits mode by default, Codex in its workspace-write sandbox, and ACP permission requests are approved automatically by default.

Qwen mode for DSH: manages local GenieX and Alibaba Cloud QwenCloud providers, normalizes thinking and sampling, detects model capabilities, and shows per-turn latency and decode speed. Its bundle patch replaces the permission plugin's preset table with reply-only, read-only, workspace-write and danger-full-access (the last two as in stock), so any custom presets are overridden.

allow/ask/deny permission gates for DeepSeek Harness tools: path/params/agents surfaces, argv decomposition, network rules, redaction, grants, dry-run, fail-closed config

Control a paired Android phone from DeepSeek Harness: read the accessibility node tree, tap by text, type into fields, take screenshots, launch apps, and read or write files over an encrypted WebSocket. Needs the companion Android app (Android 11+; the APK is attached to every release since v0.0.45, so no local build is needed — the source is in the repo if you would rather compile it with JDK 21 and Android SDK 36) and a network route from the phone to the computer (same Wi-Fi or a tunnel; the bridge listens on all interfaces by default). Pairing is a DSH settings section (8-digit code or QR code, listening port); the permission switches live in the phone app, and by default the agent cannot drive the bridge app itself.

Forces every active session into the full-access permission preset (this disables the approval gate) and appends approval, sandbox and tool-call events to a local JSONL for after-the-fact review. Audit path is configurable; it never uploads anything.

Non-blocking approvals and timed questions: permission requests park as pending items while the model keeps working and the approved call can be retried, and ask_user_question runs in timed mode (20 s) through an override of the whole standard agent preset that applies to new sessions after a restart.

Plays a short chime and shows a desktop notification when a tool asks for permission approval.

Delegates a one-shot task from DeepSeek Harness to a locally installed Reasonix over the Agent Client Protocol, reusing Reasonix's own model, credentials and sandbox settings; exposed as the `subagent_reasonix` tool. Auto-approves every Reasonix permission request.

Configure automation Hooks for user and project scopes to run commands on session, tool, permission, and context-compaction events. Manage Hook authorization manually in Hooks setting.

Memory engine for a long-lived companion agent: a six-module loop (gate, solidify, store, retrieve, inject, decay) that decides what is worth keeping, distils raw turns into long-term entries, fuses short and long term at recall time, and fades entries that stop being used. Runs offline by default; if DEEPSEEK_API_KEY is set it also sends each message to the DeepSeek API to judge and distil it. Zero runtime dependencies and no build step; ships three switchable panels over the same store - neural brain, memory ring and memory galaxy - so you can watch what it remembers. Non-commercial license: commercial use needs the author's permission.

Native desktop notifications for DSH on Windows, macOS and Linux. While the DSH window is in the background, permission requests arrive as system notifications; where the platform supports notification actions, Reject and Allow-once buttons return the decision to the host approval waterfall, and returning focus or a timeout hands the request back to the in-app panel. Approvals and questions also play a separate input cue that is independent of window focus. Turn-end, question and error reminders, notification sounds and the cue are configured on a Notifications settings page.

Approval reminder: an in-page card with Allow once / Reject when a session waits for permission, plus optional desktop notification, sound and phone push through PushPlus, ServerChan, ntfy, WeCom or a custom webhook.

After user setup, guides native subagents toward model preferences by task type, using native model-selection permissions with no extra routing-model calls.

Shows the cost of the current session's latest exchange, meaning everything since your last message, as a CNY amount to the right of the permission control in the composer, calculated from provider-reported token usage at DeepSeek's peak and off-peak prices.

Loopback-only ACP door for DeepSeek Harness: connect VS Code and other local clients to a running kernel over the local loopback address, sharing its models, tools, memory and sessions. Browse history, change permission modes and call capabilities registered by DSH plugins.

Drive a real Android phone from DSH: screenshots, taps, swipes, typing and app launching. Requires Python 3.10+ with aiohttp and mcp on the computer side, plus the AutoX.js script running on the phone with screen-capture and accessibility permissions; the phone long-polls your machine, so no public port and no relay server.

Automatic approval and audit frame for DSH tool calls: a four-outcome rule table (deny, ask, AI review, allow) over commands, file access, network and tool scope, with security rules, rule-based auto-approve/auto-deny, AI fast/deep review, human approval, permission tiers, workspace boundaries, secret redaction and placeholder restore, a hash-chained audit trail and a simulator. Target files are inspected by metadata only.

Sends a QQ direct message through a local NapCat (OneBot) instance when DeepSeek Harness asks for permission, after verifying the bot QQ; requires owner/bot QQ ids plus the NapCat endpoint and token, and falls back to a Windows notification when NapCat is unreachable.

Four agent presets for the default plan-native workflow in DeepSeek Harness: plan plans and delegates, work coordinates execution, code owns implementation changes, and review performs independent read-only audits. Each role has a defined tool-permission matrix. Works with the sibling l2-protocol bundle for opt-in controlled rounds. For new installs, Weihao654/dsh-workflow#role-chain provides these four presets and the controlled-round runtime in a single bundle. Do not enable role-chain alongside either legacy l1-presets or l2-protocol.

Keeps the Auto permission preset across DSH restarts: the auto-review unload migration no longer rewrites a live Auto Session to Full access during application shutdown, and a stored Auto Session no longer fails to open when its integration is absent.

Adds a Git chip beside the composer that opens a centered workbench (changes, history, files, tags, stash) plus a Git section in settings. Supports multi-account OAuth device flow and PAT with per-repository permissions (full, read, none), gates writes behind a global switch and reads behind an allowed-directory list, and refuses a push whose target remote belongs to no writable account. Diffs preview in place with line numbers, four layouts, word-level emphasis, syntax highlighting and Ctrl/⌘+F find; Markdown and images render inline, commit messages are searchable, and commit messages can be generated from the staged diff through the host LLM service. Ships 8 Agent tools, 51 local HTTP endpoints and 8 languages, with tokens encrypted at rest by AES-256-GCM.