Plugins

配置一组额外可写根：fs 工具与受限 shell 首次尝试即可写、无需审批，带 Web 设置页与按目录结构锚定的路径模式。 · DSH plugin: configured extra writable roots for the fs tools and the sandboxed shell, with a Web settings page and structure-anchored path patterns.

A per-command sandbox allow-list for the bash tool: a rule names a CLI and the writable roots it gets, so allow-listed programs such as lark-cli and gh run inside the kernel sandbox with the workspace plus those roots appended. Unlike plugins that answer the approval for you or that widen the writable set for every command, the grant here is scoped to the matched command, the workspace stays writable, and other commands keep their exact behaviour. Matching is by write footprint rather than by command string, so write-neutral pipes like `2>&1 | tail -N` still match; rules are edited from a Settings page or the Plugins row. Overlays cover Seatbelt, bubblewrap and Landlock; on Windows the writable root is swapped for $HOME instead.

Remote workspaces for DeepSeek Harness: pick an SSH host in the sidebar, mount a server directory over SFTP as a workspace, then read, write and edit those files with the normal file tools. Remote watch is polled so the file tree refreshes, image/binary previews work through byte-range reads, and remote_exec, remote_search and remote_git give agents the remote shell, search and git queries. An opt-in patch routes the agent's own bash/pwsh commands to the server. Every remote write and command follows the session sandbox mode and approval policy, and hosts are managed by the plugin itself (password, key or SSH agent).

DeepSeek Harness (DSH) plugin: WinStage staging–candidate–selective-commit sandbox for Windows. AI changes land in a staging tree (files + registry); a review panel shows the diff and only approved changes are written to the real workspace.

Windows sandbox ACL-repair plugin for DeepSeek Harness (dsh) — fix the grantWrite failure (SetNamedSecurityInfoW Win32 5) and retry the command invisibly

/cmd <command> in the composer runs that shell command in the session working directory, sends the command and its output to the model as a user message, and renders the input as a terminal card with exit status, expandable output and copy buttons; a bare /cmd opens an interactive terminal whose transcript is sent to the model with Ctrl+Enter. Runs with its own terminal permissions (danger-full-access) by default; set useSessionPolicy: true to use the session sandbox.

Con's 自动审查（DCAR）：确定性规则优先、LLM 按需升级的 DeepSeek Harness 工具审查插件，提供 CAutoR 权限模式。Deterministic-first auto review for DeepSeek Harness.

Restrict the file access of agents in any sandbox mode (read-only / workspace-write / danger-full-access / auto) to the session workspace, and ask the user to rule on cross-border access. Each session can also use the gear selection box next to the composer to relax the cross-border gate to 「 read-only outside workspace 」 or 「 fully release 」.

Windows x64 only, 0.5.4 preview: two scoped tools (dragon_browser and dragon_desktop) that drive a visible browser through the DOM or CDP and Windows apps through UI Automation, with per-origin and per-executable read/control scopes, batch steps, a physical-Esc emergency stop and a redacted action log. 0.5.4 only widens the DSH compatibility range to 0.2.0-rc.2 through 0.2.1.x, because 0.5.3 pinned it to an exact DSH version and was silently skipped on DSH Desktop 0.2.1. Two long-lived native processes remove the per-action process spawn, so a single key step takes about 0.7 s on the same machine; when another window steals the foreground the step is aborted instead of typing into the wrong place. The browser side ships its own Edge/Chrome launcher and CDP client, so it no longer needs another browser plugin or the Electron runtime. It is not an OS sandbox; logins, admin windows and secure desktops stay with the user.

Diverts operation-script writes out of the workspace into a per-session scratch root and collects each one into an inspectable vault outside the workspace, so the workspace holds only real deliverables.

Adds the fs_remove and fs_move tools, executed in the DSH host process so they can delete paths the sandboxed shell cannot, gated by a session allow list and a path allow/deny list that denies by default.

Adds extra working directories to a workspace, each read-write or read-only, from a folder button next to the composer or the `/add-dir`, `/remove-dir` and `/dirs` commands; the model sees them in its runtime context, and `write` and `edit` calls into read-write directories skip the sandbox escalation prompt by default while shell commands still ask.

A file editor in the DSH web GUI right sidebar: open any text file, edit it, and save in place, with a version gate on every save — if the file changed on disk during the edit it stops and asks instead of overwriting. The document preview gains an edit button and a two-step delete button, and a separate File editor sidebar tool brings its own file tree for create, rename or move, copy, cut and paste (including a file taken from the system clipboard), delete and drag to reorganize. Two renderer bands cover 107 plain-text, config and source extensions; the second is offered only as an open-with choice, leaving the shipped Markdown and highlighted-code views as the default. All mutations run through the plugin's own trusted host routes, behind the connection trust fence, the workspace containment check and the sandbox policy.

Local file manager served by the DSH web server itself: whole-disk browsing, previews for images, PDF, video and audio, text, Markdown, JSON, CSV, sandboxed HTML, docx and xlsx, Range downloads, folder ZIP, drag-and-drop upload, copy/paste, conflict-checked text editing, create/rename/delete-to-trash, and xlsx cell editing saved as a copy.

Give DeepSeek Harness its own persistent computer: a bundled microVM with shell, browser, live view and approval gates

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Persistent Bots and group rooms inside DSH. Each Bot keeps its own model, permission preset, workspace and session across restarts; a Bot can also be backed by an installed local agent CLI (Codex CLI, Claude Code, ACP agents) using that CLI's own login and models. Unaddressed messages can be triaged by the room leader, the room accumulates a shared experience card, and every answer is a run in a durable ledger the sidebar panel replays. New Bots default to the full-access permission (any command, any file; the form asks you to confirm the risk), so choose read-only or workspace-write to confine one; Codex CLI and Claude Code Bots at full access run without their own sandbox or permission prompts.

Turn-level file undo for tool writes and edits: each file is snapshotted before the write lands, and the model (an undo tool), the human (a /undo command) or a button in the assistant message action row can roll back every file a turn changed. Snapshots are written in-process rather than by shelling out, so it needs no extra sandbox permission in sessions confined to workspace-write.

Removes sandbox_permissions / justification arguments that cannot widen the call's current sandbox mode, so calls no longer fail with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode'. GPT models tend to fill these optional fields on every call and pick workspace-write, which is narrower than danger-full-access. Runs in tools/pre-execute: compares the requested mode with the mode the session's sandbox policy resolves, and drops the fields when the request is the same or narrower (also drops a lone justification). Also understands the values GPT carries over from Codex's own shell tool: null, empty and use_default are treated as no request, and in a danger-full-access session any value (including require_escalated) is dropped because nothing is wider. Real widening requests, unknown modes and tools that do not advertise DSH's escalation schema are left to DSH core. Never widens permissions. Configurable tool list (default bash, pwsh, write, edit, run_code). Zero dependencies.

Runs git in the Host process so push, pull and fetch work inside the agent sandbox; exposes 8 agent tools (status, diff, log, stage, commit, push, fetch, pull) and 11 slash commands including /git-status, /git-commit, /git-tag and /git-name-set.

Notes workspace in the right sidebar: a notes tree beside a live-preview Markdown editor with tabs, split panes, outline and trash, over plain .md files and a thin per-workspace index. Agents organize it through one `knowledge` tool; `embed` fences render an interactive HTML page in a sandboxed iframe (scripts run, no network).

DeepSeek Harness plugin: a model-facing `chrome` tool that drives the installed Google Chrome over CDP — screenshots returned as images, DOM/text/eval, console & network diagnostics, real input events. Runs in the Host, so no per-call approval and no bash sandbox limits.

macOS menu bar indicator and system notifications for DeepSeek Harness: alerts when a tool needs approval (including sandbox escalations), when a question waits, and when a turn finishes — community fork of dsh-notify, compatible with DSH 0.1.7-rc.2 and 0

DeepSeek Harness permission guard: work inside the workspace is never interrupted; only the extra permission a call asks for is judged — machine-safe actions pass, system changes ask with a consequence analysis, destructive ones are refused.