Plugins

Deterministic code security review: 40+ rules, secret entropy detection, staged-diff review, SARIF export, baseline acceptance, SBOM-lite dependency inventory and health self-check.

Conversation header badge showing the DeepSeek Harness version, checking npm for the latest release and prompting upgrades.

One-click health check for the DSH Web GUI: a sidebar button runs the ops kit's check-health.ps1 through a plain HTTP route (independent of the tool registry) and renders a structured report card; colors follow the active theme, Windows/PowerShell.

Git hygiene checker: read-only scan of merged and stale branches, oversized tracked files, untracked files and uncommitted work, with cleanup suggestions (it never deletes anything).

Per-task isolated git worktrees with a full create/sync/finish lifecycle: task names auto-derive branches, merge targets are double-checked, and batch cleanup is built in — zero manual git operations.

Surveys local code and GitHub/npm for reusable implementations before development, evaluates reuse versus rewrite, and checks architecture coupling.

Long-task orchestration loop: Codex plans/scores/reviews, DeepSeek executes, Kimi supplements (vision acceptance, summarization, cross-check).

Turn DeepSeek Harness sessions into daily, weekly, handoff and article reports, with a verifiable HTML export and a receipt that re-checks the saved file.

Agentic Control Plane for DeepSeek Harness — check every tool call against your policies before it runs, and keep a durable record of what was allowed and why.

Structured, safe Git tool family for DeepSeek Harness: status/diff/log/branch/stage/commit/stash/show/fetch/pull/remote/checkout with a destructive-command guard.

Evidence-first operating kit: six read-only tools (capability catalog, staged workflow plans, packaged skill reader, bounded local memory search, repository release audit, release checklist) and five packaged skills - plans and audits, never remote writes.

Real-compute verification gates: math simplification, logic proofs, regex validation, E-prover FOL, state-machine checks, and code repair, backed by Go-compiled binaries with prebuilt Windows executables.

Update manager for installed plugins: check for updates, back up, and roll back.

JEV agent preset bundle with prompt-guided task routing, cross-verification and quantitative checklists.

Governs the persistent information and project constraints an agent works with - project orientation and scope, information and document lifecycle, and persistent workspace mutation - through one additive system-prompt section plus deterministic runtime checks.

Branch and worktree management for DeepSeek Harness: the workspace toolbar shows the current branch with in-place switching, plus an IDEA-style branch selector, remote branch checkout, context menus (create, rename, delete, copy), push and update, and branch isolation into standalone worktrees with managed creation and deletion.

Optional JEV decision mode with deterministic project reads, bounded semantic selection, native authorization checks and desktop credential settings.

Deterministic goal-completion gate for DSH: a contract-first AC grammar with named failable check commands, a gate that re-runs every check itself (zero model trust), verdicts bound to a tree digest so file changes void passing verdicts, and a hard deny on false completion at update_goal via tools/pre-execute with a false-complete counter that blocks after two catches; scope-aware task-level claim handling (strict or goal-only) keeps multi-task Agent Teams loops from deadlocking.

Generate images from chat by calling a fleet of local or LAN ComfyUI workers, with workflow templates, worker health checks and queue control.

Checks each step of a plan before you approve it, using command rules plus Jev or an OpenAI-compatible endpoint with logprobs, and marks steps that can't be undone, affect things outside the workspace, weren't asked for or are too vague on the plan review card.

Bring a DSH plugin repository's build and release pipeline into the app: a sidebar panel listing each repository's latest workflow run, its releases, and how far the local checkout has drifted from the last release, with buttons to trigger a build, cut a release, publish a draft, re-run, cancel, or read the failed-step log. Drives the workflows through the machine's authenticated gh CLI, so the plugin stores no credential of its own, and which repositories are tracked lives in a config file rather than the package.

Run one instruction on every online Windows and macOS machine, across networks and regions: a dependency-free relay talks to each machine over outbound connections only (Tailscale, a public VPS behind TLS, or a tunnel), every machine runs the command in its own checkout, and results come back with a commit, a working-tree fingerprint and a command hash so an environment mismatch is reported as unverifiable instead of being mistaken for a different result. Sending work needs its own operator token, separate from the per-machine device token.

Adds a human-editable notes workspace with folders, full-text search, rich text, checklists, resizable tables, attachments, exports, and opt-in agent collaboration.

Checks in Trae and WorkBuddy daily from local login files, with a sidebar status and credits panel.