Plugins

Cooperative timeout guard for ask_user_question: lost or unanswered questions resolve as a structured ASK_TIMEOUT instead of hanging the turn forever.

Structured, safe Git tool family for DeepSeek Harness: status/diff/log/branch/stage/commit/stash/show/fetch/pull/remote/checkout with a destructive-command guard.

Runtime monitor for the plugins installed in a DSH profile: the panel lists every bundle and plugin entry with its Cordis fiber state and load diagnostics, scores risk from failed entries, missing bundles, version exemptions, install scripts, bin entries, a missing license and non-registry sources, keeps a timeline of state changes, and can disable a plugin entry or a whole bundle without leaving the panel.

Tempguard temperature watchdog tools for DeepSeek Harness

Connects DSH to decision models (TypeSafe Jev, TokenRhythm NeoHorse-Jev, OpenAI Decisions, and local System One endpoints) with decide, gate, rerank, and judge tools plus a settings page. Needs an API key for at least one provider (kept in the DSH credential store); the text you ask it to judge is sent to the selected provider unless it is local. The command guard is off by default.

Expose DeepSeek Harness sessions to Google Antigravity (Gemini) through a local, token-guarded HTTP bridge.

DeepSeek Harness 插件：检测思考段复读并自动打断、自动续跑。通用重复检测，不依赖白名单；支持行内重复开关、可编辑拦截提示词与聊天内提示。

Replaces keys, tokens and passwords with <SG_> placeholders before they enter model context; plaintext stays in a local AES-256-GCM vault, revealed by a click-to-reveal lock in Settings and in user messages.

Validates every tool call against that tool's own parameters schema before it runs, and denies with the exact path and type. The host renders a tool's parameters into the prompt but never checks a call against them, so a wrong-typed value reaches the tool body: a number lands in path.join and the caller gets a raw TypeError instead of an answer. This plugin hooks tools/pre-execute, resolves the definition, and returns a deny whose reason reads "demo_tool.dir: expected string, got number (123)". Covers primitive types and unions, required, enum/const, nested properties, array items, additionalProperties:false, and oneOf/anyOf/allOf. Fails open on purpose: an internal error, an unknown tool, or a schema construct it cannot read allows the call. mode deny or warn, plus a skip list. Two read-only tools, arg_guard_status and arg_guard_check.

System Duo for DeepSeek Harness. Make your agent think fast and slow: System One decision models triage, guard, shield, mask and check your agent loop beside System Two (vllm-sr/auto), with a free app.vllm-sr.ai key.

DSH plugin that enforces per-task budget caps by CNY amount or token count, with automatic interception to prevent runaway agent costs.

Session operations for DeepSeek Harness: really delete persisted sessions (ungrouped, temp, archive and subagent filters; guards on running, live and workspace sessions) and move sessions between workspaces (log relocation, header.cwd rewrite, workspace registry follow). Ships the shared session-store library.

Second-model gate on the assistant turn, installed with one command: the bundle installs the settings panel and mounts the engine out of the same package, so both halves come up together. A separate judge call scores the draft against the numbered criteria (0-10 each); any criterion under 6 fails the turn and sends it back for a rewrite, up to 3 rounds by default. Ships in dry-run mode, which only records verdicts to an audit log until you switch it off. The web panel edits the criteria, the thresholds and the judge prompt.

Clamps the session history page request to 120 messages and replaces request/header tool schemas larger than 200k characters with an empty array before React renders them, so long sessions open without freezing the transcript.

A Storage settings page for DeepSeek Harness: a donut of what dsh occupies on this machine (install, sessions, attachments, runtimes, plugins, temp), a drill-down that lists archived sessions and can delete them, and a clean action that only touches rebuildable caches. Deleting to the system Recycle Bin and Open folder are Windows-only; scanning works everywhere. Host routes accept loopback connections only and are CSRF-guarded; nothing leaves the machine.

Local task checkpoints and bounded recovery for DSH, with optional L0–L3 hierarchical memory, dependency-aware retrieval, prerequisite-aware context, and six opt-in memory tools.

Context handoff sentinel for DeepSeek Harness: three behavioral recall tests (constraints / changed files / next step) run after every compaction or on /guard check, cross-checked against the session log, returning a green/yellow/red verdict plus an optional handoff document.

Windows-only guard against the desktop shell locking itself out: it counts the dsh-auth-* launch cookies the shell has accumulated, reports how much of the 16 KiB request-header budget they consume, and once the count passes 40 it backs up the whole Cookies database and lets DSH rebuild it, so every cookie in that profile is cleared. Install is one command: on load the plugin registers its own weekly scheduled task pointing at the scripts inside the package, and uninstalling it removes that task — nothing to copy into your home directory and no schtasks line to run by hand. The check itself runs while the app is closed (it waits up to 3 hours for the shell to exit). It does not raise the header budget or keep a floating panel; scripts/ can also be run standalone without the app installed.

Adds a sidebar card to DeepSeek Harness that runs a chosen action once every task finishes and the card is armed — shut down, restart, sleep, hibernate, lock, sign out, or a script you uploaded to its shared library; it holds back with a stated reason while background jobs, errored sessions or a manual interruption are still in play. Verified on Windows, macOS and Linux.

Policy-layer guard that checks tool calls before they run: a read whitelist, a sensitive-path deny list (credentials, browser profiles, chat history, other users' home directories), dangerous-command blocking, subagent isolation, and a static scan that quarantines executables. Every denial is appended to an audit log. It is a text-and-path filter, not a sandbox or antivirus: dynamically built paths, encoded payloads and packed binaries can get past it, and it does not replace the OS antivirus.

Host-plane sovereignty clause and content guard: appends user-held adjudication to the system prompt tail, redacts credentials and hidden carriers in tool results, and vetoes irreversible actions before they run. Applies to every agent preset.

Checks installed plugins against a DSH update before you install it, and reports the shared UI members and host services they use that the new version no longer exports — the case where an update installs cleanly but leaves plugins failing to load. Includes a read-only diagnose command. Windows only, DSH desktop, Node.js 18+.

Security plugin that intercepts file deletion and write commands, requiring user token authorization.

Inject a personal rules file into the DeepSeek Harness system prompt, with silent-step and repeated-action loop guards editable from the settings dialog.