Plugins

Stops the agent after N consecutive failures on the same tool. Instead of another retry it pushes a four-part stop instruction: what was tried, the exact error text, the likely cause, and what the user must do. Detection reads real tool results (isError or a non-zero shell exit code) and mirrors them through agent.steer, so the agent sees it as an inbound message rather than a log line.

Loop guard for DeepSeek Harness: detects and stops repeated output mid-stream, prunes and compacts context, then automatically resumes the task without a restart.

开源许可合规检查：扫描依赖树，找出 GPL/AGPL 传染、许可未知等风险 —— 发布前、开源前、被审计时跑一遍。

查密钥与证书多久没换了、有没有轮换制度 —— 长期不换的密钥往往没人注意，却是实打实的风险

dsh plugin: prefix-cache health guard. Separates prefix rewrites from ordinary context growth using the three disjoint usage buckets, and estimates the tokens re-billed at full price.

Decision layer for dsh: provider-agnostic typed judgments (Jev first) behind tool guardrail, model routing, result judging, and machine approval seams

你的产物里到底有谁，清单说了算

Conversation lock for the DeepSeek Harness sidebar: every conversation row gets a lock button, and a locked conversation blurs only the conversation area behind a password box while the sidebar stays usable. Re-locks on window blur, tab hide, page hide, or whenever the open conversation changes, and never pauses a running turn - the veil reports that background work continues. The password digest, lock flags, and preferences live in <DSH_HOME>/session-lock/state.json behind two same-origin routes guarded by a custom header, so clearing the page localStorage unlocks nothing; PBKDF2-SHA256 with a random salt, and a 30-second input lockout after five wrong attempts. Recovery is opt-in per machine: a Windows login password (enabled only after a real .NET PrincipalContext ValidateCredentials check against the local machine, so Microsoft accounts and passwordless machines keep it off) and a cooling period chosen while creating or changing the password (1/6/24/72/168 hours; expiry clears the password and releases every lock, and the correct password cancels the countdown). A settings section covers status, changing the password, lock new conversations, hiding locked titles, a three-position archive-restore policy (all / locked only / off, switching needs the password), lock everything, and unlock everything. Dialogs use the native dialog top layer, so a dialog opened from Settings is never covered by it. Requires DSH 0.2.0-rc.1 or newer; no build step.

One MCP tool surface over two Windows desktop-automation backends (dsh-computer-use-win and windows-mcp). Both must be installed first: dsh-computer-use-win as a DSH plugin, windows-mcp via uv tool install windows-mcp --python 3.14, then run the bundled scripts/patch-backend.mjs once (it rewrites the local windows-mcp source; without it screenshot/read_webpage/launch_app fail) and disable the standalone wincu mount. It merges their 44 tools into 29 by dropping 10 duplicates, 4 dangerous ones (PowerShell, Registry, FileSystem, Process) and 1 tool-management entry, and blocks dangerous calls before forwarding through a reversibility-graded guard.

Adds a Continue button to the composer dock and resumes automatically when a turn is cut off by a network drop or an upstream output-limit cut. A resident link monitor asks every 10 seconds whether the network is back, because the link returning fires no event, and a turn that completes normally counts as proof the link works. The click goes through the host submission pipeline — beginSubmission plus session.prompt — so the message carries real user attribution instead of faking one, and a genuine refusal is reported rather than retried. On startup it also scans recent session logs for both fingerprints of a host that left mid-turn: an unclosed turn, and a turn closed as disposed, which is what a normal shutdown writes. A turn the user stopped by hand is never resumed.

Named roles, model route guards, native configuration, and request-model visibility for official DeepSeek Harness subagents.

Turns real DSH crash logs into a short hard-constraint list: static preflight before a plugin installs, conflict check afterwards, controlled self-heal when the harness will not start — plus handing a huge session over to a fresh one, the brief written by a model that reads the original transcript.

Native generation-time Mixture-of-Agents: every turn, reference models run the same session context in parallel as pre-run drafts and one aggregator executes with full tooling; config-as-model recipes, F mirror / R trimmed views, enforced subagent gating (dual-shape session indexing), derived per-recipe vision (vision refs relay image reads to text-only aggregators), tiered cadence with separate steering and patrol rosters plus frozen reuse between beats, degeneration guard dropping degenerate reference output, anonymized model face (failure notices carry no provider identity), and cache-friendly guidance placement (the rehearsal record is pinned where it was produced instead of appended to every request, so the cached prefix covers it and each step pays only for what was added since - on by default across every cadence).

agent 读到的内容里，有没有人在给它下命令

A 护航 panel in the session header that switches the local dsh-guard watchdog on or off and shows whether scanning is enabled, whether the guard is alive and when it last scanned; the Python watchdog that does the watching is deployed separately and found through the DSH_GUARD_ROOT environment variable. The watchdog defaults to a Windows checkout (D:\AI\Projects\dsh-guard); set DSH_GUARD_ROOT to point at another directory.

The composer predicts what you are about to type. Inline ghost text sits on the caret, measured against the editor's own font and line box, and Tab turns it into real text (Esc ignores it). The prediction is one short call through the session's own model router, seeded with your draft and the last few turns of the conversation, so an empty composer also gets a next-prompt guess written in the user's voice; suggestions that merely restate the assistant are dropped. Host side is one HTTP route with sub-path endpoints (loopback-only, 64 KB body cap, 2-minute result cache, 20-second miss cache, one in-flight call per session); client side is one 0-height overlay registered on conversation.input.overlay, with insertion guarded by the composer's draftRev CAS and a setDraft fallback. IME composition and slash commands are skipped. 16 node:test cases, zero runtime dependencies, real screenshots in docs/.

Polish button in the composer that rewrites the draft with the model the current conversation already uses: four styles, a fidelity guard that keeps every concrete fact verbatim, one-click revert, and no API key of its own.

No longer updated: folded into dsh-lifeguard (last release 0.2.2). It checked a plugin against what was installed and flagged only real conflicts.

Permission guard for DSH: four scopes with read/write/execute bits in the native permission menu, plus an optional Jev semantic classifier for bash commands.

Router and artifact gate for DeepSeek Harness: a per-turn skill router that ranks the live catalog, plus a write gate enforcing read-before-write, dedupe and a four-line audit on every file write.

Two DeepSeek Harness tools for the local tempguard watchdog: read temperatures and alertd health, and send alerts through alertd; it does not start or stop the watchdog. Needs the separate tempguard Python watchdog and its alertd service running locally, with projectDir and alertdToken set in the profile patch; there is no npm package, so install from a local clone of the repository subfolder.

Meta's Muse Code CLI inside DSH: a composer switch starts muse serve, a right-sidebar panel and five chat tools (muse_open, muse_prompt, muse_read, muse_status, muse_interrupt) share one Muse session, approvals are decided only in the panel, and a local spend guard hard-stops at $10 by default. Windows only; needs the Muse Code CLI installed and signed in. The $10 cap is a local estimate for the muse serve this plugin starts.

CalibGuard 文件安全审计的 DeepSeek Harness 插件：本地校准 CodeBERT 门控 + 云端复核，以 agent 工具与侧边栏面板两种形态使用

Evaluation guard for DSH: workspace-only filesystem, no network/subagents, wall-clock limits, and task installation for meow-ai-arena and benchmark tasks.