Plugins

Conversation lock for the DeepSeek Harness sidebar: every conversation row gets a lock button, and a locked conversation blurs only the conversation area behind a password box while the sidebar stays usable. Re-locks on window blur, tab hide, page hide, or whenever the open conversation changes, and never pauses a running turn - the veil reports that background work continues. The password digest, lock flags, and preferences live in <DSH_HOME>/session-lock/state.json behind two same-origin routes guarded by a custom header, so clearing the page localStorage unlocks nothing; PBKDF2-SHA256 with a random salt, and a 30-second input lockout after five wrong attempts. Recovery is opt-in per machine: a Windows login password (enabled only after a real .NET PrincipalContext ValidateCredentials check against the local machine, so Microsoft accounts and passwordless machines keep it off) and a cooling period chosen while creating or changing the password (1/6/24/72/168 hours; expiry clears the password and releases every lock, and the correct password cancels the countdown). A settings section covers status, changing the password, lock new conversations, hiding locked titles, a three-position archive-restore policy (all / locked only / off, switching needs the password), lock everything, and unlock everything. Dialogs use the native dialog top layer, so a dialog opened from Settings is never covered by it. Requires DSH 0.2.0-rc.1 or newer; no build step.

One MCP tool surface over two Windows desktop-automation backends (dsh-computer-use-win and windows-mcp). Both must be installed first: dsh-computer-use-win as a DSH plugin, windows-mcp via uv tool install windows-mcp --python 3.14, then run the bundled scripts/patch-backend.mjs once (it rewrites the local windows-mcp source; without it screenshot/read_webpage/launch_app fail) and disable the standalone wincu mount. It merges their 44 tools into 29 by dropping 10 duplicates, 4 dangerous ones (PowerShell, Registry, FileSystem, Process) and 1 tool-management entry, and blocks dangerous calls before forwarding through a reversibility-graded guard.

Long-conversation memory for DeepSeek Harness (DSH): keeps settled decisions, user corrections and exact numbers, with their conditions and sources, available across compaction and restarts in 100-1000+ turn sessions; one small budgeted evidence block per model step, with enabled skill rules re-applied in the same block.

Low-contrast dark theme that remaps DSH's alias tokens and adds its own chat bubble, code block banner and markdown heading colours.

Sends file deletions to the Windows Recycle Bin, lists and restores them by id, and blocks permanent shell deletes.

Durable task-decomposition plans for DeepSeek Harness: the model submits a staged plan with acceptance criteria, every work item then runs on a real department subagent, and the progress panel draws done/running/blocked subtasks as a ring, a stacked bar and per-stage steps. Ships a public security self-assessment structured on ISO/IEC 15408:2026 (Common Criteria) — security target, vulnerability analysis, SBOM and a security policy — with an explicit "no certificate claimed" line, plus a published self-correction record of where v1.8.0 documentation overstated the code (fixed in 1.8.1). Every claim is checkable by the reader instead of taken on trust. One command to install, zero runtime dependencies.

Structure-level watermark removal for PDF and Word: finds full-page Form XObject overlays drawn on every page and text blocks matching a watermark vocabulary, lists them by confidence, then excises only the drawing operators or runs — the text layer, embedded images and their resolution are not re-rendered or altered.

Long-term memory kept as plain Markdown plus git: each session opens with a generated memory-context block assembled from a global store and per-project books (role card, user profile, current focus, routing table, recent logs), the plugin records which memory files the agent read and reminds it to extract conclusions while the day's log is unextracted, personas live in roles/<role>/SOUL.md role cards, and it ships a seven-tab settings page in the sidebar plus four skills. Requires Python 3.10+.

Experimental Windows bridge for Codex to supervise DSH Desktop 0.2.1-rc.3 tasks through local MCP, with blocking direction questions, plan checkpoints, review and revision, and named workspace routing. A Windows adaptation of Cryocell77/dsh-desktop-mcp-bridge (MIT); it uses the same package name and loader row, so it cannot be enabled alongside upstream.

Interactive HTML or flowchart cards inside the conversation: the tool blocks until the user submits, then returns the clicked action, fields, comments and card state.

Markdown display enhancements for the DSH Web chat, applied on top of the host renderer rather than replacing it: code blocks become cards with a language label and icon-only wrap and copy buttons, long code blocks, tables and Mermaid diagrams fold behind an expand control, Mermaid fences render as SVG with a diagram and code toggle, a fullscreen viewer with wheel zoom, drag and double-click to fit, and SVG or PNG export, tables get a sticky header and CSV or Markdown copy buttons, and a settings panel adjusts the diagram palette, code font size, the default diagram view and the three fold thresholds.

Adds an AIignore tab to the right sidebar: scores the open conversation and its folder across five dimensions, blocks reads of build output, lockfiles and logs before they reach the model, and writes the .aiignore rules for them one button at a time.

Restart control for the DeepSeek Harness desktop app on Windows. A session header button or a tray icon stops the app and its host process, waits for both to exit, clears a stale profile lock, and relaunches, so a newly installed plugin loads without quitting the app by hand.

Adds two audit tools and four skills for Chinese medium-to-long texts (fiction among them) and document review — seven-dimension AI-flavor scoring with line-numbered blocking findings, plus file-backed continuity state for long manuscripts. Do not install with the older dsh-deai-audit from the same author, which registers the same tool names.

Task timing for DSH agents: a task_clock tool that measures elapsed time on the host monotonic clock, resumes across DSH or system restarts with the gap estimated, and returns unknown rather than inventing a number; it does not touch presets.

A liquid-glass skin built on your current desktop wallpaper: the wallpaper is blurred and veiled into the window canvas, panels stay translucent, and every surface that carries text (composer, code blocks, preview pane, menus) gets its own frost level so nothing is washed out. Apple-style liquid-glass controls. On Windows the canvas reads the current wallpaper from APPDATA; other platforms fall back to a painted gradient.

Claude Code Desktop-style selection quoting: select text in a conversation to reply to that passage from a popover, or fork the session into a side chat in the right sidebar with the selection quoted. Quotes sit above the composer as removable cards, are sent as plain Markdown blockquotes in the same format as Claude Code Desktop, and render as clamped quote blocks in sent messages.

Read-only page structure for DSH, attached to the CUA browser: table coordinates, shadow DOM fields, code blocks, and confidence labels.

AFK controls for ask_user_question: profile-wide or per-session settings, configurable automatic replies or blocking new calls, and session-log question history with read tracking; does not approve permissions or plans. Supports DSH 0.2.1-rc.2 and 0.2.1-rc.3 only.

Evaluation guard for DSH: workspace-only filesystem, no network/subagents, wall-clock limits, and task installation for meow-ai-arena and benchmark tasks.

A separate narrow-screen web surface for DeepSeek Harness rather than the desktop GUI scaled down: it serves its own session list and chat stream behind a random access token over LAN, a tunnel (cloudflared, localtunnel or localhost.run) or an SSH reverse forward through a server you own. On the phone it streams assistant text, thinking, tool calls and results, sends prompts, stops the running turn, answers blocking questions and tool approvals (including ones waiting in other sessions), switches model, thinking level and permission preset, sends up to four photos compressed on the device, and keeps the computer awake.

An independent permission gate above the built-in sandbox. It blocks writes outside the workspace and to protected paths even under danger-full-access, refuses whole-file overwrites without a complete fresh read, and keeps ZIP restore points plus Recycle Bin copies before destructive actions.

Blocks API keys pasted into the composer or written by tools, logs leak events, and scans the workspace for exposed secrets.

Mirrors assistant streaming frames (deltas, blocks, commits, turn fences) to a configurable NDJSON sink for external consumers.