Plugins

Speaks a cue for DeepSeek Harness on Windows: a configurable phrase when an agent turn completes normally, a second phrase when the agent needs you to choose — a question, a plan approval, or a permission request — and a time-of-day greeting when a new conversation starts. A small bubble in the lower-left corner mutes and unmutes every cue with one click, with its own toggle chime. Phrases are synthesized with a Microsoft Edge neural voice (skipping aborted and errored turns, subagent turns, and rounds that a goal is still driving), cached under the DSH home directory and replayed locally, with the desktop SAPI voice as the offline fallback.

Requires macOS and AirPods with head tracking. Answer DSH permission prompts and questions with AirPods head gestures — nod to allow or confirm, shake to reject or shift the selected option — and install the companion macOS menu-bar app from a card inside the session.

Runs a Claude Code project's .claude/ slash commands and permissions.deny rules inside DeepSeek Harness. Command bodies expand $ARGUMENTS, positional arguments and @file references into the agent's next turn; matching tool calls are denied before they run. Every host service is probed, so a host without a command registry, working-directory service or TUI status line degrades one feature instead of failing the boot.

Bridges the Cua Driver MCP server into DSH: installs the cua-driver executable when it is missing, starts it over stdio through the in-box MCP client, and registers its 60 accessibility-first window, input, menu, and browser tools with a bundled workflow skill and one-time macOS permission guidance.

Adds a Restart button beside the permission control in the composer toolbar that relaunches DSH in one click, so freshly installed plugins apply without closing and reopening the app.

Links DeepSeek Harness to VS Code: approvals answered in native notifications, ask_user_question answered in a sidebar card, an ide_context tool fed by the active file, diagnostics and selection, selection to composer, and a sidebar with the live transcript, workspace-scoped session picker, model and permission controls.

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Puts sessions into the built-in Auto review permission preset: new sessions at creation, existing root sessions when they are restored.

Persistent Bots and group rooms inside DSH. Each Bot keeps its own model, permission preset, workspace and session across restarts; a Bot can also be backed by an installed local agent CLI (Codex CLI, Claude Code, ACP agents) using that CLI's own login and models. Unaddressed messages can be triaged by the room leader, the room accumulates a shared experience card, and every answer is a run in a durable ledger the sidebar panel replays. New Bots default to the full-access permission (any command, any file; the form asks you to confirm the risk), so choose read-only or workspace-write to confine one; Codex CLI and Claude Code Bots at full access run without their own sandbox or permission prompts.

A resident assistant for DeepSeek Harness that is deliberately not another chat box: one floating window plus one standing conversation, both independent of every other session. The heartbeat is held back by four gates — an authority grant, a daily turn budget, quiet hours and a pacing cooldown — and it keeps working across restarts through a lease it has to hold. Each wake is decided by a model that must answer SKIP or a short message, so silence is a decision rather than a failure. The window shows the standing conversation's real message flow, read from the host session store, or from the on-disk session log when the host does not publish that session, and it can send into that conversation directly. den carries the same reach as the person it stands in for, with one limit: read-only. It may read every session, this machine and work channels such as GitHub, but it does not write, send or publish, it never asks anyone for permission, and it never gates another session's tool calls. `npm run digest:github` turns GitHub notifications and your own open pull requests into three Chinese sections — waiting on you, waiting on your review, and yours — with reply drafts that are explicitly marked as unsent.

Bridge between DSH and the local WorkBuddy desktop app, in four parts: read, search and append WorkBuddy memory, skills, plans and daily logs; run tasks through the local CodeBuddy CLI with four permission profiles; drive the running WorkBuddy window over CDP (open a conversation, read its replies as sanitized rich HTML, type and send, switch the account-billed model, relaunch it with a debug port when it is missing); and a sidebar panel that puts that conversation surface inside DSH. 25 tools and 15 HTTP routes in one plugin.

Turn-level file undo for tool writes and edits: each file is snapshotted before the write lands, and the model (an undo tool), the human (a /undo command) or a button in the assistant message action row can roll back every file a turn changed. Snapshots are written in-process rather than by shelling out, so it needs no extra sandbox permission in sessions confined to workspace-write.

Plan / Build mode switcher for DeepSeek Harness: an always-visible dropdown in the composer beside the permission control that switches the current session both ways through the shipped /plan and /plan off commands, plus a Default mode row in Settings → General that decides the starting mode for newly created sessions.

Adds a Keyboard Shortcuts page to the DSH Settings panel with six rebindable commands — permission-mode cycling, reasoning-effort stepping, a status-page and a task-list shortcut — plus PgUp/PgDn input navigation and an optional composer Enter remap.

Checks an electrical work permit for the elements it must carry and for the issue and permission sequence the current electrical safety regulations require. Reports the differences it finds; it does not judge whether the work was safe or whether the permit was validly authorised.

Removes sandbox_permissions / justification arguments that cannot widen the call's current sandbox mode, so calls no longer fail with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "danger-full-access" mode'. GPT models tend to fill these optional fields on every call and pick workspace-write, which is narrower than danger-full-access. Runs in tools/pre-execute: compares the requested mode with the mode the session's sandbox policy resolves, and drops the fields when the request is the same or narrower (also drops a lone justification). Also understands the values GPT carries over from Codex's own shell tool: null, empty and use_default are treated as no request, and in a danger-full-access session any value (including require_escalated) is dropped because nothing is wider. Real widening requests, unknown modes and tools that do not advertise DSH's escalation schema are left to DSH core. Never widens permissions. Configurable tool list (default bash, pwsh, write, edit, run_code). Zero dependencies.

Talk to DeepSeek Harness from Feishu / Lark. A chat maps to a DSH session, messages become turns and answers are pushed back as cards; questions, permission requests, model switches and conversation switches are interactive cards, and inbound files and images are downloaded into the workspace.

Pushes DSH session events to phone IM and lets you reply straight under that message, injecting the text back into the right session. Covers nine event kinds: task completion, execution error, execution blocked, manual abort, token limit reached, abnormal interruption, waiting for your answer, permission request, and waiting for plan confirmation. Channels are QQ single-chat bots and Feishu custom apps, both over WebSocket long connections — no public IP, domain or tunneling needed. Several bots can be configured at once, each subscribing to the sessions it cares about. Approvals and questions arrive with tappable buttons, and replies route home through three layers (button, quoted reply, explicit short-id prefix), falling back to the most recent intervention-needed notification and echoing which session it went to.

Bridges DeepSeek Harness sessions to Feishu/Lark, Telegram and DingTalk: each chat is bound to a resumable DSH session, replies stream back as cards, and a task-end card reports the model, token usage, step count and duration. Question and permission-approval cards are answerable from the chat, and a web settings pane configures the per-channel credentials.

Windows-only plugin that shows permission requests, waiting questions, task errors and finished turns as native card windows, and can allow a permission request straight from the card.

Plays a Windows system sound when the agent opens a question dialog, when a tool asks for permission, and when a conversation turn ends, plus a fish_beep tool to trigger a sound on demand. Custom audio folders are supported.

Delegates self-contained coding subtasks to the local Claude Code subscription through the official Agent SDK and returns the result to the host session. Nineteen per-call parameters control model, thinking effort, permission mode, allowed tools, turn count and budget cap; background jobs return a jobId immediately and stream incremental output; the result carries a session handle that can be passed back as resume to continue the same conversation; commands expected to run past ~20 seconds go through the built-in mcp__dsh__shell channel, which streams output line by line without consuming model context; a Claude Code monitor panel in the session lists jobs, renders the structured process, shows live output blocks and cancels a run; the delegation procedure ships as a runtime-registered skill, so installing the plugin installs the skill.

DSH plugin: hands a long session over to a fresh session in the same workspace on /handoff or at a token threshold, carrying the preset, model, permissions and plan mode across; the brief is written by the session's own model and the switch waits for a step boundary instead of interrupting running work.