Plugins

Secure remote access for the DeepSeek Harness Web UI: a login gate, MFA/TOTP, signed session cookies, optional admin/user/guest roles, in-browser workspace selection, and allowlisted remote file previews.

Access the dsh web UI over LAN: HTTP/HTTPS/WS forwarding plus TLS (self-signed or custom certificates); adaptive Brotli/gzip compression for HTTP and permessage-deflate for WebSocket; half-open WebSocket probing keeps mobile clients from going stale after backgrounding; launch-token auto-injection lets LAN devices connect without copying the token; DNS-rebinding protection + loopback-only upstream allowlist.

Two-way iMessage channel for DeepSeek Harness over Photon: sender allowlisting, session commands, in-chat approvals and questions, and a Settings page for device authorization and hosted-line setup.

Private loopback DSH Web gateway for Tailscale Serve, Cloudflare Access, and Headscale TCP Serve, with exact principal allowlists and guided fail-closed setup.

Private Tailscale access for DeepSeek Harness Web that allowlists users from the trusted Tailscale-User-Login header that Serve injects, with a loopback-only gateway and guarded Serve setup.

Adds a workspace-write++ permission that keeps file tools inside the workspace while skipping the Windows process sandbox for wildcard-allowlisted executables such as Git Bash.

A single-character agent that lives across QQ (via SnowLuma / OneBot 11), Bilibili and Douyin (the Douyin channel needs an always-on Windows desktop): persona cards with slowly evolving traits, per-person memory with Ebbinghaus decay and correction, a virtual clock driving a daily routine, proactive messages, auto-extracted memories, and a ten-tab settings panel covering retrieval, persona, routine, memory inspection, channels, habits, models and usage. QQ groups are deny-by-default: a group is answered only when it is on the allowlist or allGroups is explicitly switched on, and it still has to @-mention the bot. Private chats answer QQ friends only. Bilibili/Douyin auto-reply is off by default, limited to the owner, allowlist and mutual follows on Bilibili, and to the owner and allowlist on Douyin unless reply-to-everyone is explicitly enabled. Vendors MIT-licensed code from dsh-qq-bridge and dsh-douyin-bridge, credited in-source with their LICENSE files; it does not need either installed alongside.

Switchable backends behind the native web_search and web_fetch, chosen per session from a composer menu or /setup-search and /setup-fetch: DeepSeek, Exa, Firecrawl, Tavily, Tinyfish, OpenAlex, Semantic Scholar and server-side model search for search; local HTTP with a private-network allowlist, the DeepSeek Fetch API, Exa, Firecrawl, Tavily and Tinyfish for fetch.

Discord adapter that installs into a dsh web or desktop profile: @mentions and threads bind to sessions with streaming replies and live tool-activity rows, nine slash commands cover workspace binding, permission presets and model selection, and tool approvals and user questions are claimed by whichever of Discord or the web UI answers first, behind a deny-first guild allowlist.

MySQL connector for DeepSeek Harness: configure multiple connections in the settings page with per-connection table allowlist and write permission, switch the active connection from the composer, and expose mysql_query / mysql_tables / mysql_execute tools to every agent preset.

web_search provider for DeepSeek Harness with switchable search backends; installed through dsh-tool-web-enhanced-profile

Identity-gated Tailscale access to the Web GUI with dsh still bound to loopback: a 127.0.0.1 proxy published by `tailscale serve` admits a request only when the Tailscale login it stamps is allowed, with an optional per-device allowlist, so the privileged /api methods behind the loopback check — Settings, Models, Plugins — answer without dsh being told to trust a remote host.

A guarded local fetch provider for the ctx.web seam — the backend dsh does not ship for its own web_fetch tool. Every redirect hop is re-resolved and checked against the non-routable ranges, with a streamed size cap and a content-type allowlist.

Feishu/Lark IM channel for DeepSeek Harness agents with native thinking-process messages, approval cards, live goal and todo cards, workflow fan-out lines, session text search, and background job and subagent settlement notices. Access is bounded by the Feishu app's own visibility scope by design — anyone the app admits can drive the agent and answer its approvals unless the optional sender, group and approver allowlists are filled in.

Connects DeepSeek Harness to QQ over OneBot 11/12, Satori, Milky or the official QQ bot API, with a separate session per group or private chat and nine built-in tools: group management, chat history with image understanding, web search, page fetching, reverse image search and image generation. Optional proactive chatter reads recent messages on an interval and decides whether to join in, with the judging and speaking stages able to use different models. Models, proxy and allowlists are configured in the DSH settings page. First run requires an owner (auth.owners): with it empty the plugin drives no sessions at all (deny by default, so installing it does not expose the bot); once set, private chats and groups work immediately, guests only reach the guest tool allowlist while qqbot and qqconfig stay owner-only.

Database explorer panel for DeepSeek Harness: connect SQLite, MySQL/MariaDB, PostgreSQL, SQL Server, MongoDB, ClickHouse, Redis, Elasticsearch and Qdrant from a third Conversation tab — browse schemas, page through data, edit cells, insert rows, design and drop tables, run SQL, import/export CSV/JSON/SQL/Markdown, and draw editable E-R diagrams. Read-only connections enforce statement-level allowlists, agent tools ship read-only by default with an opt-in write flag, and every write (including refused attempts) lands in an auditable log. Ships an MCP stdio server exposing the same connections to external AI clients.

Deterministic keyword routing, allowlisted model switching, and an isolated image_gen channel for DeepSeek Harness.

Fail-closed Feishu (Lark) channel bridge: chat with a bot, get dsh agent turns back — with opt-in human-in-the-loop tool approval (Allow/Deny cards before every bash call, fail-closed timeout). Official-Python-SDK-only integration (exact-pinned); deny-by-default allowlist, webhook signature/timestamp/replay verification, per-chat sticky sessions; daily latest-SDK compatibility canary; bilingual docs.

Deferred tool loading gate: inject allowlisted tools in full, mark the rest for the host deferred-loading chain, and expose them as searchable placeholders with a settings card.

Personal QQ channel for dsh: managed NapCat with QR login, private/group AI replies with batching and image understanding, local archive with polling backfill, in-group @ and self-recall, QQ Zone guestbook tools, and a sidebar panel. By default any QQ user who DMs the account (or @s it in a group) gets an AI reply; set access.privateMode / groupMode to allowlist to restrict. Owner-only commands stay owner-only.

Feishu/Lark gateway for DeepSeek Harness with topic-persistent conversations, live execution cards, image and file inputs, in-chat approvals and questions, source allowlists, and durable one-time or recurring agent tasks created in natural language.

Adds subagent_route and subagent_fork_route delegation tools where the model itself picks the provider/model route for each child; the deployment only sets the spawn/fork backend, background policy and allowedProviders allowlist, while continuable children and background jobs reuse the official send_message / job_output tools.

Automatically retries model failures (drops, timeouts, rate limits, 5xx) in-turn. Retry count, delays, backoff, fallback and more are configurable. Rate-limit backoff is capped and jittered, server retry hints are honored, and optional retry-until-success keeps going within a time ceiling. Every option is editable from the plugin config or the sidebar panel: retry count, initial and max delay, backoff factor and jitter, rate-limit delay window, retry-until-success ceiling, fallback trigger and switch cap, dead-route blacklist TTL, log file. When a route keeps failing it can switch to a pinned, allowlist-filtered, or catalog-picked alternate model route, with a 30-minute dead-route blacklist (auth failure, subscription expired, billing) and a stale-assembly guard that keeps retried requests on the switched route. Ships a right-sidebar panel with live retry state, route labels and incident counters, Chinese and English locale, and memory-only logging by default.

Browser automation for DSH: the agent fills in forms, scrapes lists and works across tabs in real pages, using the logins you already have. It drives its own visible window on your desktop — minimise it and it keeps working without stealing focus — and a sign-in, CAPTCHA or native dialog stops the run and hands the page back to you: it never confirms on your behalf. Login state persists (own profile plus session-cookie re-injection). 23 Playwright tools (20 always on, 3 gated and off by default), with a URL allowlist, dialog suspension and a CDP method allowlist that are mechanism-level and pinned by tests.