Plugins

Single-bundle reverse-engineering and pentest security plugin: first-turn tool narrowing, domain routing, and 33 tools covering APK, web, native binary, protocol, malware and LLM samples — with unpacking, license-bypass and anti-analysis case playbooks, an H-CoT evaluation engine (semantic routing, /hcot command), a web workbench with a ledger-driven tool shelf, an on-disk case workflow (auto-persisted evidence chain, E-numbered validated findings, post-compaction resume), GitHub-based external tool discovery, and 361 on-demand reference docs.

An agent preset for evidence-checked research: every step advances only through system-verified observations, L3+ claims go to an independent evaluator, and the session folds into a replayable ledger that grows into a browsable domain ontology. Requires DSH >=0.1.7-alpha.1.

OpenCode Go provider with live gateway model discovery, online models.dev capability metadata, session routing, and Web settings with subscription usage.

Red-team engagement mode: send one target organization name and a planner session runs a five-role execution team (recon, asset triage, vulnerability discovery, exploitation, internal pivot) under a configurable concurrency limit; preflight checks skills/resources and asks once for missing keys or VPS; scoring follows the 8-category / 25-point merged intrusion rules with server-side caps, highest-privilege-wins and per-service dedup; findings stay in a local SQLite fact base with discovery times. The persistent right-side console has five sections / ten pages (situation, assets, findings, report, resources), follows the selected session, and includes asset mapping, agent roster, tunnels, findings, attack chain, score targets, reports, a category-organised POC/EXP knowledge base and a skill library that explains every unusable skill. Reports now download with the target's name, include the same full actions/requests/credentials/tunnels/attack-file paths as the page, and avoid false reproduction gaps. Ships 16 bundled recon/assessment skills including DeepSeek Search/Fetch public-intel, 56 redteam_* tools and one-command self-update; attack-chain skills remain a separate toolkit Release attachment.

Framework-upgrade safety and plugin gating for DSH: a pre-upgrade session-format contract preflight that adapts incompatible plugins and agent presets before you upgrade, automatic rollback on failure, auto-quarantine of plugins that broke a boot, plus environment fingerprinting and a public contract-rule pack. The built-in multi-source marketplace is a discovery layer only.

You.com agent skill provider and MCP setup for DeepSeek Harness (dsh), registered via ctx.skills

Drive the Unity Editor from DSH through the official unity CLI: live-Editor scene commands, in-Editor C# eval and runtime command discovery over a warm unity shell session, plus a raw CLI escape hatch for project creation, tests and builds. Mounts Unity's official skill collection alongside its own Unity workflow and Asset Store skills.

In-app plugin marketplace for DSH: plugin discovery, install, upgrade, toggle and uninstall in one panel for Web and Desktop host profiles, pairing a community catalog of 4,000+ entries with customizable curated lists, plus eight agent tools and a standalone dshm CLI, without a marketplace server or account.

Multi-platform API balance and usage dashboard for the DSH web GUI: balances for DeepSeek, Zhipu GLM, Kimi, StepFun, SiliconFlow, MiniMax, OpenRouter, Novita and xAI under the composer, estimated per-session and per-subagent cost with DeepSeek peak/off-peak pricing, automatic discovery of relays configured in DSH settings, and an optional draggable whale widget.

Find DSH plugins across several community catalogs plus live GitHub and npm search, ranked by relevance, trust, freshness and bounded popularity instead of stars alone.

Multi-platform research and deep search pipeline: harvest_scout for parallel discovery across GitHub, Web, Twitter, Reddit, Xiaohongshu, Bilibili, and YouTube, harvest_deep_research for automated comprehensive research reports, plus extract, cross-source verification, and credibility auditing.

Not another memory plugin: ODR is an evolving-worlds self-improvement loop (Dream-RSI) — attempts are recorded into a Discovery Tree, and between runs thousands of strategy variants are replayed against that recorded world; a strategy, recipe or lesson is promoted only after surviving counterfactual replay, never on the model's word alone, and Sentinel gates tool calls before the budget burns; the LLM stays frozen, installable from npm as dsh-open-dream-rsi.

Kiro model provider with Builder ID, Identity Center, Google, GitHub and credential-import sign-in, automatic token and profile refresh, account usage, live model discovery, selectable reasoning efforts, streaming tool calls, provider stop-reason and context-overflow handling, and token accounting that uses Kiro's exact counters when it sends them and otherwise scales the context-usage percentage it does send by the model's advertised window.

GitHub Copilot LLM adapter: OAuth device-flow sign-in, live model discovery from the Copilot API, vision support for image-capable models (gpt-4.1, gpt-4o), and two wire protocols (Chat Completions and Responses API) with automatic endpoint routing per model.

Cache-stable progressive tool discovery: a fixed tool_search and tool_dispatch surface on every request, in-memory catalog search, nested dispatch through the Harness pipeline, and a byte-stable native tool list across discovery.

Type /私 and complete 私家大厨 — Chinese skill names, zero renaming. Patches DSH skill discovery, the / gesture and the skill tool so any Unicode SKILL.md name (私家大厨, 卡路里, 作息管家…) works: slash completion, direct /私家大厨 invocation, model skill({name}) loading. Zero config; runtime changes revert on uninstall, but the regex patch written into three DSH packages on disk stays until the next DSH upgrade replaces those files.

Connects DeepSeek Harness to OOMOL-managed apps and services, with progressive Connector Action discovery and execution plus an in-app panel for managing Provider connections.

Progressive-disclosure MCP gateway that searches large remote catalogs through `mcp_search`, then invokes exact schemas through `mcp_call` with lazy connections and bounded caches.

GitHub search, discovery and audit scripts wrapped as a SKILL.md pack around the gh CLI: repo search, multi-axis explore, trending, repo summaries, similar projects, code search, issue/PR search and org audits; ships as a dsh bundle (and on npm).

Ollama Cloud native chat adapter: direct NDJSON translation of the Ollama /api/chat wire format, model discovery with context windows and capabilities, and web search/fetch providers under the ollama-cloud id, plus a Web settings card.

Native Graphify knowledge graph plugin providing 10 code intelligence tools, topological search, god nodes discovery, and PR blast radius triage.

Publishes the DSH Web GUI to LAN or internet with dsh kept on loopback. Every source must sign in for an HMAC session cookie unless passwordless LAN is opted into. Adds self-signed or custom TLS, a secureCookies override for plaintext-HTTP proxies, and a UUID shim for plain-HTTP origins.

Lifecycle management UI for the llm-pi-ai model provider: create, edit, delete, enable and disable providers with custom headers and AES-GCM-encrypted API keys; uninstall-safe restore of parked providers, remote model discovery with batch write, smart routing with five strategies, union/intersection composites, per-model connectivity tests, and request observability.

Decentralized multi-device fleet: mDNS LAN discovery, key pairing, and SSH direct execution across networks.