Plugins

Auto mode for DeepSeek Harness (dsh): an Auto entry in the Permissions selector whose approval prompts are answered by OpenGuardrails policy instead of a human — plus the full OGR guard engine underneath. No core changes.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

White-box causal guardrail for dsh: every tool call is adjudicated before execution along a deterministic causal logic chain — blocks destructive and credential-file operations, escalates repeated boundary violations, cuts faulting links until verified-fixed, and gives risk verdicts on un-auditable execution; runs fully local with zero API cost, plus 6 white-box self-check tools.

Novel-writing guardrails: 20 novel_* tools enforce fact-ledger consistency, phase and chapter gates, machine audit with deterministic metrics, and proposal-only revisions; a right-panel workbench covers reading, TTS playback, polish, proofread, continuity checks and batch drafting, and a bypass engine runs internal steps off the main conversation.

DeepSeek Harness adapter for Koma Miko Agent Specs.

Trellis-style workflow for DeepSeek Harness: per-turn phase breadcrumbs via agent/pre-step, bundled skill provider, and DSH-native task/phase state with git-cleanliness guardrails.

ICVO coding-standards kit for DeepSeek Harness (formerly dsh-coding-kit): a bundle plugin that registers tools on load and injects the standards only when apply_coding_standards is called, plus a P0 gate CLI (npx spec-wave) with G1-G7 process commands, skills install, host apply, and IDE-block refresh.

Compact Codex coding mode for DSH: light prompt guardrails against GPT over-explaining, with an editable prompt and native Codex-style tools.

Engine-enforced guardrails for DeepSeek Harness agent swarms: quality gates reject half-done work, crash-safe checkpoints resume in place — keeps AI teams from breaking, not just running.

Inject rules when needed, without wasting context. DSH port of opencode-stream-rules.

Agent security guardrail: intercepts and audits every tool call, requiring human confirmation on sensitive operations.

TypeSafe Jev (System One decision model) for DeepSeek Harness, end to end: jev_decision (choice/score/noul, parallel, typed answers + confidence), a Settings > Plugins card for the API key and switches, inline tool views showing every decision in the conversation (answer, confidence, latency, cost), an auto-guard (deterministic + Jev risk/loop checks), a local /jev dashboard, and an online verification benchmark (96.3% on 27 labeled questions, median ~283 ms on jev-latest, 2026-09-21). Honest by design: real API only, no mock fallback.

String-matches tool-call input arguments, blocks dangerous tool calls (deny) or allows them with an injected warning (warn), and ships a full rules-management panel.

Vets local, npm, and GitHub plugin source before installation, blocks configured high-risk tool calls at runtime, audits output secret patterns, and writes HMAC-chained local audit logs.

Mandatory cross-review for design proposals and lessons-learned: auto-detects design doc writes and enqueues them (tier=review) into the task queue, delivers the external reviewer verdict back to the initiating session, and appends approved preventive measures to OPS-GUARDRAILS.md (append-only, conflict-checked).

Honesty guardrails on the tool pipeline: blocks a coding agent from weakening tests, swallowing errors, stubbing type checks, or deleting tests through the shell — nine deterministic hooks, each backed by a planted-failure test proving the guard can fail.

DeepSeek Harness (dsh) approval answerer backed by the agent-governance sidecar — every approval/request is decided by the deny-by-default gate, L0–L4 rules and the organizational audit chain.

Commitment write-gate: operator-authored rules enforced before a tool call runs — a deterministic guard tier plus an LLM-judge tier, fail-closed by default, every block written to a contradictions log.

Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting

Configurable per-turn budgets for supported file mutations, limiting distinct files, mutation calls, and UTF-8 payload bytes before tool execution.

Peer communication between conversations in one DeepSeek Harness process: list the conversations the workspace shows, link one under a nickname, message it without waiting for its turn to end, read its progress without waking it, and declare rules for your own tool calls.

Per-conversation persona / master prompt plugin: create, edit, switch and delete persona templates from the composer toolbar, with highest-priority system-prompt injection, fixed interaction guardrails, subagent inheritance, new-conversation default, and local JSON persistence.

LaTeX and BibTeX guardrails for DeepSeek Harness: compile checks with automatic xelatex/lualatex detection, BibTeX entry deduplication and field filling from Crossref, and \cite key audits against the .bib file.

AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.