Plugins

Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.

White-box AGI architecture exploration: metacognition (self-cognition loop), continual learning (knowledge flywheel), world model (condition space, spatiotemporal memory graph), self-improvement (bootstrap discipline), zero-LLM white-box pipeline, and auditable trust guardrails.

Counts persistent operations within a turn and escalates on the total: a reminder first, then an explicit stop instruction, then an approval prompt. Reads the session sandbox mode on every call, and stays silent under read-only and workspace-write.

Novel-writing guardrails: 24 novel_* tools enforce fact-ledger consistency, outline and chapter gates, a deterministic machine audit with a zero-token AI-flavor scan, and proposal-only revisions; a right-panel workbench covers reading, TTS playback, whole-book checks and batch drafting with checkpoint resume.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

Auto mode for DeepSeek Harness (dsh): an Auto entry in the Permissions selector whose approval prompts are answered by OpenGuardrails policy instead of a human — plus the full OGR guard engine underneath. No core changes.

Trellis-style workflow for DeepSeek Harness: per-turn phase breadcrumbs via agent/pre-step, bundled skill provider, and DSH-native task/phase state with git-cleanliness guardrails.

DeepSeek Harness adapter for Koma Miko Agent Specs.

Per-conversation persona / master prompt plugin: create, edit, switch and delete persona templates from the composer toolbar, with highest-priority system-prompt injection, fixed interaction guardrails, subagent inheritance, new-conversation default, and local JSON persistence.

AX-first macOS computer use for DeepSeek Harness: accessibility snapshots with stable refs, background input, Unicode typing, menus and apps, set-of-mark screenshots, on-device OCR and verified actions — 11 tools bridged to the macos-cu CLI.

Compact Codex coding mode for DSH: light prompt guardrails against GPT over-explaining, with an editable prompt and native Codex-style tools.

ICVO coding-standards kit for DeepSeek Harness (formerly dsh-coding-kit): a bundle plugin that registers tools on load and injects the standards only when apply_coding_standards is called, plus a P0 gate CLI (npx spec-wave) with G1-G7 process commands, skills install, host apply, and IDE-block refresh.

Self-evolving pitfall immunity for coding agents (Claude Code, Codex, Cursor, ZCode, DSH): capture failed-then-fixed tool episodes as SQLite+FTS5 antibodies and inject them before the agent repeats the mistake. Zero runtime dependencies.

AX-first macOS computer use for DeepSeek Harness: accessibility snapshots with stable refs, background input, Unicode typing, menus, apps, set-of-mark screenshots, on-device OCR, verified actions, and optional Jev (TypeSafe System One) semantic guards — 1

Peer communication between conversations in one DeepSeek Harness process: list the conversations the workspace shows, link one under a nickname, message it without waiting for its turn to end, read its progress without waking it, and declare rules for your own tool calls.

Agent security guardrail: intercepts and audits every tool call, requiring human confirmation on sensitive operations.

Self-evolving pitfall immunity for DeepSeek Harness: capture every failed-then-fixed tool episode, distil it into a reusable antibody stored in SQLite+FTS5, and inject the relevant ones before the agent repeats the mistake.

Engine-enforced guardrails for DeepSeek Harness agent swarms: quality gates reject half-done work, crash-safe checkpoints resume in place — keeps AI teams from breaking, not just running.

Inject rules when needed, without wasting context. DSH port of opencode-stream-rules.

Reviews side-effecting tool calls against the project rules and the current goal before they run, and denies anything out of scope with a fail-closed verdict and no bypass switch.

String-matches tool-call input arguments, blocks dangerous tool calls (deny) or allows them with an injected warning (warn), and ships a full rules-management panel.

Vets local, npm, and GitHub plugin source before installation, blocks configured high-risk tool calls at runtime, audits output secret patterns, and writes HMAC-chained local audit logs.

System Duo for DeepSeek Harness. Make your agent think fast and slow: System One decision models triage, guard, shield, mask and check your agent loop beside System Two (vllm-sr/auto), with a free app.vllm-sr.ai key.

Decision layer for dsh: provider-agnostic typed judgments (Jev first) behind tool guardrail, model routing, result judging, and machine approval seams