Plugins

Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.

White-box AGI architecture exploration: metacognition (self-cognition loop), continual learning (knowledge flywheel), world model (condition space, spatiotemporal memory graph), self-improvement (bootstrap discipline), zero-LLM white-box pipeline, and auditable trust guardrails.

Counts persistent operations within a turn and escalates on the total: a reminder first, then an explicit stop instruction, then an approval prompt. Reads the session sandbox mode on every call, and stays silent under read-only and workspace-write.

Novel-writing guardrails: 24 novel_* tools enforce fact-ledger consistency, outline and chapter gates, a deterministic machine audit with a zero-token AI-flavor scan, and proposal-only revisions; a right-panel workbench covers reading, TTS playback, whole-book checks and batch drafting with checkpoint resume.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

Auto mode for DeepSeek Harness (dsh): an Auto entry in the Permissions selector whose approval prompts are answered by OpenGuardrails policy instead of a human — plus the full OGR guard engine underneath. No core changes.

Trellis-style workflow for DeepSeek Harness: per-turn phase breadcrumbs via agent/pre-step, bundled skill provider, and DSH-native task/phase state with git-cleanliness guardrails.

DeepSeek Harness adapter for Koma Miko Agent Specs.

Per-conversation persona / master prompt plugin: create, edit, switch and delete persona templates from the composer toolbar, with highest-priority system-prompt injection, fixed interaction guardrails, subagent inheritance, new-conversation default, and local JSON persistence.

AX-first macOS computer use for DeepSeek Harness: accessibility snapshots with stable refs, background input, Unicode typing, menus and apps, set-of-mark screenshots, on-device OCR and verified actions — 11 tools bridged to the macos-cu CLI.

Compact Codex coding mode for DSH: light prompt guardrails against GPT over-explaining, with an editable prompt and native Codex-style tools.

ICVO coding-standards kit for DeepSeek Harness (formerly dsh-coding-kit): a bundle plugin that registers tools on load and injects the standards only when apply_coding_standards is called, plus a P0 gate CLI (npx spec-wave) with G1-G7 process commands, skills install, host apply, and IDE-block refresh.

Self-evolving pitfall immunity for coding agents (Claude Code, Codex, Cursor, ZCode, DSH): capture failed-then-fixed tool episodes as SQLite+FTS5 antibodies and inject them before the agent repeats the mistake. Zero runtime dependencies.

AX-first macOS computer use for DeepSeek Harness: accessibility snapshots with stable refs, background input, Unicode typing, menus, apps, set-of-mark screenshots, on-device OCR, verified actions, and optional Jev (TypeSafe System One) semantic guards — 1

Peer communication between conversations in one DeepSeek Harness process: list the conversations the workspace shows, link one under a nickname, message it without waiting for its turn to end, read its progress without waking it, and declare rules for your own tool calls.

Self-evolving pitfall immunity for DeepSeek Harness: capture every failed-then-fixed tool episode, distil it into a reusable antibody stored in SQLite+FTS5, and inject the relevant ones before the agent repeats the mistake.

Engine-enforced guardrails for DeepSeek Harness agent swarms: quality gates reject half-done work, crash-safe checkpoints resume in place — keeps AI teams from breaking, not just running.

System Duo for DeepSeek Harness. Make your agent think fast and slow: System One decision models triage, guard, shield, mask and check your agent loop beside System Two (vllm-sr/auto), with a free app.vllm-sr.ai key.

Blocks AI coding agents from editing files without evidence and from running unapproved high-risk commands, and tells quoted dangerous strings apart from commands actually being executed.

0.8.6 fixes a startup crash: the host runtime package is an optional peer, never an installed dependency. TypeSafe Jev (System One decision model) wired end to end into DeepSeek Harness (0.8.6). Seven tools: jev_decision (1-25 parallel atomic verdicts in one call; noul/choice/score; typed answers with calibrated confidence; measured median 266-484 ms; verdicts only, never prose), jev_choose (rank 2-10 candidate approaches - fit 0-3 and risk - into an explicit composite with a recommended pick), jev_batch (NEW in 0.8.6: one set of 1-5 judgments over 1-20 texts, one real call per text at bounded concurrency, returning a paste-ready markdown table sortable by a judged dimension; built-in sentiment/priority/intent/pii/spam presets; a failed row is reported as failed with the raw error, never guessed), jev_usage (locally measured usage: calls, tokens, estimated cost, latency median and p95, per-tool mix, rolling windows, projected burn rate, optional local hard budgets, and a declared-balance remainder), jev_overview (session ledger), jev_guard_status (guard counters plus a registrations block that surfaces per-surface registration failures) and jev_verify (frozen 27-question live benchmark at concurrency 6: 96.3%, 26/27). WHAT IS NEW IN 0.8.6 - the ledger survives a restart, the remainder is derived instead of invented, and the plugin can now do batch paperwork. (1) The local ledger persists to $DSH_HOME/jev-usage.json BY DEFAULT, so the cumulative total no longer resets when the host restarts. Two real bugs behind the old silent zero were found and fixed: the ledger path only honoured DSH_HOME (absent inside the host process, so persistence was silently disabled and the file name was null), and save() wrote the still-empty in-memory ring over the history file because it ran before the first load while the debounce window swallowed the follow-up write. (2) Remaining is derived, never invented: TypeSafe exposes no balance endpoint - /v1/usage, /v1/quota, /v1/account, /v1/account/balance, /v1/balance, /v1/credits, /v1/billing, /v1/me, /v1/limits and a dozen more all return 404, and only /v1/models answers, with no balance headers - so the panel shows the remainder as your declared balance (quota.declaredBalanceUsd) minus locally measured spend since quota.balanceSince, and says plainly that it cannot be fetched instead of printing a number. (3) The composer pill re-reads every 20 s instead of every 60 s, so a call you just made shows up while you are still looking at it. (4) The collapsed pill leads with the remainder once you declare a balance, and the cumulative row is renamed when the ledger is on disk. Every tool has an in-conversation structured view; the Settings > Plugins card covers credentials, tool switches, the auto-guard, the dashboard, the prompt section, usage/quota and auto-triage. Honest by design: no API key means an explicit error, never fabricated results; every registration is quarantined so a failure degrades one surface. Tests 38/38 (npm test, ~2.5 s). Client half applies on refresh; server half needs a host restart.

Mandatory cross-review for design proposals and lessons-learned: auto-detects design doc writes and enqueues them (tier=review) into the task queue, delivers the external reviewer verdict back to the initiating session, and appends approved preventive measures to OPS-GUARDRAILS.md (append-only, conflict-checked).

DeepSeek Harness (dsh) approval answerer backed by the agent-governance sidecar — every approval/request is decided by the deny-by-default gate, L0–L4 rules and the organizational audit chain.

Commitment write-gate: operator-authored rules enforced before a tool call runs — a deterministic guard tier plus an LLM-judge tier, fail-closed by default, every block written to a contradictions log.

Self-protection guardrails for the DeepSeek Harness: protected-path interception, backup-before-destroy, CLI self-recovery commands, and strict sandbox defaulting