Plugins

Verifiable research-report engine for DeepSeek Harness with a content-addressed evidence ledger, versioned sealed reports where every claim carries a verification verdict and the manifest hash seals the directory, and retrieval orchestration that reuses the ctx.web and ctx.jobs seams.

Hash-anchored read / edit / batch_edit / undo_last_edit tools: every line gets a unique 3-character content hash, edits target hashes instead of line numbers, and served-state verification rejects stale ranges with fresh anchors.

Authentication gateway for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing with per-user salts, HttpOnly SameSite session cookies named per DSH_HOME and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); per-user model and API-key configuration whose private entries are encrypted with a key derived from the login password and stay unreadable by any admin, with admin sharing to selected users (usable, balance visible, key never shown, revocation immediate) and unconfigured users blocked rather than falling back to the deployment configuration; per-user isolation on the REST and list APIs and per-frame ownership filtering on the WebSocket mux; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Requires the DSH 0.2.0 line (the 0.1.1-rc.2 transport line was removed in 0.7.0); passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Vision for text-only DeepSeek via Doubao Web by default (zero-cost, no API key — drives your logged-in Chrome through a Windows CDP bridge), with Antigravity IDE quota (flash/pro) or Gemini fallback; auto detail escalation, vision evidence memory with compaction rehydration, content-hash cache, and a bilingual client panel.

Make your dsh ready for serious coding. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, IPython REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.

Make your dsh ready for serious coding. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, IPython REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.

Exposes the models already configured in DeepSeek Harness through an OpenAI-compatible gateway, so other local projects can call them with any standard OpenAI client. Multiple provider candidates share one named group with ordered, balanced or random dispatch; upstream failures before any output switch to the next candidate transparently, and rate-limited requests are retried after the provider's backoff. Per-candidate call statistics (attempts, answers, failures, token/TTFT totals) appear as badges in the settings page, and daily aggregates persist to a local file with a 30-day heatmap and trend view. Until you create a key in the UI, the endpoint accepts calls from anyone who can reach it; keys (stored as SHA-256 hashes) then turn authentication on, and the endpoint stays locked even after the last key is revoked. Exposing the optional LAN listener without a key leaves the port open to the whole network. Runs on DSH 0.1.2-rc.1 through 0.1.7-alpha.1 and later.

Vets third-party plugins before you trust them: static scan for malicious patterns (exfiltration, credential access, obfuscation, persistence) and over-privileged path use, transitive-dependency coverage, official-package hash baseline for supply-chain tamper detection, and an optional plugin-tool call gate.

base64/url/hex encoding, common hashes, and UUID generation.

LAN task delegation between DSH hosts on one network: the parent dispatches a task to a child host, the child works in its own session and workspace, results and files return to the parent's inbox, sensitive actions wait for the parent's approval, and a finished task can be continued with one follow-up inside the child's existing session. Since 0.4.0 a fresh host listens on loopback only and keeps its listener off until it is enabled, the six-digit pairing code is single-use and rotates with a lockout after repeated failures, tokens travel in an Authorization header and are stored hashed, and a dispatch with no grant or with a permission above the grant is refused before anything is sent. Transport is still plain HTTP with no TLS, so use it on a trusted LAN.

Hash-anchored read/apply_patch tools for DeepSeek Harness (dsh). Every line gets a unique 3- or 4-char hash (A-Za-z0-9, configurable) that stays stable across edits; apply_patch is the only file-mutation entry point and commits one patch batch per transac

HarmonyOS delivery orchestration for DSH: freezes a four-dimension acceptance pack whose measurable criteria carry machine-checkable assertions, runs an adversarial pre-review before dispatch, hands the work to DevEco Code in Goal mode, then audits the delivery with independently gathered evidence (screenshots, UI tree, logs, hashed evidence bundle), recomputing assertion verdicts against measured values and filing rework orders; includes a cited rule catalog, a user-confirmation state and a gate calibration ledger.

Three-layer local memory for DeepSeek Harness: L1 snapshot memory (MEMORY.md/USER.md) read on demand through the memory_* tools + L2 searchable knowledge base (facts + SQLite FTS5, Chinese search via sliding-window tokenization) + L3 import from Hermes/Claude Code/Codex/WorkBuddy and from approved Agent Hub documents (memory/global, memory/projects, accepted decisions) with content-hash dedup. v0.2.0 removed every automatic injection: memory enters the context only when the model calls one of the 12 memory_* tools, and data stays on the local drive.

Local toolbox for the DSH web GUI: 35 pure-client tools (text, encoding, hashing, extraction, conversion, reference tables) in a sidebar view, plus the /toolbox command and config-driven agent tool exposure.

Appends local hash-chained JSONL receipts for tool results and session events without storing prompts, tool arguments, result text, or raw session IDs.

Layered cross-session memory for DeepSeek Harness: L0 raw turns, L1 LLM-extracted facts with conflict resolution, L2 scenes with maxScenes eviction, L3 project + global persona, hybrid FTS + vectors (built-in 384-dim lexical hashing by default, or a confi

Session-scoped delivery receipts for local artifacts: compare current file hashes with a recorded baseline, keep agent claims separate from explicit user acceptance, flag changed or unavailable files, and export a Markdown receipt through a tool, slash command, and conversation panel.

Screen-sense mode for the dsh-pet desktop pet: captures the primary display every 30 seconds, compares an 8x8 average hash of each frame, and sends the screenshot to the session model when the frame changed (and again after the idle interval even if unchanged) so the pet comments in one short bubble line. Adds /fish, /fish_look and /fish_screen commands, a status and control HTTP pair, and a change threshold plus an idle repeat interval that can be tuned in the plugin config. Windows only (PowerShell WinForms).

DSH pet plugin that adds an Arknights operator library and custom image pets: pick one of 486 operators and the plugin downloads that operator Codex v2 atlas from the pinned upstream revision, verifies every Git blob hash and installs it locally, or import your own Codex atlas (1536x1872 or 1536x2288) or a plain PNG/WebP/GIF; the pet then follows session activity, shows a bubble while a decision is pending, and can be dragged and resized.

Run one instruction on every online Windows and macOS machine, across networks and regions: a dependency-free relay talks to each machine over outbound connections only (Tailscale, a public VPS behind TLS, or a tunnel), every machine runs the command in its own checkout, and results come back with a commit, a working-tree fingerprint and a command hash so an environment mismatch is reported as unverifiable instead of being mistaken for a different result. Sending work needs its own operator token, separate from the per-machine device token.

Read-only Skill inspector for DeepSeek Harness. It shows which Skills a conversation actually loaded — from observed loading evidence only — and which Skills the current environment can discover, and gives each Skill a detail page whose left column switches between the framework, the evidence, validation, evaluation, step evidence, run logic, the before/after of a modification when there is one, the definition facts and the raw SKILL.md. Declaration and run stay apart: the body is split into structure, declared workflow and progressive disclosure, the run logic is read from local receipts, and every declared step carries its own evidence — no observed evidence is reported as exactly that, not as executed or not executed, and the run's instruction hash sits beside the current definition as match, mismatch or unavailable. The evidence view gives each subject one of three states (declared, observed, unavailable), walks definition → load → use → outcome, names what each stage cannot reach, declines to attribute an outcome to the Skill, and can copy the snapshot out as byte-stable JSON. Validation checks the Agent Skills open standard and the platform profiles separately, each finding on a rule id and labelled standard compliance or platform compatibility. Evaluation keeps repeatable cases with the conditions each run was recorded under and the four stages of runtime evidence, comparing two runs of one case item by item without scoring them. The trigger boundary keeps should-trigger and should-not-trigger prompts, has you run them in a real new session, then records what was observed — whether a load record appeared and whether it was model-invoked or user-explicit; a typed /name is not a natural trigger, and an absent load record is reported as not observed, not as not triggered. The same projections are exposed to the agent as a read-only skill_review tool, which returns a structured review packet and says what it omitted when the packet will not fit whole. The inspector, the evidence chain and these reviews are computed on this machine from the definition and the session receipts; the Chinese reading version sends the body through the host's model when you ask for it, keeping code fences, paths and frontmatter verbatim and storing the result on this machine. A Skill can also be cloned into a local copy. It does not write back to the source Skill and does not run its scripts.

Static-only plugin gate and clinic for DSH: audit before install, hash-and-capability lock after install, local fingerprint peer search over GitHub topic:dsh-plugin, and mechanical detox. Never executes the target plugin.

Transactional uninstall engine: every destructive action runs validate/preview/execute/undo with Saga rollback, WAL crash recovery, hash-chain audit, hardlink dedup, and a Bayesian oracle that predicts success probability before you commit.

A `/backstory` command and tool that annotate each line with the git commit that last touched it and the agent turn + prompt that wrote it, from a persistent per-line ledger (drift-proof by content hash), DSH-* commit trailers, or the live session log.