Plugins

Tool catalog for agents: search ~2,600 external endpoints (SEO and SERP, backlinks, social, people and company enrichment, ad libraries, scraping) by the task you want done, read each one's parameters and per-call price, then call it with the credential injected server-side. Ships the skill plus an MCP row that stays disabled until TREG_TOKEN is set.

Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.

One-click backup, export, import and migration of a whole DSH config: settings, plugins, MCP, skills and workspaces. Secrets are excluded by default and, if you opt in, are AES-256-GCM encrypted rather than written in the clear; imports preview first and auto-backup with rollback, profiles hold multiple setups, and remote sync pushes portable config through a private Git repo with secrets excluded.

Manages DSH skills and MCP servers from the web settings: skill cards with hot enable/disable, workspace scopes, groups, batch migration and drag-and-drop import, plus stdio/HTTP MCP CRUD with connection tests, secret redaction and the unified dsh-panel CLI.

Full-screen Changzhengji-themed boot animation for DSH with a six-step authorization sequence, seven built-in real-voice packs, two switchable emblems, five switchable character portraits, and an optional access-password gate.

Pre-submit pull-request hygiene checks inside DeepSeek Harness: scans the current diff for TODO leftovers, hardcoded secrets, and non-conventional commit subjects.

Commit-time audit harness for AI coding agents: 28 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and a full MCP toolset. Installable via dsh plugin add.

MCP server manager (stdio / streamable-http): per-working-directory project and global config tiers; project-level MCP collapsed into 4 atomic tools through a middleware layer by default (`middleware: all` folds in global servers too, hot-switchable in the settings page); workspace isolation prevents cross-project interference; configs keep `${ENV}` references only, with no plaintext secrets on disk; runtime registration API for other plugins to inject MCP servers.

Honcho memory plugin by Plastic Labs: injects the user profile, session summary and relevant conclusions at session start, uploads each turn to Honcho in the background with secrets redacted, and adds honcho_search / honcho_chat / honcho_remember tools plus a /honcho status command; configured through the ~/.honcho/config.json shared with the other Honcho integrations, against hosted honcho.dev or a self-hosted instance.

Detects prompt-injection, jailbreak, and secret-leak patterns on the agent/pre-step, tools/pre-execute, and tools/post-execute seams with allow/ask/block tiers, sanitized defend/detection audit events, a defend_report tool, and a destructive-delete command guard.

Image generation and image reading for DSH: an Images page in the sidebar, labelled 图像 in Chinese (one row per model, 10 ratios, 1K–4K sizes, a contact sheet with detail cards, zoom, reuse and delete), three preset providers plus custom endpoints — one needs no key at all — and a vision-review skill. A pasted key is written to ~/.dsh/secrets/media-tools.env (mode 600) and only sent to the provider you picked. The page follows the harness language (Chinese or English). Requires Python 3.9+ (generation runs through scripts/generate.py); the page needs desktop DSH 0.2.1+.

Security-audit methodology skill pack plus the plugin_vet supply-chain gate: eight agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) in Chinese and English editions, with an npm provider bundle that mounts the skills and registers the automated plugin_vet pre-install scanner.

PII masking for DeepSeek Harness — anonymizes names, phones, emails, ids, and keys before requests and restores them at the display layer, keeping plaintext out of session logs.

Fine grained per tool permission rules for DSH at the tools/pre-execute gate, deny and ask lists in Claude Code rule syntax (`Bash(rm -rf:*), Read(_secrets_), mcp__server__tool`), works standalone without migrating.

Local security audit: config, plugin origins, sessions, network exposure — read-only redacted risk report.

Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.

Bridges DeepSeek Harness to LINE: runs its own signed webhook server, sets up a Cloudflare Tunnel (quick URL or an API-token tunnel), keeps the LINE webhook endpoint pointed at the current tunnel, and gives each LINE user a separate session with a chosen persona, plus optional scheduled check-ins. Requires a LINE Messaging API channel (Channel ID and Channel Secret); only allow-listed LINE users, or users approved from the pending queue, can talk to the bot.

Git-style conversation branching that mirrors how real programmers collaborate: a secretary root branch dispatches tasks to child branches with their own contexts, merging back only compressed summaries via squash or rebase; ships /branch commands, a branch tab, branch-to-branch messaging, and a governance baseline pairing each session branch with a git worktree.

Runs the agent's shell and file tools in disposable Podman containers, so its access is constrained to the workspace project by default, and adds container, image, volume and secret management with approval-gated control.

Migrate Codex (OpenAI Codex CLI / Desktop) MCP servers, skills, instructions, memory and session history into DeepSeek Harness with a visual panel or CLI, with dry-run previews and secrets migrated as-is.

Executor/advisor workflow ported from pi-advisor-flow: the executor calls ask_advisor for a second opinion at key decisions, after repeated failures and before completion; equivalent repeated tool calls are intercepted before execution for an advisor review with a proceed/revise/blocked verdict, and hard mode force-reviews every turn before it closes. Per-call token and cost ledger with /advisor status readout, privacy tiers for repo context and file contents, six-shape secret redaction, and a web settings card; advisor failures never stall the main loop.

WeChat Official Account source collector: QR-login credential profiles, rate-limit-safe crawling with cooldown, RSS second water source, and secret-safe handoff to ContentStudio.

Windows desktop-control plugin for DeepSeek Harness: screenshot, local OCR and UI Automation with a content policy (dangerous labels / sensitive windows / secrets) and action verification (hit-test, expect, verifyText). Fork of qingying012/dsh-desktop-con

Reads and writes a self-hosted Bitwarden/Vaultwarden vault from any session: eleven bitwarden_* tools, real-time WebSocket sync with a polling fallback, a settings panel with readonly, ask and auto write modes, and optional local masking — with masking on, passwords surface as stable placeholders unless revealed one field at a time, and on-disk session logs are swept for bitwarden secrets. Masking and log sweeping are separate switches.