Plugins

Red-team engagement mode: send one target organization name and a planner session runs a five-role execution team (recon, asset triage, vulnerability discovery, exploitation, internal pivot) at up to three concurrent agents, preflight-checking skills and resources and asking once for any missing key or VPS first, guided by a built-in first-run onboarding skill; scoring follows the merged intrusion scoring rules (8 categories / 25 points) with server-side caps, highest-privilege-wins and per-service dedup, and self-registered accounts never score; findings land in a local SQLite fact base with discovery timestamps, shown in a persistent right-side console of 12 tabs (asset mapping with a discovery timeline, agent roster, session/tunnel state, five-stage attack chain, scoring targets, a report that spells out how each score was obtained — actions, exact commands, credential provenance, tunnel build commands — a category-organised POC/EXP knowledge base and a skill library with per-skill usability verdicts); ships 23 native skills, 53 redteam_* tools and one-command self-update.

Synchronizes DSH profiles and local plugin source archives through WebDAV and S3-compatible storage, with encrypted snapshots, conflict-aware recovery, and explicit self-updates.

Enterprise AI resource platform as a 22-plugin cordis bundle: org/account/role IAM, OIDC provider and App SSO, MCP server management with the platform itself exposed as an MCP server, NAS asset storage, skill hub, agent and app registries, SaaS connector management, enterprise portal data channel, department agent workbench panel, DingTalk group bridging for message and approval push, one-click remote dsh enrollment with tool proxying, usage metering, wallet billing, model gateway, audit with alerts, self-update, and a reviewed third-party plugin marketplace — 70+ ops tools become callable by the dsh agent.

Version management for dsh: inspect the installed version against every npm channel or version line, install or downgrade in one click, stream the install log live (rollback-snapshot copy progress, npm extraction progress, elapsed time), roll back instantly from local snapshots, and automate the cycle with a policy engine (silent auto-update, execution windows, daily checks). Never stops npm mid-install — a wedged run is only stopped after an hour, and a half-committed global tree is detected and repaired from the pre-install snapshot automatically. Confirms before installing a found update, auto-restarts the host after install, and falls back to a mirror when the primary registry is unreachable.

DSH self-updater in the settings page: one-click check/pull (`git pull --ff-only`), auto background checks, version diff and changelog preview with a red-dot reminder.

Self-update for the harness launcher; checks npm for a newer @deepseek-ai/dsh, stages the tarball, and applies it on harness exit or via update-and-restart from the web panel.

Manage the dsh service via `dsh --profile ctl`: systemd lifecycle (install, start, stop, restart, enable, disable, uninstall), persisted config, health probe and logs, plus shell completions and self-update.

Plugin Guard for DeepSeek Harness (DSH): isolate broken plugins so the web UI never goes down, with one-click self-update from npm.

In-app self-update for DeepSeek Harness git-source installs (check / one-click update / rollback / restart), with an optional native macOS shell.

Turns the browser PWA shortcut already on your desktop into a real launcher: it adopts that shortcut and keeps its icon, then starts dsh web silently on double-click and opens the app window; adds restart and dsh self-update (with rollback) controls to the web UI. Windows only.