Plugins

Provides six code quality skills for code review, architecture audits, technical debt, test quality, health dashboards, and remediation.

Vision for text-only models: paste an image and the model switches to a Vision Toolkit variant for image Q&A, multi-image comparison, long-screenshot OCR, screenshot-to-UI reproduction, element grounding, and pixel diff. No API key by default — images are processed by the author-hosted free service, 100 per machine per day; configurable to your own provider.

Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.

Free, keyless web search for DSH: 7 engines (DuckDuckGo/Bing/SearXNG free + Exa/Perplexity/DeepSeek paid), auto-failover, settings-page UI with API key inputs and official links, web_fetch, and an engine test tool.

Single-bundle reverse-engineering and pentest security plugin: first-turn tool narrowing, domain routing, and 33 tools covering APK, web, native binary, protocol, malware and LLM samples — with unpacking, license-bypass and anti-analysis case playbooks, an H-CoT evaluation engine (semantic routing, /hcot command), a web workbench with a ledger-driven tool shelf, an on-disk case workflow (auto-persisted evidence chain, E-numbered validated findings, post-compaction resume), GitHub-based external tool discovery, and 361 on-demand reference docs.

HarmonyOS NEXT skill bundle for DeepSeek Harness with offline API references and DevEco, HDC, and emulator automation guidance.

Complete reverse-skill pack (85 SKILL.md) as a DeepSeek Harness Cordis plugin: reverse engineering, authorized pentesting and security-research skill router.

Manages DSH skills and MCP servers from the web settings: skill cards with hot enable/disable, workspace scopes, groups, batch migration and drag-and-drop import, plus stdio/HTTP MCP CRUD with connection tests, secret redaction and the unified dsh-panel CLI.

Cleans AI traces from Russian text: finds chatbot copy-paste artefacts (ChatGPT, Gemini, Grok, Perplexity, DeepSeek), strips hidden text marks (zero-width characters, invisible layout; shadow scan catches markers split by invisibles), and rewrites the text into natural prose on request; 40 regex markers, 38 with full evidence-registry entries; 156 gates, 530 tests; offline, text-only bundle (binary metadata removal lives in scripts/).

Red-team engagement mode: send one target organization name and a planner session runs a five-role execution team (recon, asset triage, vulnerability discovery, exploitation, internal pivot) under a configurable concurrency limit; preflight checks skills/resources and asks once for missing keys or VPS; scoring follows the 8-category / 25-point merged intrusion rules with server-side caps, highest-privilege-wins and per-service dedup; findings stay in a local SQLite fact base with discovery times. The persistent right-side console has five sections / ten pages (situation, assets, findings, report, resources), follows the selected session, and includes asset mapping, agent roster, tunnels, findings, attack chain, score targets, reports, a category-organised POC/EXP knowledge base and a skill library that explains every unusable skill. Reports now download with the target's name, include the same full actions/requests/credentials/tunnels/attack-file paths as the page, and avoid false reproduction gaps. Ships 16 bundled recon/assessment skills including DeepSeek Search/Fetch public-intel, 56 redteam_* tools and one-command self-update; attack-chain skills remain a separate toolkit Release attachment.

PTES-based penetration testing plugin with Root-Orchestrator architecture for DeepSeek Harness.

Drive the Unity Editor from DSH through the official unity CLI: live-Editor scene commands, in-Editor C# eval and runtime command discovery over a warm unity shell session, plus a raw CLI escape hatch for project creation, tests and builds. Mounts Unity's official skill collection alongside its own Unity workflow and Asset Store skills.

Engineering-discipline guard: requirements grill before the first edit, red/green test-evidence gates, forked adversary review, and a delivery report with a per-dimension verification workflow.

Runs Midscene on the models already configured in DeepSeek Harness instead of separate third-party API keys: hosts an OpenAI-compatible bridge on 127.0.0.1 (default port 8787, automatically skipping occupied ports) that proxies chat completions, streaming and non-streaming, to the DSH host model layer, so DeepSeek official routing, CodeBuddy, Codex and custom OpenAI/Anthropic endpoints all become available to Midscene agents while credentials stay inside the provider plugins and the bridge never touches them. A `/v1/midscene-env` endpoint generates the four MIDSCENE_MODEL_* environment lines with the model family inferred, and seven built-in skills — browser, desktop, Android, iOS and HarmonyOS automation plus a Vitest E2E skill and a Midscene knowledge reference — appear in the session skill catalog without `npx skills add`. Install from npm with `dsh plugin --profile web add @tnnevol/dsh-midscene`.

Quantitative R&D toolkit for DeepSeek Harness — 59 tools across six domains covering market data, indicators, factor evaluation, walk-forward ML validation, risk (VaR/CVaR/drawdown/Beta with Kupiec POF), options, bonds, FICC and fund simulation, with an end-to-end PDAT→PET research pipeline.

QA pipeline as 10 agent skills: requirement analysis, test strategy, case writing and review, E2E (Playwright) and API automation, exploratory, regression scope and bug analysis, backed by a shared knowledge base with format rules, risk model and schema validators.

Puts the Markdown documents, source files, images and video that already exist anywhere in the session workspace into the DSH sidebar, ranked by relevance to the current conversation. The default lexical mode matches your recent messages against title, summary and body locally with IDF weighting (BM25) — no model calls, no network, nothing leaves the machine. The list comes from scanning the workspace rather than from a recent-files list, so restarting DSH or opening a new session does not empty it. Results are organised into a three-tier reading order (primary / supporting / related) with a verifiable reason on every row — which field matched, which document cites this one — and one click opens an in-place preview: Markdown as rendered text, relative-path images actually drawn, source code with the host's own syntax highlighting, video streamed over HTTP Range. The same Context Pack is exposed to the agent as a knit_docs tool. Later versions added read evidence and lifecycle tracking (attribution is frozen at the moment of reading), pin / exclude (exclusion applies before retrieval, and is undoable), relation evidence (references / imports / tests, with line numbers) and an incremental index reused across restarts. Since v0.23 there is also an optional hybrid mode: it is off by default and only runs once you configure an Ollama or OpenAI-compatible embedding provider yourself. When it runs, what leaves the machine is your query text plus each candidate file's title and summary — a Markdown summary is an excerpt of the body's first paragraph (at most 60 characters), a code file's summary is its workspace-relative directory, and an image or video contributes its file name; full bodies and absolute paths are not sent, and a loopback provider keeps everything on this machine. Since v0.24 it also associates uncommitted changes: a read-only git status (fixed argv, no shell, whitelisted child-process environment) combined with the same reference / import / test / mention evidence shows which files a change is likely to drag along, and it is off by default. The benefit of semantic retrieval still awaits a real-provider run, so no recall improvement is claimed.

Multi-agent workflow for math-modeling contests: the "UltraMath" preset runs a problem from reading through framework, derivation, coding, verification, paper and review, plus 4 single-stage role presets (mathematician, engineer, writer, reviewer) and 33 model-library skill docs.

Classifies pending tool calls with Jev (TypeSafe AI's non-generative decision model) on tools/pre-execute — confident high-risk calls are denied, ambiguous ones escalated to approval — and auto-approves clearly-granted reversible calls on approval/request behind argument-evidence gating. Also subclasses the session-reference resolver so snapshots keep Jev-scored messages instead of dropping oldest-first. Degrades to stock behavior on any provider failure; shadow mode with a /jev-stats command; TypeSafe or OpenRouter endpoints; 64 tests.

QA project workbench for dsh: manage test projects, requirements, test cases, defects, milestones, reports and approval gates through a browser UI and 18 QA-domain tools.

Adds an optimize button beside the composer that analyzes and rewrites the prompt draft with SSE streaming, conversation-context awareness (template vs intent-polish strategies), an edit-continuity memory chain, undo, and model routing with fallback and a connectivity test.

DSH bundle that registers 13 native codegraph_* tools wrapping the codegraph CLI, so agents bootstrap, maintain, and query a pre-indexed code knowledge graph (symbol query, explore, node trail, callers/callees, impact, affected tests) instead of grepping files.

OMK — Observe. Measure. Know. Evidence-backed knowledge changes for AI applications.