Plugins

Bridge an official QQ bot to DeepSeek Harness in-process: a QQ message starts or resumes a real DSH session inside the host (it appears in the desktop sidebar when its working directory is a registered workspace) and the answer is sent back to QQ as text, image or file. Requires a QQ official bot application (AppID + AppSecret).

Connects DeepSeek Harness to the hosted Local Commander MCP server at localcmd.app via mcp-remote with browser sign-in, to read files and Git, run the checks you approve and check local services on your Windows computers. Requires a Local Commander account and the paired agent running on the Windows PC.

Rice on a Stick: Expose control over DeepSeek Harness (dsh) through MCP (Streamable HTTP) and dsh's native tools, with a configurable list of allowed models. Long-tail host endpoints can be invoked via a generic, audited bridge. By default, it listens only on 127.0.0.1, with an optional access token.

Union IM bridge for DSH — an independent implementation uniting the capability sets of community peer plugins (xmanrui/dsh-im, MichengAI/dsh-im-connect). Drive your agent session from 15 channel adapters across 12 platforms (including email; WeCom/DingTalk/QQ each contribute two: bot + self-built app or notify tier) — WeChat (official iLink QR bind), Feishu/Lark (long-connection + streaming cards; the voice tier requires system ffmpeg), Telegram, Discord, WeCom intelligent bot & self-built app (signed callback), DingTalk (stream + AI Card and custom-robot notify), QQ official bot (plus notify tier), Slack (Socket Mode), WhatsApp (Baileys QR pairing; the dependency ships as an optionalDependency of the plugin package), Matrix, iMessage (macOS only), Email (IMAP/SMTP thread routing). The cross-version narrow waist auto-adapts settings gen1/gen2/gen3 across hosts 0.1.2-rc.1→0.2.1-rc.2 (12-tag enum; rc.2 verified by a real desktop-profile install with double read-back) using capability probing only, never version branches. In chat: a 25-command panel, tool-approval and question loops answered in the originating chat (deny-by-default, initiator-only, 5-min expiry), image/file input gated on host model metadata, deliverable file return, a delivery log with bounded retry (uncertain is never re-sent), proactive delivery and fragment composition. It also splits the native sidebar into self-owned Tasks / Channels tabs (standing down entirely when another plugin already owns the slot), registers an `im-concise` agent preset plus reply sanitisation that keeps GenUI fences and raw HTML out of text-only chats, renders `svg` fences to PNG images, guards model choice with an allowlist, and mirrors each turn's final answer to notify channels via `/relay` (addressed by account ID or alias, never guessed on ambiguity). Secrets are one-way into the vault and never echoed back. npm: `dsh-im-union`.

iOS home-screen fix and always-on kit for DeepSeek Harness remote access: overrides the PWA manifest start_url to /pair-app so the phone icon stops hitting the harness 401, and ships a hidden watchdog that keeps the desktop host and its tunnel alive while the PC is on. Requires @linxin666/dsh-remote-web-ui (it serves /pair-app); the watchdog scripts are Windows-only.

Compaction integrity: directive lines (never/must/必须 style markers) extracted from the compacted range are verified against the summary — verbatim or by content-word coverage — and every constraint the session silently forgot is reported and written to a JSONL ledger; pinned constraints from config are checked on every compaction.

An independent permission gate above the built-in sandbox. It blocks writes outside the workspace and to protected paths even under danger-full-access, refuses whole-file overwrites without a complete fresh read, and keeps ZIP restore points plus Recycle Bin copies before destructive actions.

Encrypted local credential vault for DeepSeek Harness: sidebar record management, an info_records tool for pre-sign-in lookups, opt-in chat capture, per-record manual-only mode, and AES-256-GCM storage protected by Windows DPAPI, the macOS Keychain, or the Linux Secret Service.

Registers one agent tool, plugin_guard, that statically scans a DSH plugin package before it is installed and reports a verdict with the reasons: a missing or broken dsh.bundle.patch, a missing dsh.permissions block, install scripts, dangerous APIs and obfuscation, dependency risk, and source that is not indexed and therefore cannot be verified. Read-only: the scanned code is never imported, installed, evaluated or run.

Pre-execution guard: a `tools.guard` predicate decides allow, ask or refuse per permission preset for dangerous shell commands (git hook bypass, catastrophic `rm`, download-and-run, git history rewrites) and for edits to credential paths or to files the turn never read, and hands the model the reason plus a working alternative.

Replaces detected secrets (OpenAI, AWS, GitHub, PEM, Bearer) with deterministic, structurally valid honey tokens before they reach the model or the session file; adds manual marking for values the detectors miss, explicit user-visible restore, a cross-session canary alarm, and an opt-in JSONL log of substitution counts that never records the underlying values.

Restrict the file access of agents in any sandbox mode (read-only / workspace-write / danger-full-access / auto) to the session workspace, and ask the user to rule on cross-border access. Each session can also use the gear selection box next to the composer to relax the cross-border gate to 「 read-only outside workspace 」 or 「 fully release 」.

Pre-publish credential audit: walks a directory tree and flags API keys, tokens, private keys, database connection strings and hard-coded passwords before you commit, publish or ship. Zero dependencies, fully offline, findings are redacted to the first six characters.

Registers one `doc_ocr_sign_fix` tool for DeepSeek Harness: on macOS it diagnoses and repairs the condition where the bundled Python cannot load native extensions (onnxruntime, cv2, pypdfium2) because of the hardened runtime and library validation, by injecting the disable-library-validation entitlement and re-signing the interpreter, then verifying the imports. Operations are idempotent and the original binary is backed up first. It never touches the enclosing application bundle.

Client-side performance HUD and always-on recorder for DeepSeek Harness: FPS and worst frame, long tasks with four-leg attribution (React fiber / subtree / DOM writes / scheduler), per-plugin callback rate and sync time, DOM growth and writers, JS heap, host event loop and link RTT, plus a night-watch recorder that keeps the worst stalls and exports incident packs for replay.

Outbound route pool for DeepSeek Harness. Ships 15 seed routes plus a 20-entry candidate pool covering 7 target kinds (GitHub raw/codeload/main, npm registry, PyPI index, HuggingFace, general). Routes are verified before use: upstream IP lists go through a TLS handshake with full certificate-chain validation (a bare TCP check can be answered locally and report dead IPs as healthy), and failures advance a cooldown ladder of 2/5/15 minutes with the fastest healthy route picked per target kind. Routes are applied by rewriting the URL with one of four rules (prefix, registry, index, host-replace), reaching git, pip, npm, pnpm, gh, curl and wget through three paths: the shell seam (download commands the model runs through the bash tool are intercepted and rewritten automatically; commands wrapped by the pwsh tool, and fetches made by the host itself or the renderer, are not covered), two registered tools the model can call directly (line_pool_status, line_pool_run), and child-process spawn. Multi-line commands keep their line breaks and only the download segment is touched. URLs carrying credentials (user:token@host) are never rewritten, so tokens are not forwarded to third-party mirrors. No global config is modified. A sidebar panel lists every route with latency, failure reason and cooldown countdown, supports per-route retest and enable/disable, and shows live TUN/proxy status from network-adapter and loopback port checks. The candidate pool is re-verified every 24 hours so newly usable routes are added and dead ones dropped. 570 tests, 87% line coverage.

Session-level verdict on whether compaction would lose unlanded state; structurally refuses per-block screening.

Mirrors assistant streaming frames (deltas, blocks, commits, turn fences) to a configurable NDJSON sink for external consumers.

WeChat Mini Program engineering tools: scan a project for pages missing from app.json, scaffold pages with automatic registration, fix orphan pages, manage subpackages, tabBar and components, and drive the WeChat DevTools CLI for preview QR codes and uploads.

Configuration vault for DeepSeek Harness: snapshot, diff and safely roll back profile patches, plugin manifests, skills and workspace lists, with credentials excluded by default.

Turn-end quality gate: when the turn edited code or config it walks each file up to its project root, runs that root one check from a fixed whitelist (`pnpm check`, `cargo check`, `ruff check .`, `tsc --noEmit`) and, only if that check really ran and failed, opens a new turn carrying the failure output instead of letting the turn close.

Move an entire dsh installation to another machine and check it item by item. Three layers go across: the declaration layer (settings, credentials, plugin declarations and vendored link: sources), the state layer (sessions, storages, skills, attachments) and, optionally, the workspace project code. Sessions are rewritten at the zstd header frame only, workspace paths are remapped through an explicit path mapping, and at the end 14 checks (I1–I13 plus I6b) report PASS / FAIL / WARN. A LAN route pairs two machines and pulls the bundle over directly; merge mode diffs a bundle against a machine that has already been in use and stops before writing anything while conflicts are undecided.

Training Lens opens a local TensorBoard scalar dashboard with selectable metrics, explicit improvement direction, optional EMA smoothing and Chinese/English UI; requires an existing Python environment with TensorBoard.

Keep a DSH profile identical across machines through any WebDAV server. The plugin collects the five parts that make up a setup — models (the llm-pi-ai line of cordis.patch.yml), defaults (the agent-default-model line), patch (the remaining loader lines), plugins (package.json dependencies plus dsh.profile.bundles) and dirs (extra absolute-path directories picked in the panel, carried whole and restored to the same path, add-only, at most 5 with 2000 files / 8 MiB each) — encrypts them on this machine with a passphrase (AES-256-GCM, PBKDF2-SHA256 at 600000 iterations) and uploads one ciphertext file to <address>/dsh-webdav/dsh-profile.prop, so the server only ever holds the sealed copy (the older dsh-profile.dshsync name is still read). Merging is per part and three-way against the last synced baseline; a conflict keeps the newer copy and archives the losing one under sync/ (latest 5 per tag), every overwrite is sealed beforehand, and deletions propagate except in the plugins part, on the first sync, and in the dirs part, where dropping a directory on one machine only stops syncing it there and never deletes its files. Uploads carry ETag If-Match and If-None-Match so a concurrent change is refused instead of being clobbered. Sync runs on demand or on a 3/15/30/60 minute timer from a settings panel, and an optional local forwarder (off by default, loopback-only) re-serves the same target with locally generated credentials, rewritten PROPFIND hrefs and .prop aliases for extensionless resources. The local state lives in <profileDir>/.dsh-webdav-sync/ (sync.json is written 0600 and holds the WebDAV password and the passphrase).