Plugins

Copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box copy while the real disk stays untouched (Windows only, requires Sandboxie-Plus).

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Puts sessions into the built-in Auto review permission preset: new sessions at creation, existing root sessions when they are restored.

Writes a model-generated annotation into every DSH escalation approval prompt — what the command does, what the model intends, how risky it is and why, and what each choice means — and keeps a searchable history of past approvals at /dsh-approval/history, with a diagnostics page at /dsh-approval/diag.

Rewrites agent-issued delete commands (PowerShell `Remove-Item` and its aliases, Bash `rm`/`unlink`/`rmdir`, CMD `del`/`erase`/`rd`/`rmdir`) into system recycle-bin operations on Windows, Linux and macOS, best-effort checks scripts for the same operations before they run, and keeps no permanent-delete fallback.

Local-only telemetry service for DSH plugins: records operation trails and error events into a storage-domain KV table, applies a configurable redaction rule set before the write and again when the analysis reads back a record stored before a rule existed, and groups one plugin's failures by feature-code anchor, reporting the window it read, the route each group ran on, and the attempts recorded after its last failure in write order.

GitHub issue service for DSH: turns a telemetry failure analysis into a uniform issue report, builds a pre-filled new-issue URL that is shortened when it would exceed a configured length budget, and rewrites a plain description into a structured issue with the deployment's model.

Prints every plugin in the DeepSeek Harness loader tree at boot, with the exception text for anything that failed, and checks dependency version drift, profile config validity, web port reachability and registered tools.

Staleness keeper for the Codebase Memory knowledge graph: it compares the graph Branch node head_sha with git rev-parse HEAD and reports an exact behindBy, rebuilds only the stale projects through the codebase-memory-mcp CLI so the MCP tool 60-second cap does not apply, watches each project for edits, and mirrors the same state into a settings card and a REST control surface.

Routes eligible bash commands through rtk (Rust Token Killer) so tool output is compressed before it reaches the model, by asking the installed rtk to rewrite each command and adopting what it prints; when rtk is absent the executor behaves exactly like the stock one.

Conflict diagnosis and repair for DeepSeek Harness plugins. Builds a capability graph of the running Loader profile and of the on-disk cordis.patch.yml layers, comparing imports, peer ranges and config against the host that is ACTUALLY running rather than the profile's possibly-stale copies, and reports the conflicts that fail silently: a fiber stuck PENDING on a service no plugin provides, a browser half injecting a client module nothing provides, a tool id two plugins both register, duplicate Loader entry ids, a row disabled by one layer and re-inserted by another, an import of a host subpath the running host does not export, and a cycle among inject declarations. Every finding carries its evidence, a confidence grade for who owns a name, and a repair with a risk grade — verify it with a dry-run difference table, or take the individual .patch.yml files that --fix-out writes (never auto-loaded, so picking wrong breaks nothing).

Agent Studio for DSH Web: configure models, prompts, per-plugin tool bindings and Skills; trial-run with editable tool results and run history; preserve session capability snapshots; export standalone presets; draft Agents with a guided creator preset.

Adds a Restart dsh button above Settings that restarts dsh in place: through systemd when dsh runs as a systemd unit, otherwise via process.execve with the same PID (a thin wrapper parent on Windows or Node < 22.15), so whatever started dsh needs no supervisor config (verified on Linux; Docker, macOS and Windows not yet run for real); the page reloads once the new boot id answers.

DSH Cordis computer-use provider for the ZTE Nde desktop. npm install auto-fetches the musl binary built by computer-use-linux-zte-nde (v0.7.7-nde.3) into the package's own bin/ via postinstall; resolveCommand() resolves the cordis command path against import.meta.url so the mount works regardless of dsh web's cwd. Reserves the shared computer-use slot via ctx.computerUse.register and exposes MCP tools under mcp__computer-use-linux-nde-mcp__* (screenshot, list_windows, click, type_text, doctor, etc.). Two notable Nde fixes upstream of this provider: KWin caption+coords fallback for window targeting, and SnapshotCache that keeps AT-SPI single-wake per (app, pid) so Chrome is not repeatedly disturbed.

Installs a self-evolving development-constraints rule library, exposes it to the agent through a constraints tool and a once-per-session reminder, and audits AI token cost and context usage.

Emails you when a long turn finishes or errors, when a goal completes or blocks, and when an approval or a question has waited past a timeout; each new notification deletes the previous one from the inbox over IMAP, so the inbox holds at most one.

Persistent WeChat bridge for DSH: one WeChat user maps to one persistent agent session via the official iLink channel, with context and the user-to-session registry surviving restarts. There is no sender allowlist — anyone who can message the paired WeChat account can start a conversation with a session that has tool access, and the working directory defaults to the home directory; use a dedicated account and set WECHAT_PERSISTENT_CWD.

VSCode-style Source Control page in the DSH Web right sidebar: a paged commit lane graph with ref markers and per-commit diffs, grouped working-tree changes with stage/discard/unstage, a commit box with amend and AI-generated messages, a side-by-side and unified diff page, GitHub repository and pull request creation through the gh CLI, and bidirectional HTTPS/SSH remote switching.

Agent-facing GitHub repository tools: binds an account through a first-run prompt, then clones into the workspace and reads, exact-replaces, commits and pushes files, with writes off by default.

Codex-style Git panel for DeepSeek Harness: a header button opens a menu with commit, push, branch switching and creation, and repository initialization; shows the current branch and the total additions and deletions of uncommitted files.

Zagent — unified three-role self-improvement loop with three operators. Data-RSI (daily cross-sectional cleaning: winsorize → cross-sectional standardization → median fill, plus experience extraction), Harness-RSI (evolves system prompt / memory / skills), and Model-RSI (evolves alpha training recipes via framework-native walk-forward with 2-day gap and multi-seed). Offline one-command run, GPU auto-detect. Ships one skill.

Persistent Codex, Grok Build and Claude Code sessions through ACP, with native model controls, permission approvals and optional A2A delegation.

Host-side long-task detection for small-context local models: long outputs are scaffolded into a parts skeleton (one part per reply, then assemble), and multi-step work into a PLAN.md ledger with notes/ (plan first, one step per reply). Detection is heuristic and host-side, so it does not depend on the model judging its own limits.

Verified-progress ledger: three tools record a claimed step as progress only after an independent subagent with a fresh context confirms it against the workspace. The declared scope is fingerprinted before and after each verification, so a verifier that changed anything has its verdict voided and the round cannot become progress.