Plugins

Audits every plugin HTTP route in a profile for a browser-trust fence: plugin routes win the web server's longest-prefix match ahead of the /api gateway, so they never see its trust check and must pin the Host to loopback themselves. Grades PASS/WARN/FAIL per route and fails a fence that compares Origin to Host without pinning it (bypassable by DNS rebinding). Ships as a CLI for CI and a route_fence_scan tool.

ServerChan3 (Server酱) push notifications when a turn finishes — title, model, project directory, git branch, status and a reply excerpt, with subagent filtering and fire-and-forget delivery.

Plays a chime when the AI asks a clarifying question (a `?` / `？` in the message, or an `ask_user_question` tool call). Synthesized via Web Audio API, no audio file, works on every OS.

Voice control for the DSH web composer: push-to-talk speech-to-text into the input box (with optional auto-send), spoken playback of assistant replies via the Web Speech API, right-click settings popover, and a global Ctrl+M hotkey.

Apple on-device Vision tools for text-only dsh models: local OCR (zh-Hans + 30 langs), image classification, face detection, document layout, and a combined describe — 100% offline, no API key, tall-screenshot slicing.

Switchable web-search provider for DSH: native DeepSeek web search or an OpenAI-compatible custom backend. Installation automatically routes DSH web searches to the plugin; only provider, API key and model are required. Published on npm as @lp181818/web-search-advanced@0.1.3.

IP/domain intelligence for DeepSeek Harness: ip_lookup, dns_lookup and whois_lookup tools via free no-key APIs (ipwho.is, Google DNS-over-HTTPS, RDAP).

Route every host-process undici fetch through a local HTTP(S) proxy while keeping localhost and China-reachable APIs direct.

Realtime Avatar (realtimeavatar.ai) for agents: the developer API key held by the harness credentials store, the public docs as five on-demand skills, rta_* tools over the public REST API (balance, avatars, clips, sessions, usage) with approval-gated credit spending, and a /rta command that walks a developer from no key to a live avatar call.

Web search provider powered by ZAI GLM MCP: search and fetch via Open BigModel API with credentials auto-injection from ~/.dsh/.credentials.yaml or environment variables — no API key in config files.

Economic indicator lookup via World Bank open data (GDP, inflation, trade, population), no API key required.

Bridge local projects into Obsidian: bounded manifest scanning, deterministic dependency/tech/topic edges, and wiki-linked notes written into a managed graph/ vault namespace via the Local REST API or the vault filesystem.

Cloudflare D1 tools for agents: d1_list/query/exec/schema/stats/health over the D1 HTTP API, read-only by default with a SQLite-accurate lexical guard, LIMIT row cap, CSV/JSON query output and an approval-gated write path.

Codex-shaped coding tools and agent presets for GPT models on DeepSeek Harness: exec_command, write_stdin, apply_patch and view_image, plus OpenAI Chat Completions and Responses API routes, bridged to DSH-native plan, ask, approval and compaction. Long-running commands become DSH background jobs with bounded head/tail output readable through job_output, and each subagent type can be pinned to its own preset, provider, model and reasoning effort.

Native DSH foundation bundle that registers a persistent default workspace, provides paged read-only inspection of plugins, skills, memory, sessions, storage, settings, credentials, and DSH_HOME files, and synchronizes rich CLIProxyAPI model capabilities into native provider settings.

Bring OpenCode Zen free models to DSH: 8 live-discovered providers with zero config, no API key; includes persistent quota tracker with rate-limit detection and reset countdown.

Qwen Token Plan CN Responses provider for DeepSeek Harness via the OpenAI Responses API, with Qwen server-side tools, DSH local function tools, text/reasoning/tool-call multi-turn history, persisted image attachments, and a per-release official model catalog snapshot.

CommandCode usage & balance panel for DeepSeek Harness: API usage, credit balance, 5-hour/weekly windows from the sidebar footer.

Real-time DeepSeek account balance readout in the session header: host /api/balance route resolves the API key through the credentials seam (never sent to the browser), 60-second auto-poll plus manual refresh.

Shows DeepSeek API balance and tells whether the current moment is peak or off-peak pricing time, with a live countdown to the next switch.

Renders local audio/video paths as inline, playable previews in DSH chat: replaces paths with <audio>/<video> players backed by same-origin /api/media-preview/* route, with explicit error statuses.

Top-centered weather bar for the DSH Web UI: geolocation, current conditions, 12h/7d forecasts and severe-weather notifications via Open-Meteo (free, no API key).

DSH Desktop enhancement: one-click update checker, DeepSeek balance & API key viewer, and import other AI tools.

AI-generated curiosity & trivia plugin for the dsh web GUI (Curio in the English UI): 「开始探奇」 generates a fresh batch of unexpected knowledge (excluding everything already seen), each item unfolds into two deeper layers plus similar knowledge points, and 「探奇清单」 keeps the full history (batch, items, layers, similar points) in browser storage. Reuses the host LLM channel with zero config; when no model is available, a DeepSeek API key can be pasted into the panel. Output language follows the DSH UI language (zh/en).