Plugins

Routes DSH filesystem, shell, subprocess, and PTY operations to local, SSH, and Docker execution nodes, with a node registry, an authentication gate, a mobile-aware management UI, and per-workspace custom project instructions.

Pre-boot health gate and repair for dsh plugin trees: seven static scan rules, fault attribution after failed boots, whitelisted reversible fixes, and a panel with plugin-row management plus a RAG knowledge base of past failures.

Turns DSH permissions into 9 selectable presets (3 sandbox modes x 4 approval tiers), with rule plus LLM risk classification across four risk levels, password-gated approval for high-risk operations, and a JSONL audit log.

Semantic risk grading and progressive authorization: classifies tool calls into safe/risky/redline, asks before irreversible actions, auto-allows only approved-and-succeeded signatures.

会话注入门控：给 DeepSeek Harness (dsh) 加一个会话级上下文裁剪闸门，按会话取消/恢复插件贡献的 skill、tool、系统提示词段落——3 条影子通道、5 条本地路由、零依赖零配置。Per-session injection gate for DeepSeek Harness (dsh): trim skills, tools and prompt sections per session. Zero-config, zero dependencies.

Approval-gated workspace instructions and memory for DeepSeek Harness

Web management panel for Docker on DeepSeek Harness: manages Docker MCP servers (deploy/remove, official catalog search/pull, gateway start-stop-restart, custom deploy) and containers/images (list, start/stop/restart, remove, logs, inspect, interactive terminal, create, pull, build, load) across local CLI and SSH remote targets with one-click switching. Credentials are encrypted with Windows DPAPI, HTTP is loopback-only, and command parameters are whitelist-filtered. Build-free pure ESM; client is zero-dependency.

Multi-agent frugality defense plugin: read-ledger dedup metrics, compaction-immune rules, completion gate, cheap-model review lane.

MaxCompute (ODPS) data analysis plugin for DeepSeek Harness: metadata browsing, cost-gated SQL execution, background jobs and result export.

Provides a secure reverse proxy, enabling DeepSeek Harness to be accessed remotely and to converse with AI anytime, anywhere.

DeepSeek Harness (dsh) plugin that registers Lynkr — a self-hosted, multi-provider LLM tier-routing gateway — as a custom OpenAI-compatible provider in settings.yaml.

Multi-bot workbench for DeepSeek Harness: bridges the sdk-bots orchestration gateway (group chats, single bots) into the dsh web shell with official-styled UI.

Explains which layer killed a failed turn: times every model request (first byte, longest silence, total) and combines that with the error to name the culprit (dsh idle watchdog vs Node undici timers vs SDK timer vs server crash, context overflow, gate queue, tool timeouts, failed compactions) and the exact setting to change; verdicts in the DSH terminal plus a /why command, subagents included.

Audits every plugin HTTP route in a profile for a browser-trust fence: plugin routes win the web server's longest-prefix match ahead of the /api gateway, so they never see its trust check and must pin the Host to loopback themselves. Grades PASS/WARN/FAIL per route and fails a fence that compares Origin to Host without pinning it (bypassable by DNS rebinding). Ships as a CLI for CI and a route_fence_scan tool.

Hands DSH reset requests to an external ops agent via a versioned JSON protocol: preflight snapshot, pre-restart maturity gate (no pending approvals, free disk, cooldown), restart, health check, and interrupted-work recovery, with the result delivered back to the requesting session.

Realtime Avatar (realtimeavatar.ai) for agents: the developer API key held by the harness credentials store, the public docs as five on-demand skills, rta_* tools over the public REST API (balance, avatars, clips, sessions, usage) with approval-gated credit spending, and a /rta command that walks a developer from no key to a live avatar call.

Cloudflare D1 tools for agents: d1_list/query/exec/schema/stats/health over the D1 HTTP API, read-only by default with a SQLite-accurate lexical guard, LIMIT row cap, CSV/JSON query output and an approval-gated write path.

dsh plugin: keep llm-pi-ai provider routes' model lists in step with the pi.dev gateway, written through the official settings seam

Mobile remote pairing for DSH with QR offers, a loopback Host Gateway, encrypted Relay or Quick Tunnel transport, same-LAN WebRTC Direct, and revocable Device Tokens for the Android client.

Source-filtered HTTP/SSE/WebSocket gateway for using the DSH Web UI behind an authenticated reverse proxy, with loopback trust adaptation, in-app host directory selection, and an allowlisted health endpoint.

Auto-switch the DeepSeek route to the vision model on demand: flash main session switches (A), pro keeps deep reasoning and delegates image reading to a vision subagent (B), subagents always switch, with fatal-failure fallback. No manual model switching.

CPA account-pool status panel for DeepSeek Harness: sidebar health light, quota bars, success-rate ticks, and gateway key endings

Dynamic LLM provider gateway latency and health pulse probe for DeepSeek Harness

DSH provider preset for the Memorax DeepSeek V4 Flash gateway