Plugins

Kimi Coding web search and web fetch providers for the DeepSeek Harness — one coding-plan key fills both ctx.web seams (POST /v1/search and /v1/fetch), a settings card in the GUI stores it via the credentials service, and the fallback chain reads the Kimi CLI config for zero-setup installs.

Re-validates Cloudflare Access JWTs at the DSH origin so Settings, Credentials, Agent Preset management, and model discovery work from a remote hostname.

DeepSeek account balance in the sidebar footer plus spend per session, today, this month and all time, priced by a configurable time-of-day price table per currency (DeepSeek CNY/USD defaults included). Two read-only remote methods, no host routes, key read through the host credentials seam on every call, egress only to the configured provider origin.

Named user credentials the model uses by reference: values are entered on a Settings → Credentials page and injected into each shell execution as DSH_CM_* variables instead of being printed into the transcript, with credential_read as the documented last resort.

macOS desk pet forked from anneheartrecord/dsh-desk-pet, in a real always-on-top window that covers fullscreen Spaces: the pose follows whatever the local DSH is doing across six states, the right-click menu is a real AppKit one carrying quiet mode and a session list, and seven skins ship with it. Two of the seven are drawn from geometry by a script in the repo rather than generated, so making a skin needs no image model and no API credits; the bundled skill still expands one photo into all eighteen poses on your own image tool and credentials. There is no Electron and nothing to install alongside it: the window is driven through ctypes on the Python that ships with macOS.

Screen capture and external vision recognition: take_screenshot, list_windows, analyze_image and view_image tools with a configurable GPT vision channel (gpt-5.5 / gpt-5.6-sol / gpt-5.6-terra), API key via the credentials service, and a settings card; view_image shows the screenshot in the Web UI while the model context keeps text only.

Portão de segurança em runtime no pipeline de ferramentas: nega chamadas que citem hosts fora de uma lista de saída permitida, redige credenciais nos resultados no valor canônico e não apenas no conteúdo renderizado, e registra cada decisão em um log de auditoria JSONL; vem em modo somente monitoramento.

Bloqueia que agentes leiam ou gravem arquivos sensíveis (.env, credenciais, material de chave), mascara valores com forma de segredo vazados nos resultados de ferramentas, mantém um diário de auditoria e expõe ferramentas seguras de inspeção sg_* que nunca imprimem valores brutos.

Fonte de dados empresariais Qichacha (企查查) como plugin dinâmico do Cordis: 5 ferramentas de agente (autenticação com login por QR, busca de empresas, busca de conhecimento, busca de ferramentas, execução de ferramentas) cobrindo mais de 100 dimensões de dados (registro comercial, acionistas, judicial, PI), além de um gerenciador de contas na página de configurações; IO de rede/arquivos via subprocessos do DSH executando node -e; credenciais interoperáveis com o cliente local BizOwl.

Pacote ACP do DeepSeek Harness para delegação em editores: um perfil de servidor stdio do Agent Client Protocol configurável com um comando, que compartilha credenciais e logs de sessão do dsh

Auditoria somente leitura de higiene de credenciais para frotas de agentes: permissões de arquivos de credenciais, credenciais embutidas em remotes do git (mascaradas na saída) e contagem literal de tokens de provedores; sem dependências e determinística

Tavily-backed search provider for the DeepSeek Harness web seam (ctx.web): keyless-first credentials, a cooldown after the keyless tier refuses, and a user-visible notice when it falls back to the key.

Gemini provider for DeepSeek Harness on Google Cloud Vertex AI, with Application Default Credentials, streaming, and thought-signature replay across tool calls.

DeepSeek Harness (dsh) plugin that connects Sber GigaChat models: a built-in local OAuth proxy (client-credentials -> OpenAI-compatible endpoint, upstream serialization, legacy tool-calling translation) plus automatic provider-route bootstrap, so GigaChat

Pure JavaScript macOS Keychain credentials provider for DeepSeek Harness, replacing plaintext .credentials.yaml storage and fully supporting both refs and records without native builds, signing, or Xcode.

OpenCode Go provider that verifies a model against the gateway rather than treating a recommendation as a measurement: the models.dev protocol suggestion is probed before it is used, reasoning levels follow a measured contract, and requests run through an ordered protocol fallback chain. Context window, max output and image-input numbers are declared by a runtime-refreshed models.dev layer rather than probed, with operator overrides above both. Several OpenCode Go credentials can be stored and switched from the settings page.

Sync your DeepSeek Harness (DSH) configuration between machines over a private git or WebDAV channel: settings, plugins, MCP servers, skills, agent presets, workspaces and provider credentials. DSH 配置远程同步插件（私有通道，明文自用）。

Use your DSH models in [Libre WebUI](https://github.com/libre-webui/libre-webui) for chat, sandboxed Work and usage tracking, with provider credentials kept in DSH. Requires Libre WebUI 0.37.0 or later.

A full-page console panel opened from the sidebar, with eight tabs: an overview; a session list read from the sessions service (title, directory, running state, updated time, with filters); installed bundles and Loader entries from pluginInventory and pluginManager, with per-bundle enable switches; a plugin market listing public topic:dsh-plugin repositories from the GitHub search API; a model and provider editor that writes the llm-pi-ai settings namespace through remote.settings.mutate (switch a session model, add or edit providers and their model lists, and store API keys via remote.credentials, merging over the stored profile so fields the form does not expose survive an edit); MCP and skills tabs; and a usage tab that reads the host's loopback /api/dsh-usage/overview document. Services are declared through ctx.inject, so a deployment that omits one mounts without the console rather than crashing.

Feishu (Lark) OpenAPI MCP connection for DeepSeek Harness: drives the official @larksuiteoapi/lark-mcp stdio server with your Feishu app credentials, exposes Feishu API tools (IM messages, Bitable, docs, calendar, drive) under mcp__feishu__*, and a web se

Alibaba Cloud MCP connection for DeepSeek Harness: static AccessKey credentials + local Alibaba Cloud MCP Proxy (uvx alibabacloud.mcp-proxy) connecting to the official OpenAPI MCP Server, with tools under mcp__aliyun__* and a web settings panel

Phone and remote access to the DSH Web UI: scan a LAN QR code, or reach your PC from anywhere through a self-hosted relay server you run yourself instead of a cloudflared tunnel. Per-device credentials that pair, list, and revoke individually, and several PCs sharing one relay with automatic failover.

LLM provider plugin for the DeepSeek Harness (dsh): streams Claude through your Claude Code subscription (claude.ai OAuth credentials), no Anthropic API key required.

Web management panel for Docker on DeepSeek Harness: manages Docker MCP servers (deploy/remove, official catalog search/pull, gateway start-stop-restart, custom deploy) and containers/images (list, start/stop/restart, remove, logs, inspect, interactive terminal, create, pull, build, load) across local CLI and SSH remote targets with one-click switching. Credentials are encrypted with Windows DPAPI, HTTP is loopback-only, and command parameters are whitelist-filtered. Build-free pure ESM; client is zero-dependency.