Плагины

Отвечающий на подтверждения для DeepSeek Harness (dsh) на основе сайдкара agent-governance — каждое подтверждение/запрос решается шлюзом с запретом по умолчанию (deny-by-default), правилами L0–L4 и организационной цепочкой аудита.

Режим разрешений между workspace-write и полным доступом: команды оболочки проверяются детерминированными правилами и проверкой с помощью субагента; необратимые или системные действия требуют явного подтверждения.

Мост WeChat iLink ClawBot: официальный протокол iLink от Tencent, настройки в веб-интерфейсе (вход по QR, модель, пресет, разрешения, управление сессиями с удалением) и автообновление раз в 24 часа, отправляющее новый QR до истечения срока, без простоев.

Страж разрешений с автоодобрением: промежуточный уровень между workspace-write и danger-full-access — автоматически разрешает безопасные операции в доверенных каталогах и всегда запрашивает подтверждение человека для деструктивных, с 11 переключателями по категориям и журналом аудита.

Автономный классификатор разрешений для пресета auto: правила allow/deny по инструментам, семантический судья на LLM и контрольные точки git для сессий без присмотра.

Режим разрешений автоматического ревью в стиле Codex: добавляет предустановку авто-ревью, которая автоматически одобряет безопасные эскалации песочницы, запрашивает подтверждение для рискованных или неоднозначных и отклоняет критичные неподтверждённые операции.

Звуки событий для DSH: проигрывает выбранный звук при завершении сессии, появлении вариантов, запросе разрешения и остановке, с озвучкой персонажа, созданной ИИ, и управляемой библиотекой звуков.

Промежуточный уровень разрешений для DeepSeek Harness между workspace-write и danger-full-access: автоматически подтверждает безобидные команды и операции, нацеленные на настроенные доверенные области за пределами текущего рабочего пространства.

Аудит гигиены учётных данных парка агентов, только для чтения: права доступа к файлам с учётными данными, встроенные учётные данные в git-remotes (маскируются в выводе) и количество токенов провайдеров в открытом виде; без зависимостей и детерминированно.

Remote DSH access that needs no hosting of your own — the Feishu DM chat is the interface over the bot's outbound long connection, with cards for workspace, session (switch and rename), model, reasoning effort, permission preset and balance, and tool approvals and agent questions answered in that same chat.

Loopback-only ACP door for DeepSeek Harness: attach an external client (such as the DSH Panel VS Code extension) to the kernel you already have running, exposing session listing and permission presets.

Zero-intervention permission gate for DSH agents on macOS: auto-allows local writes made reversible by git or Time Machine, blocks network, package installs, process control and sensitive-path reads, with full audit logs.

One-click Approve & escalate on the approval card: answers the pending request and switches the live session to a permission preset.

Query and manage JumpServer through conversation: assets, users, accounts, permissions, sessions, command audit logs, command filters, and RBAC roles, authenticated with an AccessKeyID/AccessKeySecret pair (HTTP Signature).

A continuation of simon300000/dsh-auto: the Auto Approve permission preset for the DSH Web UI reviews each approval with one single-shot model call instead of a reviewer subagent, auto-approves only the actions that pass and hands the rest to human approval, and remembers confirmed decisions as project- and global-scope allow/deny lists, with an approval timeline in the right sidebar.

Keeps a redundant sandbox-escalation argument from failing a tool call. Escalating tools (pwsh, bash, write, edit) advertise the full sandbox_permissions enum, but DSH only accepts a level strictly wider than the one already in effect — a check its own source calls 'deliberately not a schema constraint'. A model that reflexively passes the argument therefore picks the level it is already at and the call dies before running with 'sandbox escalation to "workspace-write" is not strictly wider than this call's current "workspace-write" mode', costing some models a whole turn of retries. This plugin registers one tools/execute waterfall listener and, only on that documented rejection and only when the arguments really carried an escalation field, re-issues the identical call once without it. Safe by DSH's own documentation: the rejection precedes any execution ('nothing has run'), and the corrected call cannot match again, so the retry is loop-free. Reproduced and verified end to end — before: isError true, the command never ran; after: the command's real output, isError false, one tool/call and one tool/result. Zero dependencies.

33 github_* tools covering REST reads, issue writes, Git data writes, private repo creation, and clone; in-process permission gate and cost-discipline companion skill; no gh CLI required.

Git integration for DSH modelled on IDEA's VCS: a git icon beside the permission mode in the composer shows the current branch and the pending-change count, opens a branch switcher on hover and an IDEA-style VCS panel on click (branch tree, commit graph, changes and staging, commit detail, file diff), plus a settings page for commit identity, the git binary and the network flags. Registers no model tools with DSH.

Computer Use for macOS desktop applications: reads any app's accessibility tree as text with element indices, then clicks, types, pastes, scrolls, drags, selects text and sets values through it, plus screenshots read back as images. Driven by a persistent JavaScript REPL — the agent gets two tools (`js`, `js_reset`) and calls an `sky` API inside them, so state survives between calls and the tool schema stays fixed as capabilities grow. Accessibility trees come back as diffs after the first read; actions address elements by index and indices from a stale read are refused rather than misapplied; typing waits for keyboard focus and reads the field back; paste restores the clipboard. Requires macOS 14.4+, Accessibility permission (Screen Recording only for screenshots) and Node 20+; ships a prebuilt native module, so nothing compiles at install time.

System-audio visualizer for the turn navigator rail: the rail reacts in real time to whatever the default playback device is rendering, with four motion modes (spectrum, pulse, sway, travelling wave), a 16-band logarithmic spectrum from a 2048-point FFT on the host, and live sensitivity, strength, bass-punch and wave-speed controls. Audio is captured host-side through WASAPI loopback, so there is no permission prompt, no microphone and no screen capture. The browser half adds one attribute, one stylesheet, some CSS variables and a sidebar control row, and never patches the official component; switching it off removes the attribute, the stylesheet and the variables, returning the rail to its default styling. Windows only.

Named, file-defined subagent roles for DeepSeek Harness: persona, subagent-only skills, tool permissions, an ordered model chain with failover, and derived groups.

Require a real, immediately preceding sandbox denial before DSH Bash can request wider permissions.

Three-mode visible-session advisor plugin for DeepSeek Harness with configurable tool permissions, local-subagent coverage, and task-tree budgets.

Unified management and invocation of external Agent CLIs in DSH, fully isolated from the user's native installs; preset Provider, model, reasoning effort, and permissions per CLI, callable directly or like native subagents.