Плагины

Adds one button to the sidebar foot that opens the desktop DSH Web GUI — in the system browser on a phone, in a new tab on a desktop. The target address is read from plugin config, DSH_DESKTOP_URL, or ~/.dsh/desktop-url.txt, and falls back to the relay origin published by dsh-remote-web-ui; the button renders inert with a hint when nothing is configured. It also adds a small gear button that saves the address into ~/.dsh/desktop-url.txt; on a phone with no separate launch address set, a click asks the local pairing service (/api/pair/issue) for a one-time pairing link and opens it; its HTTP routes (/api/desktop-link/…) have no DSH access check.

Multi-device DSH network: sidebar topology, peer health, delegation, file transfer and node management over TLS, LAN and public tunnels. DSH spawns its mesh server (127.0.0.1:8124) detached at startup and restarts it if it exits, and the server always answers LAN discovery on UDP 0.0.0.0:8129. Once a peer is paired, the default ACL lets it read, search and write files under ~/Code, read session history and logs, and delegate tasks to your DSH sessions; shell_run, channel messages, remote desktop and repair stay off until you allow them. If SakuraFrp is installed it reads that launcher's account token (or SAKURA_TOKEN) to query api.natfrp.com tunnels. Its /api/dsh-mesh routes are guarded only by a loopback peer-address check.

Peer sessions between DeepSeek Harness instances on a LAN: UDP discovery, an explicit one-way allow list with open or confirm approval, HMAC-signed HTTP with a ±60 s window and nonce replay protection, a `跨端 · <peer>` session for delivered prompts, two-phase file transfer up to 100 MiB with SHA-256 receipts, and seven agent tools that call the named tools listed in `exposedTools` on the receiving side. Its local /cross-agent panel routes are guarded only by a loopback check, without DSH's Host/Origin admission.

SSH workbench for launching remote agent CLIs with durable sessions, terminal, file editing, Git worktrees and local port forwarding. It drives the local OpenSSH client (macOS/Linux; remote Linux with GNU coreutils, tmux optional) to run commands, edit files and forward ports on any host from ~/.ssh/config, with host-key checking defaulting to accept-new; the last 512K characters of each terminal's output are saved under ~/.dsh/remote-agent/terminals. It uses the same package name and mount id as zbzbhs/dsh-remote-agent, so the two collide if installed together.

Maintained continuation of dsh-network: authenticated LAN, Tailnet and HTTPS access to a DSH host, with pairing QR and current Web browser-auth support. Replaces the upstream dsh-network (remove it first; both register the same /dsh-network routes); the gateway listens on 0.0.0.0:3081 by default, set bindHost to restrict it.

Adds a “why does this need escalation?” button to every DSH approval card: it opens a panel with the permission requested, the risk, what refusing means, the exact tool arguments and whether the named paths fall outside the session workspace; the card also keeps a one-line risk and refusal consequence visible under it, and the model’s original reason is split into labelled paragraphs instead of a run-on block.

Security guard for DeepSeek Harness (Cordis): reviews every tool call in pre-execute against SlowMist agent-security rules, denying or flagging risky commands, MCP servers and skill loads, external URLs and repositories, untrusted documents, and EVM or Solana addresses; scans tool results for prompt injection after execution and ships a slowmist_scan audit tool plus an injected security policy prompt. Rules follow the open-source SlowMist Agent Security Skill (MIT).

Stops session lockups from OpenAI-compatible gateways that stream empty tool-call ids: intercepts llm/stream chunks in memory to synthesize consistent call_<sha256> ids across tool-call-delta and block-end, plus offline session repair/verify scripts under tools/.

Drives another DSH plugin's real interface from a script and records the real window to an animated GIF. Windows only. Its /recorder routes have no DSH access check, and the run route can make the open DSH page click and type, so any web page you have open could drive it; recordings capture a region of your screen with Pillow.

Read-only diagnostics for a DSH install — boot-crash logs and the cause named in them, config drift against a recorded fingerprint, backup freshness, workspace growth, plugin updates, host-version compatibility, duplicate client ids, and model availability — plus an action layer that always shows a plan first and needs a single-use fingerprint and explicit confirmation before anything is written. A checkup also runs 45 seconds after every host start; when the 3-hour probe cache is stale it sends a one-line test prompt to the default model and a few models of each configured provider (model.probeOnReport can switch this off). Registers the agent tools dsh_steward_report and dsh_steward_act (clean caches via dsh-disk-cleaner, backup via dsh-config-manager, disable or enable a bundle, set the default model; execute takes the plan's hash plus confirm: true) and a system-prompt section telling the agent to run the report first when something crashed.

Adds budgets to agent waiting: caps job_output waits, refuses runaway foreground commands inside run_code, breaks status-polling loops after four no-progress probes, and explains run_code deadlines and parse errors.

Moves reasoning that a provider leaks into the visible text channel back into the reasoning channel, and emits a text block when a whole turn of answer text lands only in the reasoning channel. Catches three shapes: `<thinking>`-tagged text, text that continues a reasoning tail which ended mid-token, and an answer-only reasoning turn that stops. Healthy streams pass through unchanged, block order is preserved, and each of the four rules can be switched off in one JSON config.

Keeps code edits in a review loop instead of letting the model edit files: each change is proposed as a two-column diff card with line numbers, applied by hand or with one click, and handed back for verification with another click.

Runs enabled PowerShell, CMD, Bash and Python presets in a user-defined order when DSH starts, shows live output for the selected preset in a left-sidebar page, and ends each managed process tree on stop, restart, disable, delete, or exit.

Observation-only audit for DSH Agent Teams that records per-request cache usage and prompt-prefix rewrites to JSONL, with no tool or prompt changes.

Loads Google Antigravity rules from ~/.agents/rules and the workspace's .agents/rules into the system prompt: always-on rules in full, the rest as a catalog the model can load with the antigravity_rule tool, or that activates when a touched file matches a rule's globs. The rules are prompt guidance rather than hard enforcement, and the model can toggle them off with the same tool. Settings are written to .agents/rules/settings.json in the workspace.

Godot game development workbench for DeepSeek Harness. Windows only, preview release: plans a game (GDD, tasks, acceptance checks), changes project files through controlled read/write tools, diagnoses the project and runs it for evidence. Runtime and import checks launch your configured Godot as a normal process with your permissions (the AppContainer sandbox applies only in the restrictedProduction option); the official Godot 4 standard build can be downloaded on request after confirmation (SHA-256 checked), creating a project registers it in Godot's project list, and the selected project context is sent to your configured model.

Carries a DSH environment between machines through one private GitHub or Gitee repository: third-party plugins (reinstalled from a version, or carried as a tarball or source tree), the four profile configuration files, and folder snapshots. A restore resolves each folder through an absolute path, a registered root, or a confirmed new path, compares file by file, leaves locally edited files alone, backs up anything it replaces, and refuses writes that escape a root, cross a junction, or land on a directory the plugin does not own. Configuration files and folder contents are uploaded as they are (no secret scrubbing) and the plugin does not check that the repository is private; the access token stays in the credentials service, and on first start a GIT_SYNC_* token left by dsh-plugin-git-sync is copied over. Needs Node 22.12 or later.

Shows which hosts each local app connects to, restores real domain names through the local Clash/mihomo controller, and records first/last-seen times to the second.

Synchronizes native DSH instructions, user Skills, and reviewed portable settings across devices through Microsoft OneDrive, with optional cloud encryption and explicit conflict resolution; conversations and credentials are excluded.

Sound cues played by the host operating system, not the browser: three bundled WAV files fire through the machine's own audio (SoundPlayer on Windows, afplay on macOS, paplay/aplay on Linux) when an agent's turn completes, when the context is compacted and when the agent is waiting for your answer; subagent turns can be included, cues fired closer than a configurable interval are skipped, and each bundled sound can be replaced with your own file via plugin config.

Posts a macOS notification titled with the session name when that session finishes a turn, and clicking it returns to the session. An in-app notice is always shown alongside it (9 s in the foreground, 60 s in the background); the system banner needs notifications allowed for DeepSeek Harness in macOS settings, otherwise only the in-app notice appears.

Email assistant forked from dsh-email with host-side 163 IMAP monitoring that creates DSH conversations for summaries and reply suggestions, manual suggestions for selected messages, and persistent automatic/manual processing records with session links. Includes multi-provider mailbox browsing; automatic monitoring currently supports 163 IMAP only. Install it instead of dsh-email, not alongside (both mount the same tool-email row). It registers no send or draft tools; mail text goes to your configured model and is kept in the session logs; monitoring needs DSH running continuously and a 163 IMAP authorization code.

Windows toast when a turn finishes, with one setting in Settings → General: Never, Only when unfocused, or Always.