Plugins

Zero-dependency static and sandbox smoke detector for DSH plugins: package-structure gates, cordis contract scans, keyless headless smoke, and ecosystem-listing checks.

Keep declared workspace subpaths (e.g. .git) read-only, honor a read-only rules file at the workspace root, grant extra writable roots under workspace-write, and let the model request session-scoped write access; enforced for sandboxed CLI commands and the write/edit tools.

An independent approval subagent judges every sandbox escalation, with a configurable model and an audit log.

A self-evolving plugin for DeepSeek Harness: it observes how the agent runs, proposes improvements to its own assets via the LLM, validates each proposal inside a sandboxed trial agent, and applies only verified mutations — with a versioned ledger and automatic rollback on regression.

Runs the agent's filesystem, bash and PTY terminals inside a Docker container by providing the `ctx.fs` and `ctx.subprocess` seams, so cwd, environment and background processes survive a harness restart.

LLM auto-approval for sandbox escalation requests, with presets and a fail-closed fallback.

Lets sandboxed agents reach the web through your local proxy: net_fetch fetches pages, net_proxy_status reports proxy status.

Support for the microsandbox backend.

Blaxel sandbox execution plugin for DeepSeek Harness (DSH)

DeepSeek Harness adapter for Context Mode: in-process ctx_* tools for sandboxed code execution and an FTS5 knowledge base, plus context-window routing guidance.

A dockable IDE workbench for the DSH web UI: a GPU-accelerated terminal (restty renderer over a Rust PTY), a CodeMirror editor, a file explorer, notes, a sandboxed browser, and ripgrep content search.

Support for the nono sandbox backend.

DSH 工作区组合器：左侧边栏管理多工作空间，每个绑定一个主目录（工作区锚点/文档区）+ 若干代码项目；新建向导自动识别 Java/Vue/React/Python/Go 等项目并支持多选，新建会话在主目录打开，把所有项目绝对路径注入 system prompt，联动 @chaoset/sandbox-extra-roots 放开读写白名单。

Sandboxed jq / yq / read-only sqlite3.

Sandboxed ripgrep / fd / ast-grep under allowRoots (defaults include ~/.dsh/im-workspace).

A dsh-better-sidebar tab that statically parses Qoder Canvas `*.canvas.tsx` files into structured pages in the DSH right sidebar (the source is never executed: no eval, no bundler, no sandbox iframe), with a file-viewer takeover for `.tsx` and a bundled Skill for authoring the format.

Native Auto Review for DeepSeek Harness with automatic host compatibility selection

Open folders on remote hosts over SSH as Harness workspaces: file tools (read/write/edit/grep/glob) and shell commands run directly on the remote host over SFTP, ripgrep, and ssh2 exec, with no local mirroring, an encrypted multi-host registry, and the local sandbox policy still enforced.

Workspace-scoped Semgrep SAST tool for DeepSeek Harness with a managed Windows x64 runtime, structured bounded findings, cancellation and timeout controls, and user-approved sandbox escalation. Installs from npm as @aaub-software/dsh-semgrep-sast.

A calmer reading view for DeepSeek Harness with auto-collapsing process, a minimap-style message navigation rail, in-page search, unified failure cards, and generative MCP Apps (SEP-1865) in sandboxed iframes.

Renders HTML, React (JSX/TSX), Vue, SVG, Mermaid and Markdown written by the agent in an isolated iframe sandbox with SSE hot-reload, and adds a DOM click inspector, side-by-side visual diff, a responsive device matrix and one-click Vite ZIP export.

Uses an isolated LLM review to approve or reject DSH sandbox permission requests.

Antigravity-style run_command for DSH: short commands return inline within a configurable wait window (default 10s) while longer ones auto-promote into ctx.jobs for later collection and completion notices — executed via ctx.shell under the session sandbox and approval pipeline.

LLM approval answerer for sandbox escalations beyond workspace-write: a deterministic regex filter first, then a clean-context reviewer model; humans are asked only when it is unsure. Requires the bundled core patches.