Plugins

Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.

Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.

Docker container panel for the DSH Web GUI: containers (optionally including stopped), docker inspect details, logs, stats snapshots, image list and one-shot exec on the local machine or SSH hosts — read-only by default (mutations and exec are permission-gated), with a per-container terminal drawer embedded via the tty plugin.

Auto mode for DeepSeek Harness (dsh): an Auto entry in the Permissions selector whose approval prompts are answered by OpenGuardrails policy instead of a human — plus the full OGR guard engine underneath. No core changes.

Claude Code Desktop look-and-feel for the DSH Web GUI — ivory/warm-black dual canvas, clay accent, three-font typography, permission segmented control and brand switcher, via CSS overrides and client DOM overrides.

Full-screen terminal client for DeepSeek Harness built on pi-tui: session replay/resume, streaming responses, collapsible tool cards, in-terminal approvals and questions, model/preset/permission/plan/goal management, shell mode, and a trajectory ledger.

Presents DSH Web as a playable, full-screen first-person Minecraft-style voxel interface—not a color-only skin: users walk through a persistent Three.js block world and access native workspaces, sessions, conversations, tools, model selection, permissions, context information, and the composer through in-world facilities and a workbench.

Role-based Codex / Claude Code / ACP subagent providers for the DeepSeek Harness — continuable children, durable session recovery, per-role product permissions, and delegation with a permission ceiling.

Adds an `auto` permission preset between workspace-write and danger-full-access: a classifier grants routine sandbox escalations once, while dangerous or uncertain requests still go to a human.

The organ kernel of Agent-Body: plugins organized as one body. Each command is turned into a nerve impulse that deterministically innervates the organ which should handle it and names the capability to use; a heartbeat with a variable interval (faster on alerts, slower when idle) pumps operator directives, proprioception and homeostasis warnings system-wide; reflex arcs fire with zero model calls; failures go through deterministic attribution (missing tool / arguments / permission / timeout / network), a prescription, and a re-check loop, with argument errors never auto-retried. A missing organ is compensated by the one with the highest capability overlap, and tool schemas are gated by the current intent (84.7% measured reduction, reproducible in-repo). This entry is the kernel plugin package inside the agent-body repository.

Fine grained per tool permission rules for DSH at the tools/pre-execute gate, deny and ask lists in Claude Code rule syntax (`Bash(rm -rf:*), Read(_secrets_), mcp__server__tool`), works standalone without migrating.

Imports Claude Code setup into DeepSeek Harness from a native settings screen or CLI, with dry-run previews for skills, commands, agents, hooks, permission rules, and MCP config. Codex and OpenCode remain supported as secondary origins, with collision-safe apply and post-move checks.

Match your models and token budgets to each role, then let DSH delegate specialized subagents by task type. Covers architecture analysis, UI/UX, code implementation, codebase exploration, and documentation research, with automatic setup plus per-role reasoning effort and tool permissions.

LLM-assisted auto approval with countdown fallback for the Auto permission preset: static rules, risk tiers, breaker and file audit.

Fine-grained permission gateway: per-category tool-call review (outside-workspace directories, commands, file read/write, subagents, repeated actions) with global & per-project allow/deny exceptions, quick-tool defaults, custom rules, a bilingual approval modal with inline diff details, custom rejection reasons and a sandbox-upgrade flow.

Enhanced ACP server for DeepSeek Harness: block & reasoning streaming, usage telemetry, model/effort switching, permission presets, session resume/archive, per-session MCP servers, and Zed file/terminal forwarding.

Model-based permission approval: an approval-request answerer backed by a separate reviewer model.

Adds an approval-mode toggle next to the permission selector: default approval keeps per-call confirmation, bypass approval auto-approves every tool call while staying in Workspace Write.

Self-hosted DSH Web operations panel for safe restart and upgrade, health diagnostics, model-usage statistics and provider quota lookup, backup and session management, task notifications, skill controls, subagent model routing, and Linux permission maintenance.

Adds an Auto Approve permission preset to the Web UI, using a fresh restricted Reviewer Agent to allow or deny each approval request.

Security audit plugin for DeepSeek Harness: static permission profiling and a runtime sentinel for third-party plugins

Load Claude Code assets into DSH at runtime — skills, slash commands, rules, permission rules (deny/ask/allow), subagents and hooks from .claude/ plus Claude Code plugins (plugin.json / marketplace / skills / agents / MCP), via a memory-IR parse layer that keeps .claude as the source of truth with no writes back. Six installable packages: loader, skills, permissions, agents, hooks, mcp.

Fully customizable keyboard shortcuts for the Web UI: 34 pre-registered features (sessions, views, clipboard, models, silent permission cycling, settings), one-click recording to bind your own, and a shortcut cheatsheet with built-in diagnostics.