52 DeepSeek Harness (DSH) Plugin Categories

The product spine: append-only session log, system-prompt assembly, tool registry, Agent interface and the default loop driver. No provider slots here — you extend it by listening to its events.

Generates runtime artifacts from source types so host and browser share one typed RPC contract: generator, registry, loader, protocol.

Development-time runtime contract assertions; each package registers owner-local checks and failures are attributed back to the owning package.

The provider-neutral LLM seam. Adapters register on ctx.llm; only two ship in-box (llm-deepseek, llm-pi-ai). Swapping a model means writing one adapter — the loop and compaction never change.

Persistent, owner-scoped PTY sessions for workflows that need state across tool calls or interactive stdin. One in-box backend (terminal-bash) and six model-facing tools.

Process-confinement seam: consumers hand over the exact argv, backends wrap it under a per-call policy and report enforcement. Local backends cover Linux/macOS; Windows ACL is a partial-enforcement rung.

The bash executor seam with local, sandboxed and PowerShell implementations, plus the model-facing bash/pwsh tools and the managed DSH_* environment registry.

The shared process substrate for one execution world: executable lookup, managed process trees, stdio dispositions and the terminal-process primitive. Bash, LSP, PTY and out-of-process subagents all spawn through it.

Language-server navigation seam exposing exactly four operations (goToDefinition, findReferences, goToImplementation, hover) with no raw JSON-RPC escape hatch. One generic stdio backend in-box.

One owner-isolated background-job protocol for observation, cancellation, waiting and completion notices. Background bash, PTY sends and subagent delegations all register here.

MCP client bridge: connects external Model Context Protocol servers and registers their tools on ctx.tools under server-qualified names. One plugin row per server; stdio and streamable-http transports; HMR hot-swaps.

Provider-neutral web search and fetch. Four providers ship in-box (Exa, Perplexity, native DeepSeek search, HTTP fetch); tool-web owns the stable model-facing names.

Delegate work to child agents. Six named providers coexist: fresh in-process, fork-from-parent-history, ACP, real Codex, real Claude Code (official Agent SDK), and out-of-process dsh via the TypeScript SDK.

Durable same-session objective state folded from the session log, with a same-session continuation driver plus model tools and a human command.

Runs model-authored orchestration scripts whose agent() calls fan out through ctx.subagents. One worker-thread engine in-box, plus the general workflow tool and the fixed fresh-agent Ralph loop.

Session-local reminders (after_seconds / absolute at / every_seconds ≥ 5min). The session log owns the state; the package deliberately exposes no public service and implies no external notification channel.

Plan mode is logged, per-agent collaboration state — not a generic mode registry or a capability seam. /plan enters, a user-reviewed exit_plan_mode leaves.

The model-facing todo_write tool. A single product package because one agent session owns the list; there is no replaceable provider contract.

Discovers reusable agent instructions and exposes them through a provider-neutral catalog and loader. The filesystem provider scans five ranked roots for SKILL.md or flat Markdown; remote and embedded providers are explicitly allowed.

A preset is a directory holding one agent.cordis.yml. Mounting it under an agent's scope gives that session its own tools and prompt sections while every other live session keeps its own; persona is the composable row that lets a preset change identity, not just tools.

The compaction seam: one summarizing backend driven by token pressure and request-error recovery, an optional model-free tool-result pruner, and a human /compact command. There is deliberately no model-facing compact tool.

Plugins that add model-visible request context without defining a tool: workspace instructions (AGENTS.md), current/elapsed time, tmux location, and bounded snapshots of other sessions.

Durable binary attachment identity, validation and content-addressed local storage. Unsent browser drafts are deliberately outside this capability: bytes enter durable storage only on prompt submit or provider commit.

Persistent workspaces: user directories with titles and ordered session membership, built over the domain storage facility.

The durable session data plane: persistence seam with JSONL/SQLite backends, projection seam and cache, log-backed titles with optional model-backed providers, and outbound session telemetry.

Plugins register namespace schemas and resolve layered values; providers store the raw document. One file-backed provider ships, watching external edits.

Configuration carries references, not secret values; providers own the values and consumers resolve per operation, so a rotated credential reaches the very next request. One env-over-.credentials.yaml provider ships.

Authorized retrieval over live and durable session logs — exact reads, relationship queries, full-text search — independent of compaction. One SQLite FTS backend in-box.

The human-collaboration plane: command registry, one-shot approval decisions, user-facing permission presets, and the provider-neutral question/answer seam. Approval fails closed when no answerer is present; UI front ends supply the question provider.

The protocol stack for driving a Harness runtime from another process: wire protocol, TypeScript client, stdio JSON-RPC server. Callers supply the runtime executable and its cordis.yml.

The browser half of the dsh web GUI: shell boot, browser-host communication, shared UI services and 30+ ui-* feature plugins composed through the slot system.

The application-facing Remote stack: remotes owns BFF policy and the selected business API; gateway implements the Typert unary RPC endpoints shared by host and client.

Exposes harness agents to programmatic clients over Agent Client Protocol. An interoperability transport, not a presentation or human-interaction layer; also the only in-box ctx.approval implementation.

The theme runtime owns light/dark/system preference and publishes immutable snapshots. Official note: third-party themes are an extension point, not a product — registering one means overriding same-named alias variables, with no validation that an override set is complete.

The host side of the web GUI: plain-node HTTP route carrier, the shared API gateway, SPA dist server, the workspace-directory picking seam with native/browse/auto backends, and a read-only Loader plugin inventory.

Contribute a business row to the built-in Web chat: register a ConversationNodeDefinition plus a keyed renderer. Documented as its own cookbook entry.

The distribution format: an npm package declaring dsh.bundle with a cordis.patch.yml that inserts or overrides plugin rows. Installed with `dsh plugin --profile <name> add <pkg>`. Three ship in-box: base, web-app, headless.

A profile is a directory under $DSH_HOME/profiles/<name> holding a package.json (out-of-tree deps + the ordered dsh.profile.bundles list) and the user's own cordis.patch.yml. Only web and headless ship as templates.

Zero-dependency primitives shared across capability families: branded types, harness home paths, timeout/deadline classification, output retention bounds, atomic writes, shell-free native commands, and the layered launch-environment snapshot.

Model-facing tools over the live cordis runtime the agent itself runs inside: inspect loaded plugins and the service API, define and run model-written dynamic packages, and retract them again.