Preface

Among the community plugins for DSH, some are designed to enhance capabilities, while others aim to provide clearer visibility into existing ones. dsh-builtin-toggles belongs to the latter category: it is built for DeepSeek Harness Web, checking the built-in capabilities of the current Web Loader, and displaying runtime status, profile override states, Agent preset ownership, composition scope, compatibility, and mutation eligibility.

For those maintaining Web profiles, this kind of information is often more useful than directly modifying configurations. Below, we introduce this plugin’s positioning, capabilities, installation methods, and boundaries.

Positioning

dsh-builtin-toggles is an unofficial community plugin maintained by Starfie1d1272 under the MIT license. It is not affiliated with or officially supported by DeepSeek Harness.

It is not a general-purpose plugin manager, does not provide a marketplace, and does not offer installation/update lifecycle management for third-party plugins.

Core Features

Capability Inspector / Doctor

The Capability Inspector / Doctor is used to examine all capabilities of the current Web Loader, including external, unreviewed, and anomalous entries.

It displays each item with details such as:

  • Runtime status
  • Three-state profile override
  • Agent preset ownership
  • Composition scope
  • Review provenance
  • Dependency evidence
  • Compatibility
  • Mutation eligibility

Filtering and Diagnostics

The plugin supports filtering by:

  • ID/package name
  • Category
  • Management plane
  • Composition scope
  • Policy
  • Validation
  • Runtime status
  • Anomalies

Diagnostic information can be copied as a sanitized report. This report does not contain local paths or configuration contents.

Composition-scope Modeling

Duplicate checks use the Loader’s public Entry.id and include the tree-owner chain.

This means that legitimate entries with the same ID in Host and built-in Agent presets will not be mistakenly flagged as duplicates; within the same scope, true collisions will still be marked as drifted and fail-closed.

Agent Preset Plane

Entries like tool-* and plan-mode are assembled per session by Agent presets. The plugin separately annotates these and does not misclassify them as profile overrides.

9 Reviewed UI Controls

The plugin includes only the following 9 reviewed UI controls:

  • ui-deliverables
  • ui-jobs
  • ui-goal
  • ui-message-feedback
  • ui-model-selection
  • ui-agent-preset
  • ui-skill
  • ui-subagent
  • ui-trajectory

These operate on pure interface leaves of the web profile.

Fail-closed Control

The plugin maintains locks on:

  • Core services
  • Agent capabilities
  • Third-party entries
  • Unknown entries

It does not provide a generic plugin manager, a marketplace, or an installation/update lifecycle.

Inspection API v1

The plugin offers a stable, non-localized machine interface:

GET /api/builtin-toggles/v1/inspection

This interface includes:

  • Inventory
  • Review baseline
  • Three-state configuration
  • Compatibility
  • Eligibility

Installation and Enablement

The prerequisite is an initialized DSH web profile. The plugin’s location in the Web interface is:

Settings → Plugins → Built-in Plugins

If the dsh CLI is already installed, run the plugin installation command before starting the Web process:

dsh plugin --profile web add dsh-builtin-toggles
dsh web

If using npx, there is no need to install dsh globally:

npx @deepseek-ai/dsh plugin --profile web add dsh-builtin-toggles
npx @deepseek-ai/dsh web

After installation, restart the DSH web/gateway to load the bundle layer at startup.

Typical Usage

After completing the above steps, you can open the plugin entry in the Web settings to view the capability list of the current Web Loader. It is recommended to focus on several key fields: runtime status, three-state profile override, Agent preset ownership, composition scope, review provenance, dependency evidence, compatibility, and mutation eligibility.

When troubleshooting based on specific criteria, you can use ID/package name, category, management plane, composition scope, policy, validation, runtime status, and anomalies as filtering dimensions. You can also copy a sanitized diagnostic report; this report does not contain local paths or configuration contents.

For machine integration, you can use the stable interface:

GET /api/builtin-toggles/v1/inspection
``

Regarding access boundaries, both loopback and explicitly trusted hosts can read the API; all configuration mutations additionally require loopback same-origin. `trustedHosts` is only used for DNS rebinding defense, not for authentication. The remote Inspector is read-only. The `access.mutation` in v1 indicates the transport access of the current request, distinct from each capability's `mutationEligibility`.

# Applicability and Notes

## Suitable For

- Those who need to audit the state of built-in capabilities in the DSH `web` profile
- Those who need to distinguish between Host/profile combinations and Agent preset combinations
- Those who need to view mutation eligibility and compatibility
- Integration parties requiring a stable machine interface to read inspection data

## What It Does Not Do

- Does not manage third-party plugin lifecycles
- Does not provide a marketplace
- Does not edit Agent presets
- Does not provide a generic plugin manager
- Does not offer installation/update lifecycle management

## Security and Permissions

Manageability is derived solely from the precise `MANAGEABLE_IDS` allowlist in `src/policy.ts`. The browser is never an authorization boundary.

This plugin runs with the permissions of the current `dsh` process. Before installation, you should review the source code and license.

## Compatibility Baseline

The verified reviewed/tested baseline is:
```text
@deepseek-ai/dsh-base@0.1.0-rc.6
@deepseek-ai/dsh-web-app@0.1.0-rc.6

This refers to published artifacts, not a version range commitment of >= rc.6. Subsequent public versions may still be installable or runnable, but they do not automatically become supported/reviewed baselines unless explicitly reviewed.

Uninstallation

Before uninstalling, you should revert any forced inheritance on entries modified by this plugin and remove only its own top-level literal disabled override.

If the dsh CLI is installed, run:

dsh plugin --profile web remove dsh-builtin-toggles

If using npx, run:

npx @deepseek-ai/dsh plugin --profile web remove dsh-builtin-toggles

Then restart.

Conclusion

The value of dsh-builtin-toggles lies not in extending more capabilities, but in making the state, origins, and modifiable boundaries of DeepSeek Harness Web’s built-in capabilities explicit, and restricting the manageable scope in a fail-closed manner.

It is an unofficial community plugin. Before use, you should read the source code and the MIT license.

GitHub Repository:

https://github.com/Starfie1d1272/dsh-builtin-toggles

The directory page entry is not provided with a specific URL in the verified materials. This article does not list unverified addresses.