Introduction

DeepSeek Harness (DSH) uses a plugin-based architecture. When developing or operating in Windows environments, issues such as encoding corruption, path resolution failures, and process/port conflicts occur frequently. dsh-plugin-windows-guard is designed to solve these problems.

This plugin is maintained by Pasumao and is positioned as a Windows environment pitfall-avoidance tool. Through a two-layer mechanism of “Rule Layer” + “Active Protection Layer”, it provides preventive rules and runtime interception capabilities, helping developers avoid common encoding and system operation errors.

Core Features

The plugin includes the following main capabilities:

Rule Layer: Auto-loading

By default, it automatically loads two self-contained skills, triggered by context:
- windows-enc: Handles encoding, escaping, and mojibake issues, covering the environment fact sheet, three iron rules for encoding, quote escaping cheatsheet, and the three “don’ts” for mojibake.
- windows-sys: Handles paths, processes, ports, and cross-platform miscellaneous issues (such as CRLF and ExecutionPolicy).

Active Protection Layer

The plugin provides three layers of runtime protection:

  1. L2 Mojibake Detection
    Monitors pwsh tool results and detects mojibake characteristics such as GBK misdecoding, U+FFFD characters, and Chinese characters turned into question marks. After detection, it automatically appends a [windows-guard] repair hint to the end of the result without interrupting execution.

  2. L3 Dangerous Write Interception
    Listens to tools/pre-execute events. It intercepts commands that write structured files with Set-Content, Add-Content, or Out-File without -Encoding, as well as direct use of > redirection to write structured files. After interception, it suggests the correct usage of [System.IO.File]::WriteAllText(...).

  3. L4 Encoding Tools
    Provides two tools: windows_encode_detect (diagnose file encoding confidence) and windows_encode_fix (repair to UTF-8 without BOM, with automatic backup).

Installation and Activation

The installation command is as follows:

dsh plugin --profile web add dsh-plugin-windows-guard

After installation, you need to restart dsh web for the changes to take effect. The plugin includes a cordis.patch.yml configuration file, which automatically mounts the related rules, so no manual configuration file edits are needed.

Configuration

The default configuration is fully enabled, with all features turned on:

- insert:
    - id: dsh-plugin-windows-guard
      name: dsh-plugin-windows-guard
      config:
        enabled: true     # 总开关
        postCheck: true   # L2 乱码检测
        preCheck: true    # L3 危险写拦截
        detectTools: true # L4 编码诊断/修复工具

Usage

After installation, it can be used without additional configuration:

  1. Automatic rule loading: When the model encounters tasks related to Windows commands, encoding, mojibake, paths, or processes, it will automatically attempt to load the windows-enc or windows-sys skill.
  2. Mojibake hints: When a pwsh command produces mojibake, the result includes a repair hint at the end.
  3. Command interception: If the model tries to write structured files such as JSON using commands without -Encoding, the command is intercepted and the correct API call example is returned.
  4. Manual tool invocation: You can directly call windows_encode_detect to check file encoding, or use windows_encode_fix to repair it.

Dependencies and Requirements

The plugin depends on the following environment:

  • Node.js: Version must be >= 22.5 (requires full-icu support).
  • DSH core: Depends on @deepseek-ai/cordis version ^4.0.1.
  • Runtime dependencies: Zero runtime dependencies and no build step.