DeepSeek Harness Plugins · admin-security

Zero-dependency password generator plugin supporting random and Diceware modes via cryptographically secure in-memory randomness.

Adds a Connected Apps settings section to DSH, providing a central slot where other plugins can register display cards without a registry or cross-plugin imports.

Selective Git sync for DeepSeek Harness settings and profiles with secret exclusion, per-line review, conflict handling, and safe recovery.

Localhost-first HTTP debugging adapter for DSH that blocks remote hosts and sensitive headers by default, bounds request/response sizes, and does not bypass Secret Guard or AgentFuse.

Platform-level structural recording that replaces model self-reporting with tool/skill usage auditing, watchdog alerts, and a live observability dashboard.

Lints your repo for chain-of-thought leakage — session-transcript residue in docs, comments, and JSDoc left by AI coding agents — with built-in English and Chinese batteries, zero dependencies, and CI-ready exit codes.

Bridge Grok Build CLI subscription login into DSH by syncing only the short-lived access token and routing Grok models, without storing any refresh token.

Enterprise approval-policy plugin for DSH that risk-classifies tool calls into allow, deny, or requireApproval and emits redacted JSONL audit logs.

Pre-install static security auditor for DSH: scans community plugins for lifecycle scripts, dynamic exec, credential exfiltration, path traversal and more, outputting a severity-ranked risk report.

A read-side SIEM forwarder that normalizes DeepSeek Harness session events to OCSF 1.9.0, spools them locally, and optionally ships to Splunk HEC or OTLP/HTTP with a hash-chain integrity check.

A Tailscale Serve auth plugin for dsh connection authorization, enforcing user allowlists and App-Capability-based access control with fail-closed semantics.

Zero-trust security gateway for DSH that unblocks LAN/remote access, injects mobile polyfills, and enforces cryptographic credential management with anti-spoofing and rate-limiting protection.