DSHEssentialTools
DET · dsh-essential-tools — the plugin that turns DeepSeek Harness into a usable engineering cockpit.
Let the AI drive your own logged-in browser · Branch, edit and retry any conversation · Run / snapshot / roll back real projects · Manage every plugin and every token you spend
Quick start ·
用户指导手册 ·
Changelog ·
Security ·
功能总览
😤 The problem
If you hack on real code with an AI agent in the loop, you already know these four:
| Pain | What everyone does today | What DET does |
|---|
| 🧠 One wrong turn kills the thread — you want to re-ask from message #12, not start over | Copy-paste into a fresh chat and lose all context | VTD: edit / retry any message → a real hidden branch, switch back with <N>, and the workspace code rolls back with you |
| 🌐 The AI can't see or click what you see — your logged-in dashboards, internal pages, file:// pages | Screenshot, paste, hand-hold, retry | DET Browser Extension: the model drives your already-logged-in Edge/Chrome through a localhost bridge you gate yourself (off / read / write / on) |
| 🛠 Build-run-look-check is a manual loop | Alt-Tab to the IDE and terminal 40 times an hour | Right toolbar: ▶ run · 🗎 file tree + preview/edit · 🕘 program snapshots & rollback |
| 💸 You have no idea what a session costs | Find out at the end of the month | Live balance + per-model price + per-turn cost + peak/off-peak estimate in the corner |
DET (the plugin dsh-essential-tools) is the permanent DeepSeek Harness plugin that fixes all four — and adds a full plugin manager, conversation memory layer and security audit on top. It lives in your web profile, survives restarts, and shows up in Settings → Plugin inventory.
🎁 Zero config: without project paths, every conversation/token/plugin feature works out of the box. Add paths only when you want ▶ run.
✨ Feature tour
🌐 Browser control — the headline act
A real MV3 extension (Edge / Chrome) connects to the DSH host over a localhost-only WebSocket (127.0.0.1:9123) so the model can operate the browser you are already logged into — internal tools, dashboards, webmail, local file:// pages, whatever you have open.
- Read:
read_text · read_dom · screenshot · get_url · get_title
- Write:
navigate · click · fill · run
- Six model tools:
det_browser plus web_human_search (search like a human), web_insite_search (find it in your open tabs), web_act, web_inspect, web_focus
- You hold the permission dial — the four-position switch lives in the extension popup, and DSH can only read it:
| Mode | Model can |
|---|
关闭 off | nothing at all |
只读 read | read pages (text / DOM / URL / screenshot) |
只写 write | navigate, click, fill, run — but no page content comes back |
启用 on | full read + write |
- Double gate: the host refuses to even start the bridge unless network permission = tier 4 (use your browser); below that,
det_browser is blocked before it reaches your browser.
- Approval aware: outside Full access mode, browser actions go through DSH's
tools/pre-execute approval flow; Full access is exempt.
- Hardened: origin-checked handshake, injection via fixed function + arguments (never
new Function), only the tabId DSH names, and the bridge keeps only the newest extension connection so stale MV3 service workers can't eat your commands.
➡️ Setup: browser-extension/README.md · deep dive in the 指导手册
🌲 VTD — virtual conversation tree
Stop throwing conversations away.
- Edit / retry any user message → creates a genuine branch child session (
origin: vtd-fork, hidden from the sidebar). Your original thread is untouched.
<N> fork selector on messages: hop between branches, and DET snapshots the workspace and restores the target branch's code for you (message micro-versions).- Streaming branch view: no fixed 4 s polling — the host signals
generating, so the tab refreshes at ≈700 ms while tokens flow and ≈2.5 s when idle, auto-scrolls, and shows “正在生成…”.
- Product-native rendering: real user bubbles only, context injections folded away, tool calls/results as cards, reasoning folded, fine-grained Markdown.
- Message micro-versions:
baseline / edit / retry / auto-switch recorded automatically and restorable.
🖥 Right-hand toolbar — project work without leaving the chat
| Tool | What it does |
|---|
| ▶ | Run | Finds your entry point (main/entry/run .py/.cpp, or .sln/.slnx), builds with MSBuild, launches the program |
| 🗎 | Files | Workspace file tree (collapsible, counts, indent), click to preview or edit in a modal |
| 🕘 | Versions | Program-level snapshots: manual snapshot / roll back (auto-backup first) / delete — code files only |
| 🧩 | Plugins | Jump into the plugin manager / this conversation's plugin switches |
| 🛡 | Security | Audit log and security switches |
MSBuild missing or misconfigured? Auto-discovery: vswhere → common VS install dirs → PATH, cached for 60 s, and lvalInfo reports the path actually in use.
🧩 Global plugin manager — one library, five levels, two install paths
- Library across the whole process (storage domain
dsh_global_plugins, survives restarts). Every plugin carries a level:
全局启用 always · 对话AI可自行决定启用 ai-auto · 对话内AI需审批启用 ai-approve · 不再会有新启用 frozen · 全局禁用 disabled
- Bring plugins in: ① promote a live dynamic Cordis plugin from any running conversation; ② search the store (GitHub / marketplace / leaderboard / radar) with a cached AI summary; ③ paste a manifest URL.
- From GitHub two ways: ① direct download (
det_global_plugin_github_direct); ② AI reads the source and rewrites an equivalent, safer version (det_global_plugin_github_rebuild → det_global_plugin_github_save) — the third-party code is never executed, and both paths return virus/vuln warnings.
- Resident plugins (e.g.
dbs) get a clean enable/disable switch that hot-unloads/reloads through the loader, persists across restarts, and refreshes the UI (det_global_plugin_set_enabled).
- Boot Guard: persisted enable-state is re-applied on boot;
bootFailLimit consecutive boot failures (default 2) auto-disable all global plugins so a bad plugin can never brick your startup.
- In-conversation tools:
det_global_plugin_list/enable/disable/scan_installed/import_installed/set_enabled/github_direct/github_rebuild/github_save/store_search.
🧭 MDA · CDM · TCT — memory and cost control
- MDA (Mixing Dialogue Agent) layering:
native / workspace group / model group (collapsible tree from the sidebar 🔀 MDA 分组).
- CDM (CrossDialogueMemory):
cdm_list / cdm_search (workspace-scoped by default, cross=true to escalate) / cdm_read — retrieve what you already worked out in another conversation.
- TCT (Temp Chat Tool):
det_tct — one prompt, optional preset (review / summary / format / brainstorm), typed permissions, one feedback string, session destroyed, nothing persisted.
- Model collaboration (model group):
mda_card writes a model's profile with TCT; mda_activate dispatches work to another model (⚠ token-hungry, off by default); mda_create_no_workspace_agent spins up a workspace-less agent.
📊 DeepSeek balance · pricing · per-turn cost
- Corner status card: balance from
api.deepseek.com/user/balance, refreshed every 5 s, expandable to multi-currency detail and days-until-empty estimate.
- Per-model price chip parsed from the official pricing page (CNY page first, USD fallback), switching between peak / off-peak (Beijing time Mon–Fri 09:00–12:00 & 14:00–18:00 = peak), cached 6 h with last-good fallback.
- Per-turn cost for the conversation you're in.
- Key handling: resolved by the host only (config → DSH credential seam → env var), lives only in a request header — never written to disk, never logged, never sent to the client. No MITM proxy, no key ledger, no telemetry. Network touches only
api.deepseek.com and api-docs.deepseek.com.
🛡 Security audit + network permission tiers
-
Optional pre-execution audit: every tool call gets one independent model review; high-risk calls are deny-ed and logged (secCmdAudit, secPromptDefense). ⚠ It costs latency and tokens per call.
-
Network permission — 5 tiers (inline dropdown in the input row, persisted as det.webperm):
| Tier | key | Meaning |
|---|
| 禁用网络 | off | no network at all |
| 官方API搜索 | api | DeepSeek official API only (balance/pricing need ≥1) |
| 搜索API搜索 | search | search APIs; generic fetch needs ≥2 |
| 静默浏览器仿真 | silent | headless browser simulation (read pages) |
| 使用用户浏览器 | browser | drives your real browser (det_browser needs exactly this) |
🎛 Master switch — stock DSH in one click
Settings → DET 管理器 opens with a master switch (det.features.master, on by default) above the per-feature switches.
- Off = fully native. DET keeps exactly two things: this manager page and the switch itself. Everything else is unloaded — the ▶🗎🕘🧩🛡 toolbar, the corner balance/cost/MMS card, the network-permission control, the VTD tab and message actions, the MDA sidebar overlay, the Global plugins and MDA settings entries, all
det_* / web_* model tools and system-prompt injections, the security-audit hook, the local browser bridge, and the sidebar-registry self-check. MDA grouping resets to native.
- DET-managed plugins are stopped too — and only those. The scope is the Global plugins library: records bound to a loader entry (via scan installed plugins → import, which writes
moduleName) that were actually on. Resident ones are hot-unloaded through the loader, dynamic ones have their per-session instances stopped. Plugins that are not in the library — e.g. dlt, which has its own master switch on its own settings page — belong to themselves and are never touched. Container/builtin entries (cordis:include, which owns the whole cordis.yml subtree) are never disabled, and neither are framework packages (@deepseek-ai/*) or DET itself.
- Stopping is verified, not assumed. Every target is re-read from the loader and retried once; anything that refused is reported on the manager page (
⚠ 未能停用 + reason) instead of being claimed stopped. Library records that claim to be resident but are not bound to any loader entry are listed separately as not stopped (det.master.unmanaged) with a pointer to the import action. The stopped set is snapshotted in det.master.paused (with an applied flag) and restored when the switch goes back on; a resident plugin's browser half only disappears after one page refresh, so the panel has a refresh button.
- On restores all of it — including re-loading the plugins the master switch stopped (resident plugins re-mount, session enable-records are restored so
gpSync brings them back). Per-feature switches keep their saved values. The switch applies instantly and is persisted — no restart, and turning it off is reversible because every registration is held as a disposer.
- With the master switch on, the per-feature switches still work as before: turn plugin manager off and all global plugins are disabled; turn MDA off and grouping returns to native.
✅ Indicators follow reality
The Global plugins list never guesses:
- Resident plugins are reported from the host loader (the only thing that decides whether a plugin is mounted), so
启用/禁用 is the real state. If DET's stored intent disagrees with the loader, DET corrects the record, marks the card, and also shows the fiber phase (failed / still loading).
- Session state distinguishes a saved enable-record from actually running: “本会话运行中” only when the run is live, otherwise “已启用记录 · 未运行” or “本会话未打开 · 打开后恢复”. The model-facing
det_global_plugin_list reports the same actual state.
🚀 Quick start (60 seconds)
Requirements: Windows, DeepSeek Harness 0.1.1-rc.2+, PowerShell, a web profile (auto-created on first dsh web).
# Option A — installer from the clone (recommended: installs + registers the plugin)
.\install.ps1 -Profile web
# Option B — manual, exactly equivalent
dsh plugin --profile web add dsh-essential-tools
# Option C — straight from GitHub (no npm needed)
dsh plugin --profile web add github:LLYlab/DSHEssentialTools
Then restart DSH. dsh-essential-tools appears under Settings → Plugin inventory, with its own DET 管理器 section.
The package declares dsh.bundle.patch (→ cordis.patch.yml), so
any of the three commands above registers the plugin in the profile's bundle layer by itself —
you do not need to hand-edit cordis.patch.yml. The manual insert below is only for
mounting straight from a source checkout.
Registering by hand / adding project paths / config reference
Append to %USERPROFILE%\.dsh\profiles\web\cordis.patch.yml:
- insert:
- id: dsh-essential-tools
name: 'dsh-essential-tools'
# config: # optional — only needed for the ▶ run / 🗎 file / 🕘 version tools
# lvalRoot: 'C:\path\to\project'
# srcDir: 'C:\path\to\project\src'
# solution: 'C:\path\to\project\App.slnx'
# msbuild: 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' # optional, auto-discovered
# configuration: 'Debug'
# platform: 'x64'
# rollbackTargetDefault: 'minor'
# bootFailLimit: 2 # consecutive boot failures before auto-disabling all global plugins
Leave config empty and everything except the project tools still works.
Optional: enable the browser extension
edge://extensions (or chrome://extensions) → enable Developer mode → Load unpacked → pick browser-extension/.- In DET, set network permission = 使用用户浏览器 (tier 4).
- Click the extension icon and pick a mode — start with 只读 and move up only when you need it.
- Ask the model to work on your open tab; watch the 浏览器控制 status block in DET.
v1 dynamic loading (development only)
cordis_define with plugin/host.js + plugin/client.js, then cordis_run. v2 (npm) is the supported path.
📚 Documentation
| Doc | What's inside |
|---|
| docs/GUIDE.md | 🧑🏫 用户指导手册 — install, first-run walkthrough, every feature step by step, permission model, FAQ, troubleshooting, uninstall |
| docs/DET功能.md | Feature inventory: 25 model tools, 75 endpoints, 8 UI slots, storage domains, permission tiers |
| docs/DET修改.md | Change/dev log: what was changed and why |
| docs/DET运行思路.md | Architecture and runtime flow |
| docs/SECURITY.md | Security design, five-dimension review, known boundaries, mitigations |
| CHANGELOG.md | Release history |
| ARCHITECTURE.md | Implementation-level architecture |
🔒 Security in one paragraph
Plugin code runs with the real permissions of the DSH process — that is not a sandbox, so only enable code you trust (DET says this loudly before every install). What DET does add: SSRF protection on every host-side fetch (http/https only, no credentials in URL, private/loopback/metadata addresses rejected, DNS re-checked after resolution to stop rebinding, manual redirects re-validated per hop, 5-hop cap), 15 s timeouts and Content-Length pre-checks, suspicious-code scanning with commit-SHA provenance on store installs, quoted cmd.exe argv to kill argument-splitting/injection, browser bridge bound to 127.0.0.1 with origin-checked handshake and an extension-side gate the host cannot override, approval routing for browser actions outside Full access, and a credential path that never persists your API key. The blacklist scanner is a hint, not a boundary; the real boundary is your approval.
🤝 Contributing
Issues and PRs welcome at LLYlab/DSHEssentialTools. The browser extension must be tested by loading it unpacked; the npm package never ships it (.npmignore).
License
MIT © 2026 L2959159224
