dsh-dot-plugin
DSH Dot：一个持久运行、优先只读并由用户批准执行的 DeepSeek Harness 主动式代理。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:1315577677/dsh-dot-plugin#7a55cb5582e2bb57126e9fd2ea38b0b92d9a205cDot Plugin 以 dsh-dot-plugin 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A persistent, read-only-first proactive agent for DeepSeek Harness, with user-approved execution.
dsh-dot-plugin is a DSH plugin that gives DeepSeek Harness a real Dot: its own durable Agent Session, a read-only research phase, independent risk review, user-only approvals, and a tightly-scoped execution phase.
It is inspired by the capability model of OpenAI's Dots, but it is an independent open-source project. It is not affiliated with, endorsed by, or connected to OpenAI, and it does not attempt to reproduce OpenAI's hosted cloud computer or 4,000+ app marketplace.
Most agent plugins are reactive: they answer, then stop. Dot is designed to keep a thread of work alive:
The ordinary conversation you use to code is not intercepted. Dot has its own Session and its own tool policy.
| Capability | How it works |
|---|---|
| Persistent Dot Agent | A top-level Agent/Session resumed from durable state; title Dot |
| Read-only research | Global tool allowlist + a scoped, monotonic tools.guard() |
| Real sources | Local directories, public/API URLs, and read-only MCP tools |
| Proposals | dot_propose_action writes a durable proposal; it never executes |
| Independent risk review | A separate small model classifies every proposal; the proposing model does not grade itself |
| User-only approval | DSH panel and /dot slash command; no Agent Tool can approve a proposal |
| Scoped execution | An approved execution turn receives only that proposal's tools |
| Task tracking | dot_add_task / dot_update_task; progress comes from real evidence |
| DSH schedules | dot_schedule_task uses the Host schedule service, not a private cron loop |
| Event triggers | dot_register_trigger + local webhook/service entry point |
| No global rule hijack | Rules apply to Dot only, not to the user's other Sessions |
| Result attribution | Execution results are read only from the execution turn, and interrupted turns are marked failed |
┌─────────────────────────────┐
│ DSH Host │
│ │
user approval ──────▶│ DotRuntime │
(panel or /dot) │ ├─ Dot Agent/Session │
│ ├─ read-only research │
│ ├─ proposal store │
│ └─ execution allowlist │
│ │
sources ────────────▶│ read / glob / grep │
(directory/URL/MCP) │ web_search / web_fetch │
└──────────────┬──────────────┘
│ DSH slots
┌──────────────▼──────────────┐
│ Client panel │
│ sidebar icon + main panel │
│ proposals / tasks / status │
└─────────────────────────────┘
The Dot Agent is created with the standard DSH preset, then a Dot-scoped prompt section and scoped tools are added.
read, glob, grep, web_search, web_fetch.tools.restrict() when possible.tools.guard() denies any other call even if a preset-scoped tool is not filtered by the global restriction.dot_schedule_task, dot_add_task, and dot_register_trigger are internal bookkeeping tools and remain available during research.dot_propose_action records:
execution_tools (for example ["write"]);execution_instruction.A separate Reviewer asks a small model for a risk verdict (low / medium / high) with a reason. User rules are applied after that. The default configuration does not auto-approve even low-risk proposals; opt in with autoApproveLowRisk: true.
Approval is user-only. On approval:
executionTools plus read / glob / grep;High-risk actions such as send, publish, pay, delete, invite, or credential access are expected to be proposed as drafts or preparatory steps. The user can reject them, or configure stricter rules.
dsh web profileThe plugin was tested against the DSH 0.2.1-rc.2 family.
git clone https://github.com/1315577677/dsh-dot-plugin.git
cd dsh-dot-plugin
pnpm install
pnpm build
pnpm test
Then install the local bundle with DSH's Plugin Manager:
plugin_manager install_bundle target=/absolute/path/to/dsh-dot-plugin
Or install it from the DSH Plugin Manager UI by choosing the local bundle directory.
The Host half activates immediately. The Client half (sidebar icon + panel) is part of the web boot graph, so fully quit and reopen DSH Desktop after installing or replacing the Client bundle. A browser-style page refresh is not available in the Desktop shell.
After reopening, the sidebar shows DSH Dot and the Dot Session appears in the Session list.
The default cordis.patch.yml intentionally contains no machine-specific sources. Add real read-only sources under the config.sources list and reinstall the bundle (or override the row in your profile patch).
- insert:
- id: dsh-dot-plugin
name: 'dsh-dot-plugin'
config:
enabled: true
agentPreset: standard
dotWorkspace: '/absolute/path/to/workspace'
sources:
- id: inbox
kind: directory
label: Local inbox
path: '/absolute/path/to/inbox'
readOnlyTools: [read, glob, grep, web_search, web_fetch]
executionTools: [write, edit]
dotWorkspace is the Dot Session's cwd and the workspace used by the file sandbox. It should contain the files you want Dot to be able to write after approval.
sources:
- id: github
kind: url
label: GitHub issues
url: 'https://api.github.com/repos/owner/repo/issues?state=open&per_page=10'
Dot uses web_fetch for URL sources.
Connect Gmail, Google Calendar, Slack, GitHub, or another app through DSH's MCP support, then expose only read tools to Dot:
sources:
- id: mail
kind: mcp
label: Gmail read-only
tools: [gmail_search, gmail_read]
readOnlyTools:
- read
- glob
- grep
- web_search
- web_fetch
- gmail_search
- gmail_read
This plugin does not embed OAuth credentials, app passwords, or a vendor connector. The MCP server owns authentication and the tool surface; DSH owns the tool registry.
The repository includes realistic sample files in dot-demo/inbox/. To try the plugin:
dotWorkspace to the repository root;<repo>/dot-demo/inbox;The included dot-demo/outbox/ starts empty; files appear only after an approved execution.
| Key | Default | Description |
|---|---|---|
enabled | true | Enable the Dot runtime |
initialDelayMs | 20000 | Delay before the first research round |
researchIntervalMs | 300000 | Research heartbeat |
agentPreset | standard | Preset mounted into the Dot Agent; supplies read/web tools |
dotWorkspace | profile default | Dot Session cwd / write sandbox root |
sources | [] | Directory, URL, or MCP sources |
readOnlyTools | [read, glob, grep, web_search, web_fetch] | Global tools available during research |
executionTools | [write, edit] | Tools a proposal may request for execution |
reviewProvider | current default | Small-model provider for risk review |
reviewModel | current default | Small-model model for risk review |
reviewTimeoutMs | 20000 | Risk review timeout |
rules | built-in defaults | { action_pattern, decision: allow | ask | deny } |
autoApproveLowRisk | false | Auto-run proposals that are both rule-allowed and low risk |
maxProposalsPerRound | 3 | Proposal cap per research turn |
stateDir | <plugin>/data | Durable plugin state directory |
Rules are regular expressions tested against the proposal's action type, title, outcome, execution instruction, and tools.
Open DSH Dot from the sidebar:
/dot commandFor environments where the panel is not loaded yet, the same approval path is available as a user command:
/dot
/dot status
/dot approve <n|proposal-id>
/dot reject <n|proposal-id>
/dot run
A slash command is submitted by a human; no Agent Tool can invoke it.
Register a trigger with the Dot tool or directly through the service:
const dot = ctx.get('dshDot')
await dot.fireTrigger(triggerId, {
from: 'alerts@example.com',
subject: 'urgent: production review',
})
Local HTTP entry point:
curl -X POST http://127.0.0.1:<dsh-port>/dsh-dot/trigger \
-H 'content-type: application/json' \
-H 'x-dsh-dot: 1' \
-d '{"triggerId":"trigger_...","payload":{"subject":"urgent"}}'
A trigger only wakes Dot for read-only investigation. It does not execute the instruction directly.
This is a local tool with meaningful authority, so the boundaries are explicit:
ctx.llm.stream().data/state.json; the Agent Session log remains the source of truth for conversation and tool outcomes.x-dsh-dot header and Origin check. It is not an authenticated public API; do not expose it to the public internet.dsh-dot-plugin/
├── package.json
├── cordis.patch.yml # Loader row: dsh-dot-plugin
├── dsh.plugin.json # Desktop metadata
├── icon.svg
├── locale/{en,zh}.json
├── src/
│ ├── client.ts # main panel + sidebar icon
│ └── host/
│ ├── index.ts # name / inject / Config / apply
│ ├── runtime.ts # Agent lifecycle, research, execution
│ ├── reviewer.ts # independent risk model
│ ├── tools.ts # Dot-scoped tools
│ ├── commands.ts # /dot user command
│ ├── http.ts # local panel bridge
│ ├── state.ts # atomic durable state
│ └── types.ts
├── test/
├── dot-demo/inbox/ # sample real sources
├── data/ # runtime state (gitignored)
└── lib/ # built ESM + browser artifact
Loader IDs are consistent:
dsh-dot-plugin__ModuleLoader__.load id: dsh-dot-plugindsh-dot-pluginpnpm install
pnpm typecheck
pnpm build
pnpm test
The plugin uses TypeScript compiled to ESM for the Host and a plain module-loader browser artifact for the Client.
Issues and pull requests are welcome. Please keep the read-only research boundary and the user-only approval model intact. For a behavior change that broadens execution authority, include a threat-model note and a test.
MIT. See LICENSE.
DSH Dot（dsh-dot-plugin）是一个给 DeepSeek Harness 用的常驻主动 Agent 插件：
/dot 命令中批准；它不是 OpenAI Dots 的官方实现，也不包含云端电脑、浏览器控制或内置 Gmail/Calendar OAuth；真实应用连接通过 DSH MCP 配置。
Status: early open-source release (0.1.0). Tested on the DSH 0.2.1-rc.2 family.