dsh-sage-mode
Sage mode：用户可切换的只读咨询会话模式——仅使用读取、搜索和网页工具提供回答、建议、评估、教学、头脑风暴和错误分析。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zero360-TYN/dsh-sage-mode#38afef0cb75943ef450ec3fee8e19953a848f260Sage Mode 以 dsh-sage-mode 发布，当前版本为 1.0.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A read-only advisory mode for DeepSeek Harness sessions.
Enter with /sage, leave with /sage off.
While the mode is active, the session keeps only read/search/web tools. Every tool that edits, deletes, or executes is hidden from the model and denied at execution. At the same time an advisory system-prompt section turns the model into your thinking partner: it answers, advises, evaluates, explains, brainstorms, and diagnoses — instead of changing your workspace.
The name comes from Sage (贤者): the wise one gives counsel, not a hand.
Coding agents are built to act. Sometimes you do not want action — you want to understand code, compare approaches, learn a concept, brainstorm, or debug an error. Sage mode gives that intent a first-class switch: the agent can still read your repository and search the web, but it cannot touch anything.
| Input | Effect |
|---|---|
/sage | Enter Sage mode: read-only tools only, advisory prompt injected |
/sage <question> | Enter the mode and send that question as your next message (images/files allowed) |
/sage off | Leave; the full toolset is restored immediately |
Typical uses: understanding an unfamiliar implementation, learning a codebase, comparing
design options, brainstorming, pasting a stack trace. When you are ready to actually change
code, run /sage off.
Entering the mode changes what the model can call, not the sandbox: hidden tools are removed
from the request's tool catalog entirely, and anything that still reaches dispatch is refused
by a tools.guard() that returns "let the user run /sage off first".
read read_image glob grep web_search web_fetch ask_user_question skill
cordis_inspect_list cordis_inspect_query load_workspace_dependencies
Everything else is hidden — write edit ops_replace, pwsh/bash and background jobs,
subagent/send_message, plugin_manager, todo_write, present, goal and team-task
tools, and so on. Names that do not exist in your composition are ignored, so one list works
across agent presets.
The fast read-only tools — ops_glob, ops_grep, ops_inspect_local_file — come from
dsh-ops, a separate bundle. Sage mode declares them
as an optional dependency (optionalTools in cordis.patch.yml):
To adopt a read-only tool from any other bundle, extend the map without touching the code:
config:
optionalTools:
some-other-plugin: [their_read_tool]
ops_* tools.Open Plugin Manager in the Harness and enter this repository's URL as the install spec:
https://github.com/zero360-TYN/dsh-sage-mode
pic_location: /readme_pic/install.png
The manager reads a GitHub repository URL as a git install spec, clones the package, adds its
sage-mode row, and activates it. Updating later means installing the same URL again; a fresh
JavaScript module generation needs an app restart to load.
From a checkout, point the manager at the absolute path instead:
plugin_manager(action: "install_bundle", target: "<absolute path to this repo>")
That installs the package as a link, so editing files in the repo affects the live plugin directly — convenient while developing.
The row's defaults live in cordis.patch.yml. Your own overrides belong
in the profile's user layer ($DSH_HOME/profiles/<name>/cordis.patch.yml). A patch replaces
the targeted row's whole config, so restate every key you want to keep:
- id: sage-mode
name: dsh-sage-mode
config:
command: sage # command name (default: sage)
sectionOrder: 3255 # prompt section placement
allowedTools: [read, grep, web_search] # keep only these
optionalTools: # optional deps: adopt their read-only tools when present
dsh-ops: [ops_glob, ops_grep, ops_inspect_local_file]
section: | # the full advisory prompt
...
Unknown keys fail at load instead of being ignored, so a typo cannot silently disable your configuration. Missing keys fall back to their defaults.
command/run + command/done
pair the commands service already writes, so it adds no custom event type — an
unknown event type would make older readers refuse to reopen the session. Resume and fork
restore the mode automatically.agent.ctx.tools.restrict({ allow }) hides the mutating tools and
agent.ctx.tools.guard() denies anything that still reaches dispatch. Both disposers are
owned by agent.ctx and kept in the plugin's own effect, so agent disposal and plugin
unload both unwind them.@deepseek-ai/* dependencies. A profile-installed bundle resolves those only from
the dsh installation, so the plugin uses Node builtins plus services reached through ctx.run_code transport itself is kept (otherwise the whole tool surface
becomes unusable), but the generated SDK exposes only the permitted read-only tools.exit_plan_mode is hidden too; leave plan mode with /plan off or /sage off.node test/self-test.mjs
Covers config validation, the session-log fold, the command contract, restriction/guard registration and release, the fallback mask for unusual compositions, and admitting agents that already existed when the plugin loaded.