I run a one-person studio, and DeepSeek Harness (DSH) is where I spend my working day: chats with agents that write code, run shell commands and produce documents on my own server. DSH has a plugin system, and over the last two months I wrote the pieces I kept missing. Now they are public on GitHub and npm: twelve plugins and one companion service, MIT licensed (one is Apache-2.0).
A disclosure before anything else: these were written with AI coding agents, mostly running inside DSH itself, under my direction. I decided what to build, reviewed the designs and the diffs, ran the tests and I use every one of them daily. Versions go from 0.1 to 2.1, so please treat them as beta and tell me what breaks.
The four I would start with
dsh-artifacts: see what your agents made
Agents produce files: reports, dashboards, small web apps. dsh-artifacts adds an Artifacts tab to the right sidebar that lists every file an agent wrote and previews it in place, with live reload, version history, a diff view and a public link toggle. Markdown is rendered on the server into themed pages with KPI tiles, charts, timelines and diagrams, so an agent writes a few KB of Markdown instead of a whole HTML page. Agents also get a template library: a dashboard becomes one JSON file passed to artifact_from_template.
dsh-mail: mail for humans and agents
IMAP, POP3 and SMTP accounts, Gmail and Microsoft 365 through OAuth2 with your own client, a Mail tab for reading, and mail_* tools for agents. The part I care about most is the safety rule: by default agents only create drafts, and every send result starts with SENT, DRAFT ONLY or SCHEDULED, so neither the model nor I can misread what happened. Remote images go through a signed server proxy instead of the browser.
dsh-phone: SMS, calls, voicemail and Telegram
A Phone tab with SMS threads, calls and a keypad. Call audio goes through your own server over one encrypted socket, so it works on networks that block WebRTC. Live, Voicemail and Do not disturb modes come with live voicemail transcripts and a Pick up button. It works with Twilio numbers and with SIP lines bridged through Asterisk, and it can host a Telegram account. Agents get phone_* and telegram_* tools with rate limits and a kill switch.
dsh-seal: an encrypted channel in front of DSH web
Some networks inspect TLS. dsh-seal is a small Go reverse proxy plus a service worker that it injects into the DSH page: after the first page load every request, event stream and WebSocket message travels inside a sealed channel (ECDH P-256 per page load, AES-256-GCM per stream direction, a pinned server identity). The middle box sees the host name and the traffic volume, not paths, queries or chat text. The README lists the honest limits too, starting with first visit trust.
The quiet fixes
Some plugins have no UI at all and simply remove an annoyance:
- dsh-fs-reobserve: when an agent edits a file with sed and then with the edit tool, stock DSH refuses the edit as stale. This plugin refreshes the observations the session itself made stale, and still blocks writes made by others.
- dsh-subagent-tiering: a subagent call that names no model gets a cheaper sibling of the parent (Opus to Sonnet at medium effort, Qwen max to Qwen flash). Explicit choices win.
- dsh-request-image-cap: a tall screenshot passes the area budget but breaks Anthropic's 2000 px per side limit for many-image requests, and then fails on every retry. This caps the request copy per side and leaves the stored image alone.
- DSH-Idle-Watchdog: nudges opted-in chats that stall ("shall I continue?"), with a cap, backoff and quiet hours, plus a secret-protected HTTP API so cron jobs and CI can post into a chat.
- dsh-plugin-updates: an Updates tab that only offers releases your running DSH core can load, and never mistakes a same-named npm package for your plugin.
The daily drivers
- dsh-workspace-rail replaces the chat list with pinned chats, projects as folders with their own AGENTS.md, a live Recents list and unread markers.
- dsh-note-keeper is an Obsidian-compatible notes app in the sidebar with search, a graph, audio notes with transcription, OCR and notes_* tools.
- dsh-voice reads replies aloud and takes dictation, with 23 TTS and STT provider types side by side and per-language routing (I switch between English, Italian and Greek in one text).
- dsh-orchestrator adds an Orchestrate tab and 14 orch_* tools to spawn, prompt and fork agent chats and to run command, scrape and http tasks on local or ssh runners.
Installing
The plugins are on npm under the @lucagiftzek scope, and each one also installs straight from GitHub. The sidebar tabs need dsh-better-sidebar, a community plugin that hosts them:
dsh plugin --profile web add dsh-better-sidebar # the tab host, skip if installed
dsh plugin --profile web add @lucagiftzek/dsh-artifacts
# or from GitHub: dsh plugin --profile web add github:lucagiftzek/dsh-artifacts
# then restart dsh web
Swap in any other name: @lucagiftzek/dsh-mail, @lucagiftzek/dsh-phone, @lucagiftzek/dsh-voice and so on. Two exceptions: the Idle Watchdog is the unscoped dsh-idle-watchdog, and dsh-seal is not a plugin but a small Go service you clone and build (its README has the three lines).
Every README starts with its own install block and a screenshot, and links to the others. Tested on DSH 0.2.1; several also run on 0.1.5.
What building them with agents taught me
- Put the safety rule into the tool result, not only into the docs. Models read results more carefully than descriptions.
- Give every plugin stable error codes, a doctor route and a short skill, so an agent can diagnose its own setup instead of guessing.
- Do the work on the server. The browser stays a thin UI; mail, calls and fetches go through the host, which also keeps the user's IP away from providers.
- Publish from a clean tree. My working repos contain host names and test data; the public ones are built from scrubbed trees and scanned before every push.
Feedback welcome
Each repo has issue templates and a security policy. If one of these saves you time, a star helps other DSH users find it. Everything is at https://github.com/lucagiftzek.
Top comments (2)
Enforcing draft-only status prefixes in
dsh-mailso neither the model nor the operator misinterprets execution state is an essential safety boundary for autonomous tooling. The ECDH P-256 handshake insidedsh-sealto defeat middlebox TLS inspection is also remarkably thorough. How do you handle service worker cache invalidation when deploying new companion updates?Putting execution guardrails directly into the tool return payload is something I had to learn the hard way too. Models routinely ignore system prompt warnings once the conversation history gets long, but they pay strict attention to whatever status string comes back from the command execution. The file re-observation issue is also very familiar. Whenever a subagent runs a shell one-liner to fix a config, standard diff tools assume an external modification happened and choke on the next block replacement unless you explicitly resync the file hash.