@dsh-external/dsh-redteam-modelv1.1.1✓
DSH redteam security research modes and runtime plugins, managed from one settings page: deploy the nine presets, install, update and uninstall the seventeen runtime plugins for the current profile.
Official core packages (1)
@deepseek-ai/dsh-settings^0.1.0-rc.6 || ^0.1.1-rc.0shared
@dsh-external/dsh-attack-atlasv1.2.1✓
AttackAtlas tab for the eight specialist security presets: per-mode architecture matrix (battle zones x tactics x items with per-mode terminal-state semantics), four-state coverage light-up, dispatch-on-double-click, attack-chain topology, custom work-methodology composer (layered run envelope, closure inquiry), tool/MCP/custom-tool modules with install-approval protocol, and a capability library of user-defined categories and items shared into the composer. v1.2.0 made the target a first-class dimension of the coverage ledger: coverage cells, stage bands and chain topology are accounted per target (same cell keeps independent terminal states per target), with an active-target pointer (first registered target auto-activates; redteam_atlas_target switch re-anchors; writes default to the active target), a per-target/aggregate matrix view, and org (organization) as a target kind. v1.2.1 selects the working target from a dropdown (selecting re-anchors and routes dispatches/default writes to it; a persistent badge shows the active anchor), and adds the LLM output-downstream-parsing cell (jailbreak only becomes a traditional vuln when the server re-parses model output into deserialization/SSTI/command sinks; pure-text-model targets have no such bridge). Legacy stores migrate automatically (single-target sessions attributed, multi-target rows kept in the session-common scope; *_legacy tables retained).
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-auto-advancev0.3.1✓
Auto-advancer for the eight professional security presets: when a subagent-class executor returns and the intent ledger still has open directions, a followup nudge is injected carrying the ledger state — close the intent (done with output pointer / blocked with reason), then anchor-dispatch the next step or finish quietly. Guardrailed autonomy: consecutive-turn cap (human input resets), opt-in via the intent ledger (open intents required), self-describing nudges, and a cooldown window that coalesces parallel returns. Injects only — never intercepts or rewrites; non-professional or ledger-less sessions are untouched. v0.2.0 kickoff nudge: the first human message in a professional-mode session with no operation-state draws a one-time three-registration reminder (goal/constraints/scope) — no hard gate, quick tasks may ignore. v0.3.0 mode-aware kickoff: the first-registration reminder now carries the session mode's decomposition theory, criteria structure, scope semantics and constraint hints (DECOMPOSITION imported from the sibling stage-gate plugin with generic-text degrade).
Official core packages (1)
@deepseek-ai/dsh-agent-presets*shared
@dsh-external/dsh-campaign-memoryv1.1.2✓
Campaign memory for the nine security presets: model-side write/search/get/list/remove tools storing raw content verbatim (credentials may be stored as-is or as pointers to existing local vaults), a marker-tagged per-workspace recall block injected into every assembly (fresh workspace starts clean; cross-workspace recall is an explicit search with provenance labels), preview-capped retrieval with on-demand full-text fetch, usage-ranked with expiry for detection fingerprints, a loopback web channel, and a per-session tab for browsing, searching and curating memories.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-hunterv1.0.0✓
DSH hunter plugin: FOFA / Hunter(qianxin) / Quake(360) aggregated asset search with unified DSL → per-platform syntax conversion, quota-aware pagination/export, API-key settings panel, and the code-audit live-verification pipeline (L0 fingerprint check on internet assets, L1 minimal-impact EXP only on user-authorized assets).
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-mcp-studiov1.0.2✓
MCP server studio for DeepSeek Harness: live-mounted servers with real connection status, a per-server tool browser, JSON import, and a dashboard-grade settings page.
Official core packages (3)
@deepseek-ai/cordis^4.0.1shared@deepseek-ai/dsh-mcp-client^0.1.0-rc.6shared@deepseek-ai/dsh-settings^0.1.0-rc.6shared
@dsh-external/dsh-mode-groupv1.0.0✓
DSH web client plugin: two-tier agent-preset picker on the new-session screen — built-ins and the researcher entry stay top-level while the eight professional security modes fold into a hover/click submenu, viewport-adaptive, with no other surface touched.
@dsh-external/dsh-product-subagentsv1.1.0✓
DSH subagent providers for the local claude-code / codex CLIs: registers the host-plane 'claude-code' and 'codex' providers the nine security presets' tool rows name. The CLIs keep their own model backend config (~/.claude/settings.json env, ~/.codex/config.toml); this plugin only spawns them headless and maps exit to a subagent run.
Official core packages (1)
@deepseek-ai/dsh-subagent*shared
@dsh-external/dsh-redteam-resultsv1.0.1✓
Session-scoped redteam findings registry for the nine security presets: model-side register/update/delete tools, a self-registered loopback web channel, and a per-session conversation tab (redteam 成果) with per-mode pages across all nine modes (board style per mode: findings / assets / ledger / timeline / cloudpath) plus a cross-session global ledger overview, severity stats, type distribution, lifecycle status, pagination, verify-to-session and MD/HTML exports.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-refusal-guardv1.0.0✓
DSH host-plane refusal-repair proximity injection for the five security presets: watches assistant turn text on session/event, detects refusal/moralizing patterns (two-tier: strong phrases full-text + weak keywords head-150, ), and when a hit lands re-injects a one-shot authorized-context reminder as a dynamic systemPrompt context contribution. RuntimeContextProjection dedupes: the reminder lands only when it appears (text change) and disappears after the repaired turn (change back to empty) — steady state costs nothing. Non-security presets resolve no preset id and render nothing.
Official core packages (1)
@deepseek-ai/dsh-system-prompt*shared
@dsh-external/dsh-route-boostv1.3.0✓
DSH host-plane route booster for the nine security presets: infers the current (mode, phase) from the latest user message (sticky phase memory) and re-injects a compact governance envelope — gate checklist (from dsh-stage-gate GATES), review/double-sign reminder, boundary line, evidence-level pre-judgment, refs pointers or a forced-search nudge on miss — as a dynamic systemPrompt context contribution. A new snapshot lands only when the envelope text CHANGES (RuntimeContextProjection dedupes), so steady phases cost nothing. v1.1.0 renders the constraint red-line line in the operation envelope whenever constraints are registered (compaction-proof visibility of user-stated deny/allow). v1.2.0 phase surface: in a wrap-up phase (report/summary/review) dispatch-class tools (subagent family + workflow) are folded away by a guard reading the sticky phase — closing takes priority over opening new directions; the envelope states the fold.
Official core packages (2)
@deepseek-ai/dsh-agent-presets*shared@deepseek-ai/dsh-system-prompt*shared
@dsh-external/dsh-scanner-toolsv1.0.0✓
DSH scanner-wrapper plugin (preset-plane, pentest/attack-defense): nuclei/httpx/ffuf as model tools with built-in rate discipline (conservative defaults, audited overrides), evidence-index landing, nuclei-hits→scan-reconcile pending rows, and assets.md registration enforcement for active scans (防盲打). Local binaries only — never auto-installs; MCP/install-request fallback hints built in.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-sec-enforcev1.4.1✓
DSH host-plane deterministic enforcement for the nine security presets : ctx.tools.guard() pre-execute interception — report files require a stage_gate PASS in gate-log.md, writes stay inside the task workspace (least privilege), conservative high-risk bash patterns must go through the ask-first flow, and bare full-port scans without rate controls are rejected with the fix. Guards fire only for the nine security presets; every denial appends to the workspace enforce-log.md. v1.1.0 adds the ask tier: reversible-but-invasive classes (account/privilege changes, firewall rule edits, flood stress) route through the tools/pre-execute waterfall into the host approval service (allowed-once or deny) instead of a hard block. v1.2.0: open intents block report writes until closed (intentGate, default on); the redteam controller's task briefs (task-briefs/*.md) must carry a 依据/锚点 line naming what justified opening the brief. v1.3.0 constraintGate: keyword-bearing deny constraints from the task ledger intercept matching bash commands and fetch URLs, citing the constraint text; prompt-only constraints stay envelope-injected.
Official core packages (2)
@deepseek-ai/dsh-agent-presets*shared@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-semgrep-auditv1.0.0✓
DSH semgrep wrapper plugin (preset-plane, code-audit): local semgrep as a model tool with the preset's offline rule sets (java 402 built-in + php + oss 1080 auto-located), evidence-index landing, dual-writes hits to scan-reconcile.md/.csv as pending rows (hit != vuln — reconcile via register sourceOrigin), metrics off, local binary only — never auto-installs.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-session-pulsev0.1.0✓
Session status panel for the nine security presets: header progress chip (task-list projection with completion bar), subagent chip with a right-side subagent directory drawer (running/finished groups, click a name to open that subagent session), and a left-center prompt rail listing user prompts with hover preview and click-to-locate on the chat anchor.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-stage-gatev1.5.0✓
DSH stage-gate host plugin: the stage_gate / gates_list model tools validate task-workspace artifacts against the nine security presets' gate schemas (structural checks, v1), append verdicts to gate-log.md, and list each mode's canonical gate files v1.2.0 adds the intent ledger: operation_intent registers a direction with a mandatory evidence anchor (boot exemption / criterion / scope / current-session finding / chain node — cross-store validators with format-check degrade), operation_progress closes intents (done/blocked/dropped, reason required for terminal states). v1.3.0 adds the constraints layer (operation_constraints: deny/allow with optional match keywords — keyword-bearing deny entries feed deterministic bash/fetch interception) and conservative scope auto-derivation (operation_goal returns a host-precise scope draft extracted from goal/criteria text, model confirms before registering). v1.4.0 mode-aware decomposition: DECOMPOSITION per-mode theory injected into operation_goal/scope/constraints renders (session mode resolved at execute time), and deriveScopeDraft grows per-mode extractors (audit file/route paths, binary sample hashes, cloud account/region/ARN, ad CIDR; av/ctf/redteam registration-only).
Official core packages (1)
@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-trace-vaultv0.3.0✓
Process vault for the nine security presets: zero-touch capture of every tool call (tool/call + tool/result paired by callId) into a local SQLite store with outcome classification (ok / blocked / error), plus model-side trace_search / trace_get / trace_recent tools — cross-compaction process memory and the failure-attribution data plane. Security-mode sessions only; capture never intercepts or rewrites; stored text is capped (index, not archive). Adds the failure-attribution envelope: a systemPrompt context block renders a blocked-aggregation hint (403/WAF/429 cluster) per assembly, change-only delivery, security modes only. v0.2.1: result text extraction handles the real pipeline nested tool-result blocks (text lives in the inner content array), found by live-model probing.
Official core packages (2)
@deepseek-ai/dsh-agent-presets*shared@deepseek-ai/dsh-tools*shared
@dsh-external/dsh-webshell-mgrv1.0.0✓
DSH webshell manager host plugin: session tab beside hunter with connection registry and protocol auto-detect (self-developed AES opcode channel, one-liner cmd/eval, modified-manager variants, stock manager compat), command exec / virtual terminal, file manager (binary-safe transfer, chmod, timestamp forge, remote fetch), database console (PDO native over eval-capable shells, CLI fallback), shell generator, declarative payload-plugin system discoverable by sessions, model tools for the five security presets, and a stdio MCP server sharing the same core.
Official core packages (1)
@deepseek-ai/dsh-tools*shared
