dsh-deep-opencode：在 DSH 里走 OpenCode 免费模型，无需 API Key
DeepSeek Harness 虽支持 models.dev 上的 opencode Provider，但 OpenCode 免费档仅允许来自 OpenCode 本体的请求。社区插件 dsh-deep-opencode 由 temidayoxyz 维护，启动本地 opencode serve 并提供 opencode-free 路由，使免费模型在 Harness 中可用且无需 API Key。本文基于官方 README 介绍安装命令、模型选择方式及 cordis.yml 主要配置项，并提醒插件以 dsh 进程权限运行、安装前应审阅源码与 MIT 许可证。
Read Moredsh-opencode-free：OpenCode 免费模型路线的星桥模式 Agent 预设
dsh-opencode-free（星桥模式）是 SZYTree0312 为 DeepSeek Harness 提供的 agent preset，配合社区插件 dsh-opencode-xdbridge 使用，专注 OpenCode 免费模型路线的前缀稳定与载荷控制。免费模型不按 token 收费，硬约束是速率限制、每轮重发带来的延迟与 8 MB 请求体上限。preset 通过固定工具目录、收紧 instructions 与 tool-fs 读上限、延后压缩等方式对齐桥接实现。安装需先 add xdbridge 再 add 本仓库，会话中选择星桥模式。结论主要来自读桥接源码，实机指标待补充。
Read Moredsh-connect-opencode：把本机 OpenCode 免费模型接入 DSH 模型选择器
dsh-connect-opencode（serra006，MIT，0.1.2）通过隔离 opencode serve --pure 与本地 OpenAI 兼容 shim，将 OpenCode provider 目录中 cost 全为 0 的免费文本模型注册到 DSH「设置 > 模型」。工具由 DSH 执行；支持插件市场或 npm 安装与 cordis.patch.yml 配置。不额外提供额度，上游限流与地区限制会原样透传。
Read Moredsh-opencode-freeaccess：在 DSH 里用 OpenCode 免费模型
在 DSH 中将 Provider 指向 opencode.ai 并使用免费模型时，常因请求未携带 OpenCode 要求的 session id 而返回 403 FreeTierError。社区插件 dsh-opencode-freeaccess（mubaid，MIT）在匹配 Host 的出站请求上注入官方客户端同类会话头，不改变 body 与响应，使免费档可在 Harness 内流式使用。安装：dsh plugin --profile web add github:mubaid/dsh-opencode-freeaccess 后重启 profile。支持按对话稳定 id、并发与子智能体隔离；适用于 fetch 系协议，不支持 WebSocket。安装前请审阅源码与进程权限。
Read Moredsh-opencode-live-models：在 DSH 中同步 OpenCode 与 Codex 的实时模型目录
DSH 内置 pi-ai 模型目录可能滞后于 OpenCode Go、OpenCode Zen 与 OpenAI Codex。dsh-opencode-live-models 在运行时刷新三条路线的 live 目录并保留 OpenCode 会话头与 prompt-cache 策略；集成 Settings → Models 拉取与选择；在插件详情页提供 ChatGPT 与 OpenCode Console 登录，在 Settings → Account & balance 只读展示 OpenAI、Go 订阅用量与 Zen 余额。要求 DSH ≥0.1.5-rc.1，插件 ≥0.3.0。安装 spec 为 github:Luca4Don3/dsh-opencode-live-models，需主机可访问 GitHub。
Read Moredsh-gateway-models：为 OpenCode Go 与 Command Code 网关路由补齐协议、地址与模型清单
itchenshi 维护的 DSH 宿主插件 dsh-gateway-models，为 opencode-go 与 commandcode 声明 wire 协议与 baseURL，将 DeepSeek V4.1 置顶 OpenCode Go 模型列表，并从 Command Code 公开目录幂等补齐模型；为 OpenCode 请求附加 x-opencode-session（默认每会话 UUID）。支持 GUI 勾选或 CLI 从 GitHub/Release 安装，需 DSH >= 0.2.0-rc.2、Node >= 20，MIT 许可。
Read MoreDSH OpenCode Session Sync：把 OpenCode 桌面会话导入 DSH 原生工作区
dsh-opencode-session-sync 是 forwardzz 维护的社区 DSH 插件，只读 OpenCode 的 opencode.db，经 sessionPersistence 写入，使历史会话按原 cwd 归入 DSH 工作区并支持启动后增量追加。文章介绍其核心能力、link 安装与 verify-install、opencode_sync 工具与 selfcheck，以及配置路径、幂等与 diverged 等注意事项。需 Node.js 22.5+；已在 DSH 0.2.0-rc.2 上验证。
Read Moredsh-opencode-patch: Make OpenCode Models Available in the DeepSeek Harness
`dsh-opencode-patch` is a plugin designed specifically for DeepSeek Harness to fix the issue where the OpenCode model fails to work under its default configuration. By restoring session affinity, gateway source headers, and providing tool definitions for the free tier, it resolves request rejections caused by missing network-layer protocol support. Additionally, the plugin supports offline caching of model catalogs and a real-time billing dashboard, ensuring that traffic from other providers remains unaffected.
Read MoreDeepSeek Harness Plugin: dsh-opencode-xdbridge
The DeepSeek Harness plugin dsh-opencode-xdbridge resolves the 403 issue caused by rejected direct connections to free models by running the official OpenCode binary in an isolated environment. It integrates models such as big-pickle with DSH, providing OpenAI-compatible endpoints, a visualization panel, and securely isolated runtime management. The plugin supports automatic downloads, resumable transfers, context compression, and intelligent failure classification, and requires a Node.js environment.
Read Moredsh-web-search-opencode-go: Fix DSH Web Search Routing Issue on OpenCode Go / Zen
`dsh-web-search-opencode-go` is a drop-in patched-fork plugin designed to fix errors caused by the missing `x-opencode-session` header when DeepSeek Harness (DSH)'s built-in `web_search` runs on the OpenCode Go / Zen gateway. The plugin automatically injects the required request headers and supports both DSH Bundle and Drop-in copy installation modes. Users only need to install it with a simple command and configure the baseURL to use the `web_search` tool normally in `dsh web`, without modifying the official DSH installation.
Read MoreDeepSeek Harness Plugin: dsh-opencode-models
The `dsh-opencode-models` plugin for DeepSeek Harness (DSH) addresses the lack of metadata and dynamic changes in the official model list. Users can fetch, compare, add, and synchronize OpenCode Zen models in real time via the CLI or Web interface. It requires no additional configuration, leverages existing authentication, and supports bulk management. Note that the plugin applies default capacity limits to unknown models and supports only specific free-tier model IDs; changes take effect immediately.
Read Moredsh-opencode-session-header: OpenCode Go Session Header Injection in DSH
`dsh-opencode-session-header` is a plugin for DeepSeek Harness (DSH) that fixes the `400 MissingSessionID` error returned by the OpenCode Go model when the `x-opencode-session` request header is missing. The plugin intercepts requests and injects the header, resolving the error while preserving the existing routing and caching optimizations. It only applies to the `opencode.ai` domain, supports a runtime toggle, and has no additional dependencies, making it suitable for use with DSH version 0.1.2-rc.1.
Read Moredsh-opencode-session-id: Zero-Configuration OpenCode Session ID Injection
`dsh-opencode-session-id` is a DeepSeek Harness (DSH) plugin designed to resolve the cumbersome and error-prone issue of manually injecting session identifiers when integrating with the OpenCode model. It intercepts outbound HTTP requests at the Wire layer and automatically adds session-related headers, enabling zero-configuration operation. The plugin automatically hashes UUIDs into short tokens, supports mainstream fetch protocols, and takes effect simply by installing it and restarting the service, ensuring deterministic and secure session tracking.
Read MoreDeepSeek Harness Plugin: dsh-opencode-provider
dsh-opencode-provider is a plugin for DeepSeek Harness (DSH) designed to connect DSH to a local OpenCode server over HTTP, enabling local model invocation without an API key. It supports streaming output, retry policies, and event compatibility, but is limited to text-based input and output. It does not support structured tool calling or multimodal capabilities, and requires the local server to operate within a restricted network environment. This plugin offers developers a convenient, low-cost entry point for local inference.
Read Moredsh-opencodego-quota: Display OpenCode Go quota permanently in the DSH Web GUI left sidebar.
dsh-opencodego-quota is an MIT-licensed plugin for DSH Web GUI (v1.0.5, requires Node 18+), designed to permanently display OpenCode Go quota information in the left sidebar, reducing manual query costs. It fetches data from the official OpenCode usage interface to display real-time quota progress bars (with a green-to-red gradient), used amounts, quotas, and reset times for daily (last 5 hours), weekly, and monthly time windows. It also supports displaying the billing period and a 24-hour color band based on Beijing Time. The plugin performs local refreshes every 30 seconds, allowing users to set an automatic refresh interval ranging from 5 to 3600 seconds (persisted in localStorage), or manually trigger a refresh. The API Key is automatically retrieved in order from DSH credentials, environment variables, or OpenCode CLI...
Read Moredsh-opencode-go-quota: Display OpenCode Go Quota Beside the DSH Web Input Box
`dsh-opencode-go-quota` is a DSH web plugin designed to address the issues of scattered OpenCode Go quotas, lack of intuitive monitoring, and delayed quota warnings during agent requests. Its core functionalities include displaying a dynamic progress ring next to the chat input box, which shows real-time quota remaining for 5-hour, weekly, and monthly periods. The ring's color changes based on urgency, supports clicking to switch windows and automatic refresh. When the quota reaches a threshold, the plugin injects a one-time reminder into the system prompt as the agent enters a new tier, avoiding repetitive disruptions. The plugin retrieves keys by reading the local `auth.json` or environment variables, calls official APIs to fetch data, and offers multiple configuration options to customize warning thresholds and caching durations. Installation is straightforward, supporting additions via GitHub or local paths.
Read MoreUnauthenticated HTTP Service in OpenCode Leads to RCE: The Security Red Line for Open-Source AI Coding Agents
### CVE-2026-22812 Disclosure: Versions of OpenCode prior to 1.0.216 automatically start an unauthenticated HTTP service upon launch, which defaults to ports starting at 4096 and exposes interfaces for shell execution, PTY access and arbitrary file reading. Combined with permissive CORS policies, both local processes and malicious web pages can achieve remote code execution (RCE). This vulnerability has a CVSS score of 8.8 and was fixed in version 1.0.216. This article sorts out the cause of the vulnerability, the Proof-of-Concept (PoC) attack path, and the industry background of the Hugging Face Agent intrusion, and provides suggestions for upgrading and secure Agent security design.
Read More