The default plugin composition

• 1: Codex Auth
• 2: Better Sidebar
• 3: Context Doctor
• 4: Oil Creator
• 5: Plugin Marketplace
• 6: Harbor Evolution

1 - Codex Auth

Problem addressed

One settings section combines Codex login state, available models, web search, and image generation, reducing repeated configuration across capabilities.

Usage

Open Settings → GPT Auth, complete login, inspect account state, and select a usable Codex model. The desktop composition also registers search and image capabilities: search uses standard web_search; generate_image creates or edits images and saves them as session attachments. Image tool availability depends on model declarations, login, account status, and plugin settings.

YourBuddy 0.3.9 adapts its product smoke path to the current model-selector API and verifies that the GPT Auth status route and Codex model catalog resolve without making a real model request. OAuth and real provider traffic remain outside that verification.

Reason for default inclusion

Existing Codex users can start with a familiar account and use the same authentication entry for research and image tasks. Other providers remain configurable.

Limits

This is an unofficial account interface supplied by the community; upstream explicitly limits it to personal development. Interfaces, quota, and account availability can change. Available quota depends on the account and upstream service. It reuses native Codex authentication files; keyring-only storage without usable file credentials may require changing native login storage. Images persist in conversations, but the plugin currently offers no workspace image export action. Its long-context switch also does not guarantee increased backend capacity.

2 - Better Sidebar

Problem addressed

Users can inspect a file tree, editor, image and Markdown previews, real terminals, Git differences, background tasks, and other plugin pages in the primary workbench beside the conversation instead of relying entirely on the assistant’s description.

Usage

At desktop width, the split-pane workbench stays visible to the left of the conversation even when its dock state was collapsed in an earlier session. Drag the divider to resize the two regions. File-tree clicks, Open in new tab, explorer reveal, and Changes-tab file actions open in the Session that owns the source tab. Use terminals or Git views to review code changes. The embedded Browser renders ordinary cross-origin sites without a sandbox by default; enable the restricted iframe sandbox in Side card settings when preferred. On a narrow window, the conversation remains primary and Better Sidebar opens through its overlay control. Recommended-plugin destinations, embedded-browser external actions, and terminal HTTP(S) links open in the system browser. In YourBuddy, run a recommended plugin’s install command once; its isolated Web Profile runs dependency build scripts without a separate pnpm approve-builds step.

YourBuddy 0.3.10 records the file and Browser checks in its verification record.

Reason for default inclusion

It completes the path from requesting work to producing results and human inspection, while giving other plugins a stable primary region for pages and file viewers.

Limits

Real terminal operations affect the actual working directory; a panel is not an isolation guarantee. Model-facing terminal_* and sidebar_open tools default to off and require explicit activation. The default unrestricted Browser gives embedded cross-origin pages normal iframe capabilities, including top-level navigation. The restricted setting keeps the GUI origin and unapproved loopback addresses opaque. Every mode remains subject to site iframe policies and browser rules, so some websites cannot be embedded. Side conversations remain a Beta capability. YourBuddy maintains these behaviors as replayable product patches while Better Sidebar keeps its upstream Portal presentation by default outside YourBuddy.

3 - Context Doctor

Problem addressed

As project instructions, skills, and MCP tools accumulate, users need to locate context costs, repeated instructions, and shadowed same-name skills.

Usage

Expand Context Doctor beside an existing session’s input, or ask the Agent to call context_audit. Inspect instruction chains, skill catalogs, tool schemas, and MCP groups. Review the files and sources behind suggestions before deciding to change them.

Reason for default inclusion

A workbench that encourages plugin composition should also help users observe its costs. Audits support decisions about retention, trimming, and on-demand loading.

Limits

Auditing itself is read-only. Token figures are estimates rather than billing records. Duplicate detection mainly identifies identical text; it cannot guarantee detection of semantic conflicts or establish that content has no value. Asking an Agent to implement a suggestion is a separate operation. Check paths and excerpts for sensitive information before sharing reports.

4 - Oil Creator

Problem addressed

Video and article production creates related scripts, recordings, subtitles, covers, publication packages, and performance records. Oil Creator keeps each project anchored to one ordinary local folder instead of hiding its content in a private database.

Usage

Select the 内容创作 Agent Preset, open the Library tab, and ask the Agent to inspect and configure the content workbench. Confirm the proposed library folder before saving it. Create a topic and script first, then bind recording, subtitle, cover, article, or publishing workflows as needed. The bundled publishing Skills can prepare drafts for enabled video platforms and the WeChat Official Account draft box.

Reason for default inclusion

A personal AI workbench should support finished media and articles as well as code and documents. The dedicated Preset supplies a content-production persona while the plugin keeps files, stage status, tools, and human review points together.

Limits

The core local library and script workflow work without optional integrations. Recording and editing remain human actions. Video publishing requires Ego Lite and logged-in creator accounts; WeChat Official Account drafts require AppID, AppSecret, and an API IP allowlist. Subtitle, cover, article, publishing, and metrics features require their documented external tools or credentials. Draft preparation stops before final publication or group-send. Review paths, generated copy, subtitles, titles, and platform matches before accepting or uploading them.

5 - Plugin Marketplace

Problem addressed

Users can discover community plugins in Settings, inspect their README, source, and installation method, and add capabilities when needed.

Usage

Open Settings → Plugin Marketplace, search, and inspect a plugin. A package exposes an installation confirmation only when one npm package unambiguously links to the selected repository and declares a DSH Bundle patch. Check the resulting status and restart YourBuddy through Application lifecycle. The AI explanation feature uses the configured default model.

Reason for default inclusion

The default composition is a starting point. Discovery lets users keep choosing tools while understanding their purpose and source before installation.

Limits

GitHub topics and stars support discovery rather than security review or compatibility certification. One-click installation additionally requires valid npm DSH Bundle metadata and a repository association; ambiguous metadata leaves it unavailable. Search requires external networking and may be rate-limited. Installed code has the same Host authority as manually installed DSH plugins. Membership in the same Enhancement Suite does not mean that its memory, persona, or vision plugins are also installed by default.

6 - Harbor Evolution

The 0.3.12 verification archive records the plugin and matching Python Adapter 0.9.8, the published App, the relocated runtime, and the Host Historical Session Adapter smoke. Native startup, visual window inspection, and real-model scoring remain unverified for 0.3.12. Older Hosts without page attachments still require explicit Ask AI or @harbor references. Updating only the independent plugin cannot add missing Host capabilities.

Problem addressed

Users facing inconsistent Agent results can investigate completed sessions or use fixed tasks to compare behavior before and after one controlled change.

Usage

Open an existing Harbor result, select a Trial or check several rows, and type your question in the existing Composer. Sending freezes that page and selection; expand the message attachment to inspect them. Ask AI and @harbor references take priority. Turn off Attach current page on send to omit automatic context; other tabs and slash commands do not attach Harbor implicitly. A failed message stays recoverable without overwriting a newer draft. Restore it when the Composer is free, then send again to capture the current page.

Without a dataset, choose Evaluate recent Sessions. It previews up to three completed conversations from history accessible to the current DSH, including other project directories. Review the sample, review model, and redacted-data/cost notice; confirm to start the background diagnosis and open its completed Job. No history path is required, and a bounded recent sample does not represent all history. The evolve-agent-with-harbor Skill provides the conversational entry with exact-working-directory selection; for explicit tasks, specify the Dataset, Generator, Evaluator and criteria, and Optimizer.

Reason for default inclusion

Working your way can extend to judging effectiveness on your own tasks. Actual failures can gradually become regression cases instead of judging a model or prompt from a single demonstration.

Companion components

The desktop also carries the Harbor Skill, matching harbor-dsh-evolution Python Adapter, and managed Python runtime. Ordinary desktop users should not repeat the independent plugin README’s npx ... setup installation flow. Jobs use Host execution by default; Docker remains available when a task needs container isolation. Candidate dependencies, model services, and networking must exist in the selected environment and pass Doctor.

Limits

Page references store private identity and revision records, not evidence bodies or credentials, in the original project and Session. Saved references survive the in-memory cache expiry or a Host restart, but missing/corrupt records and another Session cannot recover them. Changed evidence remains explicit; Trial sets are never silently expanded. Records are not automatically deleted. Unsent-message recovery lasts only for the current browser session, not a durable outbox. Attaching a page does not start an evaluation or deployment.

Historical session diagnosis observes existing records without rerunning a Candidate and cannot become a promotion comparison baseline. Insufficient evidence can remain unscored. A single-Query quick diagnostic primarily checks execution wiring; its drafted criteria do not establish an executed quality evaluation. Formal comparisons require fixed task, model, and evaluator identities. Evaluator reliability additionally needs independent Ground Truth meta-evaluation. The plugin does not automatically deploy Candidates or replace production Agents. Evaluation can incur additional model requests, container execution, and disk usage.

Credentials

A Candidate can invoke the frozen Host model through a temporary Job capability. Reusable Codex OAuth or upstream API credentials are not copied into the Candidate. This does not mean model requests avoid the network.

Development example: from a specialized need to a plugin

Harbor Self Evolving is an independent project developed extensively and maintained by the Y8 maintainer. It brings task diagnosis and controlled evaluation into the everyday workbench, avoiding the need for every user to assemble evaluation commands and reports manually.

An extension can use this division of responsibilities: instructions guide the work, a plugin supplies runtime operations and UI, and an external program handles necessary specialized execution. A small plugin needs neither Python nor containers. Start with your first plugin, then use the source link at the top of this page to explore Harbor. This page owns usage guidance rather than copying its development API.