DSH plugins for Files & Documents

File plugins handle the material a session produces and consumes: attaching workspace paths to a prompt, rendering and editing files in a sidebar, generating Word, Excel and PowerPoint artifacts, and keeping writes inside a safe workspace root. This is one of the denser use cases in the directory because almost every serious workflow eventually touches a file.

Check path handling first. A file plugin should resolve everything relative to an allowed root and refuse traversal. It should tell you which file it touched so the change is reviewable in the transcript. “The agent edited something” without a path is not enough to audit later.

How to evaluate

Split read paths from write paths. Reading a PDF or rendering Markdown is low risk if it stays inside the session workspace. Creating or overwriting office documents, or exposing a generic filesystem tool to the model, needs a narrower root and a clear history of what was written.

Also check whether attachments are references or contents. A composer that only mentions @path keeps secrets out of the prompt by default; a plugin that inlines whole files will eventually paste a credential into context. Office plugins should name the service they call and whether files leave the profile directory.

What good looks like

A strong file plugin is boring about safety: explicit paths, workspace-relative resolution, visible diffs or a written artifact you can open in a desktop app. Previews (Markdown, PDF, images) are useful, but the source of truth remains a file on disk. Generators for Word or Excel should emit ordinary files under the workspace, not a proprietary blob only their UI can read.

The densest listings here also expose the same surface to other plugins — a sidebar file viewer other packages can register into — which is a better investment than a one-off panel that dies with a single extension.

Common failure modes

The common failure is a recursive file tool with no root, so the model can read ~/.ssh if the prompt asks nicely. The second is silently overwriting a document without keeping a previous copy. The third is treating preview HTML as trusted content: if a plugin renders remote HTML without sandboxing, a malicious page becomes part of your session.

Install order and boundaries

Constrain the workspace root first. Exports should be ordinary files you can open without the plugin; proprietary black-box formats lock assets inside a UI.