DSH plugins for Notifications

Notification plugins close the loop on long tasks: desktop toasts, chat messages, webhooks, and log forwarding to systems that already page you. They matter most once sessions run for tens of minutes and you stop staring at the terminal. In this directory the mature shape is a bridge that puts the agent on a channel you already use, with session-level commands and per-channel access policy — but the local shape is legitimate too, and this hub now holds both.

This is also the most crowded category in the index, which is worth knowing before you shop by stars. 144 repositories carry “notif” in their name, 119 of them sit at 0–2 stars, 25 reach 3 or more, and exactly two pass 50. Coverage was never the problem; signal is. The three curated picks below are the ones that survived a read of their actual sources.

Compare them on delivery guarantees and noise control. A plugin that fires on every tool call trains you to ignore it. One that only reports completion, failure, or an approval request stays useful months later. If the channel can receive messages from other people, access control is part of the notification design, not an afterthought.

How to evaluate

Start with the event surface: which lifecycle moments actually emit (task done, task failed, approval needed, session idle). Then look at where the message goes — local OS notification, IM platform, webhook, or a paging system — and who can trigger a reply into the harness. Finally check identity: on open group channels, anyone who can message the bot may be steering your agent unless an allowlist says otherwise.

Prefer plugins that bind a chat to an explicit session, keep secrets out of the message body, and document transport (WebSocket, long poll, Socket Mode) so you can reason about offline and reconnect behaviour.

What good looks like

A strong notification path is boring on the happy path and strict on the trust path. You get one clear message when a long run ends or needs a human. You do not get a flood of intermediate tool noise. Inbound commands are either disabled or scoped to known users. Credentials for the channel live outside the model context, and the plugin’s docs name the exact platforms and permission scopes it needs.

Desktop-only toasts are fine for a single-user laptop profile. Team chat bridges are the right tool when the session outlives your attention — and the wrong tool when you have not decided who is allowed to talk back.

Common failure modes

The common failure is an “always on” bridge with default-open group policies: convenient on day one, a remote control for your agent by day two. The second is notification spam that buries the one completion message you needed. The third is assuming every IM adapter has the same security model — a platform that only supports open DMs is not equivalent to one with scoped app tokens and allowlists.

Install order and boundaries

Confirm which session a bridge is bound to, and whether sensitive content will be pushed to a third party. Completion alerts are useful; “push every tool output to IM” is an incident amplifier.