dsh-plugin-update-audit
Read-only update auditing for direct plugin dependencies in a DeepSeek Harness Profile.
The plugin adds one tool, plugin_update_audit. It inventories the selected Profile and checks each direct dependency according to its declared source:
- npm dependencies are compared with the official npm Registry
latest manifest;
- GitHub dependencies are compared with the repository's current
HEAD through the GitHub API;
- local tarballs and directories are reported as manual-review items, with SHA-256 for readable files;
- unsupported, missing, or unreachable sources are reported per plugin without aborting the whole audit.
The tool never installs, updates, removes, or rewrites a plugin. Network access is limited to registry.npmjs.org and api.github.com; use offline: true for local inventory only. Local dependency paths are redacted from tool output.
Install
dsh plugin --profile <profile> add dsh-plugin-update-audit@0.1.0
Restart DSH Desktop after installation.
Use
Ask the agent to call plugin_update_audit:
{
"profile": "dev-lab",
"offline": false,
"timeout_ms": 10000
}
Statuses are advisory:
update_available: npm has a newer stable latest version;upstream_changed: GitHub HEAD differs from an immutable pinned commit;local_review_required: a local or workspace source needs an explicit rebuild and review;current, ahead, offline, unpinned, not_installed, or unavailable: no automatic update conclusion is made.
Always review release notes and source changes, create a safety snapshot, update one plugin at a time, restart DSH, and run that plugin's acceptance tests.
Development
npm install
npm run check
npm test
npm pack --dry-run
Security
See SECURITY.md. This project is licensed under the MIT License.
