dsh-plugin-upgrade-016
The closed-corridor upgrade skill and scanner for the DeepSeek Harness hop 0.1.5-rc.2 → 0.1.6-alpha.2. It ships one version-locked corridor card and a zero-dependency seam scanner over a five-seam catalog — every seam is error-severity and every seam ships a detector:
| Seam | Breakage |
|---|
E1 | An agent/created listener that throws (or does slow work inline) blocks agent creation — the host dispatches it on a serial chain. |
E2 | Async apply race: any registration after the first await dies with INACTIVE_EFFECT in the unload window. |
E3 | Removed slot/state keys: settings.plugin.item (→ plugins.item) and SessionListState.current — both fail silently. |
E4 | Removed client APIs sessions.open/openSubagent/clear (→ retain/using/retainInfo) — click paths throw or swallow errors. |
E5 | Removed model literals deepseek-v4-flash*/deepseek-v4-vision-exp — uncatalogued ids route as text-only. |
The package is a bundle skill (the model sees the corridor card only when a task needs it) plus an npx CLI for plugin authors. It supersedes nothing and shares nothing with dsh-plugin-upgrade-015 (which owns the 0.1.3-alpha.1 → 0.1.5-rc.1 corridor): a corridor never widens, and a hop that adds seams is a new package.
What it is
skills/plugin-upgrade-016/ — the bundled agent skill: frontmatter routing, the fix-and-verify loop, and references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md (the version card: evidence, fix recipe and exit criteria per seam).lib/scan-0.1.6.mjs — a zero-dependency scanner (Node stdlib only). Born hardened: lib/ is scanned (committed build artifacts ship old seams to users), every line-level behavior is a per-seam catalog field, and the render order derives from the catalog.scripts/scan-0.1.6.mjs — the CLI (npx dsh-plugin-upgrade-016-scan --repo <path>); exit 0 = no error hit, exit 1 = at least one.docs/EVIDENCE.md — the command→output record behind every seam.
A clean scan is necessary, not sufficient: the breakage this corridor covers is silent from both ends. Verify with a real-host smoke, a resume round-trip for log writers, and a real browser assertion for a client half.
Quick start
dsh plugin --profile web add @perrylink/dsh-plugin-upgrade-016
npx dsh-plugin-upgrade-016-scan --repo <your-plugin-repo>
The skill routes itself: when a task is about migrating a plugin repo across 0.1.5-rc.2 → 0.1.6-alpha.2, the model loads the packaged card and runs the fix-and-verify loop.
Scanner usage
node scripts/scan-0.1.6.mjs [--repo <path>] [--json <out.json>] [--seams E1,E3] [--quiet]
Exit codes: 0 = no error-severity hit · 1 = at least one error hit · 2 = usage failure. The scanner is read-only: it never writes inside the scanned tree.
The five seams
See the version card (skills/plugin-upgrade-016/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md) for the full evidence and fix recipe. The short forms:
- E1 — never throw in an
agent/created listener; wrap sync work in try/catch, defer heavy work (queueMicrotask/setImmediate/own queue).
- E2 — everything registers before the first
await of an async apply; register() results go to ctx.effect().
- E3 — settings cards mount on
plugins.item (list slot: id/order/label, props {view:'summary'|'page'}); the current session derives from standard props (sessionId/useSessionStatus/retainedBy.mainView), never list.current.
- E4 — navigate via
sessions.retain(id, { source }); store and dispose the returned handle.
- E5 — model literals stay inside the alpha.2 catalog; replace
deepseek-v4-flash*/deepseek-v4-vision-exp.
Configuration
Every knob is a Schemastery Config field, documented inline in cordis.patch.yml:
enabled (default true) — register the packaged skill.skillName (default plugin-upgrade-016) — skill name published to the model catalog.skillsRoot (default the package's own skills/) — must contain <skillName>/SKILL.md.userInvocable (default true) — user-invocable in addition to model-invocable.
Development
pnpm install
pnpm test # scanner fixtures + card↔catalog parity + real-Cordis mount
pnpm run check:readmes # five-language README sync
pnpm run verify:self-contained
pnpm run verify:artifacts # pack + tarball inspection
pnpm pack
Topics
dsh · dsh-plugin · deepseek-harness · deepseek · cordis · plugin-upgrade · migration · skill · version-card · scanner · client-slots
License
Apache-2.0. See LICENSE and THIRD_PARTY_NOTICES.md.
