dsh-housekeeper

Housekeeper

DeepSeek Harness 的环境管家：工具链清单、代理临时文件/缓存扫描与安全的一键清理，以及机器规则文件（AGENTS.md）的查看/编辑——全部集成在 Web GUI 设置中。零运行时依赖。

目标 Profile

插件会安装到这里；不确定时保持 web。

npx -y @deepseek-ai/dsh plugin --profile web add github:guo6x/dsh-housekeeper#9d4c3be7d01d9c86e96cbe8d5a7088c1e6f4548c

兼容性与来源证明

Housekeeper 以 dsh-housekeeper 发布，当前版本为 0.3.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。

DSH 兼容范围: *
运行环境: web
发布来源: github
Registry 更新时间: 2026/8/26

版本

0.3.3stable

2026/8/26

0.3.2stable

2026/8/25

0.3.0stable

2026/8/25

README

🧹 dsh-housekeeper — Environment Housekeeper

中文说明 · DeepSeek Harness plugin

Keep your agent's hands clean: toolchain inventory, two-step cache cleanup, and machine rules (AGENTS.md) editing — all inside the DSH Web GUI settings. Zero runtime dependencies, one command install.

📋 Toolchain inventory — auto-detects node/pnpm/git/gh/ffmpeg/Edge/Chrome locations and versions
🗑️ Honest cache cleanup — scans the .tmp and cache directories agents leave behind: size / file count / mtime, 4000-file truncation markers, 30-day-untouched highlighting, click-to-expand content preview; create a plan, then confirm deletion
🛡️ Whitelist protection — only project .tmp dirs and cache-root children are deletable; .. escapes, symlink escapes, and system paths are rejected, with a realpath re-check before every delete
📝 Machine rules editor with a safety net — read/write ~/.dsh/AGENTS.md (the global rules every agent session loads), auto-backup of the previous version on every save, one-click restore, live on save
🌍 Configurable — scan roots default per platform (Windows: D:\github / D:\environment\cache), editable in the panel, overridable via env vars
🤖 Agent tools — housekeeper_report (inventory + disk report), housekeeper_plan (review only), and housekeeper_clean (executes a single-use token)

Install — copy, paste, confirm

# Install from GitHub — this is the supported release channel.
dsh plugin --profile web add github:guo6x/dsh-housekeeper

Restart a running dsh web process, then open Settings → Plugins → 环境管家. Seeing the Toolchain inventory section means installation is complete.

Requirements: the DSH web profile and Node ≥ 22. The plugin needs no account, API key, or extra service.

Developing from a checkout instead? Run dsh plugin --profile web add . from the repository directory. The committed lib/ files mean GitHub installs do not run a build script.

First safe pass in 60 seconds

Nothing in this walkthrough deletes files or writes rules.

Open Settings → Plugins → 环境管家.
Inspect the detected toolchain and cache candidates; click a row to preview its contents.
Do not select anything yet. You have verified the inventory and the candidate list without changing the machine.

For the same non-destructive proof through chat, paste:

Run housekeeper_report and summarize the detected toolchain plus the largest cache candidates. Do not create a cleanup plan, delete files, or change machine rules.

When you are ready to clean, select only scratch directories you recognize and choose Generate cleanup plan. Read the approved and rejected paths; deletion remains impossible until you explicitly use that plan’s one-time confirmation action.

The same reviewed flow is available to an agent: ask for housekeeper_report, review housekeeper_plan, and only then allow the returned token to reach housekeeper_clean.

If the panel is missing

Confirm the plugin is installed in the web profile: dsh plugin --profile web list dsh-housekeeper.
Restart the dsh web process after installing; a browser refresh alone cannot load new host code.
Check that Node is version 22 or newer. The inventory can run without Edge, Chrome, or any cloud credential.

Security model

All routes accept loopback clients only (403 otherwise)
Cleanup whitelist — a path is deletable only when ALL hold:
- under <projects-root>\<repo>\ .tmp\, or a direct child of <cache-root>\
- normalized path stays inside the whitelist root (no ..)
- realpath still lands inside the whitelist root (no symlink escapes)
- the whitelist roots and repo dirs themselves are never deletable
Two-step confirmation — a cleanup plan exists only in memory; its confirmation token expires after five minutes, is single-use, and every path is checked against the whitelist and realpath again immediately before deletion
The rules endpoint reads/writes $DSH_HOME/AGENTS.md only; the path is fixed
No telemetry, no external network calls

How it works

GUI settings ──fetch──▶ /housekeeper/state|clean/plan→clean|rules (loopback) ──▶ host plugin
                          ├─ probe: candidate paths + PATH lookup + versions
                          ├─ scan: rule-driven walk with sizes (4000-file cap)
                          ├─ clean: whitelist + realpath → plan → single-use confirmation → re-check, then rm
                          └─ rules: read/write $DSH_HOME/AGENTS.md (64KB cap)

Develop

pnpm install
pnpm test              # build, safety regression suite, and release-package check

MIT licensed. Issues and ideas welcome.

README

🧹 dsh-housekeeper — Environment Housekeeper

中文说明 · DeepSeek Harness plugin

📋 Toolchain inventory — auto-detects node/pnpm/git/gh/ffmpeg/Edge/Chrome locations and versions
🗑️ Honest cache cleanup — scans the .tmp and cache directories agents leave behind: size / file count / mtime, 4000-file truncation markers, 30-day-untouched highlighting, click-to-expand content preview; create a plan, then confirm deletion
🛡️ Whitelist protection — only project .tmp dirs and cache-root children are deletable; .. escapes, symlink escapes, and system paths are rejected, with a realpath re-check before every delete
📝 Machine rules editor with a safety net — read/write ~/.dsh/AGENTS.md (the global rules every agent session loads), auto-backup of the previous version on every save, one-click restore, live on save
🌍 Configurable — scan roots default per platform (Windows: D:\github / D:\environment\cache), editable in the panel, overridable via env vars
🤖 Agent tools — housekeeper_report (inventory + disk report), housekeeper_plan (review only), and housekeeper_clean (executes a single-use token)

Install — copy, paste, confirm

# Install from GitHub — this is the supported release channel.
dsh plugin --profile web add github:guo6x/dsh-housekeeper

Restart a running dsh web process, then open Settings → Plugins → 环境管家. Seeing the Toolchain inventory section means installation is complete.

Requirements: the DSH web profile and Node ≥ 22. The plugin needs no account, API key, or extra service.

Developing from a checkout instead? Run dsh plugin --profile web add . from the repository directory. The committed lib/ files mean GitHub installs do not run a build script.

First safe pass in 60 seconds

Nothing in this walkthrough deletes files or writes rules.

Open Settings → Plugins → 环境管家.
Inspect the detected toolchain and cache candidates; click a row to preview its contents.
Do not select anything yet. You have verified the inventory and the candidate list without changing the machine.

For the same non-destructive proof through chat, paste:

Run housekeeper_report and summarize the detected toolchain plus the largest cache candidates. Do not create a cleanup plan, delete files, or change machine rules.

The same reviewed flow is available to an agent: ask for housekeeper_report, review housekeeper_plan, and only then allow the returned token to reach housekeeper_clean.

If the panel is missing

Confirm the plugin is installed in the web profile: dsh plugin --profile web list dsh-housekeeper.
Restart the dsh web process after installing; a browser refresh alone cannot load new host code.
Check that Node is version 22 or newer. The inventory can run without Edge, Chrome, or any cloud credential.

Security model

All routes accept loopback clients only (403 otherwise)
Cleanup whitelist — a path is deletable only when ALL hold:
- under <projects-root>\<repo>\ .tmp\, or a direct child of <cache-root>\
- normalized path stays inside the whitelist root (no ..)
- realpath still lands inside the whitelist root (no symlink escapes)
- the whitelist roots and repo dirs themselves are never deletable
Two-step confirmation — a cleanup plan exists only in memory; its confirmation token expires after five minutes, is single-use, and every path is checked against the whitelist and realpath again immediately before deletion
The rules endpoint reads/writes $DSH_HOME/AGENTS.md only; the path is fixed
No telemetry, no external network calls

How it works

GUI settings ──fetch──▶ /housekeeper/state|clean/plan→clean|rules (loopback) ──▶ host plugin
                          ├─ probe: candidate paths + PATH lookup + versions
                          ├─ scan: rule-driven walk with sizes (4000-file cap)
                          ├─ clean: whitelist + realpath → plan → single-use confirmation → re-check, then rm
                          └─ rules: read/write $DSH_HOME/AGENTS.md (64KB cap)

Develop

pnpm install
pnpm test              # build, safety regression suite, and release-package check

MIT licensed. Issues and ideas welcome.

Housekeeper

兼容性与来源证明

版本

Housekeeper

README

🧹 dsh-housekeeper — Environment Housekeeper

Install — copy, paste, confirm

First safe pass in 60 seconds

If the panel is missing

Security model

How it works

Develop

兼容性与来源证明

版本

相关插件

相关插件

相关插件

README

🧹 dsh-housekeeper — Environment Housekeeper

Install — copy, paste, confirm

First safe pass in 60 seconds

If the panel is missing

Security model

How it works

Develop