dsh-plugin-check
检查已安装的 dsh 插件，与经过验证的软件包注册表进行比对：哪些插件包含损坏的软件包，哪些固定使用已不存在的 dsh 版本，以及哪些会在安装时于你的计算机上运行代码。为每个问题起草修复该问题的 issue
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-check@0.1.0Plugin Check 以 dsh-plugin-check 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Check the DeepSeek Harness plugins you already installed, and draft the issue that fixes each problem.
Every plugin marketplace answers what could I install. None of them answers is what I
installed still working — which is the question that decays: dsh went 0.0.1-rc.1 →
0.1.0-rc.6 in its first five days, so a plugin that installed cleanly last week can be
pinned to a range that no longer resolves.
dsh plugin --profile web add dsh-plugin-check
Ask the agent to check your plugins. It calls the plugin_check tool, which reads the
profiles under $DSH_HOME, asks dshplugins.co what it knows about
each installed package, and reports the difference.
Checked 6 installed plugin(s): 4 with problems, 0 not in the registry.
[web] @nanmicoder/dsh-agent-teams
error: depends on @deepseek-ai/dsh-llm@^0.0.1-rc.1, but npm now ships 0.1.0-rc.6
[web] @a834063245/hologram-dsh
error: rows-resolvable: 1 row(s) name something an install cannot resolve
Pass draftReports: true and it also writes an issue body per problem plugin, naming the
exact edit that fixes it, ready to file against that plugin's repository.
| Finding | Meaning |
|---|---|
patch-shipped | The declared cordis.patch.yml never shipped — the plugin installs and the layer is not there |
rows-resolvable | A patch row names something an install cannot resolve, usually the package's pre-publish name |
client-half-shipped | A declared browser half is missing — it boots fine and the UI never appears |
prebuilt | Source only, so installing runs its build script on your machine |
| stale range | Its dsh dependency range excludes the version npm ships today |
It never installs, upgrades, or removes anything. Most of what it finds can only be fixed by the plugin's author, which is why it drafts the report rather than pretending to repair.
It reads packaging, not code: a plugin with nothing reported can still be malicious or useless. Treat it as a dead-on-arrival filter, not a safety endorsement — a plugin runs inside the dsh process with everything dsh can reach.
- id: plugin-check
name: dsh-plugin-check
config:
registry: https://dshplugins.co # any host serving the same /api/v1 shape
timeoutMs: 8000
Data comes from the free dshplugins.co API (CC BY 4.0), which downloads every published tarball daily and checks it against what its manifest claims.
MIT