DeepSeek Harness Plugin Hub

发布与管理完整 Harness Profiles，发现适合你的插件。

探索

插件目录环境预设文档中心动态

社区

发布插件联系我们报告问题

相关链接

Plugin Hub GitHubDeepSeek Harness 官方项目系统状态隐私说明
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

独立、非官方社区项目，与 DeepSeek 官方无隶属、授权或背书关系。

Surface Contract Proof — DeepSeek Harness 插件（DSH Plugin）
← Plugins
S

dsh-surface-contract-proof

Surface Contract Proof

跨已记录的 DSH ToolRuntime、MCP JSON-RPC 和 CLI JSON 接口的基于内容寻址的一致性证明

插件会安装到这里；不确定时保持 web。

npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-surface-contract-proof#e357791563aef587f1cb89dad98e0fd370e00817
README兼容性版本

兼容性与来源证明

Surface Contract Proof 以 dsh-surface-contract-proof 发布，当前版本为 0.2.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。

DSH 兼容范围
*
运行环境
any
发布来源
github
Registry 更新时间
2026/9/7

版本

0.2.1stable
2026/9/7
0.2.0stable
2026/8/20

相关插件

正在加载相关插件…

最新版
0.2.1
DSH
*
HMR
重启进程
Tree shaking
未声明可安全裁剪
解包体积
未提供
文件数
未提供
Surface
any
许可证
MIT
发布源
github
GitHub
★ 2
周下载
0
最近提交
2026/9/7
查看源码 ↗
README Badge

点击下方 Badge 复制 Markdown，粘贴到 README 即可。

这是你的 Plugin？认领权益 · 优先安全扫描

验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。

认领这个 Plugin →
报告问题
DeepSeek Harness Plugin Hub
ProfilesPlugins分类动态文档登录管理 Profiles
ProfilesPlugins分类动态文档登录

相关插件

继续浏览 developer-tools 分类下经过校验的插件。

Web App@deepseek-ai/dsh-web-appdsh 浏览器界面捆绑包：位于 dsh-base 之上的 Web 补丁层，加上运行时粘合插件（提供前端 dist、Web 界面提示符、bash 运行时变量和 URL 行）Sdk Minimal@deepseek-ai/dsh-sdk-minimal独立的最小 SDK 配置包：JSON-RPC、一个 DeepSeek 适配器、持久化 Shell 和 JSONL 会话Sdk App@deepseek-ai/dsh-sdk-appdsh SDK 配置包：基于 dsh-base 提供 stdio JSON-RPC 服务和进程生命周期管理Subagent Codex@deepseek-ai/dsh-subagent-codex基于官方 app-server 协议的一次性 Codex 子代理提供程序

README

dsh-surface-contract-proof

dsh-surface-contract-proof verifies that recorded DeepSeek Harness ToolRuntime, MCP JSON-RPC, and CLI JSON envelopes preserve one pinned semantic contract across a baseline and an observed revision.

Version 0.2.0 removes the bundled DSH tool runtime and the default export that stock Cordis Loader misclassified. It exposes host-neutral tool definitions through its namespace export and is regression-tested through real local-path and fixed-commit stock Web profiles.

It reads explicit, SHA-256-pinned JSON fixtures. It does not execute the target, start arbitrary commands, call a network service, replay side effects, or implement an action core.

Complementary boundary

dsh-action-parity proves that interfaces bind the same Action ID/core and that runtime success/conflict behavior is reachable. This plugin answers a different upgrade question: given immutable recordings, did request/response schema versions, success bits, error classes, exit-code mapping, conflict and confirmation semantics, normalization, timeout/stale/out-of-order behavior, and result digests remain identical across ToolRuntime, MCP, and CLI?

Generic OpenAPI/Pact tools validate HTTP consumer-provider contracts. This verifier is specific to the three DSH machine surfaces and uses offline recorded envelopes.

Safety and evidence

  • Exactly three surface kinds are required: dsh-toolruntime, mcp-jsonrpc, and cli-json.
  • Baseline and observed fixtures bind target revisions, contract/schema versions, transport versions, and SHA-256 bytes.
  • Surface-specific fields normalize into one canonical case digest; the manifest pins each expected digest.
  • Missing, stale, malformed, secret-shaped, schema/version-drifted, or semantically different fixtures fail closed.
  • Reports expose hashes, identities, statuses, and differing field names only—never request arguments, response bodies, CLI output, prompts, messages, credentials, or secrets.
  • Paths are workspace-relative regular files; traversal and symlinks are rejected. Writes are atomic, read back, and limited to explicit artifactDir.

CLI

dsh-surface-contract-proof inspect --workspace . --manifest contract.json
dsh-surface-contract-proof verify --workspace . --manifest contract.json --artifactDir artifacts

Use inspect to obtain canonical baseline digests, review them, then pin them as cases[].expectedSha256. Exit 0 means verified; exit 2 means failed or invalid evidence.

DSH / MCP tools

  • dsh_surface_contract_inspect
  • dsh_surface_contract_verify
  • MCP aliases: surface_contract_inspect, surface_contract_verify

The MCP surface is proof-only and in-memory: it accepts bounded inline manifest/fixture JSON, reads or writes no files, and returns no fixture bodies. DSH/CLI may write only a content-addressed report beneath an explicit workspace-relative artifactDir, with atomic read-back verification.

dsh plugin --profile surface-contract add github:dongsheng123132/dsh-surface-contract-proof#<commit>

Development

npm ci
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp

MIT licensed. See SECURITY.md.