dsh-tool-surface-proof
离线内容寻址的 DSH 模型可见工具接口符合性证据
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-tool-surface-proof#8db6d315c91a8a99e16c70162e8ad7587f4f4768Tool Surface Proof 以 dsh-tool-surface-proof 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Content-addressed evidence that the actual recorded model-visible tool surface of one DeepSeek Harness deployment still matches an approved lock across agent scopes, permission modes and presentation modes.
DeepSeek Harness already generates an official default Tool Schema Catalog by booting shipped tool plugins. dsh-mcp-lens already compresses large MCP catalogs and offers schema-budget checks. This plugin does neither. It verifies deployment-specific, explicitly recorded envelopes: for example, whether an owner/native surface and a reader/native surface still expose exactly the approved tool identities and schemas after an upgrade.
Schema version 1 binds an exact deployment revision, evaluation time, freshness policy and one approved surface per surfaceId. Each surface declares agentScope, permissionMode, presentationMode, and ordered {nameHash, schemaHash, position} locks. Each observation records the same public dimensions plus the model-visible tool objects captured by a separate trusted recorder.
The verifier detects missing or unexpected surfaces, scope/permission/presentation mismatch, added or removed tools, schema changes, optional order drift, stale/future observations, duplicate identities and revision mismatch. Reports contain only SHA-256 identities, counts and drift categories. They never return tool names, descriptions, schemas or raw business content.
This plugin does not capture live runtime state, grant or deny permission, execute commands, connect to MCP servers, or prove that a recorder was honest. Use a trusted deployment-specific recorder to create the observation envelope and review the lock before approval.
dsh-tool-surface-proof inspect --manifest surface.json
dsh-tool-surface-proof verify --workspace-root . --manifest surface.json --artifact-dir artifacts
Verification reads one workspace-relative regular file, rejects symlinks and traversal, performs no network requests or subprocesses, and writes only one content-addressed JSON report below the explicit artifact directory with exclusive creation and read-back verification.
The DSH bundle exposes dsh_tool_surface_inspect and dsh_tool_surface_verify. The independent stdio MCP server exposes inline, filesystem-free equivalents. Both call the same interface-free core.
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
python C:/Users/ZhuanZ/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .
MIT licensed. See SECURITY.md.