upstream-radar

Upstream Radar

持续监控 DeepSeek Harness 插件的依赖项和兼容性，包括准确路径、上游变更以及隔离安装/加载证据。

目标 Profile

插件会安装到这里；不确定时保持 web。

npx -y @deepseek-ai/dsh plugin --profile web add upstream-radar@0.45.0

兼容性与来源证明

Upstream Radar 以 upstream-radar 发布，当前版本为 0.45.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。

DSH 兼容范围: *
运行环境: any
发布来源: npm
Registry 更新时间: 2026/9/20

版本

0.45.0stable

2026/8/25

0.44.0stable

2026/8/25

0.43.5stable

2026/8/25

查看其余 68 个版本收起版本

0.43.4stable

2026/8/24

0.43.3stable

2026/8/24

0.43.2stable

2026/8/24

0.43.1stable

2026/8/24

0.43.0stable

2026/8/24

0.42.0stable

2026/8/23

0.41.0stable

2026/8/23

0.40.0stable

2026/8/21

0.39.0stable

2026/8/21

0.38.0stable

2026/8/21

0.37.0stable

2026/8/19

0.36.0stable

2026/8/18

0.35.0stable

2026/8/18

0.34.0stable

2026/8/18

0.33.12stable

2026/8/17

0.33.11stable

2026/8/17

0.33.10stable

2026/8/17

0.33.9stable

2026/8/17

0.33.8stable

2026/8/17

0.33.7stable

2026/8/17

0.33.6stable

2026/8/17

0.33.5stable

2026/8/17

0.33.4stable

2026/8/17

0.33.3stable

2026/8/17

0.33.2stable

2026/8/17

0.33.1stable

2026/8/17

0.33.0stable

2026/8/17

0.32.0stable

2026/8/15

0.31.0stable

2026/8/15

0.30.0stable

2026/8/15

0.29.0stable

2026/8/15

0.28.0stable

2026/8/15

0.27.0stable

2026/8/15

0.26.0stable

2026/8/15

0.25.0stable

2026/8/15

0.24.0stable

2026/8/15

0.23.0stable

2026/8/15

0.22.1stable

2026/8/15

0.22.0stable

2026/8/15

0.21.0stable

2026/8/15

0.20.0stable

2026/8/15

0.19.4stable

2026/8/15

0.19.3stable

2026/8/15

0.19.2stable

2026/8/15

0.19.1stable

2026/8/15

0.19.0stable

2026/8/15

0.18.0stable

2026/8/15

0.17.0stable

2026/8/15

0.16.0stable

2026/8/15

0.15.0stable

2026/8/15

0.14.0stable

2026/8/15

0.13.0stable

2026/8/15

0.12.0stable

2026/8/15

0.11.0stable

2026/8/15

0.10.0stable

2026/8/15

0.9.0stable

2026/8/15

0.8.0stable

2026/8/15

0.7.1stable

2026/8/15

0.7.0stable

2026/8/15

0.6.2stable

2026/8/15

0.6.1stable

2026/8/15

0.6.0stable

2026/8/15

0.5.3stable

2026/8/15

0.5.2stable

2026/8/15

0.5.1stable

2026/8/15

0.5.0stable

2026/8/15

0.4.1stable

2026/8/15

0.4.0stable

2026/8/15

README

Upstream Radar

Always-on compatibility testing for DeepSeek Harness plugins—across headless, Web, and TUI.

简体中文 ·

Upstream Radar binds exact plugin bytes to an exact DSH host and runtime, lets an Agent derive a bounded environment from repository instructions and prior evidence, then proves the relationship in disposable GitHub VMs. It runs again when the ecosystem changes or evidence expires, so it tests the current version—not only the diff.

It is built for the DeepSeek Harness (DSH) plugin ecosystem. A static review is evidence about a package; an isolated runtime review is evidence about one exact plugin × DSH × Node/profile pair. Neither is presented as a timeless compatibility badge or a security certificate.

Listed by the DSH ecosystem in awesome-dsh-plugin, awesome-deepseek-harness, and awesome-deepseek-harness-plugins.

The problem

A source repository can be green while the package users install is not ready for the current DSH host:

the README advertises a version that was never published;
a plugin imports a newer DSH package than its peer range allows;
package.json and the lockfile describe different releases;
an install-time build or dependency script needs tools the user does not have;
a DSH host dependency is missing, so the dependency graph cannot be completed.

These are ecosystem relationship problems. They are easy to miss when the two repositories are checked separately.

What Radar does

Build one exact compatibility record (IR). Align the npm artifact, source commit, DSH host, runtime/profile, dependency paths, and advisories.
Derive the environment. An Agent reads declared installation guidance and failed evidence, then emits only a bounded install plan.
Prove each execution plane. Fresh, secret-free runners exercise headless load, Chromium Web boot, or a real PTY TUI interaction.
Keep the result alive. DSH/plugin/dependency changes and evidence expiry trigger retests; confirmed failures become fixable reports and clean retests close the loop.

flowchart TB
  Trigger["Schedule / upstream change / evidence expiry"] --> IR["Exact IR: plugin bytes ↔ DSH ↔ runtime ↔ dependencies"]
  IR --> Agent["Agent derives a bounded install plan"]
  Agent --> VM{"Fresh secret-free GitHub VM"}
  VM --> Headless["Headless: install → register → load"]
  VM --> Web["Web: Chromium → boot handoff → client bundle"]
  VM --> TUI["TUI: PTY → frame → input → declared shutdown"]
  Headless --> Ledger["Versioned evidence ledger + reverse impact index"]
  Web --> Ledger
  TUI --> Ledger
  Ledger --> Decision{"Plugin-attributable failure?"}
  Decision -->|"yes"| Issue["Produce one fixable maintainer report"]
  Decision -->|"no / detector gap"| Hold["Hold the report and calibrate"]
  Issue -->|"author ships a fix"| Trigger
  Hold --> Trigger

The Agent may choose declared build packages, profile setup, and the next bounded retry. Exact fingerprints decide which cell a report can satisfy, and the disposable runner—not the model—establishes the result. Missing evidence can never become a pass.

Try a real check

No local DSH profile is needed for this first check. It reviews one exact published artifact without executing plugin code:

npx --yes upstream-radar@0.45.0 inspect \
  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
  --deep --fail-on never

This historical DSH plugin release returns review / incomplete because its published host dependency chain reaches an unavailable package. That is a useful, reproducible release/host-contract report—not a claim of malicious behavior. See the full evidence report.

To review your own public repository without installing it:

npx --yes upstream-radar@0.45.0 scan \
  https://github.com/owner/dsh-plugin \
  --fail-on never

The repository scan reads source manifests, DSH metadata, and lockfiles. It does not install dependencies, run lifecycle scripts, load the plugin, start DSH, or call an LLM.

Run it on every change

Copy one of the maintained workflows into your repository:

Review one exact plugin across DSH versions — a manual check with artifact evidence and an isolated load matrix.
Observe one plugin repository every day — compares commits, published versions, manifests, and dependency graphs, then wakes an Agent only when there is a meaningful change.
Run the dependency gate in CI — checks the lockfile or reviewed Radar configuration before merge.

The isolated headless and Web/TUI observers use fresh GitHub-hosted runners. They are not your workstation and receive no project or model secrets.

Evidence from the ecosystem

The current 100-plugin compatibility feed records 87 observed compatible, 9 needs review, 0 reproduced incompatible, and 4 not observed. Its execution-plane ledger contains 22 exact Web/TUI cells; all 22 now pass in isolated GitHub VMs.

The nine review cells are not hidden failures. Seven have a green Web proof but retain separate headless host/peer-contract evidence; two retain known old DSH host-package ranges tracked by existing maintainer issues. Radar keeps those facts visible without calling a working browser plugin broken.

The first non-headless cells now run in GitHub-hosted VMs:

Exact cell	Observed proof	Result
`dsh-univer-office@0.2.9 × DSH 0.1.1-rc.2 × Web`	HTTP 200, DSH boot handoff, declared client bundle fetched, no browser/page errors	Compatible
`@deepseek-harness-tui/dsh-tui@0.9.2 × DSH 0.1.1-rc.2 × TUI`	Real PTY frame, keyboard input, documented double-Ctrl-C exit, code 0	Compatible
`@linxin666/dsh-web-all@0.3.3 × DSH 0.1.1-rc.2 × Web`	Agent-approved four dependency builds; aggregate client bundle returned 200; boot manifest, app mount, and plugin materialization matched	Compatible
`dsh-better-sidebar@0.16.1 × DSH 0.1.1-rc.2 × Web`	VM observed a `node-pty` build gate; DeepSeek approved only that exact dependency; the secret-free retry passed install, host, browser interaction, and shutdown	Compatible

The better-sidebar run demonstrates the closed loop: dynamic evidence found a build requirement absent from the headless plan; DeepSeek checked the exact manifest, README, and VM log; a fingerprint-bound policy approved only node-pty; then a separate runner with no model secrets established the pass. This was Radar's environment gap, so no plugin issue was filed. Earlier TUI and Web detector mistakes were handled the same way: held, corrected, and rerun instead of being sent to authors.

As of 2026-08-25, Radar has filed 13 maintainer-facing reports. The outcome is more useful than the raw count:

Outcome	Reports
Fix shipped and rechecked (5)	Sanqi #5 (`0.5.5`), HDC #3 (`0.7.3`), Voice #2 (`0.2.6`), Msg Hub #1, Toolbox Web #1
Boundary reviewed or documented (3)	Msg Hub #3, Spotlight #5 / PR #7, WSL Workspace #6 — closed without claiming a runtime fix
Still open (5)	Anan #1, Verification Receipt #3, dshscan #1, OAuth #14, Composer Expand #1

“Closed” is not automatically “fixed.” The full domain report index records the evidence, validation level, PR coverage, and remaining boundary for every report.

If Upstream Radar helps the DSH ecosystem stay compatible, please give it a Star ⭐

版本

0.45.0stable

2026/8/25

0.44.0stable

2026/8/25

0.43.5stable

2026/8/25

查看其余 68 个版本收起版本

0.43.4stable

2026/8/24

0.43.3stable

2026/8/24

0.43.2stable

2026/8/24

0.43.1stable

2026/8/24

0.43.0stable

2026/8/24

0.42.0stable

2026/8/23

0.41.0stable

2026/8/23

0.40.0stable

2026/8/21

0.39.0stable

2026/8/21

0.38.0stable

2026/8/21

0.37.0stable

2026/8/19

0.36.0stable

2026/8/18

0.35.0stable

2026/8/18

0.34.0stable

2026/8/18

0.33.12stable

2026/8/17

0.33.11stable

2026/8/17

0.33.10stable

2026/8/17

0.33.9stable

2026/8/17

0.33.8stable

2026/8/17

0.33.7stable

2026/8/17

0.33.6stable

2026/8/17

0.33.5stable

2026/8/17

0.33.4stable

2026/8/17

0.33.3stable

2026/8/17

0.33.2stable

2026/8/17

0.33.1stable

2026/8/17

0.33.0stable

2026/8/17

0.32.0stable

2026/8/15

0.31.0stable

2026/8/15

0.30.0stable

2026/8/15

0.29.0stable

2026/8/15

0.28.0stable

2026/8/15

0.27.0stable

2026/8/15

0.26.0stable

2026/8/15

0.25.0stable

2026/8/15

0.24.0stable

2026/8/15

0.23.0stable

2026/8/15

0.22.1stable

2026/8/15

0.22.0stable

2026/8/15

0.21.0stable

2026/8/15

0.20.0stable

2026/8/15

0.19.4stable

2026/8/15

0.19.3stable

2026/8/15

0.19.2stable

2026/8/15

0.19.1stable

2026/8/15

0.19.0stable

2026/8/15

0.18.0stable

2026/8/15

0.17.0stable

2026/8/15

0.16.0stable

2026/8/15

0.15.0stable

2026/8/15

0.14.0stable

2026/8/15

0.13.0stable

2026/8/15

0.12.0stable

2026/8/15

0.11.0stable

2026/8/15

0.10.0stable

2026/8/15

0.9.0stable

2026/8/15

0.8.0stable

2026/8/15

0.7.1stable

2026/8/15

0.7.0stable

2026/8/15

0.6.2stable

2026/8/15

0.6.1stable

2026/8/15

0.6.0stable

2026/8/15

0.5.3stable

2026/8/15

0.5.2stable

2026/8/15

0.5.1stable

2026/8/15

0.5.0stable

2026/8/15

0.4.1stable

2026/8/15

0.4.0stable

2026/8/15

README

Upstream Radar

Always-on compatibility testing for DeepSeek Harness plugins—across headless, Web, and TUI.

简体中文 ·

Listed by the DSH ecosystem in awesome-dsh-plugin, awesome-deepseek-harness, and awesome-deepseek-harness-plugins.

The problem

A source repository can be green while the package users install is not ready for the current DSH host:

the README advertises a version that was never published;
a plugin imports a newer DSH package than its peer range allows;
package.json and the lockfile describe different releases;
an install-time build or dependency script needs tools the user does not have;
a DSH host dependency is missing, so the dependency graph cannot be completed.

These are ecosystem relationship problems. They are easy to miss when the two repositories are checked separately.

What Radar does

Build one exact compatibility record (IR). Align the npm artifact, source commit, DSH host, runtime/profile, dependency paths, and advisories.
Derive the environment. An Agent reads declared installation guidance and failed evidence, then emits only a bounded install plan.
Prove each execution plane. Fresh, secret-free runners exercise headless load, Chromium Web boot, or a real PTY TUI interaction.
Keep the result alive. DSH/plugin/dependency changes and evidence expiry trigger retests; confirmed failures become fixable reports and clean retests close the loop.

flowchart TB
  Trigger["Schedule / upstream change / evidence expiry"] --> IR["Exact IR: plugin bytes ↔ DSH ↔ runtime ↔ dependencies"]
  IR --> Agent["Agent derives a bounded install plan"]
  Agent --> VM{"Fresh secret-free GitHub VM"}
  VM --> Headless["Headless: install → register → load"]
  VM --> Web["Web: Chromium → boot handoff → client bundle"]
  VM --> TUI["TUI: PTY → frame → input → declared shutdown"]
  Headless --> Ledger["Versioned evidence ledger + reverse impact index"]
  Web --> Ledger
  TUI --> Ledger
  Ledger --> Decision{"Plugin-attributable failure?"}
  Decision -->|"yes"| Issue["Produce one fixable maintainer report"]
  Decision -->|"no / detector gap"| Hold["Hold the report and calibrate"]
  Issue -->|"author ships a fix"| Trigger
  Hold --> Trigger

Try a real check

No local DSH profile is needed for this first check. It reviews one exact published artifact without executing plugin code:

npx --yes upstream-radar@0.45.0 inspect \
  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
  --deep --fail-on never

To review your own public repository without installing it:

npx --yes upstream-radar@0.45.0 scan \
  https://github.com/owner/dsh-plugin \
  --fail-on never

The repository scan reads source manifests, DSH metadata, and lockfiles. It does not install dependencies, run lifecycle scripts, load the plugin, start DSH, or call an LLM.

Run it on every change

Copy one of the maintained workflows into your repository:

Review one exact plugin across DSH versions — a manual check with artifact evidence and an isolated load matrix.
Observe one plugin repository every day — compares commits, published versions, manifests, and dependency graphs, then wakes an Agent only when there is a meaningful change.
Run the dependency gate in CI — checks the lockfile or reviewed Radar configuration before merge.

The isolated headless and Web/TUI observers use fresh GitHub-hosted runners. They are not your workstation and receive no project or model secrets.

Evidence from the ecosystem

The first non-headless cells now run in GitHub-hosted VMs:

Exact cell	Observed proof	Result
`dsh-univer-office@0.2.9 × DSH 0.1.1-rc.2 × Web`	HTTP 200, DSH boot handoff, declared client bundle fetched, no browser/page errors	Compatible
`@deepseek-harness-tui/dsh-tui@0.9.2 × DSH 0.1.1-rc.2 × TUI`	Real PTY frame, keyboard input, documented double-Ctrl-C exit, code 0	Compatible
`@linxin666/dsh-web-all@0.3.3 × DSH 0.1.1-rc.2 × Web`	Agent-approved four dependency builds; aggregate client bundle returned 200; boot manifest, app mount, and plugin materialization matched	Compatible
`dsh-better-sidebar@0.16.1 × DSH 0.1.1-rc.2 × Web`	VM observed a `node-pty` build gate; DeepSeek approved only that exact dependency; the secret-free retry passed install, host, browser interaction, and shutdown	Compatible

As of 2026-08-25, Radar has filed 13 maintainer-facing reports. The outcome is more useful than the raw count:

Outcome	Reports
Fix shipped and rechecked (5)	Sanqi #5 (`0.5.5`), HDC #3 (`0.7.3`), Voice #2 (`0.2.6`), Msg Hub #1, Toolbox Web #1
Boundary reviewed or documented (3)	Msg Hub #3, Spotlight #5 / PR #7, WSL Workspace #6 — closed without claiming a runtime fix
Still open (5)	Anan #1, Verification Receipt #3, dshscan #1, OAuth #14, Composer Expand #1

“Closed” is not automatically “fixed.” The full domain report index records the evidence, validation level, PR coverage, and remaining boundary for every report.

If Upstream Radar helps the DSH ecosystem stay compatible, please give it a Star ⭐