Preface

In the DSH plugin workflow, after a model completes a code modification, the common question isn’t “did tests run,” but rather “was this change actually exercised by the tests.” A fully green result might come from unrelated tests, or it might only cover a portion of the changed lines; when the code changes again, old conclusions may remain in the context.

DSH-changeproof (apageoflove/dsh-changeproof) addresses this issue by providing line-level evidence: after code changes, it confirms that the modified lines are truly covered by tests. Below is an introduction to what it does, how to install it, and how to use it within DSH or as a standalone CLI.

What This Is

DSH-changeproof is a DeepSeek Harness (DSH) plugin maintained by Apageoflove, licensed under MIT. It focuses on “change proof”: rather than simply reporting test pass/fail, it cross-checks the changed lines against test execution evidence.

It adapts to Istanbul (vitest/jest) and coverage.py (pytest) coverage evidence.

Core Features

The plugin identifies tests related to the current changes based on code reference relationships.

Line-Level Verification

After test execution, it verifies line by line. If a changed line was not executed, the plugin does not pass and explicitly points out the uncovered lines.

Conclusion Expiry

Evidence is bound to a code fingerprint. When the code changes, old conclusions automatically become invalid.

Conclusion Status

The plugin uses the following statuses to express conclusions:

  • VERIFIED: Passed
  • PARTIAL: Partially covered
  • FAILED: Test failed
  • STALE: Conclusion expired
  • UNVERIFIED: No valid evidence
  • NOT_APPLICABLE: Nothing verifiable

Bottom line: without coverage evidence, or if the evidence is inconsistent with the current code, VERIFIED is never granted.

Automatic Verification

After the model modifies code, changeproof_verify is automatically invoked for verification, with no manual trigger required.

Standalone CLI

The plugin provides a standalone CLI that can analyze, execute tests, and view conclusion status without installing DSH.

Execution Safety

Because the plugin executes user-configured test commands, subprocess execution includes explicit security hardening, including:

  • argv-only
  • Environment variable allowlist
  • cwd path confinement
  • Timeout with process tree termination
  • Output limits

Installation and Enablement

Prerequisites for deploying to DSH:

  • Node.js ≥ 24 (DSH requires ^22.19 || >=24)
  • pnpm 11.7
  • Git

The engines field in package.json requires node >=20.11.0.

Prepare the local plugin directory first, then install it into the DSH profile:

pnpm dsh plugin --profile web add <plugin-directory>

After the steps above, you can check whether the plugin appears in the configuration:

pnpm dsh --profile web --dump-config | grep changeproof

Typical Usage

Using the DSH Web Interface

Start the local web interface:

pnpm dsh web

After the model modifies code, changeproof_verify is called to verify the changes.

Using Headless Commands

Set the environment variable:

export DEEPSEEK_API_KEY=sk-xxxxxxxx

Then run:

pnpm dsh --profile headless "Modify the discount in src/calc.ts to 75% and verify"

This example asks the model to modify the specified file and verify; the verification process is automatically triggered by the plugin.

Using the Standalone CLI

When DSH is not installed, you can directly invoke the CLI in the plugin directory:

node dist/host/cli.mjs plan --workspace <project-path>
node dist/host/cli.mjs verify --workspace <project-path> --yes
node dist/host/cli.mjs status --workspace <project-path>

plan is for analysis, verify executes tests and generates conclusions, and status checks whether the conclusion is still valid.

Applicable Scenarios and Notes

It is suitable for scenarios where DSH is used for agent development and where “tests passing” should be distinguished from “changes being verified.” It is especially suitable for projects that already have test commands and can produce Istanbul or coverage.py coverage evidence.

Notes:

  • The plugin executes user-configured test commands and runs with the current DSH process permissions; inspect the source code and license before installation.
  • The current installation command uses a placeholder for the local plugin directory and is not equivalent to a directly executable remote package installation command.
  • After publishing to npm (not yet published), you can use:
pnpm dsh plugin add dsh-changeproof
  • Repository materials mention that a Critical finding in the dsh.so static scan is explained as usage of Node.js built-in subprocess module APIs; this scan is a static heuristic check, not a security audit.

Directory and Source Code

Community directory page:

https://www.skillhub.cn/plugins/Apageoflove/DSH-changeproof

GitHub repository:

https://github.com/Apageoflove/DSH-changeproof

The DSH community directory is an independent site and has no official affiliation with DeepSeek / High-Flyer.