Preface

In the DeepSeek Harness (DSH) ecosystem, plugins can carry workflow capabilities; the community directory page is a standalone site, not equivalent to the official app store. For plugin authors, before publishing, they need to confirm that manifest, patch, entry, build, pack, and fresh-profile installation verification all pass; otherwise, issues may only surface during agent invocation or profile installation.

The following introduces zoahdev/dsh-plugin-doctor. It corresponds to the plugin health check approach outlined in RFC #1629 dsh plugin check, providing a CLI check and an agent-callable plugin_check tool.

What This Is

dsh-plugin-doctor is a DeepSeek Harness plugin health check tool, maintained by zoahdev, licensed under MIT.

Its core positioning is:

  • CLI mode: dsh-plugin-doctor or node lib/bin.js can be run in a terminal or CI.
  • Plugin shell mode: once installed, the plugin_check tool can be invoked by agents.
  • Check scope: manifest, patch, entry, files, build, pack, install, config.
  • Additional capabilities: profile checks, read-only audits, environment diagnostics, secret-safe env provenance, supply-chain poison preflight, and broken tool-call-sequence detection.

Core Features

The capabilities of dsh-plugin-doctor can be categorized as follows.

Pre-Publish Plugin Checks

It covers common checks in the plugin publishing pipeline:

  • manifest
  • patch
  • entry
  • files
  • build
  • pack
  • install
  • config

These checks are used to confirm whether plugin structure, entry points, packaging, and installation configurations are complete.

Profile Checks

Profile checks listed in the verified materials include:

  • host-shadowing
  • manifest BOM
  • large-files
  • entry-points
  • profile-deps
  • native-modules

These checks target the DSH profile environment to identify issues that may affect runtime, such as host instances, profile dependencies, entry files, and native modules.

Heuristic Security Checks

Verified features include:

  • pre-execute-side-effects
  • shell-launcher

These are heuristic checks designed to flag potential pre-execution side effects and shell launcher risks.

Read-Only Audit Mode

audit is a separate read-only check mode.

It reports:

  • Package identity
  • lifecycle scripts
  • Cordis patch operations
  • capabilities
  • findings

Verified materials state: audit is a read-only inspection mode that does not import the target plugin, run lifecycle scripts, install dependencies, or access the registry.

audit-batch Batch Auditing

audit-batch supports batch auditing and supports --json / --markdown output.

Environment Diagnostics

Environment diagnostics cover:

  • node/pnpm/dsh PATH
  • Web UI port
  • Windows bash, etc.

env explain

env explain is used for secret-safe env provenance, with values always displayed as [redacted].

Supply Chain and Tool Call Checks

Verified features also include:

  • supply-chain poison preflight
  • broken tool-call-sequence detection

Exit Codes

Exit code rules:

  • 0 when there are no failures
  • 1 when there are failures

--json is used for machine-readable report output, suitable for CI.

Installation and Enablement

Install from npm into a specific profile:

dsh plugin --profile web add dsh-plugin-doctor

Verified materials also provide a local build installation example:

dsh plugin --profile web add ./dsh-plugin-doctor-1.6.0.tgz

Note: the package.json version in the verified materials is 1.16.0, while the local installation example references dsh-plugin-doctor-1.6.0.tgz; the two are inconsistent, and the materials do not explain why.

Before installation, review the source code and license. This tool runs with the current dsh process permissions.

Typical Usage

Quick Check of Current Directory

npx dsh-plugin-doctor .

Build Check

npx dsh-plugin-doctor --build ./my-plugin

Full Verification

npx dsh-plugin-doctor --full ./my-plugin

Preflight / Check

npx dsh-plugin-doctor preflight ./my-plugin
npx dsh-plugin-doctor check ./my-plugin

Read-Only Audit

npx dsh-plugin-doctor audit ./my-plugin

Audit Compare

npx dsh-plugin-doctor audit ./new-version --compare ./old-version --json

audit-batch

npx dsh-plugin-doctor audit-batch ./plugins/plugin-a ./plugins/plugin-b --json

audit-batch also supports --markdown output.

Profile Check

npx dsh-plugin-doctor --profile ~/.dsh/profiles/web

Environment Diagnostics

npx dsh-plugin-doctor --env

env explain

npx dsh-plugin-doctor env explain DEEPSEEK_API_KEY

Agent Invocation

After installation into a DSH profile, the agent can be instructed to run a build first and then perform full verification. The agent will invoke the plugin_check tool, optionally passing build / full flags.

Applicable Scenarios and Notes

Suitable for the following scenarios:

  • DSH plugin developers performing health checks before submission or release
  • Machine-readable checks on plugin packages in CI
  • Diagnostics for DSH profile environments
  • Read-only audits of plugin packages
  • Enabling agents to call plugin_check in the plugin shell

Notes:

  • audit is a read-only inspection mode that does not import the target plugin, run lifecycle scripts, install dependencies, or access the registry.
  • The working-tree fallback skips tests, fixtures, examples, demos, plain JSON data, and undeclared development scripts.
  • The peerDependencies listed in the verified materials are:
  • @deepseek-ai/cordis ^4.0.1
  • @deepseek-ai/schemastery ^3.18.1
  • @deepseek-ai/dsh-tools ^0.1.0-rc.6
  • The plugin runs with the current dsh process permissions; review the source code and license before installation.

Links

  • GitHub: https://github.com/zoahdev/dsh-plugin-doctor
  • Directory page listed in plugin leads: https://www.skillhub.cn/plugins/zoahdev/dsh-plugin-doctor