Introduction

In the DSH plugin scenario, whether a Windows host can safely enter the DeepSeek Harness workflow cannot rely solely on manually checking a few configurations. A more stable approach is to first organize the host state into a purified, SHA-256 fixed set of observational evidence, and then let the plugin perform validation based on a clear strategy.

dsh-windows-readiness-proof is used for this step of verification: it does not collect state, nor does it fix issues; it only performs readiness validation on existing evidence and generates deterministic artifacts.

What is this

dongsheng123132/dsh-windows-readiness-proof is a DSH plugin maintained by dongsheng123132, licensed under MIT, and requires Node.js >= 22.

It has a clear focus: an evidence verifier, not a collector or remediation tool. The input is purified hosted Windows host observational data, and the output is a deterministic artifact suitable for CI or auditing.

Core Features

Validation Targets

The plugin performs explicit DeepSeek Harness readiness validation on SHA-256 fixed, purified hosted Windows host observational data.

CLI

Provides inspect and verify CLI entry points, with options to specify workspace, manifest, and artifactDir.

DSH / MCP Tools

Exposes the following DSH/MCP tools:

  • dsh_windows_readiness_inspect
  • dsh_windows_readiness_verify

And aliases:

  • windows_readiness_inspect
  • windows_readiness_verify

Fail Closed

The following evidence will result in a Fail Closed state:

  • Missing
  • Expired
  • Future time
  • Format error
  • Suspected secret
  • Carrying identity
  • Path escape
  • Symbolic links
  • Policy mismatch

Output Boundaries

The report only exposes opaque identities, hashes, classifications, reason codes, and control status; it does not expose usernames, domains, endpoints, registry paths, command output, credentials, or raw observational data.

Behavioral Boundaries

The plugin does not run PowerShell, read the registry, modify Group Policy, create Defender exceptions, edit WDAC/AppLocker, install software, restart services, or probe the network.

Installation and Usage

When installing, use the official command and replace <commit> with a fixed commit:

dsh plugin --profile windows-readiness add github:dongsheng123132/dsh-windows-readiness-proof#<commit>

Since the plugin runs with the current dsh process permissions, it is recommended to check the source code and license before installation. This plugin is MIT licensed and requires Node.js >= 22.

Typical Usage

inspect

inspect is used to view the readiness status under the current manifest:

dsh-windows-readiness-proof inspect --workspace . --manifest manifest.json

verify

verify will execute the validation and write the results to the artifact directory:

dsh-windows-readiness-proof verify --workspace . --manifest manifest.json --artifactDir artifacts

Exit code conventions:

  • exit 0: verified
  • exit 2: readiness or evidence failure

DSH Entry and Web Loader

DSH entry is a namespace plugin (no default export).

For a built DSH checkout and an isolated Web profile containing this bundle, you can run:

DSH_CHECKOUT=/path/to/dsh DSH_HOME=/path/to/isolated-home npm run smoke:web-loader

This step is used to check whether the real Cordis Loader preserves tools injection when loading the bundle in a stock Web profile.

Use Cases and Considerations

Suitable for teams that use Windows readiness as input for CI or audits. Particularly suitable for scenarios where you want to turn “whether the host meets harness prerequisites” into auditable evidence rather than relying on interactive checks.

Considerations:

  • It is not a collector; it will not collect host state for you.
  • It is not a remediation tool; it will not modify Group Policy, Defender, WDAC/AppLocker, or other configurations.
  • Evidence must be fixed by the manifest and purified.
  • The report only outputs opaque identities, hashes, classifications, reason codes, and control status.
  • The plugin runs with the current dsh process permissions; source code and license should be checked before installation.

References

GitHub repository:

https://github.com/dongsheng123132/dsh-windows-readiness-proof