Introduction

DeepSeek Harness (DSH) loads plugin bundles from the profile upon startup. After adding a new third-party plugin, if the combination features duplicate tool registration, entry ID conflicts, peer version inconsistencies, multiple memory plugins enabled simultaneously, or missing token/app id for telegram/lark/IM style channel plugins, it may affect startup.

Below is an introduction to dsh-plugin-auditor. Before a new plugin is added to the profile, it performs a read-only compatibility pre-check on the current plugin combination and outputs a risk report to reduce startup risk after adding new plugins.

Plugin Overview

Repository path:

HYY-King/dsh-plugin-auditor

License:

MIT

It is designed for auditing DSH plugin combinations. Its working method relies mainly on read-only checks and does not execute the code of the audited plugins. The documentation states that it has zero dependencies and uses a built-in mini YAML parser to handle:

cordis.patch.yml

peerDependencies are declared as:

@deepseek-ai/cordis ^4.0.1
@deepseek-ai/dsh-tools ^0.1.0-rc.6

Core Checks

Below are the specific checks.

  1. Duplicate Tool Registration: Checks if two plugins register the same tool name.

  2. Entry ID Conflict: Checks if multiple bundles mount the same entry ID in:

cordis.patch.yml

  1. Peer Version Inconsistency: Checks if the peer versions of plugins (@deepseek-ai/*) required by the plugins are inconsistent with the installed versions.

  2. Memory Plugin Uniqueness: Checks if multiple memory plugins are enabled simultaneously.

  3. Channel Plugin Credentials: Checks if token/app id are missing when enabling telegram/lark/IM style channel plugins.

How It Works

This plugin performs read-only checks on the following files in the profile:

package.json
cordis.patch.yml
node_modules

Where:

node_modules

is used to view installed packages. The checking process does not execute the code of the audited plugins.

Installation and Activation

The following installation command comes from the documentation example:

--profile web

is the profile used in the example; the actual profile name needs to be confirmed according to the current DSH configuration.

Installation command:

dsh plugin --profile web add github:HYY-King/dsh-plugin-auditor

After installation is complete, restart dsh web to activate the plugin:

# restart dsh web to activate

Typical Usage

After the plugin is activated, call the tool:

audit_plugins

Full Audit: Call without arguments:

audit_plugins

Scans all bundles in the current profile.

New Plugin Preview: Call:

audit_plugins

and pass:

newPlugins: ["package-name"]

to preview name-level conflicts.

Applicable Scenarios and Notes

Suitable for developers or users who maintain multiple plugins in a DSH profile and wish to see combination risks before adding new plugins.

Note that:

  • Audit results are static heuristic signals, not compatibility guarantees.
  • The plugin runs with the permissions of the current dsh process; before installing third-party plugins, review their source code, permissions, and license.
  • The installation example in the documentation uses:
--profile web

It is not stated whether this profile is a general installation requirement.

  • Directory page links are from the documentation, an independent site, and do not constitute an official affiliation with DeepSeek or Huanfang.

Links

GitHub:

https://github.com/HYY-King/dsh-plugin-auditor

Directory page link:

https://www.skillhub.cn/plugins/HYY-King/dsh-plugin-auditor