Introduction¶

The common philosophy of the DSH ecosystem is that “everything is a plugin.” The community directory is an independent site with no official affiliation to DeepSeek / Huaquan, and should not be understood as an official app store.

For agent developers, installing and trying a single plugin is usually not difficult. The difficulty lies in combining multiple Registry Releases, author self-hosted plugins, and Agent Presets into a reusable, auditable DSH Profile. If this combination relies solely on local manual installation, several problems can easily arise:

1. The combination result lacks a reviewable manifest.
2. Author sources are not pinned to the full Git commit.
3. The license facts for each component are unclear.
4. Publisher signatures lack a clear verification entry point.
5. Installation, activation, confirmation, and rollback are mixed together, making it difficult to return to the previous Profile generation when problems occur.

Below is an introduction to omdsh-dev/omdsh-runtime. It provides a lightweight toolchain around these problems for auditable DSH composition, signing, candidate installation, and rollback.

What is it¶

The official description of omdsh-dev/omdsh-runtime is:

Lightweight OMDSH Runtime and Profile Pack toolkit for auditable DSH composition, signing, candidate installs, and rollback.

It can be understood as a Profile Pack toolchain for DSH. It reuses official Harness Profile, Bundle, Cordis, and package operations, provides a headless execution layer, and adds deterministic plan/apply, candidate generations, explicit confirmation, and previous-generation recovery paths, without introducing another Loader or daemon.

The verified basic information is as follows:

Current information does not provide star count, project license, official installation command, plugin categories, and directory page address. These should not be used as confirmed facts.

Core Capabilities¶

1. Pinning the composition boundaries of a Profile Pack¶

A Profile Pack will record:

• Precise Registry project and Release ID.
• Author self-hosted sources, pinned to full Git commits.
• Corresponding Registry snapshot.
• Observed @deepseek-ai/dsh version.
• An Agent Preset.

This makes a combined package not a “collection of a few plugin names” but an object closer to an auditable manifest.

2. Providing deterministic plan/apply and candidate generations¶

It supports deterministic plan/apply, candidate generations, explicit confirmation, and previous-generation recovery.

In other words, instead of directly changing the local environment to the target state, it first forms a candidate installation state, which then undergoes explicit activation and runtime confirmation.

3. Outputting an SPDX license manifest¶

omdsh pack licenses reports component license expressions, source, SPDX link, and whether manual review is needed.

It is a list of license facts, not legal advice, nor an automatic license compatibility judgment.

4. Supporting Ed25519 publisher signatures¶

When executing a signed omdsh-profile-pack-envelope/v1, a publisher key must be provided and the Ed25519 signature verified.

Using --require-signature will reject legacy unsigned input.

5. Supporting named pack instances and rollback¶

It uses named pack instances and separates activation and runtime confirmation.

Rollback re-selects the previous Profile generation. It does not claim to reverse databases, networks, file systems, or other external side effects. Embedded preset rollback is still outside the scope of Profile generations.

6. Coexisting with existing Pack/Skill projection tools¶

It can coexist with workspace-oriented Pack/Skill projection tools without introducing another Loader or daemon.

Profile Packs are responsible for release boundaries: precise DSH Runtime and Registry Releases, author source commits, license facts, publisher signatures, and recoverable Profile generations.

Installation and Enabling¶

Current information does not provide an official installation command, so this article does not concatenate dsh plugin add github:owner/repo, nor does it directly give an unverified npm install command.

The package information that can be confirmed from the information is as follows:

package: @ohmydsh/runtime
registry: https://registry.npmjs.org/
dist-tag: preview
cli: omdsh

This information is used to locate the package and CLI, not for the installation command.

Be sure to note the following before enabling:

1. Plugins will run with the permissions of the current dsh process.
2. Before installing, check the source code, source, license, and publisher signature.
3. Current information does not clearly state the project license, so manual review should be performed first.
4. The preview release will not implicitly move latest, so you should clearly distinguish between preview and the official channel when using it.

Typical Usage¶

The example commands below use those given in the information. File names, package names, Releases, profiles, keys, and commits in the examples are example values and should be replaced with real values in actual use.

1. Initialize a pack¶

First, create a local pack file:

omdsh pack init research.pack.json --id research --preset code

This generates research.pack.json, where --id research is the pack identifier and --preset code is the Agent Preset in the example.

2. Add Registry Release and author sources¶

First, add a Registry Release:

omdsh pack add research.pack.json --release sample@1.2.3

Then add an author self-hosted source. This source will be pinned to the full Git commit:

omdsh pack add research.pack.json --source-id my-plugin --package @me/dsh-my-plugin --version 0.1.0 --repository https://github.com/me/dsh-my-plugin --ref <40-character-commit> --license MIT

Note: author-owned source always belongs to experimental-fixed-source. --trust-source is required before creating a candidate, and this plugin cannot be published as trusted community distribution until it passes Registry admission.

3. Check licenses and lock¶

First, view the license facts for each component:

omdsh pack licenses research.pack.json

omdsh pack licenses reports component license expression, source, SPDX link, and manual-review status. It is not legal advice, nor an automatic license compatibility judgment.

After confirming, lock a distributable file:

omdsh pack lock research.pack.json --output research-0.1.0.dshpack

This step solidifies the current pack combination into research-0.1.0.dshpack.

4. Testing and pre-checks¶

If the combination contains author-owned source, --trust-source must be used explicitly during testing and pre-checks:

omdsh pack test research.pack.json --profile web --trust-source

Inspect after locking:

omdsh pack inspect research-0.1.0.dshpack

Then execute plan:

omdsh pack plan research-0.1.0.dshpack --profile web --trust-source

Through the steps above, you can check if the current combination meets the requirements for format, hash, digest, signature, Registry, profile, and trust options, rather than writing directly to the Profile.

5. Sign the pack¶

Sign the locked pack with the publisher:

omdsh pack sign research-0.1.0.dshpack --private-key publisher.pem --key-id example/releases-2026 --publisher example --source https://github.com/example/research --output research-0.1.0.signed.dshpack

This generates research-0.1.0.signed.dshpack. The signed envelope requires a publisher key at execution time, and the Ed25519 signature must pass verification.

6. apply, activate, confirm, and rollback¶

Apply the signed pack to a named instance:

omdsh pack apply research-0.1.0.signed.dshpack --instance research --profile web --trusted-key publisher.pub --require-signature

--require-signature will reject legacy unsigned input.

Activation is still required after apply:

omdsh activate --profile web

Then perform runtime confirmation:

omdsh confirm --profile web

If you need to return to the previous Profile generation later, you can execute:

omdsh pack rollback --instance research

It is important to note that rollback re-selects the previous Profile generation and does not reverse databases, networks, file systems, or other external side effects. Embedded preset rollback is outside the scope of Profile generations.

Applicable Scenarios and Notes¶

Suitable scenarios for using it include:

1. Teams that need to combine multiple DSH plugins into a reusable Profile.
2. Individuals who need to pin Registry Releases, author source commits, and Runtime versions.
3. Publishers or reviewers who need to check license facts before distribution.
4. Recipients who need to verify publisher signatures before executing a pack.
5. Processes that need to break installation, activation, confirmation, and rollback into clear steps.

Precautions before use:

• Plugins will run with the permissions of the current dsh process.
• Check source code, license, publisher signature, and dependent plugins before installation.
• omdsh pack licenses is a license manifest, not legal advice.
• author-owned source cannot be published as trusted community distribution before passing Registry admission.
• source manifest does not accept Git branches, tags, local paths, install scripts, secrets, or copied node_modules.
• custom preset is embedded in UTF-8 text form only after rejecting symlinks, credential-like files or content, binary data, and absolute user paths.
• applying embedded preset content requires --trust-preset.
• replacing an existing custom preset requires --replace-preset.
• applying a pack only replaces plugins tracked by the same named pack instance, managed by pinned Registry snapshots and fixed sources; other untracked local packages are preserved.
• rollback does not promise to reverse external side effects.

Conclusion¶

The value of omdsh-dev/omdsh-runtime is to advance DSH composition from “locally installing a few plugins” to a Profile Pack process that is recordable, signable, confirmable, and rollbackable.

Repository URL:

https://github.com/omdsh-dev/omdsh-runtime

Current information does not provide a directory page address, so this article does not complete the directory page link.