Preface

Writing a plugin for DeepSeek Harness (DSH), the code itself is often not the most time-consuming part. The real trouble spots are at both ends: getting started requires building directories, applying templates, and configuring dependencies; publishing requires running type checks, tests, packing previews, secret scanning, and confirming the package works within a clean DSH profile. These steps are not hard to do manually once, but the difficulty lies in doing them without missing anything every time.

dsh-plugin-forge brings this entire workflow into DSH’s chat workflow and sets up human confirmation at key nodes: the model can work, but cannot approve stages, create repositories, or publish packages on your behalf. Below is an introduction to its positioning, installation, and typical usage.

What is it

dsh-plugin-forge is a DSH plugin maintained by luoyuejun9. Its positioning can be summarized in one sentence: a human-gated plugin creation, validation, and publishing workbench.

Basic Information:

  • Version: 0.1.0
  • License: MIT
  • Target DSH Version: 0.1.0-rc.6
  • Runtime Environment: DSH Web profile
  • Runtime Requirements: Node >= 22.19

It turns “a plugin idea” into a traceable output: it first generates versioned specifications, then generates secure project scaffolding, then runs validation to gather evidence, performs an isolated DSH installation check, and finally—only after explicit human confirmation—publishes to GitHub/npm.

DSH’s philosophy is “everything is a plugin.” The need to “how to standardly and safely create and publish a plugin” is itself a real demand in the ecosystem, and dsh-plugin-forge solves this problem.

Core Capabilities

Four v0.1 Templates

New projects start from templates. Currently, four are provided:

  • tool-command
  • skill-wrapper
  • stateful
  • bundle

/forge Command and Web Studio Card

The plugin targets the DSH Web profile, contributes the /forge command, and provides a replayable Plugin Forge card in the chat. This card is a native DSH Conversation Node; its state is rebuilt based on persisted forge/* session events. Therefore, even after replaying a conversation or loading more chat history, the phase state remains.

Phase Advancement Only Accepts Human Confirmation

In the entire workflow, only /forge continue can advance the phase. The model can read state, perform validation, run checks, and write restricted implementation files, but it cannot approve stages, create repositories, or publish packages. The publishing step always remains in human hands.

Installation and Enabling

Use the official install command to add the plugin to the Web profile:

dsh plugin --profile web add dsh-plugin-forge@0.1.0

After installation, you need to reload the DSH Web profile; the /forge command and the Plugin Forge card in the chat will then be available.

Typical Usage

Below is the complete workflow copied from the README, from environment check to publishing:

/forge doctor
/forge new dsh-my-plugin --type tool-command --title "My plugin" --description "A focused DSH capability"
/forge continue <forge-id>
/forge run <forge-id>          # scaffold
/forge continue <forge-id>
/forge run <forge-id>          # implementation assistance
/forge continue <forge-id>
/forge run <forge-id>          # verification
/forge continue <forge-id>
/forge release <forge-id> --dry-run
/forge publish <forge-id> --fingerprint <sha256>

Let’s break it down in order:

  1. /forge doctor first checks if the environment is ready.
  2. /forge new creates a new plugin project, specifying the type, title, and description. The generated project must be a new directory under the active DSH workspace.
  3. Next comes the alternating use of continue and run: first continue to enter the next phase, then run, used for scaffold (generating scaffolding), implementation assistance, and verification respectively.
  4. After the above steps, the project is completed with scaffolding, implementation, and verification. Use /forge release <forge-id> --dry-run to preview the release without actually publishing.
  5. Once confirmed, /forge publish <forge-id> --fingerprint <sha256> officially publishes the release with the current release fingerprint.

For local development verification, use these three commands:

npm install
npm run check
npm pack --dry-run

Security Boundaries

This plugin draws a fine line regarding “what the model can do,” with several rules documented:

  • The generated project must be a new directory under the active DSH workspace.
  • The model can only write to the src/, test/, schemas/, and docs/ directories; templates, dependencies, publish configurations, .git, and credentials are protected.
  • New dependencies must pass comparison against a small DSH/TypeScript whitelist.
  • The validation process runs npm install --ignore-scripts, typecheck, test, build, pack preview, secret scan, and a clean DSH profile installation.
  • Publishing requires the current release fingerprint; any change to the project invalidates the planned release.
  • Forge invokes your existing git, gh, and npm sessions but does not read or store their credentials.

Applicable Scenarios and Considerations

Who is it for? Developers who need to repeatedly develop DSH plugins and want to standardize the process from creation to publishing into a replayable workflow; especially scenarios where the model handles execution but the release decision remains in your hands.

Points to note:

  • The plugin runs with the permissions of the current dsh process. It is recommended to review the source code and license (MIT, with an additional Chinese README README.zh.md in the repository) before installing.
  • After installation, you need to reload the DSH Web profile for it to take effect.
  • Publishing is based on human confirmation: --dry-run will not publish, and publish must carry a valid fingerprint; you need to re-run the release plan after the project changes.

Closing

The value of dsh-plugin-forge is not in writing more code for you, but in chaining the error-prone parts of “making a plugin”—scaffolding, validation, installation check, and publishing—into a pipeline with a human gate. If you are writing plugins for the DSH ecosystem, it is worth a try.

  • Community Directory Page (Community-maintained independent site, no official affiliation with DeepSeek / Quant): https://www.skillhub.cn/plugins/luoyuejun9/dsh-plugin-forge
  • GitHub Repository: https://github.com/luoyuejun9/dsh-plugin-forge