Introduction

The philosophy of DSH is “everything is a plugin,” where capabilities are stacked up through plugins. However, with many plugins, the problem reverses: given a specific repository, which ones should actually be installed? Which are no longer maintained? Which carry supply chain risks like lifecycle installation scripts? Manually searching npm one by one, reading READMEs, and checking licenses is slow and prone to errors.

dsh-smart-profile reverses this flow: instead of starting from a generic plugin list, it starts from the repository itself and the current task. It detects the tech stack first, then recommends capabilities, and finally provides an install plan that can be reviewed line-by-line and explicitly approved. By default, everything is preview-only; nothing is written.

What is it

dsh-smart-profile is a plugin for DeepSeek Harness, maintained by Makima667, licensed under MIT. In one sentence: project tech stack detection and capability recommendation.

The version in the current package.json is 1.0.0, requiring engines Node >= 20, with zero runtime npm dependencies. It solves the configuration gap brought about by the “everything is a plugin” ecosystem: it does not require users to pre-understand every plugin, but instead strings together a chain of detection, recommendation, discovery, scoring, preview, approval, installation, verification, and rollback.

Core Features

Tech Stack Detection (smart_profile_scan)

Performs heuristic tech stack detection on the project repository, returning evidence and confidence rather than treating every signal as a definitive conclusion. The detection coverage includes:

  • JavaScript / TypeScript / Node.js, Python, Java / Kotlin, Go, Rust, PHP, Ruby, .NET, Dart / Flutter
  • Frontend frameworks: React, Next.js, Vue, Nuxt, Svelte, Angular
  • Backend frameworks: Express, Fastify, NestJS, FastAPI, Django, Flask, Spring Boot, Gin, Axum, Actix Web, Laravel, Symfony, Rails, Sinatra, ASP.NET Core
  • Database signals: PostgreSQL, MySQL, MongoDB, Redis, SQLite
  • Infrastructure: Docker / Compose, Kubernetes / Helm, Terraform
  • Cloud & CI: partial AWS / Azure / Google Cloud signals, GitHub Actions, Azure Pipelines, Google Cloud Build
  • Testing tools: Playwright, Cypress, Vitest, Jest, Pytest, PHPUnit, RSpec, xUnit
  • Monorepo: npm / yarn / pnpm workspaces, Turborepo, Nx, Lerna

Capability Recommendation & Task Scoping

smart_profile_recommend provides capability recommendations based on the detection results; smart_profile_compose scopes capabilities for a specific task, for example, keeping only parts related to “fix frontend Playwright tests.”

Candidate Discovery & Scoring

smart_profile_discover performs candidate discovery from the public npm registry, discovering only, not installing. smart_profile_score scores candidates and marks risks. A score of 1.0 combines:

  1. Project / capability match
  2. Publication freshness
  3. NPM search relevance (weak signal)
  4. Metadata such as repository / license / homepage
  5. Dependency volume
  6. Lifecycle installation scripts
  7. DSH bundle declaration

Auto setup selection will directly reject the following candidates: below the set score threshold, marked review-required, having blocking lifecycle installation script risks, or not declaring dsh.bundle.patch.

Install Plan & Safe Write

smart_profile_install_plan provides a precise install command plan for a single candidate without execution; smart_profile_setup_plan previews the full setup plan without execution. The default behavior is preview-only: writing to the DSH profile requires both --apply and --approve to be provided; providing only --approve will install nothing.

The install flow is:

  1. Install selected packages one by one
  2. Verify with DSH --dump-config after each installation
  3. Remove the current package if verification fails
  4. Roll back previously installed packages from this run in reverse order

Rollback is best-effort; failures at the host or package manager level may interrupt the rollback process. If a package already exists in the combined profile, setup will not modify it. The original combined configuration will not be persisted; the operation result returns only a hash.

smart_profile_compat outputs the local DSH compatibility strategy and matrix report. compatibility.json distinguishes three states: ci-target (the channel the repository workflow attempts to test), verified (reserved for combinations with evidence), and unknown (targets not recorded in the matrix). Declared targets will not be automatically marked as verified. The repository CI tests the npm package form, local bundle installation, and --dump-config for Node 20 / 22 / 24 and @deepseek-ai/dsh@next.

Local Web UI

npx dsh-smart-profile web . --port 4173

This command starts a read-only dashboard locally: bound to 127.0.0.1 by default, it displays the detected tech stack and capability recommendations, supports task composition, does not provide install/remove endpoints, performs text escaping on repository-provided text, and enables CSP.

Another design trade-off to note: this plugin deliberately does not automatically install tools for Harness models; profile writing is always an explicit CLI operation, and model calls cannot silently install host-level code.

Installation & Activation

Install the plugin into a DSH profile:

npx --yes @deepseek-ai/dsh@next plugin --profile web add dsh-smart-profile@latest

The web in the command is the profile name and can be replaced with your own. You can also use the plugin’s built-in helper command to accomplish the same:

npx dsh-smart-profile install --profile web

If you need to confirm the currently published version number before installing, you can run:

npm view dsh-smart-profile version

The version confirmed in the documentation is 1.0.0; the latest published version on npm is determined by the output of the command above.

Typical Usage

First, see the help, then perform a tech stack detection on the current directory:

npx dsh-smart-profile --help
npx dsh-smart-profile scan .

The most common entry point is a single command to preview the full setup plan:

npx dsh-smart-profile setup .

Trim the plan to a specific task:

npx dsh-smart-profile setup . --task "fix the frontend Playwright tests"

Change the target profile or adjust the candidate score threshold:

npx dsh-smart-profile setup . --profile web --min-score 75

After reviewing the plan, explicitly apply it:

npx dsh-smart-profile setup . --profile web --apply --approve

The two write switches are intentionally separated: --approve without --apply will still install nothing.

If you don’t want to go through the entire setup chain, you can also call individual steps:

npx dsh-smart-profile recommend .
npx dsh-smart-profile compose "debug the database migration" .
npx dsh-smart-profile discover .
npx dsh-smart-profile score .
npx dsh-smart-profile compat next

Perform a manual security flow for a single package—generate a plan first, then approve and execute:

npx dsh-smart-profile plan dsh-example@1.2.3 --profile web
npx dsh-smart-profile apply dsh-example@1.2.3 --profile web --approve

Applicable Scenarios & Notes

Suitable for: developers maintaining multiple repositories with different tech stacks who want DSH configuration to follow the project; teams that want to leverage model automation for selection but require every step to be reviewable and rollbackable.

A few points need to be clear before use:

  • Default is preview-only; all writes require both --apply and --approve
  • Scores are for reference only; a high score is not a safety guarantee; sensitive environments should review source code
  • Rollback is best-effort; host or package manager failure may interrupt the rollback process
  • Targets declared in compatibility.json will not be automatically marked as verified; specific matrix content is subject to the files in the repository
  • The plugin runs with the permissions of the current dsh process; you should check the source code and license yourself before installing (this project is MIT)

Conclusion

dsh-smart-profile does not do anything complicated: it makes plugin selection start from the repository and task, making every step explainable, previewable, and rollbackable. If you maintain projects with frequently changing tech stacks, or if you don’t trust the model to decide what to install on its own, this workflow of “preview by default, write only with explicit approval” is worth trying.

  • Directory: https://www.skillhub.cn/plugins/Makima667/dsh-smart-profile
  • GitHub: https://github.com/Makima667/dsh-smart-profile