Preface

The philosophy of DSH (DeepSeek Harness) is “everything is a plugin.” As you install more things, two problems slowly emerge. First, you don’t know which plugins are reliable: whether third-party plugin manifests are complete, whether the patch layer covers internal lines that shouldn’t be touched, and whether there are high-risk calls in the code—it’s hard to verify these individually. Second, troubleshooting is difficult: when plugins don’t start or services are missing, you often only see PENDING or FAILED states, without knowing who to stop or who to keep.

dsh-plugin-doctor targets these two issues: turning plugin auditing into a read-only tool within the conversation, and bringing startup/shutdown, installation, uninstallation, and version updates into the settings panel. Below is an introduction to its features, installation methods, and precautions.

What is it

dsh-plugin-doctor is a DSH plugin manager: it audits the compliance and security risks of installed plugins and provides plugin management in the settings panel, covering start/stop, install, uninstall, and version updates. Current version 0.1.1, license MIT, code hosted at GitHub repository Oo0520/dsh-plugin-doctor.

Core Functions

Host Tools

Plugins register five tools, invoked by AI in the conversation:

Tool Purpose Side Effects
plugin_audit Audit all bundles in profile: manifest contract, patch layer risks, static code scanning, supply chain risks Read-only
plugin_list Read-only list loader combination lines and fiber run status (PENDING missing services / FAILED errors) Read-only
plugin_toggle Hot enable/disable plugin: loader runtime takes effect immediately, while writing profile cordis.patch.yml persistently (HMR applies automatically) Changes runtime state + patch file
plugin_uninstall Uninstall plugin package (dsh plugin remove forwards pnpm), with dry-run confirmation Deletes dependencies, requires restart
plugin_install Install plugin package (dsh plugin add forwards pnpm) Requires restart

Settings Panel

In the web client, go to “Settings → Plugin Health Check”. There are two views: plugin list and health check report:

  • Plugin list shows run status, version, Chinese function descriptions, and installation time. Plugins installed in the last 7 days are marked with a “New” badge.
  • Search matches plugin name, ID, and Chinese description simultaneously.
  • Enable/disable supports runtime hot switching and persistence; before disabling, it first checks if disabling causes other items to become PENDING (e.g., stopping a service provider), and if so, automatically rolls back and refuses.
  • Install/uninstall can directly handle community plugins in the panel; pure client-side plugins (without dsh.bundle) can also be enabled from orphan patch lines, mounted by the market after restart.
  • Version updates query the npm registry to compare with the local version, support one-click upgrades, and can identify update false positives caused by pnpm minimumReleaseAge.
  • Interface descriptions follow DSH language switching; Chinese is displayed first, English displays a concise English summary.

Audit Rules

Audit rules are divided into Error, Warning, and Suggestion levels. For example:

  • Error (needs handling): eval/new Function, reading .credentials.yaml, install scripts (preinstall/postinstall).
  • Warning (recommended attention): Direct use of child_process, iterating process.env, GitHub dependencies without fixed commits.
  • Suggestion: Low-priority risk items.

Health check scope = profile bundles list ∪ unofficial dependencies. Newly installed plugins can be scanned immediately; official built-in packages @deepseek-ai/* are only lightly checked for manifests (trusted) and do not scan code.

Uninstall Reliability

The success of uninstallation depends on whether the manifest still references the package, not the pnpm exit code. Even if pnpm fails midway, it forces convergence to a consistent state:

  1. Remove references from package.json’s dependencies and dsh.profile.bundles.
  2. Clean residual patch lines in cordis.patch.yml.
  3. Runtime disable its loader entry so it won’t be combined on the next startup.
  4. Individually prompt for residual directories that are locked and cannot be deleted; can be manually deleted.

After the steps above, the page won’t have issues due to residual references, and the system can continue running.

Installation & Enablement

Two common installation methods, choose one based on source:

dsh plugin --profile web add dsh-plugin-doctor          # npm
dsh plugin --profile web add github:Oo0520/dsh-plugin-doctor   # github

Also supports local path / tarball installation. The repository already contains the built artifacts lib/, so GitHub installation doesn’t require a build script. You need to restart the profile after installation.

Three precautions:

  1. pnpm Supply Chain Cooling Period: pnpm 11 defaults to minimumReleaseAge (approx. 24h) which will reject packages published on the same day. When blocked, append --config.minimum-release-age=0 at the end of the command to bypass it once, without modifying persistent configuration.
  2. link: Installation Shape: Local path installation generates a link: dependency; the source directory needs to contain its own node_modules (run npm install first); npm/tarball/github installation does not have this requirement.
  3. Configuration Items: There is only one profile configuration item, which is the target profile name, defaulting to web; during runtime, it automatically infers the current profile from ctx.baseUrl.

Typical Usage

  • Enable/Disable Plugins: In the conversation, ask the AI to call plugin_toggle, which takes effect at runtime and persists by writing to the profile’s cordis.patch.yml. Before rewriting the file for the first time, it automatically backs up to cordis.patch.yml.bak.plugin-doctor.
  • Uninstall Plugins: plugin_uninstall defaults to dry-run; it must have confirm=true to execute; it refuses to uninstall official packages @deepseek-ai/* and the plugin itself.
  • Self-Maintain Chinese Descriptions: Supplement descriptions in the external dictionary ~/.dsh/.plugin-doctor/descriptions.json in the format { "package-name": "Chinese Description" }; priority is higher than the built-in dictionary.
  • Secondary Development: After modifying src/, run npm run build (build:host uses tsc, build:client uses tsdown) and restart the profile.

Applicable Scenarios & Notes

Suitable for users who use DSH long-term and have installed multiple community plugins: run an audit regularly to check if new dependencies pose risks, use the panel to centrally handle start/stop and version updates, and use plugin_list to check PENDING/FAILED to locate issues when they occur.

Needs clear boundaries:

  • plugin_toggle refuses to disable official built-in lines (fs/tools/webserver/loader, etc.) and plugin-doctor itself to avoid locking yourself out.
  • Plugins run with the current dsh process permissions. Before installing any third-party plugin, it is recommended to check its source code and license; the auditing capabilities of this plugin are an auxiliary troubleshooting tool, not a security fallback.

Conclusion

dsh-plugin-doctor turns the “invisible” parts of DSH plugins into “auditable and manageable” ones: you can check risks before installing, and after installing, you can hot start/stop, upgrade, and cleanly uninstall. Plugin addresses:

  • Community plugin directory page: https://www.skillhub.cn/plugins/Oo0520/dsh-plugin-doctor (Independent site, no official affiliation with DeepSeek / Hypothesis)
  • GitHub repository: https://github.com/Oo0520/dsh-plugin-doctor