Introduction

When maintaining a DeepSeek Harness (DSH) Profile, the version status of direct dependencies (such as npm packages, GitHub repositories, or local tarballs) often requires manual verification. Manual checks are inefficient and prone to omissions. The dsh-plugin-update-audit plugin provides a read-only audit solution for taking inventory of a Profile and checking the status of each dependency.

Plugin Overview

This plugin is used for read-only update auditing of Profile plugins and belongs to the admin-security category. It is maintained by user wcnm8888 and released under the MIT License. By comparing against official data sources, it reports whether a plugin needs to be updated or has changes.

Core Features

The plugin mainly provides the following capabilities:

  1. Profile Inventory: Performs a complete asset inventory for the selected Profile.
  2. npm Dependency Check: Checks npm dependencies against the latest version in the official npm Registry.
  3. GitHub Dependency Check: Uses the GitHub API to compare the repository’s current HEAD with the commit locked in version control to detect upstream changes.
  4. Local Source Report: Reports local tarballs and directories, and provides SHA-256 checksums for manual review.
  5. Abnormal Source Report: Lists unsupported, missing, or unreachable sources without interrupting the entire audit process.

Installation and Enablement

Add the plugin using the official installation command:

dsh plugin --profile <profile> add dsh-plugin-update-audit@0.1.0

After installation, restart DSH Desktop to activate the plugin.

Usage

Call the plugin_update_audit tool in the DSH context, passing the target Profile and configuration parameters:

{
  "profile": "dev-lab",
  "offline": false,
  "timeout_ms": 10000
}

Audit Status

The audit results return specific status codes to guide subsequent operations:

  • update_available: An update is available in the npm Registry.
  • upstream_changed: The HEAD of the GitHub repository does not match the locked commit.
  • local_review_required: A local or workspace source requires explicit rebuild and review.
  • current, ahead, offline, unpinned, not_installed, unavailable: No automatic update conclusion is made.

Security and Limitations

  • Read-only operation: The plugin never installs, updates, removes, or rewrites any plugin. It only reads information and generates reports.
  • Network restrictions: The plugin only accesses registry.npmjs.org and api.github.com. To inventory local files only, set offline: true.
  • Path sanitization: Local dependency paths are masked in the output to prevent leakage of sensitive information.
  • Operational recommendations: Before making any updates, be sure to review release notes and source-code changes, create a safe snapshot, and update plugins one by one. After updating, restart DSH and run the acceptance tests for this plugin.

Summary

This tool is an auxiliary means for dependency governance in DSH Profile management, focusing on transparency and traceability of information. For more details, visit GitHub.