Introduction

The plugin mounting mechanism of DeepSeek Harness (DSH) resolves package identity at runtime through the identityFromManifest function. When the name in a plugin mounting line is a path, the system searches upward for the nearest package.json and requires both the name and version fields to be non-empty. If they are missing or empty, DSH throws a REQUEST_EXTENSION error, causing every official DeepSeek request to fail. This error is often mistakenly attributed to a model or account issue.

dsh-plugin-guard is a protective plugin designed for this scenario, aiming to prevent request interruptions caused by improper mounting configurations.

Plugin Overview

Name: dsh-plugin-guard
Maintainer: Linicc
Category: admin-security
License: MIT

This plugin mirrors the upstream resolution rules and implements a three-layer defense mechanism to ensure that plugin mounting configurations comply with the required specification.

Core Features

The plugin provides the following core capabilities:

  1. Startup self-heal
    During the plugin apply() phase, it scans all patch layers in configuration files. For noncompliant plugin modules, it writes a minimal compliant package.json next to the module. This process covers all configuration files and costs about 1ms per session.

  2. Check-on-write
    Monitors write operations on configuration files (.yml/.yaml). After each write, it immediately re-audits and repairs the configuration, then outputs the results to the console.

  3. Three CLI tools
    - dsh_guard_audit: Lists all configuration lines that may trigger an error.
    - dsh_guard_repair: Writes a missing package.json for noncompliant plugin directories (idempotent; it does not overwrite existing files).
    - dsh_guard_verify: Checks before mounting whether a plugin entry can pass the upstream resolution rules.

Installation and Configuration

Installation is recommended in the form of a DSH bundle. This plugin declares dsh.bundle.patch, so after installation it automatically inserts its plugin line into the configuration.

dsh plugin --profile <profile> add github:Linicc/dsh-plugin-guard

After installation, enable the plugin in the configuration and set the parameters:

- id: plugin-guard
  name: dsh-plugin-guard
  config:
    autoRepair: true       # 自动修复缺失的 package.json (默认: true)
    verbose: false         # 是否输出审计详情到控制台
    # profileRoot: "..."   # 默认扫描路径为 $DSH_HOME/profiles

Usage Examples

  1. Audit the current configuration
    Run dsh_guard_audit to see which lines cause resolution failures.

  2. Repair the configuration
    Run dsh_guard_repair to automatically generate the files for directories missing package.json.

  3. Pre-check
    Before mounting a new plugin, use dsh_guard_verify to confirm that it can pass the resolution rules.

Implementation Details and Security Boundaries

The plugin fully mirrors the upstream resolution rules, including path determination, manifest lookup, and field validation, ensuring no behavior inconsistencies.

Security boundaries:
- It writes a file only when the plugin directory has no package.json at all; it does not modify manifests of other packages.
- If the offending manifest belongs to an ancestor directory (such as the profile root), the issue is marked as repairable: false and deferred to manual handling; the plugin does not modify it automatically.
- All audit and write operations are wrapped in try/catch to ensure that the plugin itself does not become the cause of request failures.

Use Cases

  • During local development, mounting file paths directly instead of package names.
  • A plugin directory is missing a package.json file.
  • A strict guarantee is needed that plugin mounting configurations are consistent with upstream resolution rules.

Summary

dsh-plugin-guard provides a safety net for DeepSeek Harness plugin mounting through startup self-healing, write monitoring, and CLI tools. It turns configuration errors that would otherwise cause global request failures into auditable, repairable local issues.

Plugin directory | GitHub repository