dsh-provenance

Most plugin scanners in the DeepSeek Harness ecosystem run after dsh plugin add has completed, inspecting files already on disk. But the npm registry does not rebuild tarballs from the repository, so a publisher can showcase clean source on GitHub, accumulate stars, and then ship a package with an extra file carrying install hooks. By the time a scanner looks, the injected code has already executed. dsh-provenance closes that timing gap: it runs before installation and answers the more fundamental question, Is the code you install actually the code the author showed you?

The tool cross-checks five dimensions: source pinning immutability, registry integrity against the published digest, install-hook disclosure, SLSA build provenance tying the artifact to a specific commit and CI workflow, and file-level comparison of published output against the upstream source. When not a single published file can be matched, the report explicitly raises diff.nothing-verified rather than presenting a reassuring zero-count. An install guard is also built in, intercepting installation attempts that have not passed a preflight in the current session, protecting against agents being lured into installing untrusted plugins via poisoned READMEs or crafted issue comments.

It is designed for ops and security teams managing the DeepSeek Harness plugin ecosystem, DevOps engineers adding supply-chain gates to CI pipelines, and developers worried about agent-driven installs of untrusted code. Zero runtime dependencies, all parsing in memory, and the audited package is never executed during the check.