dsh-plugin-forge

Building a plugin from scratch inside DeepSeek Harness often means letting the model write code, install dependencies, run tests, and publish to npm in a single pass. Without a human checkpoint, privilege escalation and irreversible releases become real risks. dsh-plugin-forge adds a hard human gate to that pipeline: the model can read status, run checks, and write bounded implementation files, but it can never approve a stage, create a repository, or publish a package. Every step forward requires explicit human confirmation.

Four v0.1 templates—tool-command, skill-wrapper, stateful, and bundle—drive the workflow from versioned specification to safe project scaffold, then through a full verification chain: npm install --ignore-scripts, typecheck, test, build, pack preview, secret scan, and a clean DSH profile install. Model writes are restricted to src/, test/, schemas/, and docs/; templates, dependency configuration, .git, and credential files are protected. Dependencies are checked against a small DSH/TypeScript allowlist, and publishing is bound to the current release fingerprint, so any file change automatically invalidates the pending release plan. Forge invokes existing git, gh, and npm sessions without ever reading or storing their credentials.

This plugin is well suited for individual developers or small teams who want AI-accelerated plugin development but insist on auditable, replayable workflows with clear human approval points. The in-chat Plugin Forge card is a native DSH Conversation Node that rebuilds stage, check, detail, and next-command context from durable forge/* session events, so status survives replay and additional chat history loads. It ships with system typography, instant progress feedback, and reduced-motion / high-contrast fallbacks for comfortable tracking across long sessions.