dsh-plugin-doctor

Once you have a dozen or so community plugins installed on DSH, hidden problems rarely stay quiet: a manifest pointing to a missing file, an eval call tucked into a patch, an install script silently reading your credentials. dsh-plugin-doctor consolidates security auditing and day-to-day maintenance into a single tool. A one-click health check covers manifest contracts, patch-layer risks, static code scanning, and supply-chain threats, with findings sorted into errors, warnings, and info notices. Newly installed plugins are scannable immediately.

Beyond scanning, it turns plugin management into a visual panel. Search, toggle, install, uninstall, and version update are all available in the settings page. Hot enable and disable take effect instantly and persist automatically; before disabling, it probes whether other entries would be left in PENDING and rolls back if so. Uninstall reliability does not depend on pnpm exit codes, so even if a locked file blocks deletion, the system converges to a consistent state. Version updates compare against the npm registry and recognize the illusion caused by pnpm release age.

Who is it for? If you run a DSH web client with several or many community plugins and want a plugin steward that can audit, manage, and recover for you, this is the tool to use. For solo developers a one-off CLI audit may suffice; for small teams or long-lived DSH instances, the structured audit rules, bilingual description dictionary, and uninstall safety net noticeably reduce maintenance overhead.