dsh-depguard

Installing multiple plugins on DeepSeek Harness can silently corrupt your session: when a core package like @deepseek-ai/dsh-tools ends up with a second physical copy on disk, JS Symbol keys (which differ on every module evaluation) cause tool scheduling to crash instantly, leave orphaned tool_calls in the conversation, and lock every subsequent request into a 400 INVALID_REQUEST loop. dsh-depguard exists to intercept this topology problem before it ever surfaces.

It ships two tools. dsh_depguard_predict fetches a target plugin manifest before installation and compares its dependencies and peerDependencies against your current runtime baseline: a direct dependency on a core package is flagged CRITICAL, a peer version mismatch is flagged WARNING. dsh_depguard_check scans the on-disk dependency tree post-installation and reports duplicate physical copies of core packages (same-name-same-version still triggers, since Symbol keys differ per evaluation), version drift, and community plugins that vendor core services into their own node_modules instead of declaring peerDependencies. Every finding carries a fix field with a remediation command, delegated to third-party plugins such as dsh-undo-plugin or dsh-boot-guard, keeping detection and remediation cleanly separated.

Built for anyone running a multi-plugin Harness stack. The plugin is strictly read-only with zero runtime dependencies, writes no config files, and never invokes a package manager on its own. All @deepseek-ai/* packages are declared as peerDependencies so it cannot introduce a duplicate core copy itself. Simply say a natural-language phrase like "check my plugin dependencies" in the session to trigger detection.