dsh-agent-plugin-research

In Agent-driven DeepSeek Harness workflows, pulling community plugins straight from the ecosystem leaves a dangerous gap: versions float on latest branches with no audit trail, third-party build scripts execute before anyone has inspected them, and after install the Agent has no clear path to activation or metadata verification. dsh-agent-plugin-research is a structured workflow bridge designed to close that gap - not a visual marketplace for humans, but a seven-tool pipeline that has the Agent search, pin, inspect, confirm, install, verify, and plan activation before anything is written to disk.

The core capabilities span the full plugin lifecycle: search across GitHub, npm, private indexes, or curated offline tables; inspect manifests, install scripts, and cordis.patch.yml for risk; install and uninstall as permanent writes that require explicit confirm and will refuse to proceed when an approval channel is unavailable but failing; verify package identity, lockfile, patch, and profile layer consistency; and generate an activation plan tailored to the tools the current Agent can actually see, supporting three paths - dev hot-injection via dsh-super-injector, transactional config HMR via user cordis.patch.yml, and supervised restart via dsh-restart-resume.

This plugin suits Agent users managing multiple community plugins in a Harness environment, solo developers who want a safety floor under automated install workflows, and teams needing precise dependency control in production bundles. It does not replace dsh-super-injector or dsh-restart-resume; rather, when those optional tools are visible to the current Agent it identifies them as activation paths and recommends concrete steps, while its search, inspection, and persistent install capabilities stand independently without depending on any external tool.