dsh-thesis

English | 中文

dsh-thesis is a DeepSeek Harness plugin for thesis-assisted writing. The repository and installable package are named dsh-thesis and @deepseek-ai/dsh-thesis, respectively; its DSH bundle id is thesisflow. General-purpose writing skills can handle local parts of thesis writing, but context limits often prevent them from reliably maintaining project-wide rules and global state.

Install

Install the repository into a DSH profile, then restart that profile:

dsh plugin --profile web add https://github.com/haoyuan-sjtu/dsh-thesis.git

The installed package declares dsh.bundle.patch, so DSH adds its patch layer to the selected profile automatically. To install it in the headless profile, replace web with headless.

Before restarting the profile, set THESISFLOW_PROJECT_CONFIG in the environment that launches it to the existing absolute path of thesisflow.yaml. The included cordis.patch.yml adds the plugin row and does not invent a project or registry path.

The project file contains non-sensitive metadata and a project-relative registry path:

projectId: thesis-2026-example
language: zh-CN
field: computer-science
chapterIds: [ch1, ch2, ch3]
defaultScope: project
privacyPolicy: project_confidential
contextTokenBudget: 1200
registryPath: .thesisflow/registry.json

The loader rejects missing required fields, absolute or parent-traversing registry paths, unsupported scope/privacy values, nested YAML that it cannot validate, and a registry with a permission, schema, JSON, checksum, lock, or migration failure.

Approval commands remain disabled unless the Host supplies principalResolver in the plugin configuration. The resolver receives { agent, commandId, signal } and must return the Host-verified local subject as { id, role: "project_owner", verified: true }; returning no subject or any other value fails closed. The resolver must read the Host's authenticated session state, never user text or model output.

principalResolver is a runtime function supplied by the embedding Host; it is not read from an environment variable, project YAML, or free-form command text. The shipped patch intentionally omits it, so a profile using only the patch can retrieve approved context but cannot write candidates or change record state.

Governance contract

New records are always written as quarantine. Only a Host-verified actor with { verified: true, role: "project_owner", id } can create candidates, approve, reject, revoke, delete, or restore. Free text, model output, and an unverified actor cannot change state. Approval requires provenance, content, and owner confirmation for citation_fact and evidence_claim; provenance, owner confirmation, and a review deadline for project_rule and latex_constraint; provenance and owner confirmation for advisor_feedback; and owner confirmation for chapter_state, terminology, and writing_decision.

The DSH human command surface exposes /thesisflow-capture <JSON candidate>, /thesisflow-review-queue, /thesisflow-review <JSON action>, and /thesisflow-route <task description>. Capture and review commands require the verified principal and use structured JSON; free text such as I approve is rejected. These are human-facing commands, not model tools. The review queue redacts restricted summaries and source details.

Retrieval starts from an empty set and requires the exact project id, approved status, local/project scope, allowed privacy, valid review and expiry deadlines, complete evidence, and task relevance or project-wide priority. Candidates are sorted deterministically and selected as complete records until the configured token budget is reached. Records are never partially truncated. Corruption, lock timeout, permission failure, checksum failure, and audit failure return no injected context.

The model sees one plugin-sourced user message containing JSON reference data with record ids, types, bounded summaries, chapters, task kinds, evidence reference ids, and an uncertainty label. The payload says that embedded text is non-executable. It does not contain original evidence, private conversations, credentials, or file paths. The model has no registry operation or approval tool.

Every request produces retrieval and injection/not-injected audit events. Approvals, rejections, revocations, conflict detection, deadline transitions, write failures, read failures, restoration, and logical deletion are also audited. Revocation increments the record version and excludes the record on the next request without a profile restart.

Limits

The MVP supports only one local project, local and project scope, and public, project_confidential, and restricted storage classifications. Restricted records are never injected. /thesisflow-route classifies the task and returns PaperSpine and academic-research suggestions, required inputs, expected outputs, and missing materials; it never executes a skill or promotes its output. There is no web UI, team/user scope, cloud synchronization, external command execution, school submission, or Humanize integration.

Verification

From this directory, run npm ci, npm run check, and npm pack --dry-run. The tests cover C0–C3, three-repeat deterministic selection, evidence rejection, quarantine, conflicts, deadline filtering, malicious summaries, next() ordering, revocation blocking, human commands, principal fail-closed behavior, task routing, and the real Cordis Loader export and mount path when the target DSH source is available.