5,905 plugins and counting. Some of them fight each other. Install a skin and another plugin silently breaks. Two plugins register the same tool name and the harness crashes at startup. Your agent writes a plugin in Creator mode and it vanishes on restart.

This plugin makes all of that visible — and fixable — before it bites you.

Why you need it

DeepSeek Harness is "everything is a plugin", and the ecosystem exploded to thousands of plugins within a week. But nobody is keeping watch:

| Pain | What actually happens | What guardian does | |---|---|---| | "I installed a skin and now X is broken" | Plugins silently collide | plugin_profile_scan finds tool-name collisions | | Two plugins register the same tool | Harness crashes at startup (see Pi #7696) | Conflict detected before you ship | | "Is this random npm plugin safe?" | No trust system exists | plugin_doctor checks it, with honest confidence tiers | | "The plugin my agent just wrote is gone" | Creator-mode plugins live only in memory | plugin_promote promotes it to durable disk |

Four tools, one lifecycle

陌生/临时插件  →  plugin_doctor 体检  →  通过门禁  →  plugin_promote 转正  →  可信磁盘插件
                        │
                 plugin_profile_scan 扫已装集冲突
                        │
                 plugin_install 引导安装（先审计→再执行）

| Tool | What it does | Analogy | |---|---|---| | plugin_doctor | Health-check a single plugin directory | 门诊 checkup | | plugin_profile_scan | Scan the installed set for cross-plugin conflicts | 体检 center | | plugin_promote | Turn an ephemeral plugin into a durable, versioned asset | 落户 registration | | plugin_install | Guided install: audit first, then execute | 一键安装 one-click install |

What makes it honest: three-tier confidence

Every finding is tagged with a confidence tier — borrowed from Pi's pi-extension-doctor:

| Tier | Meaning | |---|---| | confirmed | Provable from the files we read (e.g. a missing field) | | inferred | A static pattern was seen — not proof of runtime behavior | | unknown | A boundary (remote spec, unreadable file) blocked a conclusion |

No fake precision. A static scan result is labeled "inferred", never "definitely a bug".

30-second start

dsh plugin --profile web add github:Nico0713520/dsh-plugin-guardian
# restart dsh web, then ask in a session:

plugin_doctor target="/path/to/my-plugin"
plugin_profile_scan
plugin_promote source="/path/to/my-plugin"
plugin_install spec="npm:some-plugin"      # audit-only by default
plugin_install spec="npm:some-plugin" approve=true

Demo

plugin_doctor against a real DSH plugin:

DSH plugin doctor
target : /path/to/dsh-gh-cli
verdict: WARN  (0 blocker · 1 warn · 3 info)

[info] confirmed — cordis patch file present
[warn] confirmed — Pre-release peer dependencies (9)   → 建议锁版本
[info] inferred  — Spawns subprocesses
[info] inferred  — Detected 2 possible tool name(s): gh_cli_run, gh_auth_status

plugin_promote:

DSH plugin promote
status : PROMOTED
name   : dsh-gh-cli@0.1.0
sha256 : 6cf15989…
install: dsh plugin --profile web add link:…/.guardian-plugins/dsh-gh-cli-6cf15989

Safety boundary

• plugin_doctor and plugin_profile_scan are read-only. They never install packages, execute source, spawn subprocesses, hit the network, or write a file.
• plugin_promote writes only to a managed staging directory ($DSH_HOME/.guardian-plugins) with a provenance marker (sha256 / promotedAt / source). It never touches your live profile unless you pass register=true.

Tools

| Tool | Parameters | Notes | |---|---|---| | plugin_doctor | target (path or npm:/github: spec), format (text/json) | Three-tier confidence report | | plugin_profile_scan | profileDir (defaults to $DSH_HOME/profiles/web) | Finds tool-name collisions, dupes, version skew | | plugin_promote | source, register (default false), profile, outputDir | Doctor-gated, atomic, provenance-marked | | plugin_install | spec, approve (default false), profile | Audit-first guided install; approve=true runs dsh plugin add |

FAQ

Is this the same as dsh-plugin-check? — Overlapping but different. plugin-check does 33 read-only checks on a single plugin. guardian adds three things it doesn't: confidence tiers, cross-plugin conflict scanning, and promote (转正) — the last of which is entirely absent from the ecosystem.

Will plugin_promote modify my profile by surprise? — No. It defaults to register=false; it only stages the plugin and prints the exact dsh plugin add command. You opt in to registration explicitly.

What's the Pi reference? — Pi's pi-extension-doctor established the confirmed/inferred/unknown confidence model and a strict read-only boundary. guardian applies the same discipline to DSH's much larger, messier ecosystem.

Development

git clone https://github.com/Nico0713520/dsh-plugin-guardian.git
cd dsh-plugin-guardian
npm install --legacy-peer-deps
npm run typecheck
npm run test
npm run build

Requirements

• Node.js ≥ 20
• DeepSeek Harness (@deepseek-ai/dsh, verified on 0.1.0-rc.x)

Related

• Contributing
• Changelog
• DeepSeek Harness — the official repo
• dsh-plugin topic — discover more plugins
• pi-extension-doctor — the confidence model we borrow

License

MIT — see LICENSE.