Pre-install compatibility gate for DSH plugins: locks the resolved version, checks peer/engines declarations, dry-installs into an isolated DSH_HOME and boots it with a timeout, blocks on any failure, and restores the profile if the real install fails. Optionally intercepts dsh-market install/update clicks. Compatible with DeepSeek Harness 0.2.x.
Install
# from npm (prebuilt)
dsh plugin --profile web add dsh-plugin-precheck
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:BaqiF2/dsh-plugin-precheck
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).
README
This plugin publishes its README in Chinese only.
安装 DSH 插件前先做兼容性与启动验证：发现问题即阻止安装并保留原环境，面向不了解插件依赖的新手。
它做什么
在 Web GUI「设置 → Plugins」中新增「安装预检」标签页。输入 npm 包名后：
- 解析并锁定版本（
pnpm view） - 基础兼容性检查：peerDependencies 与已装版本比对、Node engines、bundle 清单声明；信息缺失时显示「无法确认」而不是放行
- 组合检查：新插件的
cordis.patch.yml与当前配置树（dsh --dump-config）比对——插入 id 重复（确定错误）、补丁目标不存在/被多个插件覆盖（疑似风险） - 隔离试装 + 试启动：临时
DSH_HOME中复制 profile 文本文件，pnpm add锁定版本 →--dump-config静态校验 →--port 0 --no-open试启动，等就绪行 + 401 探针，180 秒超时树级杀死。隔离环境不含凭据、不挂载定时任务、不触碰正式环境 - 检查通过后才允许正式安装：使用同一锁定版本；安装前备份 profile 四个文本文件，失败自动还原 +
pnpm install复原 +--dump-config复验；恢复失败如实告知并给出日志与手动步骤
保护范围（如实声明）
- 覆盖：本页面的检查安装；开关开启时，本浏览器标签页中 dsh-market 的安装/更新点击（fetch 拦截 → 完整预检 → 通过才放行）
- 不覆盖：命令行
dsh plugin add、其他浏览器标签页；市场插件若未来改变端点或传输方式，拦截会失效（探测不到即不启用，不会误拦，UI 有状态显示） - 检查通过 ≠ 插件永久稳定，≠ 通过安全审计
dsh-market 拦截的工作原理
dshmarket 的全部路由都是 exact 注册（webServer 精确表优先，重复注册会抛错），且没有预安装钩子——Host 层无法插入中间件。因此拦截做在浏览器层：patch window.fetch 识别 POST /dsh-market/install、/dsh-market/update、/dsh-market/api/v1/updates，暂停请求 → Host 半侧把请求映射为安装来源（安装：url → 注册表条目 → npm 包名或 GitHub target；更新：包名 → 市场目标版本）→ 跑完整预检（含隔离试启动）→ 通过才用原始 fetch 放行；阻止/取消则返回合成 400 让市场 UI 自己报错。可在「安装预检」标签页随时停用。
兼容性
- 已针对 DeepSeek Harness
0.2.0-rc.2验证。 - Host 依赖要求
@deepseek-ai/cordis ~4.0.4；UI/Host 包兼容0.1.2-0至0.3.0-0，覆盖当前0.2.x预发布线。 - Node.js 要求
>=22。
安装
dsh plugin --profile web add dsh-plugin-precheck
# 然后重启 dsh web
状态词汇
检查中 / 检查通过 / 已阻止 / 无法完成检查 / 正在安装 / 正在恢复 / 已恢复 / 恢复失败。所有结论附判断依据，可复制脱敏诊断报告。
Links
More in this category
kenryu42/cc-safety-net★ 1900
Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.
ADWMC/helm-d#helmd★ 984
Security-analysis plugin for DeepSeek Harness: 33 tools spanning six security domains, evidence/reporting and toolbox, plus the case lifecycle, routing and tool ledger; a session-bound case workflow with an evidence chain, E-id validation and reproducible findings; 362 on-demand references; three hot-swappable persona profiles; and a four-tab workbench (armor / case / intercept / about) with case-state recovery after context compaction.
toby-bridges/api-relay-audit★ 904
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
SeaOf0/dsh-redteam-model★ 807
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
howmp/dsh-pentest★ 616
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
PerryLink/dsh-auto-review★ 244
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
Community comments
Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.