DeepSeek Harness Plugin

margbug01/dsh-ma-plugins#dsh-librarian

Stars ★ 1 Category Git & Code Review Added 2026-08-26

Evidence-first GitHub research subagent with bounded tools and in-memory request caching.

Install

# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)

dsh plugin --profile web add github:margbug01/dsh-ma-plugins#path:/dsh-librarian

Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).

README

Evidence-first GitHub repository research for DeepSeek Harness.

The main agent sees one librarian_explore tool. A fresh read-only child receives the low-level GitHub tools for code search, repository/ref resolution, numbered file reads, directory listing, recursive globbing, commit history, and diffs. Search snippets are treated as navigation hints; reports are instructed to cite verified file ranges and permanent GitHub links.

Install

dsh plugin --profile web add link:C:/path/to/dsh-ma-plugins/dsh-librarian

The bundle patch mounts the plugin with these defaults. Override by id in ~/.dsh/profiles/web/cordis.patch.yml, restating every config key you keep:

- id: dsh-librarian
  config:
    apiKeyEnv: GITHUB_TOKEN
    maxApiCalls: 36
    timeoutMs: 600000
    maxRetries: 1
    maxRetryDelayMs: 5000
    cache:
      enabled: true
      maxSizeMb: 100
      refTtlSeconds: 60
      searchTtlSeconds: 30
      disk: false

Do not - insert this plugin again after dsh plugin add; that double-mounts it.

agentOptions is optional. When omitted, the Librarian inherits the parent agent's provider and model.

The token resolves through the DSH credential service first, then the process environment. Keep credentials outside the repository.

The cache stays in memory and is cleared when DSH restarts. Immutable commit and tree reads remain cached until least-recently-used eviction. Branch, repository, and history reads use refTtlSeconds; complete search responses use searchTtlSeconds. Incomplete search responses, errors, rate-limit responses, credentials, and responses marked private, no-store, or no-cache are never cached. Matching in-flight requests from one Librarian run share a single GitHub request, while each caller keeps independent cancellation. Individual responses are capped at 16 MB before entering the memory layer.

disk: true is reserved for a future opt-in disk cache. Version 0.3.1 logs a notice and continues with memory only.

Development

npm run check
npm test

Requires Node.js 22 and DSH 0.1.0-rc.6.

Content from the project README on GitHub ↗

Links

More in this category

View the whole category →

Community comments

Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.