DSH Plugin Doctor

dsh-plugin-doctor audits DeepSeek Harness npm Bundles before they reach a real Profile. It validates the Bundle manifest, scans risky behavior, installs into a temporary DSH_HOME, boots the Web Profile, produces machine- and human-readable reports, and can install with automatic Profile rollback.

The implementation follows the official DSH quickstart and Bundle publishing guide.

DeepSeek Harness is in Developer Preview. Doctor therefore records the exact Node, DSH, Cordis/peer dependency and operating-system evidence instead of treating one successful run as permanent compatibility.

What v0.1 checks

• package.json, dsh.bundle.patch, published files, YAML patch syntax and Cordis rows
• Node engine, DSH compatibility declaration, Cordis and all peer dependency ranges
• package lifecycle scripts, Cordis hooks, shell/process execution, filesystem reads/writes, network access, credential access, dynamic code and native modules
• temporary-Home installation with dsh plugin --profile web add ... --ignore-scripts
• composed configuration before/after installation and real Web startup on loopback
• JSON, Markdown, SVG compatibility badge and a DSH regression matrix
• team allowlists, scoped private registries and per-package permission grants

The static scanner is deliberately explainable: every finding includes a file, line, evidence, permission and confidence. It is a review aid, not a proof that unflagged code is safe.

Install and use

DSH itself currently requires Node ^22.19 || >=24; Node 24 is recommended when running isolated checks.

npm install -g dsh-plugin-doctor

# Local checkout, full isolated test against the DSH on PATH
dsh-plugin-doctor check .

# Published or private npm package, tested against several DSH releases
dsh-plugin-doctor check @acme/dsh-tools \
  --dsh-version 0.1.0-rc.2 \
  --dsh-version 0.1.0-rc.3 \
  --dsh-version 0.1.0-rc.6

# Strict mode also blocks unacknowledged high-risk permissions
dsh-plugin-doctor check . --strict --allow-permission hooks

# Audit, isolate-test, install into the real Profile, then boot-test it
dsh-plugin-doctor install @acme/dsh-tools --profile web

# Restore the latest saved Profile snapshot
dsh-plugin-doctor rollback --profile web

Reports are written to reports/ by default:

reports/
├── acme-dsh-tools.doctor.json
├── acme-dsh-tools.doctor.md
└── acme-dsh-tools.badge.svg