dsh-plugin-auditor

Readme

# dsh-plugin-auditor

Audit your DSH plugin combination before adding a new one — predict whether it will crash the harness on boot.

DeepSeek Harness loads every bundle in the profile at startup. Third-party plugins that are unconfigured or conflicting (duplicate tool registrations, entry-id collisions, peer version mismatches, missing tokens/app ids) can fail the whole plugin tree. This plugin turns those lessons into a read-only pre-flight check.

## Install

```sh
# from git
dsh plugin --profile web add github:HYY-King/dsh-plugin-auditor

# or from a local directory (development)
dsh plugin --profile web add D:\path\dsh-plugin-auditor

# restart dsh web to activate
```

## Usage

After restart, ask the agent to call the `audit_plugins` tool:

- **Full audit**: call with no arguments to scan every bundle in the current profile.
- **New-plugin preview**: pass `newPlugins: ["package-name"]` for a name-level conflict preview.

## Checks

| Check | What it catches |
|---|---|
| Duplicate tool registration | Two plugins registering the same tool name (e.g. two memory plugins both registering `memory_forget`) |
| Entry-id collision | Multiple bundles mounting the same id in `cordis.patch.yml` |
| Peer version mismatch | A plugin requiring a `@deepseek-ai/*` version that differs from the installed one |
| Memory-plugin uniqueness | More than one memory plugin enabled at once — keep exactly one |
| Channel-plugin credentials | telegram/lark/im-style plugins enabled without token/app id — disable or configure |

## How it works

- **Read-only**: inspects the profile's `package.json`, `cordis.patch.yml`, and each installed package under node_modules; **never executes audited plugin code**.
- **Zero-dependency**: a mini YAML parser tailored to the simple `cordis.patch.yml` shape.

## Disclaimer

The audit is a static heuristic signal, not a compatibility guarantee. Always review a third-party plugin's source, permissions, and license before installing.

## License

MIT