dsh-plugin-update-audit

Readme

# dsh-plugin-update-audit

Read-only update auditing for direct plugin dependencies in a DeepSeek Harness Profile.

The plugin adds one tool, `plugin_update_audit`. It inventories the selected Profile and checks each direct dependency according to its declared source:

- npm dependencies are compared with the official npm Registry `latest` manifest;
- GitHub dependencies are compared with the repository's current `HEAD` through the GitHub API;
- local tarballs and directories are reported as manual-review items, with SHA-256 for readable files;
- unsupported, missing, or unreachable sources are reported per plugin without aborting the whole audit.

The tool never installs, updates, removes, or rewrites a plugin. Network access is limited to `registry.npmjs.org` and `api.github.com`; use `offline: true` for local inventory only. Local dependency paths are redacted from tool output.

## Install

```sh
dsh plugin --profile <profile> add dsh-plugin-update-audit@0.1.0
```

Restart DSH Desktop after installation.

## Use

Ask the agent to call `plugin_update_audit`:

```json
{
  "profile": "dev-lab",
  "offline": false,
  "timeout_ms": 10000
}
```

Statuses are advisory:

- `update_available`: npm has a newer stable `latest` version;
- `upstream_changed`: GitHub `HEAD` differs from an immutable pinned commit;
- `local_review_required`: a local or workspace source needs an explicit rebuild and review;
- `current`, `ahead`, `offline`, `unpinned`, `not_installed`, or `unavailable`: no automatic update conclusion is made.

Always review release notes and source changes, create a safety snapshot, update one plugin at a time, restart DSH, and run that plugin's acceptance tests.

## Development

```sh
npm install
npm run check
npm test
npm pack --dry-run
```

## Security

See [SECURITY.md](SECURITY.md). This project is licensed under the MIT License.