CharlotteN7/dsh-plugin-inspector

README excerpt

dsh-plugin-inspector Know what a plugin does before you install it. dsh-inspect reads a DeepSeek Harness plugin — a directory, an npm tarball, or a published package fetched by name and checked against the hash the registry published — and tells you what it declares and what its code is capable of. It does not install it, build it, import it, spawn it, or evaluate any part of it. Install Node ^22.19.0 =24 . Once a release is published: Until then the binary comes from a checkout — and lib/ is generated, so a fresh clone has no dsh-inspect until it is built: To run it from source without building, pnpm run inspect . Why dsh plugin add is a thin pnpm forwarder. It passes your arguments to pnpm verbatim — no spec parsing, no added flags, no subcommand allowlist, no confirmation prompt — and then reconciles the profile's layer list from the installed state. Any package whose package.json declares dsh.bundle.patch is promoted to a mounted patch layer : an ESM module imported into the harness process at the agent's uid, with ungated top-level side effects, and a YAML layer that applies after @deepseek-ai/dsh-base and can therefore override any field of any core row by id — or set disable…

Category