TonyWang-hub/dsh-plugin-trust-center

README 摘要

DSH Plugin Trust Center Evidence-first inspection, compatibility verification, and quarantine tooling for DeepSeek Harness plugins. Important: a pass Passport means that the declared package structure passed this version's bounded checks. It is not a certification that third-party code is safe. Stage 1: Plugin Passport CLI Stage 1 performs deterministic, static-by-default inspection of: - a local directory, such as ./my-plugin ; - an npm package, such as npm:@scope/[email protected] ; - a GitHub repository, such as github:owner/repo v1.2.3 . Network sources are resolved before inspection: npm metadata records an exact published version and GitHub refs resolve to a 40-character commit SHA. Archive extraction rejects traversal, links, oversized downloads, oversized files, excessive entries, and excessive expanded size. Run from a GitHub Release Download the .tgz and SHA256SUMS.txt assets from the matching GitHub Release, verify the checksum, then run: Run from source Node.js 24.17.x and pnpm 11.21.0 are required. Commands inspect never imports target modules or runs package-manager lifecycle scripts. It emits: - human : a bounded terminal summary; - json : a canonical Plugin Passport; - s…

分类