PerryLink/dsh-plugin-doctor

Name: PerryLink/dsh-plugin-doctor
Author: PerryLink

Plugin插件 Native原生 ⭐ 4 Apache-2.0 Approval & Security审批与安全

An all-in-one "integrity + runtime health" checker for dsh plugins. Zero dependencies (it uses only what Node ≥22 ships), and one run covers four layers at once: static package-structure checks (R) → Cordis contract scan (K) → dynamic sandbox smoke (D) → ecosystem directory-listing validation (CC). Every criterion traces back to three first-hand research tracks dated 2026-09-07: the deepseek-harness

catalog descriptioncatalog 简介 / catalog description：Zero-dependency verification standard for DeepSeek Harness (dsh) plugins — static structure gates (R), cordis contract checks (K), sandbox smoke (D), ecosystem-listing checks (CC). 零依赖 DSH 插件核验标准：静态结构门禁、cordis 契约扫描、无头沙箱冒烟与生态收录核验。

Project Overview项目介绍

Edited by Zhiwei Agent (zhiwei)由知微Agent(zhiwei)编辑

dsh-plugin-doctor is an all-in-one "integrity + runtime health" checker for DSH (DeepSeek Harness) plugins, shipped with zero runtime dependencies and relying only on capabilities already provided by Node ≥22. A single run covers four layers in order: R static package-structure checks, K Cordis contract scanning, D dynamic sandbox smoke, and CC ecosystem directory-listing validation. Every criterion is traceable to three first-hand research tracks dated 2026-09-07 covering the deepseek-harness docs and source, the cordiverse/cordis source contracts, and a full inventory of distribution channels in the workspace, with the complete text archived in SURVEY.md.

The package declares dsh.bundle.patch → cordis.patch.yml in package.json, so it also installs as a DeepSeek Harness bundle. Installation uses dsh plugin --profile web add "github:PerryLink/dsh-plugin-doctor#main" for the git channel or dsh plugin --profile web add @perrylink/dsh-plugin-doctor for the npm channel, and the host half is a plain ESM module exporting apply(ctx) with no browser dsh.client UI. The typical workflow is node doctor.mjs --repo <path>, optionally constrained with --no-smoke, --only R,K ASCII aliases, --dsh <version> to pin the smoke host, --json report.json or --json - for machine output, --format check --json - for the PASS/WARN/FAIL tri-value view, and --purge to clean doctor-quarantine directories; it targets maintainers who need pre-publish gating and reproducible Cordis contract verification.

Requirements are Node ≥22.19 or ≥24; the dynamic smoke layer additionally needs network access and pnpm. When the K group finds neither src/ nor lib/, all nine checks are skipped and the tool exits 6 instead of reporting a false green, an override --allow-degraded is available. Coverage is exposed in JSON as coverage.K and groups.K, the new 0.2.0 fallback also keys on main pointing at lib/ rather than on a missing build script. The project is released under Apache-2.0, and a sensible first-run pattern is to start with --no-smoke to validate static and manifest layers before enabling the network-dependent dynamic smoke stage.

dsh-plugin-doctor 是面向 DSH（DeepSeek Harness）插件的"完整性 + 运行时健康"一体化检查工具，零运行时依赖（仅依赖 Node ≥22 自带能力）。它在一次运行中覆盖四层检测：R 静态包结构、K Cordis 契约扫描、D 动态沙盒冒烟、CC 生态目录清单校验，所有判定准则均依据 2026-09-07 完成的 deepseek-harness 文档源码、cordiverse/cordis 契约源码以及工作区分发渠道清单三份一手调研（SURVEY.md 全文收录）。

该插件通过 package.json 中的 dsh.bundle.patch → cordis.patch.yml 声明，可作为 DeepSeek Harness bundle 安装：git 通道使用 dsh plugin --profile web add "github:PerryLink/dsh-plugin-doctor#main"，npm 通道使用 dsh plugin --profile web add @perrylink/dsh-plugin-doctor，宿主端为导出 apply(ctx) 的纯 ESM 模块。典型工作流是 node doctor.mjs --repo <路径>，可加 --no-smoke 仅跑静态层或 --only R,K 用 ASCII 别名限定分组，面向需要发布前自检、修复 Cordis 契约偏差的开发者维护者。

依赖要求 Node ≥22.19 或 ≥24；动态冒烟层需联网并安装 pnpm。当 K 组因缺少 src/ 与 lib/ 完全未真实运行时，工具以 exit 6 拒绝误报绿色，可通过 --allow-degraded 显式接受。项目以 Apache-2.0 发布，首运行建议先以 --no-smoke 验证静态与清单层，再按需启用动态冒烟。

View on GitHub在 GitHub 查看

Send to your DSH发给你的 DSH 安装

请帮我安装这个 DSH 插件。安装前先完成【兼容性检查 + 安全性检查】，检查通过再动手。

插件：dsh-plugin-doctor（PerryLink/dsh-plugin-doctor）
仓库：https://github.com/PerryLink/dsh-plugin-doctor
本站详情页：https://www.yhbd.top/plugins/perrylink-dsh-plugin-doctor/
本站登记：类型 plugin · 归类 原生 DSH 插件 · 许可证 Apache-2.0 · ⭐ 4 · 最近提交 2026-10-03 · 主语言 JavaScript

按下面顺序执行，每步先把结论告诉我，再进入下一步：

【1 兼容性检查】
① 我这边：DSH 版本、Node 版本、操作系统、当前 profile（web / desktop）。
② 读它的 README、package.json、插件 manifest，列出它要求的 DSH 版本 / Node 版本 / 操作系统 / 外部依赖 / 需要另外先装的运行时。
③ 逐条比对，结论只写「满足 / 不满足 / 未知」三种；不满足的给出可行替代方案。
④ 检查是否和我已装的插件冲突：命令名重复、skill / tool 重名、端口占用、重复注册的 MCP server。

【2 安全性检查】
① 仓库可信度：和上面「本站登记」是否一致；star / fork 数、创建时间、最近提交，是否归档或长期停更。
② 安装脚本：逐行看 package.json 的 preinstall / install / postinstall，以及 install.sh、setup.ps1 之类脚本。出现 curl|bash、下载后直接执行、混淆代码、访问与插件功能无关的域名，立刻停下来告诉我，不要继续装。
③ 依赖：列出新增依赖，标出无人维护、或与知名包拼写近似的可疑包（typosquatting）。
④ 权限与副作用：它会读写哪些目录、访问哪些域名、需要哪些 DSH 权限（filesystem / network / shell / clipboard 等），以及怎么卸载和回滚。
⑤ 如果它要求 sudo / 管理员权限，或权限明显超出功能所需，先停下来问我。

【3 安装】
上面两步没有「不满足」和「高危项」时才执行；用官方推荐方式安装，不要自行提权。

【4 汇报】
用表格输出：检查项 / 结论 / 依据 / 是否需要我决策。拿不准的一律写「未知」并说明要我怎么确认——不要猜，也不要替我决定。

Send this message to DSH in your current session: it verifies compatibility and security first (answering met / not met / unknown item by item) and only installs once everything checks out — it will stop and ask you if it finds a high-risk item. The box scrolls; the copy is the full prompt. CLI install commands may not be accurate across systems, so DSH is the safer route.把上面这条消息直接发给当前会话里的 DSH：它会先核对兼容性与安全性（逐条给「满足 / 不满足 / 未知」），确认没问题再安装，有高危项会停下来问你。框内可滚动，复制到的是完整提示词；安装命令不一定准确，发给 DSH 更稳。

Pre-install check安装前体检Compatibility · Security兼容性 · 安全性 1 warning1 项注意

Only 4 stars - very few users, little community feedback星标只有 4，几乎没人在用，遇到问题缺少社区反馈

DSH walks through these 9 checksDSH 会逐条核对这 9 项

Compatibility兼容性

DSH, Node, OS and profile requirementsDSH 版本 / Node 版本 / 操作系统 / profile 是否满足要求
External dependencies and runtimes (Electron / Python / Docker, ...)外部依赖与运行时（Electron / Python / Docker 等）是否齐备
Conflicts with installed plugins: command names, skill / tool names, ports, duplicate MCP registration与已装插件是否冲突：命令名、skill / tool 重名、端口占用、重复 MCP 注册

Security安全性

Repo matches the facts registered here; archived or abandoned?仓库是否与页面登记一致，是否归档或长期停更
Safety of preinstall / install / postinstall and install.sh / setup.ps1preinstall / install / postinstall 与 install.sh、setup.ps1 是否安全
curl|bash, download-then-execute, obfuscation, unrelated domains → stop immediatelycurl|bash、下载即执行、混淆代码、无关域名 → 立刻停止
Typosquatting or unmaintained packages among the new dependencies新增依赖里有没有 typosquatting 或无人维护的包
Requested permissions vs. what the feature actually needs申请了哪些权限、是否超出功能所需（filesystem / network / shell / clipboard）
Any sudo / admin requirement, plus uninstall and rollback是否要求 sudo / 管理员权限，以及卸载与回滚方式

Anything uncertain must be marked unknown with a note on how to confirm it. This site's signal screen is a static snapshot, not a security audit.拿不准的必须标「未知」并说明要我怎么确认。本站的信号筛查是静态快照，不能替代安全审计。

Or use CLI install (for developers)或使用命令行安装（适合开发者）

CLI Install命令行安装

dsh plugin --profile web add @perrylink/dsh-plugin-doctor

把 PerryLink/dsh-plugin-doctor 加入你的 DSH 配置（web profile）即可启用。

READMEREADME

31.9 KB · 缓存于 2026-09-29 05:49:27 · 31.9 KB

dsh-plugin-doctor

English · 简体中文 · Español · Português · हिन्दी

An all-in-one "integrity + runtime health" checker for dsh plugins. Zero dependencies (it uses only what Node ≥22 ships), and one run covers four layers at once: static package-structure checks (R) → Cordis contract scan (K) → dynamic sandbox smoke (D) → ecosystem directory-listing validation (CC). Every criterion traces back to three first-hand research tracks dated 2026-09-07: the deepseek-harness docs and source, the cordiverse/cordis source contracts, and an inventory of every distribution channel in the workspace (full text in SURVEY.md).

⭐ 如果它帮到了你

这个插件是 DSH 插件家族的一员（40+ 个，全部 Apache-2.0）。如果你在用，给个 star —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。

English: part of a 40+ plugin family for DeepSeek Harness. If it is useful, a star helps the next person find it — nothing is gated behind it.

Installation (DSH bundle)

dsh-plugin-doctor declares dsh.bundle.patch → cordis.patch.yml in package.json, so it can also be installed as a DeepSeek Harness bundle:

# git channel (latest main)
dsh plugin --profile web add "github:PerryLink/dsh-plugin-doctor#main"

# npm channel (released version; always use the scoped full name -- the bare name dsh-plugin-doctor is a different project)
dsh plugin --profile web add @perrylink/dsh-plugin-doctor

Showing the opening section of the README — the full document lives in the repository以上为 README 开头摘要，完整文档在仓库内 · View the full README on GitHub →在 GitHub 查看完整 README →

渲染基于仓库 PerryLink/dsh-plugin-doctor 的 README.md。在 GitHub 查看原文 →