Dsh Plugin Check

by omdsh-dev · omdsh-dev/dsh-plugin-check

Build failsBundlegit (build fails)freshinstall scripts

DSH 插件健康检查工具：扫描插件仓库的清单协议 / patch 格式 / 构建陷阱 / hub 收录状态，零依赖只读，注册 plugin_check 工具

Install Dsh Plugin Check

Likely fails to load: not on npm, needs a build, and ships no `prepare` script — a git install fetches sources, not built artifacts, so the entry point is never produced.

This install is expected to fail

A git install pulls source, not build output. This package needs a build step, has no prepare script to run it, and is not published to npm — so nothing produces the compiled output the loader then goes looking for.

Three things would fix it, all of them on the author's side: publish the package to npm, add a prepare script that builds on install, or commit the build output to the repository. Until one of those happens, the command below is here so you can reproduce the failure, not so you can install it.

What would be run — expected to install and then fail to load

# 1. add the bundle to a profile — --profile my-profile points at $DSH_HOME/profiles/my-profile
dsh plugin --profile my-profile add github:omdsh-dev/dsh-plugin-check

# 2. verify: the bundle should show up as a layer in the resolved config
dsh --profile my-profile --dump-config

# 3. boot the profile
dsh --profile my-profile

Before you run itinstall scripts

This package declares prepack — package-manager lifecycle scripts that execute on your machine at install time, outside the agent sandbox, before any tool-approval prompt exists.
A plugin runs with your permissions once loaded: it can read your files, use your credentials and reach the network. Tool approvals do not sandbox it.
Installing from git resolves a moving branch. Pin a commit — github:omdsh-dev/dsh-plugin-check#<commit-sha> — so the code you reviewed is the code you install.

Prerequisites

API key: Not required.
Network access: Not required at runtime.
Language: TypeScript — a git install pulls this source, not build output.

Install check

Every field the verdict was derived from, so you can re-derive it yourself

Field checked	Result	Weight	What the spec says about it
lifecycleScripts	fail	warn	runs at install time, outside the agent sandbox: prepack
dsh.bundle	pass	fatal	package.json declares a `dsh.bundle` layer
dsh.bundle.patch file	pass	fatal	patch file present at `cordis.patch.yml`
npm registry	missing	warn	`@deepseek-ai/dsh-plugin-check` is not published to npm
prepare script	missing	fatal	needs a build but ships no `prepare` script — a git install fetches sources, not built artifacts

Verdict reason: git-only + needs build + no prepare script
package.json read: package.json
Rules applied from: docs/user/develop/basic/publish.md
Checked at: 2026-08-15
Install-time scripts: prepack

From the README

Excerpt as published by the author, plain text, unedited

DSH 插件健康检查工具 —— 扫描插件仓库，诊断**清单协议 / patch 格式 / 构建陷阱 / hub 收录状态**，输出合规报告与修复建议。**只读**，不修改、不构建被检查仓库。组织内插件仓库持续增长，作者踩过的坑（cordis 双副本、tsconfig 三件套、patch name 不一致、产物 `.ts` 残留——运行时必崩）本可以自动化拦截。本工具把全部实测踩坑变成**可自动检查的门禁**：模型或 CI 直接对仓库目录跑一次 `plugin_check`，拿合规报告与修复建议。 - **只读**：仅 `readdir/stat/readFile`，绝不修改或构建被检查仓库 - **零业务依赖**：仅 node 内置模块（fs/path/child_process） - **hub 检查离线优先**：先读本地 hub catalog（`DSH_HUB_SOURCE` 或 cwd/hub/ 下），gh 调用作 fallback；全部失败静默降级 `skipped`（报告如实标注，不算警告） - **不执行 tsc**：构建陷阱全部静态文本扫描（快、无副作用）注册 `plugin_check` 工具（`@deepseek-ai/dsh-plugin-check`，row id `tool-plugin-check`），统一输出 JSON 文本。 | 参数 | 类型 | 必填 | 说明 | |---|---|---|---| | `action` | string | ✅ | `check` / `scan` / `schema` | | `path` | string | | 插件仓库目录（check）或父目录（scan）；默认当前工作目录 | | `strict` | boolean | | strict 模式：warning 升级为 error 影响 v