Dsh Scholar

Needs allowlistBundlegit + preparefreshinstall scripts

dsh-scholar

Install Dsh Scholar

Installs from git, but pnpm >=10 will refuse until you add an `allowBuilds` entry in your profile's pnpm-workspace.yaml. That grants this package permission to execute code on your machine at install time, outside the agent sandbox — pin a commit (github:owner/repo#sha) before allowing it.

The one-line version

dsh plugin --profile my-profile add github:lzszq/dsh-scholar

This one needs an explicit build approval before it works

Installed from git, this package builds itself with a prepare script. pnpm 10 refuses to run that script until you list the package in pnpm-workspace.yaml. Adding it means you are allowing this package's code to run on your machine, outside the agent sandbox, at install time. The first install prints an allowBuilds hint and fails — that is expected, add the entry and retry.

1. allow the build in pnpm-workspace.yaml

onlyBuiltDependencies:
  - @dsh-scholar/research-plugin

2. install, pinning a commit so the code you approved is the code you get

# 1. add the bundle to a profile — --profile my-profile points at $DSH_HOME/profiles/my-profile
dsh plugin --profile my-profile add github:lzszq/dsh-scholar#<commit-sha>

# 2. verify: the bundle should show up as a layer in the resolved config
dsh --profile my-profile --dump-config

# 3. boot the profile
dsh --profile my-profile

Before you run itinstall scripts

This package declares prepare — package-manager lifecycle scripts that execute on your machine at install time, outside the agent sandbox, before any tool-approval prompt exists.
A plugin runs with your permissions once loaded: it can read your files, use your credentials and reach the network. Tool approvals do not sandbox it.
Installing from git resolves a moving branch. Pin a commit — github:lzszq/dsh-scholar#<commit-sha> — so the code you reviewed is the code you install.

Prerequisites

API key: Not required.
Network access: Not required at runtime.
Build approval: Required — the package must be listed in pnpm-workspace.yaml before it will build.
Language: TypeScript — a git install pulls this source, not build output.

Install check

Every field the verdict was derived from, so you can re-derive it yourself

Field checked	Result	Weight	What the spec says about it
lifecycleScripts	fail	warn	runs at install time, outside the agent sandbox: prepare
dsh.bundle	pass	fatal	package.json declares a `dsh.bundle` layer
dsh.bundle.patch file	pass	fatal	patch file present at `cordis.patch.yml`
npm registry	missing	warn	`@dsh-scholar/research-plugin` is not published to npm
prepare script	pass	fatal	ships a `prepare` script that builds on git install
pnpm allowBuilds	fail	warn	pnpm >=10 refuses to run a git dependency's prepare script until allowlisted

Verdict reason: git-only with a prepare script — requires an explicit build allowance
package.json read: package.json
Rules applied from: docs/user/develop/basic/publish.md
Checked at: 2026-08-15
Install-time scripts: prepare

From the README

Excerpt as published by the author, plain text, unedited

> **加急开发适配中！** **简体中文** | [English](README.en.md) DSH Scholar 是面向纯计算研究的 AI 科研工作台。它把研究资料、项目对话、代码与数据、实验运行、证据账本和 TeX 手稿放在同一个可恢复项目中，既可以从新问题开始，也可以接入已经进行到一半的研究。 - **可治理的研究流程**：从 Scope、Idea、Experiment Contract 到 Evidence、Claim 和 Release，关键节点由人类 Gate 把关。 - **受控实验**：Runner 在本机 Docker 或受控远端机器上执行冻结的实验计划，记录日志、状态与产物。 - **可追溯证据**：论文主张可追溯到受控 Run、Artifact 和经评审的 Evidence。 - **一体化工作台**：Chat、Workspace、Terminal、Manuscript、Trajectory 和 Settings 共用同一项目上下文。 - **可恢复与可审计**：Research Kernel 保存权威状态、NextAction、审批轨迹和产物引用。 - DSH Scholar 辅助研究，不代替研究者承担科学判断、审批、署名和发布责任。 - 默认使用 `gate-only`；Agent 不能批准 Human Gate、伪造 accepted Evidence 或绕过实验合同。 - 正式实验必须绑定不可变代码/数据快照和固定执行环境，并由受控 Runner 真实执行。 - Chat、普通 stdout 和 Interactive Terminal 输出不会自动成为正式 Evidence。 - 产品聚焦机器学习、数据科学、生物信息学等纯计算研究，不适用于临床决策、人体试验、湿实验或其他高风险研究。完整的环境、端口、变量和验收矩阵见 [开发、测试与

Topics

GitHub topics on this repository

#dsh #dsh-plugin