dsh-plugin-update-audit

Read-only update auditing for direct plugin dependencies in a DeepSeek Harness Profile.

The plugin adds one tool, plugin_update_audit. It inventories the selected Profile and checks each direct dependency according to its declared source:

• npm dependencies are compared with the official npm Registry latest manifest;
• GitHub dependencies are compared with the repository's current HEAD through the GitHub API;
• local tarballs and directories are reported as manual-review items, with SHA-256 for readable files;
• unsupported, missing, or unreachable sources are reported per plugin without aborting the whole audit.

The tool never installs, updates, removes, or rewrites a plugin. Network access is limited to registry.npmjs.org and api.github.com; use offline: true for local inventory only. Local dependency paths are redacted from tool output.

Install

dsh plugin --profile <profile> add dsh-plugin-update-audit@0.1.0

Restart DSH Desktop after installation.

Use

Ask the agent to call plugin_update_audit:

{
  "profile": "dev-lab",
  "offline": false,
  "timeout_ms": 10000
}

Statuses are advisory:

• update_available: npm has a newer stable latest version;
• upstream_changed: GitHub HEAD differs from an immutable pinned commit;
• local_review_required: a local or workspace source needs an explicit rebuild and review;
• current, ahead, offline, unpinned, not_installed, or unavailable: no automatic update conclusion is made.

Always review release notes and source changes, create a safety snapshot, update one plugin at a time, restart DSH, and run that plugin's acceptance tests.

Development

npm install
npm run check
npm test
npm pack --dry-run

Security

See SECURITY.md. This project is licensed under the MIT License.