chenw2759-wq/dsh-plugin-healthcheck
70Last commit Aug 15, 2026
dsh-plugin-healthcheck DSH plugin
This plugin validates plugins after installation without requiring a backend restart. It performs L0 static checks, L1 config composition, L2 isolated trial boot, and C8 malware scanning. It detects and fixes common issues like missing files, dependency errors, module duplicates, and malicious code, with automatic repair or rollback.
How to install the dsh-plugin-healthcheck DSH plugin
dsh plugin --profile web add "file:$HOME/.dsh/plugins/dsh-plugin-healthcheckCopying does not run this command. Review the repository and version before installing the dsh-plugin-healthcheck DSH plugin.
dsh-plugin-healthcheck DSH plugin data source
dsh-plugin-healthcheck DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-plugin-healthcheck DSH plugin can do
- L0 static checks: file integrity, dependency declaration, high-risk copies, dependency resolution, Windows command validation, lockfile consistency, disabled plugin detection, Cordis usage detection
- L1 config composition: validates bundle, profile, and home patch layers using the same algorithm as real startup
- L2 isolated trial run: spawns a subprocess with full boot, port offset to 0, detects hangs and crashes before real restart
- C8 malware scanning: pure static isolation, detects 7 malicious patterns (download-execute, credential theft, etc.) with evidence redaction and false-positive control
- Automatic repair and rollback: writes disabled line to home patch, HMR hot-reload, no harness modification
- Prebuilt prompts for complex issues to delegate to agent
Where the dsh-plugin-healthcheck DSH plugin fits
- Check if a newly installed plugin will cause a backend crash before restarting
- Detect malicious code or supply chain attacks in plugins
- Identify and automatically fix missing files or dependency issues in plugins
- Validate plugin configuration composition and lockfile consistency
- Run a full isolation boot test to ensure all plugins activate correctly
Who the dsh-plugin-healthcheck DSH plugin is for
- DSH plugin developers who want to verify their plugins before deployment
- DSH advanced users who manage a plugin-heavy environment and need to prevent instability
dsh-plugin-healthcheck DSH plugin limitations
- Only works within the DSH environment; not a general-purpose plugin checker
- Repair executor can only modify plugin code, profile, and config files; cannot modify harness source code
- Requires the plugin to be installed in the DSH plugins directory and registered via DSH plugin management
- L2 trial run may timeout after 90 seconds for hanging plugins
dsh-plugin-healthcheck DSH plugin: from the repository README
Quoted from the chenw2759-wq/dsh-plugin-healthcheck README, the upstream source of the dsh-plugin-healthcheck DSH plugin. Copyright remains with the original authors.
> DSH 插件健康检查 —— 装完新插件后**不重启后端**即可验证插件是否会导致事故。 > 纯静态检查 + 配置组合 + 隔离试跑 + 木马扫描，发现即修复（自动修复 / 自动回滚 / 预制提示词）。 `#dsh-plugin` · DeepSeek Harness (DSH) · TypeScript · turtle-ui ## 截图 设置面板 →「插件检测」：  运行一次检测（L0 静态 + L1 配置组合 + L2 隔离试跑 + 木马扫描）：  --- ## 它解决什么问题 DSH 的 `dsh plugin add` 只负责把插件装进 profile（薄 pnpm 转发器），**装完不做任何验证**—— 问题要等下次后端启动才暴露。常见事故： | 事故 | 根因 | 本插件拦截方式 | |---|---|---| | 启动报 `ERR_MODULE_NOT_FOUND`（缺哈希 chunk） | `files` 白名单漏掉代码分割产物 | C1 files 完整性 | | 后端启动报缺 `zod` / `schemastery` | 插件登记成 `link:` 依赖，绕过了 profile 的 node_modules | C2 依赖声明审计 | | agent 报 `Cannot read properties of undefined (reading 'prepare')` | `file:` 依赖装出 harness 核心包副本 → **模块双实例** → Symbol 身份错位 | C3 高危副本检测 | | `dsh-skin CLI not found`（Windows） | 命令不在注册表 PATH / `execFile` 只认 .exe | C5 Windows 命令 | | 改了 `link:`→`file:` 不生效 | pnpm 不重解析 lockfile | C6 lockfile 一致性 | | 被禁用的插件长期残留在依赖里 | 禁用是压制症状而非修复 | C7 禁用插件识别 | | 供应链投毒 / 恶意代码 | 发布包内注入恶意逻辑 | C8 木马扫描（纯静态隔离） | | 启动报 `loader fibers failed`（`cannot get property "fs" without inject`） | 插件未构建（lib 缺失）或 cordis 用法错误（`ctx.plugin()` 后同步取服务） | C9 cordis 用法检测（毫秒级） + L2 隔离试跑（重启前确认） | --- ## 实战案例（真实事故） ###
Read the full READMERepository license: MIT
dsh-plugin-healthcheck DSH plugin questions
How do I install dsh-plugin-healthcheck?
Clone the repository to your DSH plugins directory (e.g., ~/.dsh/plugins), then use the DSH plugin management command to add it: `npx @deepseek-ai/dsh plugin --profile web add "file:$HOME/.dsh/plugins/dsh-plugin-healthcheck"`. After that, restart the backend and you will find the 'Plugin Health Check' option in the settings panel.
Does this plugin require a restart after installation?
Yes, the plugin itself requires a backend restart to register its routes and UI. However, once installed, it allows you to check other plugins without restarting the backend. The L2 isolated trial run simulates a full boot in a subprocess, so you can detect issues before a real restart.
What types of checks does it perform?
It performs L0 static checks (file integrity, dependency declaration, high-risk copies, Windows command, lockfile consistency, disabled plugin detection, Cordis usage), L1 config composition (validates bundle, profile, and home patch layers), L2 isolated trial run (full boot in subprocess), and C8 malware scanning (7 malicious patterns, pure static, no execution).
Can it automatically fix problems?
Yes, many issues can be automatically fixed. For example, missing files can be repaired, and L2 failures can trigger an automatic rollback by writing a disabled line to the home patch (HMR hot reload, no restart needed). The repair executor only modifies plugin code, profile, or config files, never the harness source code. A confirmation prompt is shown before any repair action.
Will the malware scanner produce false positives?
The scanner is designed to minimize false positives. It skips tests, node_modules, and build artifacts. Patterns like `new Function("return …")` (common in schemastery), `atob(dataUrl)` for data decoding, `downloadFile(` as a method name, loopback IPs, and normal HTTPS API calls are not flagged. It uses two-level calibration: strong combinations (e.g., download-execute + destructive) cause errors, while single hits produce warnings suggesting manual review.