omdsh-dev/dsh-tool-schema
30Last commit Aug 14, 2026
dsh-tool-schema DSH plugin
dsh-tool-schema provides a pure-function JSON Schema validation kernel inside DSH. It supports four actions: validate (full verdict with path errors), paths (only failure paths), explain (static constraint tree), and normalize (deep copy + apply defaults + re-validate). It enforces strict security: no dynamic code execution, no network access, and all unsupported keywords are reported as schema issues.
How to install the dsh-tool-schema DSH plugin
dsh plugin --profile web add github:omdsh-dev/dsh-tool-schemaCopying does not run this command. Review the repository and version before installing the dsh-tool-schema DSH plugin.
dsh-tool-schema DSH plugin data source
dsh-tool-schema DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-tool-schema DSH plugin can do
- Validate JSON data against any JSON Schema (draft 2020-12 subset) with RFC 6901 error paths
- List only failing paths with keyword summary for quick diagnosis
- Explain schema constraints as a static tree (nodes) without natural language
- Normalize input by applying explicit defaults from `properties` and re-validate
- ReDoS protection: all pattern checks run in a worker thread with 1,000ms hard budget; schema and data size limited to 256 KiB each
- Prototype pollution protection: only `Object.hasOwn`; `__proto__`/`constructor`/`prototype` treated as plain JSON keys
Where the dsh-tool-schema DSH plugin fits
- Validate API response structures against expected schemas in agent workflows
- Check plugin manifest or configuration files for conformance to a schema
- Locate exactly which fields fail schema validation with path-level detail
- Apply default values from a schema to a data object and verify the result
Who the dsh-tool-schema DSH plugin is for
- Agent developers who need reliable JSON Schema validation inside DSH tools
- DSH users who want to verify data integrity without relying on model guessing
dsh-tool-schema DSH plugin limitations
- Only supports a subset of draft 2020-12 (no `$dynamicRef`, `$vocabulary`, etc.); unsupported keywords cause immediate failure by default
- Data and schema each limited to 256 KiB; nested depth ≤ 64; schema nodes ≤ 10,000; traversal nodes ≤ 100,000
- `$ref` only supports local references (starting with `#`); remote references are not supported
- `normalize` only applies default from `properties` when the missing field’s default passes its own sub-schema; oneOf/anyOf branches are skipped if ambiguous
- Pattern validation uses a worker thread with 1,000ms budget; matches may be incomplete if timeout occurs
dsh-tool-schema DSH plugin: from the repository README
Quoted from the omdsh-dev/dsh-tool-schema README, the upstream source of the dsh-tool-schema DSH plugin. Copyright remains with the original authors.
DSH JSON Schema 验证工具插件 —— 验证数据、列出失败路径、解释 schema 约束、安全应用 default。零网络、零动态代码执行。 [](LICENSE) ## 动机 Agent 需要验证任意 JSON 数据是否符合 schema（API 响应结构、插件 manifest、配置文件、会话事件），并定位失败路径。现有路径没有这个能力： 1. **`defineTool` 参数 DSL 是作者 DSL**——面向插件作者声明工具参数，不是面向任意用户 schema 的通用验证服务 2. **`dsh-tool-json` 只提供查询**——能取路径、能筛选，但不验证结构、不给 RFC 6901 失败定位 3. **模型"目测"验证不可靠**——复杂嵌套 schema（allOf/oneOf/`$ref`/pattern）组合下，手算通过/失败极易出错，且无法展示可验证的过程 本插件提供独立的纯函数 JSON Schema 验证内核：一次函数调用返回 verdict、路径化错误与 schema 问题。不执行任何代码、不访问网络，**绝不静默忽略不支持的 schema 关键字**。 ## 安全模型 - **零动态执行**：验证内核是纯数据遍历，不构造 `RegExp`（pattern 在独立 worker 内执行）、不 `eval`、不访问网络、不读文件 - **不支持关键字绝不静默忽略**：报告 `unsupported-keyword` schema issue；`strictSchema=true`（默认）直接失败（`valid:false` / `complete:false`），`strictSchema=false` 验证已支持子集（`valid:null` / `complete:false` / `supportedSubsetValid`） - **ReDoS 防线**：所有 `pattern` 校验在**可终止的 worker 线程**内共享 1,000ms 硬预算，超时 `terminate()` 并报错——灾难性回溯不能阻塞宿主进程；pattern ≤ 16 KiB、每 schema ≤ 100 个 - **原型污染防护**：所有对象访问用 `Object.hasOwn`，`__proto__` / `constructor` / `prototype` 只作为普通 JSON 键处理 - **`$ref` 安全性**：仅支持本地引用（`#` 与 `#/$defs/<token>`，RFC 6901 转义）；目标必须存在；环检测（schema-check 静态报告 `ref-cycle`
Read the full READMERepository license: MIT
dsh-tool-schema DSH plugin questions
How do I install dsh-tool-schema into my DSH profile?
Use the bundle installation command: `dsh plugin --profile web add github:omdsh-dev/dsh-tool-schema` for the web profile, or replace `web` with `headless` for headless. After installation, verify with `dsh --profile web --dump-config | grep tool-schema`. You can also install from a local npm pack tarball.
Does this plugin support remote $ref references?
No, only local references (`#` and `#/$defs/<token>`) are supported. The plugin does not fetch remote schemas to keep the validation zero-network. If you need to validate against a remote schema, you must resolve it beforehand and pass the resolved schema object.
What happens if my schema contains unsupported keywords?
By default (`strictSchema: true`), the validation will fail with a schema issue and set `valid: false` and `complete: false`. If you set `strictSchema: false`, the plugin will validate only the supported subset and report `valid: null` with `supportedSubsetValid` indicating whether the supported part passed. Unsupported keywords are never silently ignored.
Can I use this plugin to validate large data or deep schemas?
There are hard limits: data and schema must each be ≤ 256 KiB, nesting depth ≤ 64, schema nodes ≤ 10,000, and traversal nodes ≤ 100,000. If these limits are exceeded, the plugin will return an error immediately. For very large data, consider splitting or pre-processing.
How does the plugin protect against ReDoS attacks?
All `pattern` keyword checks are executed in a separate worker thread with a shared 1,000ms hard budget. If the worker does not finish within that time, it is terminated and an error is reported. Additionally, each pattern must be ≤ 16 KiB and each schema can have at most 100 patterns. This prevents catastrophic backtracking from blocking the host process.