dsh-plugin-safe-install

!License !Stars !Repo size !Platform

> A DeepSeek Harness (DSH) plugin that bundles the complete "safe plugin installation for beginners" workflow as a built-in skill. Install and go — zero dependencies, zero network access, zero lifecycle scripts. >

> English | 中文

---

How this story began (the author's account)

I am a complete beginner who knows nothing about programming. My first experience installing DeepSeek Harness (DSH) plugins was a disaster:

1. Installing plugins was painful: I saw all kinds of plugins in the market and followed tutorials — dsh plugin add xxx — installing one after another; 2. DSH would never start properly afterwards: every time I installed a new plugin, DSH refused to boot — and the error messages were all English technical jargon I couldn't understand; 3. The worst part: no startup = no way to fix it: I wanted to ask for help or debug, but DSH couldn't even start, so I had no way to even ask the AI; as a beginner who knows nothing, all I could do was stare at the screen; 4. Tried again and again, failed again and again: uninstall and reinstall, restart the computer, wipe the config and start over... I kept falling into the same traps, until I finally broke DSH entirely and could only rescue it piece by piece from the backup directory web_bak.

After many attempts I finally understood: what I needed was not just "how to install", but a workflow for "how to install safely, how to verify after installing, and how to roll back when things break" — and it had to be simple enough for a complete beginner to follow.

So I distilled this painful experience into this plugin's core skill: dsh-plugin-safe-install (the safe DSH plugin installation & testing workflow).

---

What this plugin does

Once installed, DSH agents automatically gain the built-in skill dsh-plugin-safe-install. When you say "help me install plugin X", the agent follows this workflow:

Phase	What it does	Why it matters for beginners
0️⃣ Scope & permissions	Confirm what to install and which permissions are needed	Never touches your config without asking
1️⃣ Baseline	Check current state and create a rollback checkpoint first	You can always restore to a known-good state
2️⃣ Security audit	Check for malicious scripts and verify the source is trustworthy	Don't open the door to suspicious plugins
3️⃣ One-by-one install + five-level verification	Install one → verify one → install the next	Failures surface at the first step, never as a pile-up
4️⃣ Native dependency handling	Handle node-pty / sharp and other build issues	The "installed but won't boot" traps all have solutions here
5️⃣ Clean uninstall / rollback	How to remove a broken plugin completely	No residue left behind to keep breaking DSH
6️⃣ Final check	Full verification + remind to restart to apply	Confidence after every install

The most important lesson in the workflow (and the deepest trap I fell into): use dsh-doctor boot for startup verification (it starts, probes, and exits by itself). Never use dsh web --port 0 as a startup test — it is a long-running server that never exits on its own; mistaking "timeout" for "failure" makes you retry endlessly and hang forever. I spent dozens of rounds stuck in this trap before climbing out — it is now a hard rule inside the skill.

---

Installation

Option 1: from GitHub (recommended)

dsh plugin --profile web add github:rouyiemei/dsh-plugin-safe-install

> The plugin self-mounts via its dsh.bundle.patch declaration — no manual config editing needed.

Option 2: local development / trial

# After cloning or downloading this repo, run from the project directory:
dsh plugin --profile web add link:./dsh-plugin-safe-install
# Or just copy the skills/ directory into your skill roots (works without the plugin):
#   cp -r skills/dsh-plugin-safe-install ~/.agents/skills/

Restart dsh web after installing — the skill then appears in the agent's skill catalog.

Uninstall

dsh plugin --profile web remove dsh-plugin-safe-install

Project layout

dsh-plugin-safe-install/
├── package.json          # DSH bundle plugin manifest (dsh.bundle.patch)
├── cordis.patch.yml      # bundle layer (insert plugin row)
├── index.js              # plugin entry: registers skills/ as a skill provider (zero deps)
├── skills/
│   └── dsh-plugin-safe-install/
│       └── SKILL.md      # the skill: six-phase safe install workflow + checklist (bilingual)
├── LICENSE               # MIT
├── README.md             # 中文说明
└── README.en.md          # English readme

Security notes

Zero runtime dependencies, no lifecycle scripts (no arbitrary code runs at install time), no network access (only reads its own skills/ directory locally).
The skill content is 100% readable: see skills/dsh-plugin-safe-install/SKILL.md in full after installation.

License

MIT

Source facts

Install

Check the source files