ZSeven-W/dsh-harbor
dsh-harbor
DeepSeek Harness (DSH) plugin: a read-only ledger for the plugins you already have installed — a capability inventory with file:line evidence, declared-vs-detected reconciliation, cross-profile version drift, and a diff of what changed since the last scan.
Install
npx @deepseek-ai/dsh plugin --profile web add link:/path/to/dsh-harborRestart `dsh web` after install. Bundle APIs can change during the developer preview.
README badge
[](https://dshhub.dev/plugins/dsh-harbor)Paste this into your README. The star count updates with every catalog sync.
From the README
Excerpt from ZSeven-W/dsh-harbor, cleaned of badges and images.
<strong>Evidence-first governance for the DeepSeek Harness plugins already installed on your machine.</strong><br /> <sub>Capability Inventory • Declared vs Detected • Runtime Attribution • Conflict Detection • Version Drift • Change Timeline</sub>
<sub>npm: <code>@zseven-w/dsh-harbor</code> · Current plugin release: <code>0.1.0-rc.2</code> · Tested with DSH <code>0.1.1-rc.2</code></sub>
<a href="./README.md"><b>English</b></a> · <a href="./README.zh.md">简体中文</a> · <a href="./README.zh-TW.md">繁體中文</a> · <a href="./README.ja.md">日本語</a> · <a href="./README.ko.md">한국어</a> · <a href="./README.fr.md">Français</a> · <a href="./README.es.md">Español</a> · <a href="./README.de.md">Deutsch</a> · <a href="./README.pt.md">Português</a> · <a href="./README.ru.md">Русский</a> · <a href="./README.hi.md">हिन्दी</a> · <a href="./README.tr.md">Türkçe</a> · <a href="./README.th.md">ไทย</a> · <a href="./README.vi.md">Tiếng Việt</a> · <a href="./README.id.md">Bahasa Indonesia</a>
<br /> <p align="center"><sub>The Harbor settings page in DSH light mode — live runtime registries, profile-scoped attribution, local version truth, and the change baseline.</sub></p>Why DSH Harbor
DSH plugins run in the host's Node realm with the same local permissions as DSH itself. Harbor does not pretend this can be solved with a score or a badge: it keeps a read-only, evidence-backed ledger of what is installed, what each plugin declares, what its code and live host actually expose, where plugins collide, and what changed since the previous scan.
🔎 Capability Inventory
Harbor scans every installed third-party bundle across DSH profiles and reports a fixed 13-capability vocabulary. Source findings carry file:line evidence; manifest, filesystem, and runtime facts state their origin explicitly.
🤝 Declared vs Detected
Plugins may declare dsh.capabilities in package.json. Harbor reconciles the declaration against detection, exposes missing and unknown ids, and fails closed on malformed declarations instead of letting one bad package break the whole report.
🟢 Runtime Attribution
Inside a live DSH host, Harbor enumerates tools, providers, and routes, then attributes them only to plugins installed in the active profile. Missing host registries remain visible as coverage gaps rather than empty proof.
⚠️ Conflict Detection
The ledger finds same-profile tool names, route prefixes, provider ids, client-module ids, and order-sensitive message hooks. A quoted route used by a client does not make that client the route owner.
🧭 Two Version Axes
Cross-profile drift is local and always offline. The optional upstream check is separate, explicit, registry-aware, credential-redacted, and cached for six hours. link: and file: installs never masquerade as current registry versions.
🕰️ Change Timeline
Snapshots track additions, removals, version transitions, profile moves, capability changes, and claim changes. Even two artifacts exchanging profiles are reported as concrete per-profile transitions.
How it works
…
