
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
dsh-plannotator
Advanced tools
Opens the official Plannotator app to review the agent's plan — annotate, approve, or send it back.
Standalone DeepSeek Harness plugin. When the agent is ready with a plan, it opens the official Plannotator app — the real product, not a lookalike review screen in the chat.
This package is not a fork or patch of the Plannotator monorepo. It uses the Plannotator app you already have installed.
Layout follows dsh-plugin-starter: host plugin, pure lib/ helpers, runtime skill, node:test, CI, and a bundle manifest — zero dependencies, no build step.
index.js host plugin (plan intercept + commands + skill)
lib/ deterministic helpers (unit-test friendly)
skills/plannotator/SKILL.md model-facing skill manual
tests/ node:test suite
cordis.patch.yml bundle patch layer
When the agent presents a plan, Plannotator opens instead of the built-in review card.
You can also open Plannotator yourself:
| Command | What it does |
|---|---|
/plannotator-review | Review the current changes, or a pull request if you paste a URL |
/plannotator-annotate | Annotate a file, folder, or URL |
/plannotator-last | Annotate the latest assistant reply |
/plan.| Reviewer action | What dsh does |
|---|---|
| Approve | Leave plan mode and continue. |
| Approve with notes | Leave plan mode, then inject the notes as a follow-up user message. |
| Deny / annotate | Stay in plan mode. The agent revises with your feedback. |
| Dismiss (close the UI) | Stay in plan mode and wait for your next message. |
0.1.0-rc.6 or a compatible developer previewplannotator CLI that already ships plannotator opencode-plan (current releases do)Install the CLI if it is missing:
# macOS / Linux / WSL
curl -fsSL https://plannotator.ai/install.sh | bash
# Windows PowerShell
irm https://plannotator.ai/install.ps1 | iex
Then confirm it is on PATH (or at ~/.local/bin/plannotator):
plannotator --help
dsh plugin --profile web add dsh-plannotator
dsh web
Check that the layer is composed:
dsh --profile web --dump-config # look for "# == dsh-plannotator"
Use /plan, let the agent propose a plan, and review it in Plannotator.
The same flows are also available as official terminal subcommands (plannotator review, plannotator annotate, plannotator last). The slash commands above wrap those CLIs inside dsh.
git clone https://github.com/eightHundreds/dsh-plannotator.git
cd dsh-plannotator
dsh plugin --profile web add .
dsh web
No install or build step. A local dsh plugin add . stays linked to this checkout.
Dev-load with a --patch overlay (plugin path must be absolute):
# dev.cordis.yml
- insert:
- id: dsh-plannotator
name: /absolute/path/to/dsh-plannotator/index.js
dsh --profile web --patch ./dev.cordis.yml
dsh plugin --profile web remove dsh-plannotator
A broken bundle patch can keep the whole web profile from booting. If dsh web no longer starts after install, remove the plugin and run --dump-config again.
When the agent leaves plan mode, this plugin opens the official Plannotator app and waits. Approve, deny, or dismiss is then applied back in dsh. Anything else is left to the official tools.
Defaults work with a normal Plannotator install. Override only if the binary is not where the plugin looks.
| Variable | Purpose |
|---|---|
PLANNOTATOR_BIN | Absolute path to the plannotator executable. |
PLANNOTATOR_DSH_USE_SOURCE=1 | Run the Plannotator hook server from a local checkout via bun. |
PLANNOTATOR_DSH_SOURCE_ROOT | Directory to walk upward from when searching for that checkout. |
PLANNOTATOR_DSH_SOURCE_ENTRY | Exact path to apps/hook/server/index.ts. |
PLANNOTATOR_BUN / BUN | bun executable used in source mode. |
Without PLANNOTATOR_BIN, the plugin uses ~/.local/bin/plannotator when that file exists, otherwise plannotator on PATH. On Windows it also checks %LOCALAPPDATA%\plannotator\plannotator.exe.
The child process always gets PLANNOTATOR_ORIGIN=dsh and PLANNOTATOR_CWD=<session cwd>. The stock opencode-plan command still hard-codes an OpenCode origin in the UI badge; that is a Plannotator-side limit.
| Symptom | What to check |
|---|---|
| Native dsh review card still appears | Plugin layer missing in --dump-config, plan mode not active, or the plan does not start with # …. |
Could not find \plannotator`` | Install the CLI, or set PLANNOTATOR_BIN. |
dsh web never boots after install | Remove the plugin. Do not add a hard inject: ['planMode'] to the host patch. |
exit_plan_mode is only available in plan mode | Older builds returned a bare { approved: true } and failed the official schema. Upgrade this plugin. |
| Badge says OpenCode | Expected. The stock CLI labels opencode-plan that way. |
dsh origin, installer)UserQuestionProvider or wrap Claude hooks.jsonnode --test
FAQs
Opens the official Plannotator app to review the agent's plan — annotate, approve, or send it back.
The npm package dsh-plannotator receives a total of 82 weekly downloads. As such, dsh-plannotator popularity was classified as not popular.
We found that dsh-plannotator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.