
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
dsh-plugin-devkit
Advanced tools
开发者工具包:一键生成合规 dsh 插件脚手架(默认 TypeScript,可选 JavaScript)、按三条硬规则校验 schema、生成社区注册表发布条目。
🇬🇧 English | 🇨🇳 简体中文
Developer toolkit for building DeepSeek Harness (dsh) plugins. Generates compliant scaffolds, lints your tool schema against the 3 hard rules, and prepares a registry entry for publishing.
# Option 1 (recommended): from npm (package name is dsh-plugin-devkit)
dsh plugin --profile web add dsh-plugin-devkit
# Option 2: from GitHub
dsh plugin --profile web add github:d-ouyang/dsh-plugin-devkit
# local dev:
dsh plugin --profile web add ./dsh-plugin-devkit
Restart the web service (:3080) after installing.
scaffold_plugin — generate a compliant scaffoldSay in chat: "Generate a dsh plugin named my-tool, category tools, author d-ouyang"
→ Creates ~/dsh-plugin-my-tool/ with the entry files (TypeScript by default: index.ts + <name>-core.ts + tsconfig.json), package.json, cordis.patch.yml, README.md, test.ts, examples/.
→ Pass language: "js" for plain JavaScript (index.js + <name>-core.js + test.mjs).
→ TypeScript plugins are transpiled on the fly by dsh's tsx at runtime (zero build) and get type-checking for the cordis ctx and tool schema.
lint_plugin — catch the 3 hard schema rulesSay: "Check if ~/dsh-plugin-my-tool's schema is valid"
→ Compiles your tools with the real harness defineTool compiler and translates cryptic errors into "you broke rule N — fix it like this".
explain_rules — the 3 hard rules explainedSay: "What are the 3 hard rules for dsh tool schema?"
open_landscape — plugin market landscape dashboardSay: "Show me the dsh plugin market" / "Open the plugin landscape"
→ Generates and opens a visual dashboard: per-category plugin counts / avg stars / max stars, Top 25 by stars, and a competition-gap scan. Every direction has a "create this kind of plugin" button that copies a market-aware prompt — paste it into chat and the agent uses scaffold_plugin to build that direction for you.
file://~/.dsh/devkit/landscape.htmlhttp://localhost:3080/devkit/landscaperequired is either omitted or true — never false.type is a single string — no arrays (use type: 'json' for nullable).object (incl. nested items) must set additionalProperties: true|false.Full workflows: USAGE.md (EN) · USAGE.md (中文)
FAQs
开发者工具包:一键生成合规 dsh 插件脚手架(默认 TypeScript,可选 JavaScript)、按三条硬规则校验 schema、生成社区注册表发布条目。
We found that dsh-plugin-devkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.