dsh-plugin-dev

A development guide for plugins for DeepSeek Harness, a TypeScript agent framework built on Cordis. It explains how plugins register tools and services, declare dependencies, and clean up when unloaded.

In plain words
What is it for?
Use it to create, modify, debug, or package dsh plugins, including tools, services, language-model adapters, event listeners, and cordis.yml configuration patches.
Why use it?
It reduces mistakes when a plugin has dependencies, child plugins, configuration, or resources such as timers and connections. It also explains the plugin lifecycle and failure states.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/truehooha/dsh-plugin-dev-skill/dsh-plugin-dev
Any agent
npx skills add TrueHOOHA/dsh-plugin-dev-skill --skill dsh-plugin-dev
Clone the repo
git clone --depth 1 https://github.com/TrueHOOHA/dsh-plugin-dev-skill

Made for: Claude Code, Codex.

Per session 133 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,554 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00133 $0.01554
Opus 5 $0.00067 $0.00777
Sonnet 5 $0.00027 $0.00311
Haiku 4.5 $0.00013 $0.00155

Measured yesterday against content hash 4b891f9f89e0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dsh-plugin-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

dsh-plugin-dev/SKILL.md · 178 lines

How it starts

The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dsh Plugin Development

Develop plugins for DeepSeek Harness (dsh), a Cordis-based agent framework. Plugins are TypeScript modules exporting apply(ctx: Context), composed via cordis.yml.

Quick Reference

Plugin Structure

import type { Context } from '@deepseek-ai/cordis'
export const name = 'my-plugin'
export function apply(ctx: Context) { /* register capabilities */ }

Three forms: function (default), object ({ name, inject, apply }), class (extends Service — use only when providing a service to other plugins).

Dependencies: export const inject = ['tools', 'llm'] — framework keeps plugin PENDING until all injected services are ready.

Auto-cleanup: Everything registered through ctx is an effect — unload automatically cleans up. For custom resources (timers, connections), wrap in ctx.effect(() => { ... return () => cleanup }).

Child plugins: const fiber = ctx.plugin(childPlugin) — children inherit parent context; await fiber.dispose() unloads recursively.

Fiber States

PENDING → LOADING → ACTIVE → UNLOADING → DISPOSED
                 ↘ FAILED

PENDING → missing service dependency. FAILEDapply threw or config validation failed. Service disappearing at runtime auto-disposes dependents.

Tools

import { defineTool } from '@deepseek-ai/dsh-tools'
export const inject = ['tools']
export function apply(ctx: Context) {
  ctx.tools.register(defineTool({
    name: 'greet', description: '...',
    parameters: { name: { type: 'string', required: true } },
    output: { schema: { type: 'string' }, render: (_args, value) => [{ type: 'text', text: value }] },
    async execute(args) { return `Hello, ${args.name}!` },
  }))
}

defineTool converts parameters to JSON Schema, validates args, and auto-unregisters on unload. See references/basic/tool.md for details.

Configuration

import Schema from '@deepseek-ai/schemastery'
export interface Config { greeting: string; maxRetries: number }
export const Config: Schema<Config> = Schema.object({
  greeting: Schema.string().default('Hello'),
  maxRetries: Schema.number().default(3),
})
export function apply(ctx: Context, config: Config) { /* validated config */ }

Read the full file on GitHub · 178 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 178 lines · 133 tokens per session scan A 4b891f9f89e0

Subscribe to this mod's changes

dsh-plugin-dev is a skill published in the GitHub repository TrueHOOHA/dsh-plugin-dev-skill (2 stars, last pushed 18d ago), licensed Apache-2.0. It adds 133 tokens to every session and 1,554 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

clarify-intent-and-establish-shared-understanding

Grounded in first principles, rigorously examine and refine a user's plan, task, decision, goal, strategy, proposal, or idea through structured, progressively deeper questioning, in order to bridge the gap between the User and the Agent. Use when the user explicitly requests grilling, challenge, pressure-testing…

Inference1/clarify-intent-and-establish-shared-understanding · 286 tokens

dsh-delegate-runtime

Internal contract for calling the dsh bridge from commands and the dsh-delegate agent — subcommands, flags, environment, and failure handling. Read before composing any dsh-bridge.mjs invocation.

cpj-dev/dsh-plugin-cc · 47 tokens

odai

Skill "odai" from orziz/odai, covering 精神内核, 当前判断, 按表现分配支撑, 共同行动边界 and 完成.

orziz/odai · 57 tokens

ribao

日报、周报、工作总结、状态更新:基于可核证事实形成完整汇报。用户要求汇报一段时期的工作、沿用既有汇报模板、整理进展与风险,或 odai 判断专业汇报工艺会改善结果时使用。.

orziz/odai · 64 tokens

dsh-run-output

Internal guidance for presenting DeepSeek Harness bridge results (reviews, critiques, delegated runs) back to the user. Read before summarizing any dsh-bridge.mjs output.

cpj-dev/dsh-plugin-cc · 40 tokens

pptwise

Generate a native, editable PPTX deck from an outline, notes, or source material with the pptwise CLI. Use when the user asks to create a PPT, deck, presentation, or slides and wants a deterministic, editable, theme-consistent result.

liustack/pptwise · 54 tokens