Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xun404/dsh-pihuo-plugins/dsh-plugin-clientnpx skills add xun404/dsh-pihuo-plugins --skill dsh-plugin-clientgit clone --depth 1 https://github.com/xun404/dsh-pihuo-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-client)<a href="https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-client"><img src="https://agentmods.dev/badge/skills/xun404/dsh-pihuo-plugins/dsh-plugin-client.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01275 |
| Opus 5 | $0.00037 | $0.00638 |
| Sonnet 5 | $0.00015 | $0.00255 |
| Haiku 4.5 | $0.00007 | $0.00128 |
Grade A, and why
dsh-plugin-client scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
浏览器半插件
Host 插件与浏览器插件共用 Loader 语义（Fiber、inject、update），只换模块如何到达。本技能拥有 dsh.client、slots、组件纪律。Host 侧实现仍走 dsh-plugin-author。
对照：../deepseek-harness/packages/client/AGENTS.md、packages/client/modules。
何时需要浏览器半
| 目标 | 要不要 Client 包 |
|---|---|
| 工具 / 适配器 / 钩子 | 不要。Host 即可 |
| 工具结果的卡片 | 通常只要 Host 上的 presentCall / presentResult；第一方 UI 会映射 card kind |
| 设置页里自己的表单 | 要。且树外插件默认不会出现在内置「插件配置」白名单里 |
| Chat 里一种新节点 | 要。ConversationNodeDefinition + conversation.chat.node |
| 独立面板 / 设置分区 | 要。往已有 slot 注册 |
先问：能否用 render-intent / 会话事件完成？能就不要开 Client 包。
声明
package.json：
{
"exports": {
".": { "default": "./lib/index.js" },
"./client": { "default": "./lib/client.js" }
},
"dsh": {
"client": { "platform": "web", "inject": ["slots"], "immediately": false }
}
}
- 必须同时是 Loader 树上的一条 Host 行，
client-modules才扫得到。--patch开发行的name必须是包根目录的绝对路径（或已安装的包名），不要指向src/index.ts，否则require.resolve(<name>/package.json)失败，该包永远不是 client 行。 exports["./client"]必须指向 CJS factory bundle（通常lib/client.js），不是tsc的 ESM 目录。缺文件时启动会聚合成run pnpm run build错误。immediately: true仅给外壳级包。功能插件默认懒加载。dsh.client.inject是信息性包名边（如@deepseek-ai/dsh-client-ui-tool），不是 Cordis 服务名。export const inject = ['slots']才是 apply 的服务依赖。
扫描按包名缓存且不过期：改「是不是 client 包」要重启 dsh。改 bundle 内容走 rebuild 通知，不是改 package.json 字段。
./client 产物合同
Host 把该文件当经典脚本挂到 /plugins/<id>/client.js。浏览器半是惰性 CJS：脚本执行时必须登记 factory，require 时才跑模块体。
window.__ModuleLoader__.load({
id: '<package name>', // 必须等于 Loader 行的 name / boot entries[].id
factory: (require) => {
var module = { exports: {} }; var exports = module.exports;
// CJS body; `require('react')` 走外壳 module table
return module.exports;
},
});
react/react/jsx-runtime/ 其它 platform module 必须 external，不要打进包。- 不要发 ESM
import。tsc 的lib/client/index.js只能当类型，不能当 served bundle。 - 本仓库：
packages/ui-acp-worker/scripts/build-client.mjs（esbuild）。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 91 lines · 75 tokens per session scan A d10e3934cd78
dsh-plugin-client is a skill published in the GitHub repository xun404/dsh-pihuo-plugins (2 stars, last pushed 19d ago), licensed MIT. It adds 75 tokens to every session and 1,275 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
codex-sync
Operate dsh-codex-sync from this session — preview and import Codex chats, toggle Skills/MCP/import settings, check MCP mirror health, install the reverse MCP bridge.
dsh-plugin-development
Use when designing, creating, modifying, packaging, installing, reviewing, auditing, or diagnosing a DeepSeek Harness plugin: a live dynamic Cordis plugin driven by cordisdefine, a source-backed workspace plugin under packages, or an out-of-tree installable bundle using dsh.bundle and cordis.patch.yml. Also use for…
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-web-pre-push-checks
Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.