Borrowing it
Nothing to install: this file belongs to xun404/dsh-pihuo-plugins. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/xun404/dsh-pihuo-plugins/main/.agents/skills/dsh-plugin-runtime/SKILL.mdgit clone --depth 1 https://github.com/xun404/dsh-pihuo-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-runtime)<a href="https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-runtime"><img src="https://agentmods.dev/badge/skills/xun404/dsh-pihuo-plugins/dsh-plugin-runtime/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-runtime"><img src="https://agentmods.dev/badge/skills/xun404/dsh-pihuo-plugins/dsh-plugin-runtime.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.00961 |
| Opus 5.5 | $0.00033 | $0.00384 |
| Sonnet 5.5 | $0.00016 | $0.00192 |
| Haiku 4.5 | $0.00008 | $0.00096 |
Grade A, and why
dsh-plugin-runtime scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Cordis 运行时
dsh 没有特权内核：产品每一部分都是插件。本技能只讲进程内运行时。配置树如何叠出来见 dsh-plugin-compose。
对照源码：../deepseek-harness/vendor/cordis、vendor/loader。
细节展开：references/cordis.md。
加载一条插件时发生什么
- Loader 按条目
nameimport 模块（unwrapExports处理 CJS/ESM/default）。 Registry.plugin把函数 /{ apply }/ 类 归一成 callback，按 callback 身份建 Runtime。- 为这次挂载建 Fiber。有
inject则先PENDING，服务齐了再跑 callback。 - 函数/对象走
apply(ctx, config)；类则new Ctor(ctx, config)，再跑[Service.init]。 - 通过
ctx的注册记在该 Fiber 的 effect 列表上。
YAML 行序不决定启动顺序。启动顺序 = 服务依赖图。
Fiber 状态
PENDING → LOADING → ACTIVE
↘ FAILED
ACTIVE → UNLOADING → DISPOSED
| 状态 | 含义 | 常见原因 |
|---|---|---|
| PENDING | 依赖未齐 | inject 写了尚未 provide 的 key；或写错了服务名 |
| LOADING | 正在执行 apply | 同步 apply 里做了重 I/O 会卡住观感 |
| ACTIVE | 在跑 | — |
| FAILED | apply / Config 抛错 | schema 校验失败、import 失败、apply throw |
| UNLOADING / DISPOSED | 已卸 | 父组 disable、依赖消失、HMR、fiber.dispose() |
依赖服务消失 → 本插件 DISPOSED；服务回来 → 重新加载。这是设计，不要用全局单例绕过。
排障顺序：dsh --profile <name> --dump-config 确认行在树里 → 查 Fiber 是 PENDING 还是 FAILED → PENDING 对 inject 与提供方 id；FAILED 看 loader 日志与 Config schema。
必须遵守的运行时规则
apply开始时，inject里的服务已就绪。不要在模块顶层读ctx。- 可选依赖：不写
inject，用ctx.get('name')。 - 提供服务：
Service子类super(ctx, 'key')，并declare module '@deepseek-ai/cordis' { interface Context { key: ... } }。Host 与 Client 不要复用同一个 Context key 表达不兼容的类型。 - 事件模式必须与声明一致。Waterfall 观察者必须
next()；策略监听器可以短路。不要对 waterfall 事件用emit。 ctx.plugin(child)的子 Fiber 随父卸载。- 多个异步 disposer 并发执行。顺序清理必须放进同一个
ctx.effect返回的函数里串行 await。 - Web 发行组合默认关掉共享 HMR（
dsh-web-app把hmr行disabled: true）。不要假设改源文件会热替换 Web 进程。
isolate
同一服务名可以有多个实例。条目上：
isolate:
shell: true # 本条目私有 realm
# shell: my-label # 同 label 共享一个 GlobalRealm
Agent preset 用 isolate 让不同会话看到不同能力集。树外插件不要随便 isolate 核心服务，除非就是要一份私有实例。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 71 lines · 82 tokens per session scan A f93ff8b72a2e
dsh-plugin-runtime is a skill published in the GitHub repository xun404/dsh-pihuo-plugins (2 stars, last pushed 2mo ago), licensed MIT. It adds 82 tokens to every session and 961 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
dsh-plugin-runtime compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| dsh-plugin-runtimexun404/dsh-pihuo-plugins | Skill | 2 | 2mo ago | MIT | A | 82 | Claude Code, Codex |
| dsh-plugin-guidePerryLink/dsh-plugin-guide | Skill | 65 | yesterday | Apache-2.0 | A | 62 | Claude Code, Codex |
| dsh-troubleshootpingfanfan/hello-dsh | Skill | 107 | 1mo ago | MIT | A | 61 | Claude Code, Codex |
| error-handlingpingfanfan/hello-dsh | Skill | 107 | 1mo ago | MIT | A | 51 | Claude Code, Codex |
| ask-good-questionspingfanfan/hello-dsh | Skill | 107 | 1mo ago | MIT | A | 61 | Claude Code, Codex |
| perf-optimizepingfanfan/hello-dsh | Skill | 107 | 1mo ago | MIT | A | 44 | Claude Code, Codex |
| debug-systematicallypingfanfan/hello-dsh | Skill | 107 | 1mo ago | MIT | A | 51 | Claude Code, Codex |