Upstream Radar: always-on compatibility evidence for 100 DSH plugins

[MicroMilo]

Hi DSH plugin authors and maintainers 👋

DSH is moving quickly. A plugin repository can look green while the exact package users install still targets an older DSH contract, needs an undocumented dependency build, or depends on a Web/client runtime that a headless check cannot provide.

We built Upstream Radar to keep that relationship observable over time.

What it does

• Watches exact DSH and plugin releases instead of treating one historical scan as permanent.
• Builds the relationship between the published plugin artifact, DSH host, Node/profile, and dependency graph.
• Installs, registers, and loads exact packages in disposable, secret-free GitHub runners when execution evidence is needed.
• Lets a configured DSH Agent interpret bounded repository instructions and approve only dependency builds that the isolated runner actually observed.
• Opens or updates an author-facing issue only after a reproducible, attributable failure. A missing execution plane or incomplete evidence stays needs review, not plugin broken.

The model plans a constrained retry; the disposable runner establishes the result.

Current public result

The maintained cohort follows 100 entries from the DSH plugin ecosystem. Against the exact @deepseek-ai/dsh@0.1.1-rc.2 + Node 22 headless profile, the current feed records:

• 74 exact headless passes
• 22 review-only results
• 0 reproduced incompatibilities
• 4 repository-only entries not yet observed by the npm runner

Live evidence: 100-plugin compatibility feed

In the latest closure run, the Agent reviewed all 25 current headless cases and selected four exact build-policy retries. dsh-im-connect and dsh-tui became compatible. dsh-remote and dsh-web-ui-all installed and loaded, then exposed a deeper Web-client peer boundary instead of being mislabeled as install failures.

Run evidence: Agent planning and isolated retries

This is deliberately not a universal compatibility badge or security certificate. Every result is bound to the displayed package bytes, DSH version, runtime, profile, and observation time.

Try it

Review one exact published artifact without executing plugin code:

npx --yes upstream-radar@0.43.5 inspect @sanqi-normal/dsh-webui-market-plugin@0.5.4 --deep --fail-on never

Or review a public plugin repository:

npx --yes upstream-radar@0.43.5 scan https://github.com/owner/dsh-plugin --fail-on never

The latest release is available on npm with GitHub OIDC provenance. The project is also listed in awesome-dsh-plugin.

We would like feedback from plugin authors

If your plugin appears in the feed and the status or installation contract is wrong, please reply with the exact npm coordinate or documented repository install command. We will rerun it, preserve the correction in the evidence, and avoid turning environment limitations into blame.

We are especially looking for help defining the correct DSH Web/client execution plane and reliable observation of repository-installed plugins.

If this is useful for keeping the DSH ecosystem healthy, a ⭐ or a test case would help a lot.