dsh-plugin-security v0.5.0

Added

• Call gate. Every tool call is attributed to the plugin that registered it and checked in the host tools/pre-execute waterfall. A call into a high-risk plugin, or one whose security check could not be completed, asks Allow once / Allow / Disable through the host user-questions card, falling back to the native approval prompt when no card can be shown. Allow once admits exactly the call that asked; Allow is remembered for the installed version; Disable disables the plugin.
• Plugin-manager sync. Disable, enable, uninstall and enforce-mode auto-disable call the host plugin manager (setBundleEnabled / removeBundle), the same operations as the native Plugins page. A plugin disabled on either page is denied while it is still loaded; gate blocks stored by earlier versions move to the plugin manager at startup.
• Settings page: per-plugin Enable / Disable / Reset, a Disabled tab, native disabled state, refresh on focus.
• The three-level risk (high / at risk / none) and the declared tool names are stored with every scan record and shown in reports and agent tools.
• Scan triggers: plugin-manager changes, profile recompositions (CLI installs under hot reload) and on demand at call time, in addition to startup.
• The bundled review skill registers itself with the host skill catalog; the manual skill link is no longer needed.
• npm run test:e2e: a real headless dsh in an isolated DSH_HOME with a harmless high-risk fixture plugin, a scripted question answerer and a deterministic local model.
• Repository: security policy, issue and pull-request templates, Dependabot, CODEOWNERS, an e2e CI job and a manual npm publish workflow with provenance.

Changed

• A plugin no scan can record is asked about instead of passing; dependency audits that ended unknown are retried by the next scan and at call time (at most once per plugin every five minutes).
• A forced rescan keeps the agent review of unchanged content; superseded records of the same package are dropped.
• Tools registered before the gate started are attributed by their execute source text, so the first call into a newly installed plugin is gated (found by the e2e run).
• Host-rendered text (the question card, denial messages) follows the dsh UI language set in Settings → General, read per question; DSH_LOCALE overrides it and the process locale is the fallback.
• Screening revision risk-status-4: existing records are rescanned once after upgrading.

Fixed

• security_review threw ACTION_ICON is not defined after it had already stored the verdict.

---

npm: dsh-plugin-security@0.5.0 · integrity sha512-FqMfHzGsG+lNEM+7B39wQir+GaU8qoKSlzOYKgxLiojl/XeVrTpZJN7J1JKiPGCAg7TWtrk/o/0X7Q6kwUUjWA==

Install or upgrade: dsh plugin --profile web add dsh-plugin-security@0.5.0, then restart dsh.

dsh-plugin-security v0.4.6

Plugin security review for DeepSeek Harness, with dependency advisories, contextual evidence, AI-assisted review, and reversible enforcement.

Changes / 更新

• Fix settings RPC HTTP 404 and route lifecycle registration. / 修复设置页 RPC 404 及路由生命周期。
• Reduce false positives: capability matches are distinct from behavior evidence; remove A–F grading. / 分离能力记录与行为证据，降低误报，移除 A–F 评级。
• Restore disposition configuration and add searchable risk/whitelist tabs, per-plugin actions, exports, and compact statistics. / 恢复处置配置，完善搜索、风险与白名单 tab、逐项操作、导出及统计。
• Publish English and Chinese documentation, standard dsh bundle/client metadata, and shared protocol peer declarations. / 完善中英文文档与标准 dsh 包配置。

Install / 安装

dsh plugin --profile web add dsh-plugin-security@0.4.6

Restart the host after upgrading. Requires the @deepseek-ai/dsh-typert-protocol@0.2.0-rc.2 host protocol. / 升级后重启宿主，协议依赖为 @deepseek-ai/dsh-typert-protocol@0.2.0-rc.2。

Scanning happens after plugins load. API matches are not malware verdicts, and automatic quarantine requires an unprotected target, enforcement mode, an enabled threshold, and a high-confidence malicious review. / 检查发生在插件加载后。API 匹配不等于恶意；自动隔离须满足非保护目标、强制处置模式、开启阈值及高置信度恶意审读结论。

Validation / 验证

91 tests passed locally and in GitHub Actions on Node.js 22 and 24. Verified isolated tarball imports, dsh profile installation, and the bundle configuration layer. / 本地及 Node.js 22、24 CI 均通过 91 项测试，并验证隔离安装、模块导入与 dsh 配置层。

npm package · English README · 中文 README