dsh-public-plugins

Public, reusable DeepSeek Harness (dsh) plugin bundles and skills. Everything here is generic tooling: workflow canvas JSON, blind A/B evaluation, LLM cost math, and an incident ledger. No vendor/company secrets, no internal app identifiers, no user/member identifiers, no credentials, no real prompts.

Bundles

Bundle	MCP server	Tools	Public skills
dsh-plugin-workflow-canvas	bundles/dsh-plugin-workflow-canvas/mcp/canvas_server.py	canvas_normalize, canvas_contract, canvas_mutate, canvas_validate, canvas_diff	workflow-canvas-lab
dsh-plugin-eval-harness	bundles/dsh-plugin-eval-harness/mcp/eval_harness_server.py	eval_payload_build, eval_package_export, eval_aggregate, eval_report	llm-badcase-blind-eval, effect-measure-before-after
dsh-plugin-llm-cost-lab	bundles/dsh-plugin-llm-cost-lab/mcp/cost_lab_server.py	cost_config_validate, cost_node, cost_matrix, cost_html_report	llm-node-cost-optimize
dsh-plugin-incident-ledger	bundles/dsh-plugin-incident-ledger/mcp/incident_ledger_server.py	issue_init, issue_upsert, issue_list, issue_get, issue_board_build, issue_check	production-incident-triage

Each bundle is an npm-style package whose package.json contains:

"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }

and whose cordis.patch.yml inserts one @deepseek-ai/dsh-mcp-client row (the Python stdio MCP server) and one @deepseek-ai/dsh-skill-filesystem row (the bundle skills/ directory).

Distribution note

This is a monorepo of four bundles. dsh installs bundles as npm-style packages with a dsh.bundle manifest, and npm/GitHub git installs address a repository, not a subdirectory — so today the supported install path is the local checkout shown above (dsh plugin --profile web add <absolute-bundle-path>). If/when these get published, the plan is one npm package per bundle (plain JS/Python, no build step), after which dsh plugin add <npm-name> will work. A dsh-plugin GitHub topic is set on this repo for discoverability.

Local-only installation

From this repository root, install each bundle into the desired dsh profile with (do not run this unless you intentionally want to install it):

dsh plugin --profile web add "$PWD/bundles/dsh-plugin-workflow-canvas"
dsh plugin --profile web add "$PWD/bundles/dsh-plugin-eval-harness"
dsh plugin --profile web add "$PWD/bundles/dsh-plugin-llm-cost-lab"
dsh plugin --profile web add "$PWD/bundles/dsh-plugin-incident-ledger"

The cordis.patch.yml files use !!js env-var overrides with absolute defaults that point back at this checkout, so the bundles work from the repo path directly.

No-secrets policy

• MCP servers are local-file tools only: no network calls, no credentials, no environment secrets are printed.
• eval_payload_build writes the blind-eval keymap to a file and returns only its path; the mapping is never echoed into chat.
• Do not commit internal hostnames, internal app identifiers, user/member identifiers, credentials, or real prompts.

Verification

# 1. Smoke: initialize + tools/list handshake for every MCP server (python3 stdlib only)
bash scripts/smoke_all.sh

# 2. Compile every Python file
find bundles scripts -name '*.py' -print0 | xargs -0 -n1 python3 -m py_compile

# 3. Ensure no !!js scalar uses backticks (the dsh YAML dialect rejects them)
if grep -Rn '!!js[^#]*`' bundles/*/cordis.patch.yml; then
  echo "ERROR: backtick scalar near !!js" >&2; exit 1
fi

# 4. Quick tool-level self-tests (optional, stdlib only)
python3 - <<'PY'
import json, subprocess, sys
servers = [
    "bundles/dsh-plugin-workflow-canvas/mcp/canvas_server.py",
    "bundles/dsh-plugin-eval-harness/mcp/eval_harness_server.py",
    "bundles/dsh-plugin-llm-cost-lab/mcp/cost_lab_server.py",
    "bundles/dsh-plugin-incident-ledger/mcp/incident_ledger_server.py",
]
for s in servers:
    p = subprocess.Popen([sys.executable, s], stdin=subprocess.PIPE, stdout=subprocess.PIPE, text=True)
    def send(m):
        p.stdin.write(json.dumps(m) + "\n"); p.stdin.flush(); return json.loads(p.stdout.readline())
    send({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26"}})
    out = send({"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}})
    tools = [t["name"] for t in out["result"]["tools"]]
    assert tools, s
    print(f"{s}: {len(tools)} tools")
    p.stdin.close(); p.wait(timeout=10)
PY

Layout

bundles/
  dsh-plugin-workflow-canvas/   # generic canvas toolkit + lab skill
  dsh-plugin-eval-harness/      # blind A/B eval + badcase/before-after skills
  dsh-plugin-llm-cost-lab/      # cost calculator + optimize skill
  dsh-plugin-incident-ledger/   # incident JSONL ledger + triage skill
scripts/
  smoke_all.sh                  # MCP handshake smoke test

Known limitations

• Canvas tools are structural only; they never execute node code and do not parse JavaScript semantics.
• eval_payload_build pairs variants for records with >2 variants (pairwise X/Y cases); exactly 2 is the most common and least noisy setup.
• cost_html_report expects meta.prices (or top-level prices) inside the report config.
• The !!js YAML tags are intentionally not parseable by plain PyYAML; verification uses grep instead of YAML parsing.