Plugins

Audit CVE/chaîne d'approvisionnement en direct des dépendances du projet de votre espace de travail (npm/pip/go), soutenu par OSV.dev, avec un outil cve_audit et une re-analyse automatique optionnelle lors des changements de lockfile.

Hermetic composition lock: fingerprints the profile's dependencies, bundle order, lockfile and patch layer; booting a drifted composition warns, or fails under strict mode (the --frozen posture for CI).

Engineering work-tools for DeepSeek Harness: registers two model-facing Host Tools — a scoped `git` runner, and a package-manager runner (`dev`) that detects npm/pnpm/yarn/bun from the workspace lockfile and picks the right verb per manager. Both run through dsh's sandboxed shell and return structured stdout/stderr/exitCode, so the agent gets focused, reviewable results instead of raw bash, and adding another tool is a copy-paste of one register block.

DSH plugin: sync model settings, plugin manifests, patch layers and lockfiles across devices through a private Git repository (manual push/pull; https+token or ssh public-key auth).

Scan project lockfiles (npm/pnpm/yarn/pip/go/cargo/maven/gradle/...) against the free OSV API and report confirmed dependency vulnerabilities with fix versions and remediation commands.

DeepSeek Harness plugin for Readproof: stable readproof:// identity, freshness policy, snapshots, per-run manifests, diff, byte-exact replay, and evidence bundles as model-callable tools.