プラグイン

ワークスペース自身のプロジェクト依存関係（npm/pip/go）に対するライブ CVE/サプライチェーン監査：OSV.dev をバックエンドに、cve_audit ツールとロックファイル変更時の任意自動再スキャンを提供。

Engineering work-tools for DeepSeek Harness: registers two model-facing Host Tools — a scoped `git` runner, and a package-manager runner (`dev`) that detects npm/pnpm/yarn/bun from the workspace lockfile and picks the right verb per manager. Both run through dsh's sandboxed shell and return structured stdout/stderr/exitCode, so the agent gets focused, reviewable results instead of raw bash, and adding another tool is a copy-paste of one register block.

DSH plugin: sync model settings, plugin manifests, patch layers and lockfiles across devices through a private Git repository (manual push/pull; https+token or ssh public-key auth).

Scan project lockfiles (npm/pnpm/yarn/pip/go/cargo/maven/gradle/...) against the free OSV API and report confirmed dependency vulnerabilities with fix versions and remediation commands.

DeepSeek Harness plugin for Readproof: stable readproof:// identity, freshness policy, snapshots, per-run manifests, diff, byte-exact replay, and evidence bundles as model-callable tools.