Introduction¶

The DSH ecosystem emphasizes “everything is a plugin.” When developing plugins, two common pain points arise: one is developing local DSH configuration, which can easily dirty the real ~/.dsh; the other is uncertainty about the reliability of third-party plugins. Simply installing and uninstalling plugins directly in the current DSH configuration can lead to state pollution and residue issues.

Below, we introduce @swell05/dsh-whale-tank. It is a DSH plugin development sandbox helper tool: it isolates DSH_HOME, creates a development-mode DSH configuration sandbox and plugin development skeleton, includes development knowledge packages, plugin plug/unplug side-effect detection with sandbox restoration, and third-party plugin vet inspection.

What Is This¶

@swell05/dsh-whale-tank is maintained by swell05 and licensed under MIT. It does not modify the real ~/.dsh; instead, it creates a development sandbox within an isolated DSH_HOME for plugin initialization, building, plug/unplug testing, restoration, and third-party plugin pre-checking.

It is suitable for DSH plugin development in dsh web mode, or for inspecting third-party plugins distributed as npm packages.

Core Features¶

Plugin Development Sandbox¶

init creates an isolated DSH_HOME, an official baseline profile, and state.json, without modifying the real ~/.dsh.

Skeletons are generated by type (host, client, both), are buildable, and include a development toolkit.

Development Knowledge Packages¶

Optionally loads development knowledge packages such as AGENTS.md, NOTES.md, and docs/dev-guidance. These are merged incrementally according to the merge-spec, without overwriting existing user content.

.wttools Workspace Tools¶

.wttools is a zero-dependency, single-file tool that remains usable even after plugin uninstallation. Common commands include:

Third-Party Plugin vet Inspection¶

vet is used to inspect third-party plugins in three stages:

1. Static hazard inspection
2. Restricted dynamic verification
3. LLM source code review

Inspection results generate vet-report.md and vet-result.json, stored in .vetting/. The conclusion is one of three: no vulnerabilities found, caution advised, or not recommended.

Installation and Activation¶

First, confirm the environment meets the requirements:

• node >=20
• peerDependencies: @deepseek-ai/cordis ^4.0.1

Install into the web profile:

dsh plugin --profile web add @swell05/dsh-whale-tank

After installation, restart web (the bundle layer stack is composed at boot).

To uninstall:

dsh plugin --profile web remove @swell05/dsh-whale-tank

Typical Usage¶

Initializing a Plugin Project¶

In a blank workspace conversation in dsh web, enter:

/whale-tank-init

After describing the plugin’s main functionality, it will create the sandbox and skeleton, and optionally load development knowledge packages.

Inspecting a Third-Party Plugin¶

Enter:

/whale-tank-vet

Provide the npm package name you wish to inspect, and the three-stage inspection will run automatically. After completion, review vet-report.md and vet-result.json in .vetting/.

Using .wttools¶

Common command examples:

.wttools\status
.wttools\deps --add @deepseek-ai/dsh-tools
.wttools\run-test --profile headless

If npm run build reports tsc not found after skeleton generation, first run:

npm install

Or:

.wttools\deps

Then run:

npm run build

Applicable Scenarios and Notes¶

Suitable for developing DSH plugins in dsh web mode, or for pre-checking third-party npm plugins.

Notes:

• vet is a heuristic pre-check, not a security guarantee.
• Isolation relies on a separate DSH_HOME and restricted execution to prevent state pollution, not to prevent local execution.
• Network behavior is only logged, not blocked.
• vet is only available via /whale-tank-vet in web; the CLI is not provided at this time.
• The plugin channel enforces version consistency and will directly reject mismatches with the sandbox runtime version.
• Skills and Tools have only been tested in dsh web mode.
• DSH plugins run with the current dsh process permissions. Source code and licenses should be inspected before installation.

References¶

GitHub: https://github.com/swell05/dsh-whale-tank