Foreword¶

Here is an introduction to the plugin flynow-harness/dsh-plugin-java-engineer. It is a Java Engineer plugin for DeepSeek Harness (referred to as DSH below), maintained by flynow-harness, hosted on the community directory SkillHub (Category: Client, Starred 0), open-sourced under the MIT license, and compatible with dsh@0.2.2-alpha.2 (Desktop / Web GUI).

DSH developers working on Java projects usually encounter two recurring types of requests: one is “Did I install the Java environment correctly on this machine?” or “Are there any pitfalls in the Boot version and dependencies in my pom?” The other is “Help me generate a runnable Spring Boot scaffold” or “Help me calculate the JVM parameters in the container.” If these tasks rely on the Agent to invent commands on the fly to check, the results are unstable and might result in unsafe commands. The approach of this plugin is to register a batch of deterministic tools as Host tools callable by the Agent, making conclusions reproducible and reviewable: except for scaffolding which is a write operation, the rest are all read-only or pure calculation, and it does not run builds for the user, nor does it fabricate build results.

The package name is @local/java-engineer (version 1.0.0), containing 6 Host tools with the java_ prefix, as well as a persistent “Java Engineer Toolbox” toolbar below the input box on the Web side.

Core Features¶

The plugin provides 6 deterministic Host tools, plus a Client-side toolbar. Here is an overview of the tools:

java_env_probe      Scan local JDK / Maven / Gradle, give installation & config suggestions      Read-only
java_project_audit  Offline audit of pom.xml / build.gradle, with file line number evidence      Read-only
java_scaffold_spring_boot  Generate Spring Boot 3 Maven project scaffold             Write to specified dir only
java_jvm_tune       Calculate JVM parameters based on memory budget + load profile       Pure calculation
java_review_file    Java source code review based on patterns, declaring unprovable parts   Read-only
java_snippet        Built-in library of 24 reusable Java engineering snippets             Read-only

1. java_env_probe: Scans JAVA_HOME, SDKMAN, asdf, jenv, Homebrew, common installation directories, PATH, project wrappers, and version lock files, and provides installation and configuration suggestions. It does not execute java -version / mvn -v; versions come from the JDK’s release file and inferred from installation paths. Maven/Gradle versions may show “Version Unknown” when not installed via SDKMAN.

2. java_project_audit: Uses lightweight regex for offline auditing of build files, covering Spring Boot and Java versions, dependency manifests, BOM coverage, known security baselines (log4j, snakeyaml, h2, commons-text, etc.), javax.* / JUnit 4 legacy references, source code anti-patterns, and reports include file line numbers. It does not parse the full Maven/Gradle model, nor does it check CVEs online; the security baseline table is just an offline baseline.

3. java_scaffold_spring_boot: Generates a compilable, runnable Spring Boot 3 Maven project scaffold, including pom, main class, health endpoint, service, application.yml, JUnit 5 tests, .gitignore, README, Dockerfile, supporting 10 starter combinations and dryRun preview. If the directory is non-empty (and overwrite is not passed), or artifactId/package name is invalid, it returns a clear reason instead of silently writing. Note that this repository does not include mvnw; the artifacts depend on Maven provided by the host machine or IDE.

4. java_jvm_tune: Calculates JVM parameters based on memory budget and load profile, outputting heap settings, collector selection (G1/ZGC/Parallel), container percentage mode, metaspace, OOM dump, GC logs, parameter trade-off explanations, and a ready-to-use JAVA_TOOL_OPTIONS one-liner.

5. java_review_file: Performs Java source code review based on patterns, covering string ==, BigDecimal(double), Optional.get, swallowing exceptions, printStackTrace, unbounded thread pools, SimpleDateFormat, resource leaks, SQL concatenation, field injection, private @Transactional, etc. It is a pattern-matching review and cannot prove concurrency, transaction, or domain semantic correctness; parts requiring manual or testing confirmation are explicitly listed in the report.

6. java_snippet: Built-in library of 24 reusable engineering snippets, covering virtual threads, record validation, sealed + pattern matching, Stream collectors, CompletableFuture, BigDecimal amounts, JPA N+1, JUnit 5, logging conventions, time API, JDBC batching, thread pools, etc.

After installation, a short system prompt is injected on the Host side to tell the Agent that these tools exist, when to use them, and “Do not claim the build passed unless it has actually been run.”

Input Box Toolbar¶

On the Client side, a persistent “Java Engineer Toolbox” stays below the input box when there is an active session. It does not calculate by itself but is responsible for handing the request to the Agent:

• Environment Check / Spring Boot Scaffold / pom Audit / Code Review / Snippet Lookup: Fill a pre-written request into the input box (if the current slot does not provide an input action, copy to clipboard and prompt to paste), and press Enter for the Agent to call the corresponding tool.
• JVM Tuning: Expand a small panel, select memory (GiB), load profile, JDK, and whether it is a container, preview the request to be sent in real-time, then “fill into input box”.
• The text follows Client locale (Chinese/English), colors only use --dsw-alias-* theme tokens, light/dark themes adapt automatically, and no Harness Client packages are imported.

This design ensures UI and Host are of the same origin: real computation always comes from Host tools, avoiding drift between UI and tool logic.

Installation and Enablement¶

Installation consists of two steps. First, clone the repository:

git clone https://github.com/flynow-harness/dsh-plugin-java-engineer.git

Then, in DeepSeek Harness, provide the absolute path of this repository directory to plugin_manager:

plugin_manager({ action: "install_bundle", target: "/absolute/path/dsh-plugin-java-engineer" })

The criteria for successful installation is that it returns application: "applied" and warnings is empty. After that, you can verify three points in sequence:

1. The Agent tool list shows 6 tools starting with java_;
2. Open an existing session, and the coffee cup toolbar appears below the input box (refresh the page if it does not appear);
3. In Settings → Plugins, you can see the Chinese/English title, description, and icon.

To uninstall, use another plugin_manager call:

plugin_manager({ action: "remove_bundle", target: "@local/java-engineer" })

This plugin is type: module, engines.node requires >=20, dsh.bundle.patch points to cordis.patch.yml, Client declares itself as Web platform and immediately: true. This information is all written in the repository’s package.json; before making changes, you can first look at cordis.patch.yml in the root directory to understand the injection point.

Typical Usage¶

The following examples are from the README and can be said directly to the Agent:

Use java_env_probe to see what is missing on my machine and give installation commands for macOS.
Use java_project_audit to audit the current project, focusing on Boot version, BOM coverage, and javax migration risks.
Use java_jvm_tune to help me calculate JVM parameters for a low-latency service in an 8-core / 8GiB container.
Use java_scaffold_spring_boot to generate a scaffold in ~/projects/order-api, first dryRun to show me the file list.
Use java_snippet to explain the correct usage of virtual threads in IO-intensive services and the pinning pitfalls.

The recommended daily sequence is: first run java_env_probe to confirm the environment, then use java_scaffold_spring_boot with dryRun to generate the scaffold, and then use java_project_audit to verify dependencies and security baselines. The README also explicitly states that the scaffold is “a starting point, not the answer,” and generating artifacts still requires auditing and verification of choice.

Testing and Development¶

The repository comes with tests and does not require installing any dependencies:

npm test          # 8 smoke test groups: tool definitions, health check, snippets, JVM params, templates, scaffolds, audit, review
npm run check     # node --check for all modules

Tests create temporary projects and clean them up upon completion, without connecting to the internet or modifying repository files. CI (.github/workflows/ci.yml) runs the same set of checks on every push / PR. The code style is zero-dependency ESM with Chinese comments; the Host side only uses node: built-in modules, and the Client side only uses React provided by the module registry. One goal is to avoid dependency resolution failures causing the entire plugin to fail to activate. When adding new tools, the README requires adding a corresponding smoke test and maintaining the principle of “read-only or explicitly declaring the write scope.”

Applicable Scenarios and Notes¶

Suitable for developers handling Java projects in DSH: when needing environment checks, scaffold initialization, build file audits, JVM parameter tuning, source code pattern reviews, or snippet lookup. It does not replace builds, tests, and CI, but only provides reproducible starting points and checklists.

Points to note:

1. The plugin runs with the permissions of the current DSH process. The scaffold will write files to the specified directory; when involving execution flow within the repository, check the source code and license (this project is MIT) before installing, and do not treat it as unverified third-party code.
2. Except for scaffolding, everything is read-only or pure calculation; java_project_audit does not check CVEs online, and security conclusions ultimately rely on official announcements.
3. The toolbar “fill into input box” depends on the slot providing inputActions; if unavailable, it falls back to copying to the clipboard.

Conclusion¶

The value of this plugin lies in solidifying those things in Java projects that are certain but prone to errors when calculated on the fly by an Agent into 6 reproducible Host tools: what the environment is, what problems exist in build files, how to generate scaffolds, how to calculate JVM parameters, what common anti-patterns are, and how to look up snippets. Combined with the input box toolbar, daily Java engineering tasks can reduce one guess.

Directory page: https://www.skillhub.cn/plugins/flynow-harness/dsh-plugin-java-engineer
Repository: https://github.com/flynow-harness/dsh-plugin-java-engineer