Introduction¶

When enabling agents to participate in the full “requirements to deployment” lifecycle within DSH (DeepSeek Harness), common issues include: writing code first and patching UX and security later, RAG and subagents lacking exit criteria, and deployments ending with just a string of links without verifiable evidence. dsh-fullstack-engineer (repository yinbo-liao/DSH-full-stack-engineer-plugin) is not a code generator, but a set of planning and review tools: using fixed engineering order and gates, it breaks down “deliverable” into checkable artifacts. See the SkillHub plugin page here; categorized as a workflow, consistent with DSH’s “everything is a plugin” ecosystem. The directory site is independent of DeepSeek / Hui Fang, not an official app store.

What is this¶

Maintainer yinbo-liao. Package name dsh-fullstack-engineer, current version 0.1.0 (MIT). The plugin provides agents with a full-stack engineering operating contract: scoped requirements, UX patterns, security and reliability, step-by-step RAG based on LangChain / LangGraph, and engineering conventions for harness / loops for subagents. The README explicitly states: it is a planning and review instrument, it does not generate the application for you, but enforces order and evidence to make the application publishable. The plugin itself has no network, file system, or process access; actual validation is handled by the host or CI.

Core Tools and Outputs¶

The following six tools have corresponding output descriptions in the README; there is also a system prompt snippet fullstack-engineer:playbook explaining the non-negotiable engineering order.

Plugin-enforced Engineering Order¶

The README fixes the process into six steps, consistent with the gate chain scope -> ux -> build -> reliability -> rag -> harness -> release -> outcome (Note: GATE_G is only for extensions; KPI/fence failures do not block release or rollback).

1. Frame: User, jobs, non-goals, constraints, acceptance, single success KPI.
2. UX: Flows and states (default, loading, empty, partial, error, offline, permission-denied, success), accessibility, and copy.
3. Contract: API, data models, authorization, migrations, rollback.
4. Threat model: Object authorization, multi-tenancy, injection, SSRF, keys, CSRF/sessions, audit; AI side includes prompt injection, RAG ACL leakage, tool abuse.
5. Evaluate: Corpus attribution/ACL, golden set, thresholds; define rollback before RAG or subagent.
6. Release evidence: Records must include producer, commit, scope, and freshness; cannot be just a URI.

RAG Blueprint Highlights¶

fullstack_rag_blueprint adopts a step-by-step design, with exit criteria for each stage. LangChain is used as a component toolkit (e.g., DocumentLoader, TextSplitter, VectorStore, Retriever, RunnableParallel, reranker); LangGraph is used for orchestration when bounded multi-step states are needed. Design highlights include: mixed retrieval (BM25 + vector), ACL filtering before scoring, rerank to top 5 after top 20 recall; 500–800 token chunks, 15% overlap, parent document expansion; cite or refuse, don’t give ungrounded answers; 50+ question golden set (including refusals and injections); thresholds example recall@5 ≥ 0.85, faithfulness ≥ 0.90, citation precision ≥ 0.90, refusal correctness ≥ 0.95; token/cost/latency budgets and weekly feedback loops.

Subagent Harness¶

fullstack_subagent_plan produces supervisor + typed workers (product, UX, backend, frontend, security, verifier), routing only one at a time, context budget discipline, iteration/tool call limits, no-progress rules, stop conditions, approval gates, append-only audit expectations, and red team scenarios like “self-audit evidence” and “skip verifier”.

Integration with dsh-secure-mesh¶

If dsh-secure-mesh is installed, prompts guide agents to use secure_fetch for external HTTP (disallowing naked exposure), request_human_approval before irreversible/high-impact operations (only approved: true authorization), validate_claim for SQL/Python/financial claims, and apply untrusted data fencing rules for retrieval and external text.

Installation and Activation¶

The package declares dsh.bundle.patch, which can be installed via any DSH bundle method. The original steps in the README are as follows.

1. Publish/install package dsh-fullstack-engineer@0.1.0, or use Git checkout.
2. Add bundle in Plugins page, or write the fullstack-engineer entry from cordis.patch.yml to profile.
3. Restart or reload profile.

Dependency requirements (package.json): engines.dsh is >=0.2.0 <0.3.0; peer dependencies include @deepseek-ai/cordis, @deepseek-ai/dsh-system-prompt, @deepseek-ai/dsh-tools within corresponding version ranges.

For local development, you can build and stub test first:

npm install
npm run build
npm run test:stub

For sandboxes that forbid Node subprocess testing, you can use in-process test commands from the README (e.g., node --test --test-isolation=none). For real profile debugging, add the plugin with a local path and run integration.real.test.mjs (path varies by environment, refer to your local checkout).

Configuration¶

Typical Usage (Workflow Level)¶

The materials do not provide a single CLI dialogue example, but the tool design implies calling in gate order: use fullstack_plan first to define scope and acceptance criteria, then fullstack_ux_review / fullstack_security_review to align interface and security design; if RAG is needed, run fullstack_rag_blueprint before implementation to align the ten steps and thresholds; use fullstack_subagent_plan for multi-agent schemes; after all stages produce complete artifacts, use fullstack_gate to determine pass/hold. The Playbook segment (when prompt: true) writes the above order into the system prompt, reducing agent skipping steps.

Suitable Scenarios and Limitations¶

Suitable for: Teams or individuals needing full-stack/feature delivery planning and review in DSH, drafting RAG or subagent schemes, and using unified gates to converge evidence.

Notes (all from README):

• Planning is deterministic and opinionated, cannot replace product discovery.
• Threat model is at the design layer, listing tests that should be run, not claiming they are executed.
• No deployment, migration, provider tuning, or code writing.
• Veracity of evidence is verified by host/CI; gate only states what must exist.
• Please review the repository source code and MIT license yourself before installing; the plugin runs under DSH process permissions, and the overall attack surface needs evaluation when combined with other plugins.

Conclusion¶

dsh-fullstack-engineer changes full-stack delivery from “finishing by feel” to “producing in order and passing gates with evidence” — planning, UX, contract, threat model, evaluation, and release records are interlocked, and it separately covers the RAG ten steps and subagent harness. If you are implementing complex features in Harness rather than a one-off script, you can treat this bundle as a workflow baseline.

• Directory page: https://www.skillhub.cn/plugins/yinbo-liao/DSH-full-stack-engineer-plugin
• GitHub: https://github.com/yinbo-liao/DSH-full-stack-engineer-plugin