Upstream Radar

Always-on compatibility testing for DeepSeek Harness plugins—across headless, Web, and TUI.

简体中文 ·

Upstream Radar binds exact plugin bytes to an exact DSH host and runtime, lets an
Agent derive a bounded environment from repository instructions and prior
evidence, then proves the relationship in disposable GitHub VMs. It runs again
when the ecosystem changes or evidence expires, so it tests the current
version—not only the diff.

It is built for the DeepSeek Harness (DSH)
plugin ecosystem. A static review is evidence about a package; an isolated
runtime review is evidence about one exact plugin × DSH × Node/profile pair.
Neither is presented as a timeless compatibility badge or a security certificate.

Listed by the DSH ecosystem in
awesome-dsh-plugin,
awesome-deepseek-harness, and
awesome-deepseek-harness-plugins.

The problem

A source repository can be green while the package users install is not ready
for the current DSH host:

• the README advertises a version that was never published;
• a plugin imports a newer DSH package than its peer range allows;
• package.json and the lockfile describe different releases;
• an install-time build or dependency script needs tools the user does not have;
• a DSH host dependency is missing, so the dependency graph cannot be completed.

These are ecosystem relationship problems. They are easy to miss when the two
repositories are checked separately.

What Radar does

1. Build one exact compatibility record (IR). Align the npm artifact,
   source commit, DSH host, runtime/profile, dependency paths, and advisories.
2. Derive the environment. An Agent reads declared installation guidance
   and failed evidence, then emits only a bounded install plan.
3. Prove each execution plane. Fresh, secret-free runners exercise headless
   load, Chromium Web boot, or a real PTY TUI interaction.
4. Keep the result alive. DSH/plugin/dependency changes and evidence expiry
   trigger retests; confirmed failures become fixable reports and clean retests
   close the loop.

flowchart TB
  Trigger["Schedule / upstream change / evidence expiry"] --> IR["Exact IR: plugin bytes ↔ DSH ↔ runtime ↔ dependencies"]
  IR --> Agent["Agent derives a bounded install plan"]
  Agent --> VM{"Fresh secret-free GitHub VM"}
  VM --> Headless["Headless: install → register → load"]
  VM --> Web["Web: Chromium → boot handoff → client bundle"]
  VM --> TUI["TUI: PTY → frame → input → declared shutdown"]
  Headless --> Ledger["Versioned evidence ledger + reverse impact index"]
  Web --> Ledger
  TUI --> Ledger
  Ledger --> Decision{"Plugin-attributable failure?"}
  Decision -->|"yes"| Issue["Produce one fixable maintainer report"]
  Decision -->|"no / detector gap"| Hold["Hold the report and calibrate"]
  Issue -->|"author ships a fix"| Trigger
  Hold --> Trigger

The Agent may choose declared build packages, profile setup, and the next bounded
retry. Exact fingerprints decide which cell a report can satisfy, and the
disposable runner—not the model—establishes the result. Missing evidence can
never become a pass.

Try a real check

No local DSH profile is needed for this first check. It reviews one exact
published artifact without executing plugin code:

npx --yes [email protected] inspect \
  @sanqi-normal/[email protected] \
  --deep --fail-on never

This historical DSH plugin release returns review / incomplete because its
published host dependency chain reaches an unavailable package. That is a
useful, reproducible release/host-contract report—not a claim of malicious
behavior. See the full evidence report.

To review your own public repository without installing it:

npx --yes [email protected] scan \
  https://github.com/owner/dsh-plugin \
  --fail-on never

The repository scan reads source manifests, DSH metadata, and lockfiles. It does
not install dependencies, run lifecycle scripts, load the plugin, start DSH, or
call an LLM.

Run it on every change

Copy one of the maintained workflows into your repository:

• Review one exact plugin across DSH versions
  — a manual check with artifact evidence and an isolated load matrix.
• Observe one plugin repository every day
  — compares commits, published versions, manifests, and dependency graphs, then
  wakes an Agent only when there is a meaningful change.
• Run the dependency gate in CI
  — checks the lockfile or reviewed Radar configuration before merge.

The isolated headless and
Web/TUI observers use fresh
GitHub-hosted runners. They are not your workstation and receive no project or
model secrets.

Evidence from the ecosystem

The current 100-plugin compatibility feed
records 87 observed compatible, 9 needs review, 0 reproduced incompatible,
and 4 not observed. Its execution-plane ledger contains 22 exact Web/TUI
cells; all 22 now pass in isolated GitHub VMs.

The nine review cells are not hidden failures. Seven have a green Web proof but
retain separate headless host/peer-contract evidence; two retain known old DSH
host-package ranges tracked by existing maintainer issues. Radar keeps those
facts visible without calling a working browser plugin broken.

The first non-headless cells now run in GitHub-hosted VMs:

The better-sidebar run demonstrates the closed loop: dynamic evidence found a
build requirement absent from the headless plan; DeepSeek checked the exact
manifest, README, and VM log; a fingerprint-bound policy approved only
node-pty; then a separate runner with no model secrets established the pass.
This was Radar's environment gap, so no plugin issue was filed. Earlier TUI and
Web detector mistakes were handled the same way: held, corrected, and rerun
instead of being sent to authors.

As of 2026-08-25, Radar has filed 13 maintainer-facing reports. The outcome is
more useful than the raw count:

“Closed” is not automatically “fixed.” The full domain report index
records the evidence, validation level, PR coverage, and remaining boundary for
every report.

If Upstream Radar helps the DSH ecosystem stay compatible, please give it a Star ⭐