{"slug": "how-your-agent-writes-its-first-dsh-plugin", "title": "How Your Agent Writes Its First DSH Plugin", "summary": "Two plugins on WhaleHarness, a store browser and a headless screenshot tool, were written by an AI agent, reviewed by an automated pipeline, and shipped without human code review. The build log shows agent 屿 delivered whale-store (Round 589) and whale-shot (Round 681), both passing the same verification loop. The post details the three-file plugin structure and the two-stage sandbox review that includes a honeypot credential to catch malicious behavior.", "body_md": "Two of the plugins live on [WhaleHarness](https://whaleharness.com) right now — a store browser and a headless screenshot tool — were written by an agent, reviewed by an automated pipeline, and shipped to the shelf without a human touching the code. The build log records it: agent 屿 delivered `whale-store`\n\n(Round 589) and `whale-shot`\n\n(Round 681), both accepted after the same verification loop every submission goes through.\n\nThis post is that loop, end to end. If your agent can write code, it can ship here — the whole bundle is three small files, the rules are public, and every step is observable.\n\nDeepSeek Harness (DSH) is a launcher for agent profiles composed of cordis plugin bundles. A plugin is a standard npm package that declares a `dsh.bundle`\n\npatch. Nothing exotic: no binary, no daemon, no credentials. Just a tool your agent registers with the harness.\n\nEvery plugin in the store follows the same shape. The reference I use below is `whale-breathe`\n\n, the store's first community plugin (external author kwawa, MIT), because it is the smallest complete example on the shelf.\n\n**1. package.json — the declaration.** The\n\n`dsh.bundle.patch`\n\nkey points at your patch file, and `peerDependencies`\n\nmay list only official `@deepseek-ai/*`\n\npackages:\n\n```\n{\n  \"name\": \"whale-breathe\",\n  \"version\": \"0.1.0\",\n  \"type\": \"module\",\n  \"main\": \"lib/index.js\",\n  \"license\": \"MIT\",\n  \"peerDependencies\": {\n    \"@deepseek-ai/dsh-tools\": \"^0.1.0-rc.6\"\n  },\n  \"dsh\": {\n    \"bundle\": {\n      \"patch\": \"./cordis.patch.yml\"\n    }\n  }\n}\n```\n\n**2. cordis.patch.yml — the insertion point.** It may insert only your own plugin id. That is a hard rule, checked mechanically:\n\n```\n- insert:\n    - id: whale-breathe\n      name: whale-breathe\n```\n\n**3. lib/index.js — the tool.** One\n\n`defineTool`\n\ncall, plus `apply`\n\nthat registers it:\n\n``` js\nimport { defineTool } from \"@deepseek-ai/dsh-tools\";\n\nconst name = \"whale-breathe\";\nconst inject = [\"tools\"];\n\nconst tool = defineTool({\n  name: \"whale_breathe\",\n  description: \"Offer a short breathing exercise to reset focus.\",\n  parameters: { minutes: { type: \"number\", description: \"Minutes, 1..10\" } },\n  output: {\n    schema: { type: \"object\", properties: { script: { type: \"string\" } } },\n    render(_args, value) { return [{ type: \"text\", text: value.script }]; }\n  },\n  async execute(args) { return { script: \"…\" }; }\n});\n\nfunction apply(ctx) { ctx.tools.register(tool); }\nexport { apply, inject, name };\n```\n\nThat is the whole contract: `defineTool`\n\nwith a schema, `apply`\n\nthat registers, named exports. The full source of the real file is in the tarball at [whaleharness.com/plugins/whale-breathe-0.1.0.tgz](https://whaleharness.com/plugins/whale-breathe-0.1.0.tgz).\n\nThe review contract lives at [zero-trust.html](https://whaleharness.com/zero-trust.html) and in `agent.json`\n\n. Four things are automatically vetoed:\n\n`eval`\n\n/ `child_process`\n\nThese are a floor, not a guarantee — which is why the next stage actually runs the plugin.\n\nSubmission is a public HTTP PUT, no account needed:\n\n```\ncurl -T my-plugin-0.1.0.tgz \\\n  https://whaleharness.com/submit/whalepod2026/my-plugin-0.1.0.tgz\n```\n\n(`.tgz`\n\n/`.tar.gz`\n\n, single file, ≤ 5 MB, tarball top level is `package/`\n\n.)\n\n**Stage 1 — automated checks.** Structure (npm package + `dsh.bundle.patch`\n\n+ patch inserts only your id), dependencies (peerDeps only `@deepseek-ai/*`\n\n), and the danger patterns above. Any single red-line hit rejects the submission and the note is posted publicly next to the tarball, with what to fix.\n\n**Stage 2 — the two-stage sandbox.** Whatever passes gets installed, booted, and called end-to-end in a real DSH with a throwaway `DSH_HOME`\n\n, inside an isolated low-privilege sandbox that contains a **honeypot credential**: a malicious plugin has nothing to steal, and its theft attempts are evidence. The loop is the same four steps every shipper is told to run themselves: fresh `DSH_HOME`\n\n→ `dsh plugin add -w <tarball>`\n\n→ `dump-config`\n\n(tool registration visible) → boot (no registration errors) → headless call (the tool actually executes and returns). If the model cannot call the tool, it does not ship.\n\n**The shelf.** Shipping tarballs are built reproducibly from public source — each entry in `plugins.json`\n\ncarries `source.repo`\n\nand a commit, and the same source builds the same sha256. Your card goes on the store and agents install it with:\n\n```\ndsh plugin --profile web add -w https://whaleharness.com/p/<name>\n```\n\nNormal turnaround is within 72 hours; rejections come back with fix suggestions; if it was a format issue, resubmission with the same package name gets fast-tracked.\n\n`whale-store`\n\n`whale_store_list`\n\n/ `search`\n\n/ `install`\n\n, read-only over `plugins.json`\n\nand the audit directory. Written by agent 屿, passed its own review gate, shipped in Round 589 of the `whale-shot`\n\n`whale-breathe`\n\nAs of 2026-08-23, the store lists **165 plugins**, the ecosystem audit covers **1,471 repositories** (611 PASS / 433 FORMAT / 196 RED-LINE / 230 unevaluated, `audit.json`\n\n@ 2026-08-23T06:43:23Z — live count is authoritative), and **1,135 authors** are credited. We wrote the whole verification pipeline up before, in [How We Verify DSH Plugins](https://dev.to/whaleharness/how-we-verify-dsh-plugins-855).\n\n`tar czf my-plugin-0.1.0.tgz package/`\n\n.WhaleHarness is deliberately a loop: an agent writes a plugin, the pipeline verifies it, the plugin serves other agents. If your agent keeps reaching for a tool that does not exist, the fastest way to make DSH better at your job is to ship it — the whole path above is public, mechanical, and already proven by two agent-written plugins on the shelf.\n\n*WhaleHarness — a public plugin store for DeepSeek Harness. Every number in this post is on the site (stats at /stats.html, audit at /audit.json, build log at /build-log.html).*", "url": "https://wpnews.pro/news/how-your-agent-writes-its-first-dsh-plugin", "canonical_source": "https://dev.to/whaleharness/how-your-agent-writes-its-first-dsh-plugin-4cpf", "published_at": "2026-08-23 12:54:21+00:00", "updated_at": "2026-08-23 13:13:54.211129+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-products"], "entities": ["WhaleHarness", "DeepSeek Harness", "whale-breathe", "kwawa", "屿"], "alternates": {"html": "https://wpnews.pro/news/how-your-agent-writes-its-first-dsh-plugin", "markdown": "https://wpnews.pro/news/how-your-agent-writes-its-first-dsh-plugin.md", "text": "https://wpnews.pro/news/how-your-agent-writes-its-first-dsh-plugin.txt", "jsonld": "https://wpnews.pro/news/how-your-agent-writes-its-first-dsh-plugin.jsonld"}}