# This week in dsh — 2026-08-15 (Week 1)

> First weekly edition of the ecosystem map. Sources: GitHub topic search, awesome lists, marketplace registries, official Discussions, and direct verification. Compiled 2026-08-15 by zoahdev.

## What happened this week

- **0.1.0-rc.6 is the public train** (`next` on npm; `latest` still points at the broken `0.0.1-rc.1` — see Bug radar).
- The ecosystem exploded: `dsh-plugin` topic now has 2,958 repos; 8+ curated lists; multiple marketplaces; dozens of dsh-specific plugins (web UI, TUI, vision, memory, teams, skills).
- Official PRs are currently closed; Discussions are the active contribution channel.

## Notable ships (selected)

| Project | Signal | Note |
|---|---|---|
| dsh-web-ui | 2,201★ | web UI plugin/skin collection |
| deepseek-harness-desktop | 3,363★ | desktop shell |
| dsh-TUI | 1,019★ | terminal UI |
| dsh-anchored-standard | 1,225★ | preset |
| modlens | 1,480★ | vision |
| dsh-market | 141★ | in-DSH plugin market |
| dsh-find-plugins | 78★ | plugin finder skill |
| dsh-handbook | 244★ | 0→1 handbook |
| zoahdev suite (5 repos) | ✅ verified | intelligence 195+ tools, doctor, search, radar, template |

## Bug radar (tracked)

| # | Title | Status | Root cause / fix |
|---|---|---|---|
| 1686 | `dsh web` boot fails on Linux CI (missing pty.node) | open | upstream npm CLI lacks linux-x64 prebuild; workaround: Windows runner for web boot |
| 1697 | `undefined.prepare` crashes every tool call after plugin install | open, fix staged | dual-instance unique symbol; `Symbol.for` + protocol guard on [fork branch](https://github.com/zoahdev/deepseek-harness/tree/fix/tool-runtime-scheduler-symbol-for) |
| 1729 | agent ran `rm -rf` after failed `&&` (`;` semantics) | open | shell chaining semantics; verify before merge |
| 1734 | postinstall emits DEP0190 (lefthook, shell:true) | open, patch proposed | use JS bin via process.execPath; verified workaround: `cmd.exe /d /s /c` |
| 1763 | same `undefined.prepare` family on web_search/fetch | open | see 1697; diagnostic: dsh-plugin-doctor `--profile` |
| 1768 | prompts lost when turn aborted during auto-compact | open | agent-loop lifecycle |
| 1769 | bwrap workspace-write sandbox escapable via mount | open | security; needs upstream fix |
| 1777 | native folder picker truncates CJK paths (Windows) | open | U+4E00 path handling |
| 1780 | 400 `reasoning_text must be passed back` | open | LLM adapter protocol |
| 1782 | host-plane plugin registrations invisible to agents | open, hypothesis | likely dual-instance (1697 family), not scope layering — registry view includes global layer |
| 1789 | restricted mode breaks schannel TLS (Windows) | open | CreateRestrictedToken strips credentials; workaround: Node/OpenSSL clients |
| 1841 | tool error leaves unpaired tool_call, session stuck | open, diagnosed | #1697 family second-order effect; diagnose with dsh-plugin-doctor --profile |
| 1842 | profile package.json UTF-8 BOM crashes dsh web at boot | open, patch staged | readProfileManifest JSON.parse without BOM strip; fork branch fix/profile-manifest-bom-strip |
| 1923 | 零审批静默逃逸：借壳启动绕过 workspace/审批 | open, analyzed | approval=consent UX 非 OS 边界；OS 级沙箱+shell-launcher 白名单方向；doctor v1.11 增加 shell-launcher 检查 |
| 1928 | 静态扫描把 db.exec 误报为 shell 执行 | open, false positive | 同类已修：doctor v1.10.2 只匹配 spawn/execFile/execSync/fork；建议 dsh.so 加 node:sqlite 白名单 |
| 1930/1933 | 上下文超限（664K+384K>1M）/ 需要压缩功能 | open, diagnosed | 分层压缩设计建议（规则外置/结构化摘要/80% 阈值/原子可恢复）；关联 #1864 检索契约 |
| 1935 | 权限热切换后工具报错并静默转子 agent | open, diagnosed | 策略快照 vs 会话上下文不同步；子 agent fallback 掩盖根因（#1841/#1924 族） |

## Gap radar

| Gap | Status | Who |
|---|---|---|
| Official `dsh plugin check` | community impl exists (dsh-plugin-doctor `preflight`) | zoahdev |
| Official `dsh doctor` diagnostics | community impl exists (`--env --port`) | zoahdev |
| TUI (requested #1776) | 3+ community TUIs exist (dsh-TUI, tianshu-tui, oh-dsh) | community |
| Standard third-party distribution (#1776) | 4-piece proposal (dist-tags / allowBuilds UX / plugin.json / preflight) | zoahdev proposal |
| npm dist-tag hygiene | `latest` points at broken rc.1 — ecosystem-wide ERESOLVE source | upstream needed |
| allowBuilds UX for git installs | dsh CLI prints guidance; marketplace UI surfaces it | upstream + marketplace |
| CI template for plugins (pack → fresh profile → real invocation → visibility) | template exists (dsh-plugin-template) | zoahdev |
| Agent-session visibility verification standard | registry-level check exists; full-session still open | zoahdev |
| English docs coverage | handbook + tutorials cover most | community |

## Ecosystem health notes

- **Naming collisions are real**: at least two "plugin doctor" projects (zoahdev's, Xrainsmile's) and several "plugin search" projects. Verify owners before installing.
- **Quality varies wildly**: most popular projects are UI/skins/skills; verified-installable plugins with CI are rare. The catalog marks signals where audited.
- **Curation is crowded, quality-signaling is not** — this map's niche.

## Official release compatibility (initial report)

> Published for the first time in Week 1. From Week 2 on, this section is
> generated on demand by `scripts/release-compat.mjs` (workflow_dispatch)
> and archived under `docs/release-compat/`.

| Train | npm tag | Verified by | Result |
| --- | --- | --- | --- |
| 0.1.0-rc.6 | `next` (current public train) | zoahdev suite (6 repos) + dsh-subscribe v0.3 | ✅ pack → fresh profile → real tool invocation → web boot; HTTP one-click install exit 0 |

Known caveats tracked in the bug radar: #1697 dual-instance unique symbol
(fix staged on [fork](https://github.com/zoahdev/deepseek-harness/tree/fix/tool-runtime-scheduler-symbol-for)),
#1686 Linux web boot (workaround: Windows runner), npm `latest` tag hygiene.

## Changelog of this map

- 2026-08-15: first edition. Catalog: 40+ curated entries, 10 tracked bugs, 10 gaps.