dsh-bridge

██████╗ ███████╗██╗  ██╗  ██████╗ ██████╗ ██╗██████╗  ██████╗ ███████╗
██╔══██╗██╔════╝██║  ██║  ██╔══██╗██╔══██╗██║██╔══██╗██╔════╝ ██╔════╝
██║  ██║███████╗███████║  ██████╔╝██████╔╝██║██║  ██║██║  ███╗█████╗
██║  ██║╚════██║██╔══██║  ██╔══██╗██╔══██╗██║██║  ██║██║   ██║██╔══╝
██████╔╝███████║██║  ██║  ██████╔╝██║  ██║██║██████╔╝╚██████╔╝███████╗
╚═════╝ ╚══════╝╚═╝  ╚═╝  ╚═════╝ ╚═╝  ╚═╝╚═╝╚═════╝  ╚═════╝ ╚══════╝

Familiar harness commands for DeepSeek Harness, with every plugin audited first.

Current stills, rendered from the specs rather than a running build: detection matrix (light) · trust card (light).

What

dsh-bridge is a DeepSeek Harness plugin for people arriving from Claude Code, Codex CLI, OpenCode, or Jcode. It ports the slash commands you already know onto DSH-native seams, adds a guided connectors flow, and refuses to recommend a community plugin until an adversarial review has graded it.

Why

• Language. The DSH plugin ecosystem skews non-English. The catalog and command surface here are English-first.
• Trust. Plugins are arbitrary code. Every recommendation ships a report card citing file-and-line evidence you can re-check.
• Muscle memory. /model, /resume, /memory, /mcp, /review behave the way your previous harness taught you.

Install

dsh plugin --profile web add github:beartackler/dsh-bridge

Not yet functional. That command is the target shape, proven by existing plugins such as dsh-ponytail. Specs and audits are real today; the runtime is not.

Verified catalog

docs/catalog/INDEX.md lists every plugin that has completed a trust review, with the audited commit and a linked report card.

Grades: A verified-clean · B safe with documented behavior · C use with awareness · D risky · F do not install. A grade is an evidence-backed opinion over one pinned commit, not a safety guarantee.

Commands

Each command is specified before it is written. Status of all sixteen: spec, not implemented.

Command	Does
/help	Lists the bridge surface and the DSH-native equivalent of each command.
/init	Onboards a repository and generates its instruction file.
/connect	Detects existing provider credentials, configures routes, smoke-tests them.
/model	Switches the active model or route without editing profile YAML.
/status	Reports session, profile, and route state already known. Probes nothing.
/doctor	Runs environment health checks and prints only what it actually observed.
/memory	Reads and edits persistent user and project memory.
/compact	Compacts conversation context on demand.
/resume	Picks a recent session to resume or fork.
/review	Reviews working-tree or pull-request changes.
/improve	Proposes and applies targeted improvements to selected code.
/mcp	Adds, inspects, and removes MCP servers.
/browse	Browses the verified catalog with grade and trust filters.
/trust	Prints a plugin's trust report card with its evidence.
/install	Installs a plugin, preferring verified builds and requiring explicit risk consent.
/suggest	Handles the dead end: scaffolds the plugin that does not exist yet.

Naming caveat: shipped names will be either /bridge:<name> or /bridge-<name>, pending an open DSH parser question.

Docs

• Architecture — how the plugin sits on the Cordis kernel.
• Trust pipeline — grading bands, heuristics, provenance checks.
• Command specs · Plugin author guide · Glossary · FAQ
• Charter · Contributing · Security · Roadmap

Status

Under active development. Research and audit artifacts land in docs/ as they are produced.

Milestone	State
Capability research	in progress
Adversarial audit of DSH built-ins	in progress
MVP plugin (commands, connectors)	next
Trust report card pipeline	planned
Onboarding wizard UI	planned

Principles

1. Trust over speed. Every security claim cites evidence.
2. English-first, i18n-ready.
3. Minimal code. Shortest correct implementation, no speculative features.
4. You own your machine. No telemetry without opt-in.

Provenance

Built by a mixed-model agent swarm (ox-alpha and Claude Opus 5) under human review. We say so because a trust product that hides its provenance has no business asking for yours.

Not affiliated with DeepSeek. Built on their MIT-licensed groundwork with gratitude.