Plugin Sandbox Test Results
We installed 120 top plugins in an isolated sandbox to verify whether they install on the current DSH 0.2.2-rc.1 and, once installed, whether they actually load. This is the only third-party integration test data available.
Plugins tested
120
Passed
104
Failed
16
Pass rate
87%
The headline finding: 16 plugins (13%) cannot be installed on the
current DSH at all. Their CI is green and their unit tests may pass — but they do not
install into a real environment. That is the cost of testing only half the job.
1. Failure reasons
| Reason | Count | Plugins |
|---|---|---|
| Version incompatible | 8 | dsh-ops, dsh-prime-memory, dsh-thinking-levels, dsh-browser-cdp, dsh-find-plugin, dsh-perm-gate |
| Package not found | 5 | dsh-meme, dsh-mcp-connector, @anysearch/anysearch-dsh, dsh-chat-import, @kenz1117/dsh-ui-usage-billing |
| Other | 1 | @deepseek-harness-tui/dsh-tui |
| Installs but not registered | 1 | @roarpeng/graphflow |
| Install timed out | 1 | @a9i5k4/dsh-auto-memory |
2. Failure details (first 30)
| Plugin | Verdict | First error line |
|---|---|---|
dsh-ops | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-meme | Package not found | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@deepseek-harness-tui/dsh-tui | Other | || 0.1.5-rc.1 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.3 || 0.2.1-rc. |
dsh-prime-memory | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-mcp-connector | Package not found | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-thinking-levels | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-browser-cdp | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-find-plugin | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-perm-gate | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-context-compression-improved | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@roarpeng/graphflow | Installs but not registered | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@anysearch/anysearch-dsh | Package not found | dsh: initialized profile web at /home/node/.dsh/profiles/web |
dsh-chat-import | Package not found | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@anionex/dsh-vision-toolkit | Version incompatible | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@kenz1117/dsh-ui-usage-billing | Package not found | dsh: initialized profile web at /home/node/.dsh/profiles/web |
@a9i5k4/dsh-auto-memory | Install timed out | TIMEOUT |
3. Dependency size (heaviest 10)
Size drives install time and disk usage. Anything over 400 MB is worth noting.
| Plugin | node_modules |
|---|---|
@linxin666/dsh-pet | 487.9 MB |
@zaofan/dsh-qqbot | 479.6 MB |
@linxin666/dsh-client-ui-task-board | 472.6 MB |
@a9i5k4/dsh-auto-memory | 406.9 MB |
dsh-better-sidebar | 277.1 MB |
dsh-univer-office | 271.9 MB |
@michengai/dsh-skills-manager | 262.0 MB |
@roarpeng/graphflow | 175.3 MB |
dsh-pet | 136.2 MB |
dsh-mobile | 84.8 MB |
4. Install time
| Plugin | Duration |
|---|---|
@a9i5k4/dsh-auto-memory | 180.1s |
@zaofan/dsh-qqbot | 41.6s |
@linxin666/dsh-pet | 19.3s |
@linxin666/dsh-client-ui-task-board | 18.3s |
@michengai/dsh-skills-manager | 12.7s |
dsh-better-sidebar | 12.6s |
dsh-chat-import | 11.1s |
dsh-pet | 11.0s |
@kenz1117/dsh-ui-usage-billing | 9.8s |
dsh-univer-office | 9.6s |
5. Method
This is a real sandbox test, not a static scan.
We built a Docker image (Node 24 + pnpm + DSH 0.2.2-rc.1) and run three stages per plugin.
| Stage | Environment | What happens |
|---|---|---|
| 1. Install | Network on, isolated container 1 GB RAM / 1.5 CPU / 256 pids |
dsh plugin --profile web add <plugin>, 180s timeout |
| 2. Verify | No network, non-root | dsh plugin list confirms installation |
| 3. Load | No network, all capabilities dropped | dsh --profile web --dump-config confirms the plugin is mounted |
Security note: stages 2 and 3 run with
--network none, so even a malicious plugin cannot exfiltrate data or reach external
services. Containers are destroyed after each run, leaving no state.6. Verdicts
| Verdict | Meaning |
|---|---|
| pass | Installed, loads, and appears in the config tree |
| install_failed | Install stage failed (version mismatch, missing package, timeout) |
| installs_but_not_registered | Installed and config loads, but the plugin never appears in the tree — likely inert |
7. Limitations
| Limitation | Detail |
|---|---|
| npm packages only | Plugins installed from github: or
#path: are not covered yet |
| Install and load only | We do not test functionality, performance or security |
| Single DSH version | Only 0.2.2-rc.1, no version matrix yet |
| Limited sample | 120 plugins (top by downloads), not all 8,559 |
8. Raw data
/data/plugin-tests.json — full results per plugin with install logs, duration, dependency size and config entry count.
If you maintain a plugin: take the error message and fix it.
We are only recording the fact that users cannot install it — this is not a judgement on your
code quality.