dsh-remediation: A Report-to-Remediation DSH plugin for DeepSeek Harness
feely0208/dsh-remediation
A DSH plugin that turns audit reports into actionable remediation checklists — concrete steps, before/after snippets, effort estimates and verification commands, plus bounded auto-apply fixes.
dsh-remediation is a DSH plugin in the DeepSeek Harness ecosystem that turns audit findings into executable fixes. It takes the JSON report from any guard plugin and produces a severity-sorted remediation checklist, each item pairing the finding location, regulatory basis, concrete steps, before/after snippets, estimated effort, and verification method. For rules declaring autoApply it performs bounded mechanical edits, printing only by default and writing after explicit confirmation with backups first. It adds no detection rules and fabricates no fixes, suited to teams that need audit findings actually resolved.
How to Install
dsh plugin --profile web add @deepwhale-cn/dsh-remediation- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- feely0208
- Distribution
- Plugin
dsh-remediation Key Features
dsh-remediation Repo Summary
What Does It Do?
It is a DSH plugin for DeepSeek Harness that turns an audit report's "what is wrong" into "what to change it to, how long it takes, and how to verify the fix". It reads the JSON report produced by any guard plugin and generates a remediation checklist sorted by severity, closing the gap between a long list of findings and actually fixing them. It adds no new detection rules of its own; it only converts reports into actionable fixes and can mechanically apply changes for rules that explicitly declare autoApply.
Core Features
- Report-to-checklist conversion: takes the JSON output of any guard plugin and produces a severity-sorted remediation list, each item pairing the finding location, regulatory basis, concrete steps, before/after snippets, estimated effort, and verification method.
- Deliverable Markdown output: saves the checklist as a Markdown file that can be attached directly to a remediation report.
- Bounded auto-apply: for rules whose recipe declares autoApply (such as creating a LICENSE file or raising log retention days), it performs mechanical edits, defaulting to dry-run that only prints what would change until explicitly confirmed.
- Explicit safety boundaries: backs up files before writing, touches only declared files, requires all target paths to stay inside the project root, and never runs scripts, accesses the network, or deletes files.
- No fabricated fixes: rules without a recipe are reported as having no dedicated fix yet, falling back to the original report's advice and pointing to the list of covered rules.
- Custom recipe directories: additional recipe folders can be supplied to extend coverage, and JSON output is available for CI or downstream processing.
How to Use This Plugin?
After enabling it in DSH, first run any guard plugin to produce a JSON report, then hand that report to this plugin to generate the remediation checklist. By default it only prints results and leaves files untouched; once you confirm, an explicit apply flag writes the changes for declared rules and backs up originals first. Save the checklist as Markdown when you need a deliverable, or switch to JSON output when wiring it into a pipeline. After fixing, rerun the original guard plugin and confirm the corresponding rule no longer appears. The plugin is maintained by feely0208 under the MIT license and is part of the DeepWhale guard family.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: feely0208/dsh-remediation. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.