@deepseek-ai/dsh-thesis

Readme

# dsh-thesis

English | [中文](README.zh-CN.md)

[dsh-thesis](https://github.com/haoyuan-sjtu/dsh-thesis) is a DeepSeek Harness plugin for thesis-assisted writing. The repository and installable package are named `dsh-thesis` and `@deepseek-ai/dsh-thesis`, respectively; its DSH bundle id is `thesisflow`. General-purpose writing skills can handle local parts of thesis writing, but context limits often prevent them from reliably maintaining project-wide rules and global state.

## Install

Install the repository into a DSH profile, then restart that profile:

```sh
dsh plugin --profile web add https://github.com/haoyuan-sjtu/dsh-thesis.git
```

The installed package declares `dsh.bundle.patch`, so DSH adds its patch layer to the selected profile automatically. To install it in the headless profile, replace `web` with `headless`.

Before restarting the profile, set `THESISFLOW_PROJECT_CONFIG` in the environment that launches it to the existing absolute path of `thesisflow.yaml`. The included [cordis.patch.yml](cordis.patch.yml) adds the plugin row and does not invent a project or registry path.

The project file contains non-sensitive metadata and a project-relative registry path:

```yaml
projectId: thesis-2026-example
language: zh-CN
field: computer-science
chapterIds: [ch1, ch2, ch3]
defaultScope: project
privacyPolicy: project_confidential
contextTokenBudget: 1200
registryPath: .thesisflow/registry.json
```

The loader rejects missing required fields, absolute or parent-traversing registry paths, unsupported scope/privacy values, nested YAML that it cannot validate, and a registry with a permission, schema, JSON, checksum, lock, or migration failure.

Approval commands remain disabled unless the Host supplies `principalResolver` in the plugin configuration. The resolver receives `{ agent, commandId, signal }` and must return the Host-verified local subject as `{ id, role: "project_owner", verified: true }`; returning no subject or any other value fails closed. The resolver must read the Host's authenticated session state, never user text or model output.

`principalResolver` is a runtime function supplied by the embedding Host; it is not read from an environment variable, project YAML, or free-form command text. The shipped patch intentionally omits it, so a profile using only the patch can retrieve approved context but cannot write candidates or change record state.

## Governance contract

New records are always written as `quarantine`. Only a Host-verified actor with `{ verified: true, role: "project_owner", id }` can create candidates, approve, reject, revoke, delete, or restore. Free text, model output, and an unverified actor cannot change state. Approval requires provenance, content, and owner confirmation for `citation_fact` and `evidence_claim`; provenance, owner confirmation, and a review deadline for `project_rule` and `latex_constraint`; provenance and owner confirmation for `advisor_feedback`; and owner confirmation for `chapter_state`, `terminology`, and `writing_decision`.

The DSH human command surface exposes `/thesisflow-capture <JSON candidate>`, `/thesisflow-review-queue`, `/thesisflow-review <JSON action>`, and `/thesisflow-route <task description>`. Capture and review commands require the verified principal and use structured JSON; free text such as `I approve` is rejected. These are human-facing commands, not model tools. The review queue redacts restricted summaries and source details.

Retrieval starts from an empty set and requires the exact project id, `approved` status, local/project scope, allowed privacy, valid review and expiry deadlines, complete evidence, and task relevance or `project-wide` priority. Candidates are sorted deterministically and selected as complete records until the configured token budget is reached. Records are never partially truncated. Corruption, lock timeout, permission failure, checksum failure, and audit failure return no injected context.

The model sees one plugin-sourced user message containing JSON reference data with record ids, types, bounded summaries, chapters, task kinds, evidence reference ids, and an uncertainty label. The payload says that embedded text is non-executable. It does not contain original evidence, private conversations, credentials, or file paths. The model has no registry operation or approval tool.

Every request produces retrieval and injection/not-injected audit events. Approvals, rejections, revocations, conflict detection, deadline transitions, write failures, read failures, restoration, and logical deletion are also audited. Revocation increments the record version and excludes the record on the next request without a profile restart.

## Limits

The MVP supports only one local project, `local` and `project` scope, and `public`, `project_confidential`, and `restricted` storage classifications. Restricted records are never injected. `/thesisflow-route` classifies the task and returns PaperSpine and academic-research suggestions, required inputs, expected outputs, and missing materials; it never executes a skill or promotes its output. There is no web UI, team/user scope, cloud synchronization, external command execution, school submission, or Humanize integration.

## Verification

From this directory, run `npm ci`, `npm run check`, and `npm pack --dry-run`. The tests cover C0–C3, three-repeat deterministic selection, evidence rejection, quarantine, conflicts, deadline filtering, malicious summaries, `next()` ordering, revocation blocking, human commands, principal fail-closed behavior, task routing, and the real Cordis Loader export and mount path when the target DSH source is available.