jingzhao-l/iterate-plugin

iterate-plugin for DeepSeek Harness (dsh)

dsh 桌面端的 iterate 质量指挥中心 + 经验银行插件（v3.6）。把 iterate 生态的同一套 review/fix loop 直接搬进 dsh 界面，新增质量门禁、经验银行、防御事件流与原生指挥操作。

The iterate ecosystem's quality command center + experience bank plugin for dsh (v3.6). Natively embedded inside the DeepSeek Harness (dsh) desktop client with quality gates, experience bank, defense events stream, and native command buttons.

English · 简体中文

Developed and reviewed in the iterate-skill monorepo: the plugin code is maintained in the main repository and synced here via git subtree; releases and npm publishing happen in this (plugin) repository, which is the canonical publish point for the dsh ecosystem. Please star / fork the main repository and file issues at the main repository Issues.

⭐ If this helps your dsh workflow, give the main repo a star — it means a lot to open-source maintenance!

The iterate Ecosystem / iterate 生态一览

iterate is not one single binary — it is a skill ecosystem that layers a strict multi-round code gate on top of your existing AI assistants, IDEs, and scripts. It never replaces your tools; it adds an audit-and-close-the-loop layer on them. The whole ecosystem ships as three interchangeable components sharing one `iterate.config.yaml` + one 9-dimension review system:

• Core Skill + CLI — a portable AI skill /iterate + iterate CLI. For conversation-driven multi-round iteration inside Trae / Claude Code / Cursor / Copilot / Codex and 25+ other assistants.
• iterate-harness — a standalone headless engine, command ih (npm: iterate-harness). Runs the exact same loop in terminal / CI / git hooks, without any conversational assistant required.
• iterate-plugin (this repo) — a dsh desktop-client plugin (npm: iterate-plugin). Plugs the harness runtime into the dsh UI: convergence dashboard, triage panel, round progress — all surfaced as native dsh widgets.

How they fit together: Core Skill is the canonical, assistant-agnostic review/fix engine (the "brains"). iterate-harness is the same engine wrapped as a headless CLI + WebUI for unattended runs. iterate-plugin (this repository) wraps that harness runtime as a dsh plugin, rendering the triage UI and convergence dashboard directly inside the dsh desktop client. Configuration (iterate.config.yaml) and the 9-dimension review system are identical across all three — learn one, use them all.

Quick install / entry points for the rest of the ecosystem:

# Core Skill + CLI (install into 25+ AI assistants)
npx iterate-skill-installer

# iterate-harness: headless engine (npm wrapper, simplest)
npm install -g iterate-harness
curl -fsSL https://raw.githubusercontent.com/jingzhao-l/iterate-harness/main/scripts/install.sh | bash
ih iterate init && ih iterate review

# iterate-plugin: dsh desktop plugin (this repo — commands repeated under Installation below)
dsh plugin --profile web add iterate-plugin

This document focuses on iterate-plugin (this repo). For Core Skill docs see the iterate-skill monorepo; for headless engine docs see iterate-harness.

About This Plugin

iterate is an open-source project that gives AI coding assistants the ability to review and fix code in multi-round autonomous loops. It targets a concrete pain point:

AI assistants tend to "talk a lot but do little": a single conversation only touches a few lines, stops caring about the rest of the repo after seeing one file, and rarely double-checks what they broke. iterate automates these closing chores — itemized review, per-dimension triage, fix, validate, and iterate again — so AI actually finishes changes and gets them right.

iterate-plugin is the iterate integration for the DeepSeek Harness (dsh) desktop client. It brings iterate's review loop (review → triage → fix → validate → converge) directly into the dsh UI, offering autonomous closed-loop code iteration (normal mode) and dry-run read-only multi-round review.

v3.2 Quality Command Center: the plugin has grown from a "passive observation panel" into an "active command center + knowledge base". It now ships quality gate view + writable compute, an experience bank with search / adopt / add, a defense events stream (record + bilingual labels), native command buttons, and a task_mode indicator.

Besides 17 pure-function tools, it carries a build-free Web UI layer (convergence dashboard, triage panel, stats card, 11-tab runtime observatory — live activity stream + F1–F10 —, theme skin, etc.) that plugs straight into dsh's existing UI slots. Configuration (iterate.config.yaml and the review dimensions) is identical across the other two components of the iterate ecosystem (skill / headless engine) — zero migration cost.

📑 Table of Contents

• ✨ Features
• 📦 Installation
• 🧭 Using the UI in dsh
• 💬 Usage
• ⚙️ Project configuration
• 🔧 Registered tools
• 📁 Runtime artifact layout
• 🎨 Design
• 🧪 Running the tests
• ⚠️ Disclaimer & License

✨ Features

Two modes

The plugin runs the same iterate engine as the rest of the ecosystem, either fully read-only or as an autonomous fix loop:

• dry-run — repeats multi-dimension review until convergence; zero files modified.
• normal — review → atomic fixes → validation every round → rollback on failure → loop until convergence.

Both modes share:

• Repeated review until convergence
• Parallel dimension review
• Deterministic aggregation / dedupe / sort
• meta-review report-consistency audit
• Self-stop when converged
• Breakpoint save / resume (long iterations)

normal mode additionally:

• Fixes atomic findings only (architectural ones are kept for later approval)
• Validates after each round's fixes
• Rolls back failed fixes, and can save / resume progress

UI layer (build-free client slots, v3.7: 11 tabs, bilingual)

• ConvergenceDashboard (conversation.input.dock) — live round progress bar, severity stats, dimension badges, trend mini-chart above the input; normal mode also shows fix-count badges; plus a live workflow-phase chip (current phase + running/stopped) and a task_mode indicator (code / iterate), now backed by the persisted transcript (iterate_status / iterate_transcript emit taskMode). While a run is active the dashboard switches to a running state (round + phase) instead of the static empty state, and the start buttons are hidden.
• ObservatoryPanel (conversation.input.dock) — an eleven-tab runtime observatory below the input: live activity stream (default tab, type filter) + F1 review threads (expand / collapse all), F2 convergence trend (incl. the per-round comparison table: findings raised / fixed / severity mix / validation outcomes), F3 finding locations (severity / dimension / search filter), F4 fixes + rollback, F5 checkpoint resume, F6 run console, F7 decision timeline (type / round filter + search), F8 Quality Gate, F9 Experience Bank, F10 Defense Events. Number-key shortcuts: 1–9 jump to F1–F9, 0 to F10, - back to the live stream. F8/F9/F10 are live — they scan the session stream for the latest iterate_quality_gate / iterate_experience / iterate_defense_events results and render real data (PASS/FAIL chip + per-dimension score bars, experience entries with adopt buttons + client-side search, defense type-count chips + filtered event stream); when the session stream has none they distinguish "no data on disk" from "not pulled yet" and offer a 拉取磁盘快照 (pull disk snapshot) instruction that has the model call the read-side tools and echo the .iterate/ artifacts back into the stream. One-click JSON export of all observatory data — manifest + live + qualityGate / experienceBank / defenseEvents / report (download, copy fallback). v3.9: two report-export buttons (导出报告 / 导出 SARIF) render the *same shared data model* as the iterate_report tool — a PR-pasteable Markdown run report and a SARIF 2.1.0 log for CI / GitHub Code Scanning. v3.5.3: reset actions surfaced — F5 copies an iterate_checkpoint clear instruction, F8 an iterate_quality_gate clear instruction, F10 an iterate_defense_events clear instruction.
• TriagePanel (conversation.chat.turnTail) — per-finding triage with y (keep → fix), n (skip), a (known-intentional) keyboard shortcuts and ↑/↓ navigation (focus-guarded: only active while the panel has focus), filtering, batch ops (incl. select-all), localStorage persistence. Write-back closed loop: the primary button copies an iterate_triage apply instruction for the marked entries (the tool validates, dedupes, backs up, rolls back on failure); a secondary button copies the raw known_intentional YAML; 回读已写入条目 copies an iterate_triage list instruction to confirm what actually landed. Copy payloads are aligned to the target tool schemas. v3.2: native command buttons (approve architectural fix, trigger new round, rollback to checkpoint). v3.3: §8 指派修复 (assign) — one click copies an iterate_fix instruction carrying every in-scope finding (respecting the batch toggle).
• StatsCard (conversation.chat.turnTail) — convergence stats, round history, trend chart and completion summary when no findings remain.
• iterate theme skin (theme.overrideTokens) — a warm-amber 13-token --dsw-* override, light/dark modes, togglable in settings.
• ProgressCapsule (shell.overlay) — popup notification on each round completion / convergence (incl. convergence confirm).
• SettingsPanel (settings.section) — theme toggle, triage-persistence notes, config-management guide (covers validation.commands / language / personalization.known_intentional with an explicit "empty validation.commands = unprotected" warning; a field picker generates the matching iterate_config write instruction), v3.7: a 回读当前配置 (read back current config) button that closes the write → read-back loop — it copies an iterate_config read instruction and, once the model echoes the result into the session, shows the current value of the selected field, runtime status overview (artifact layout + view/cleanup tool guide + disk-snapshot pull), one-click triage data reset.
• Bilingual UI (v3.7) — every piece of UI chrome (panels, empty states, tabs, badges, settings, stop-reason and completion labels) ships in 简体中文 and English. Pick the language under Settings → 界面语言 / Interface language; the choice persists in localStorage (iterate-ui-lang) and otherwise auto-detects from navigator.language (a stored choice always wins, and auto-detection never writes a preference). Model-facing copy deliberately stays Chinese — the build*Instruction payloads and the copy-paste guides are contract text mirroring SKILL.md, so the two expanded guides carry a 「中文（粘贴给模型的契约文案）」 chip instead of looking like a missed translation.

The UI layer is defensive by design: it degrades gracefully if any of slots / theme / React is unavailable — it never crashes the client.

Behavior beyond the tools

Beyond the 17 registered tools (full reference further down), the plugin closes several loops end to end:

• Findings triage loop — review → UI triage (y/n/a) → iterate_triage writes back known_intentional → auto-filtered next round
• Structured fix system — each fix backs up first, writes a registry entry, records the diff; a failed validation can be reverted with iterate_rollback
• Breakpoint resume — checkpoints saved at the start of each round; interrupted long iterations can resume
• History audit — iterate_history reads the decision log (filtered by type / since / round / fixed file / limit, default latest 50, cap 200) plus a fix-registry summary (per-round fixed/failed counts, scoped by the same round/file filters) to audit run process and fix details
• Runtime cleanup — iterate_prune removes stale decision-log entries, stale checkpoints, orphaned fix backups, empty rounds and stray temp files left by crashed atomic writes; dry-run by default (report-only), real cleanup requires dryRun:false, and every cleanup is logged
• Config read / write — iterate_config supports validated, backed-up, rollback-capable partial writes; since v3.7 the settings page can also read the effective config back (instruction + inline current value)
• Session-aware project root (v3.7) — on dsh ≥ 0.2.1-alpha.2 the plugin follows the session's *mutable* working directory through the host's WorkingDirectoryService instead of the immutable Session.header.cwd, so a mid-session directory switch redirects everything under .iterate/ (config, decision log, checkpoints, fix backups, approval policy) to the workspace actually in use. The service is feature-detected with a header.cwd fallback on every failure mode, so older hosts behave exactly as before.
• v3.2 Experience Bank — iterate_experience queries historical fixes and patterns with search / filter / adopt, and can persist new verified fixes (add) — re-adding the same pattern+dimension bumps its hit count instead of duplicating it
• v3.2 Quality Gate — iterate_quality_gate reads quality gate status with per-dimension convergence rates and PASS/FAIL, and can recompute + persist a fresh certificate (compute) from this round's findings / validation results (real convergence from findingsByRound)
• v3.2 Defense Events — iterate_defense_events queries defense events (precondition failures, rollbacks, invariant violations, assumption falsifications) and can record new ones; readable labels follow the project language (en / zh)

📦 Installation

From npm

dsh plugin --profile web add iterate-plugin
# or
pnpm add iterate-plugin

From GitHub (dsh ecosystem third-party install)

dsh officially supports installing plugins directly from a GitHub repo: dsh plugin --profile web add "github:owner/repo#ref" (repo root is the plugin, auto-enabled once dsh.bundle is declared). This plugin's standalone iterate-plugin repository has the repo-root-is-plugin publish point, synced from the main repo via git subtree, content identical to the npm package:

dsh plugin --profile web add "github:jingzhao-l/iterate-plugin#main"

After installation, restart the dsh service (recommended dsh web --patch) and refresh the page so both the host and the client UI layer load.

Local development / source mount

dsh plugin --profile web add /path/to/iterate-skill/harness/iterate-plugin
# or
pnpm add /path/to/iterate-skill/harness/iterate-plugin

Then add to your profile cordis.patch.yml:

- insert:
  - id: iterate-plugin
    name: 'iterate-plugin'

The package carries its own dsh.bundle.patch (i.e. cordis.patch.yml); the npm package's files whitelist is src / lib / dist / cordis.patch.yml / README.md / README.zh-CN.md / LICENSE. dist/ is the compiled output of the TypeScript server-side logic, shipped with the package so it works with dsh's github:owner/repo#ref git-clone install (Node does not strip TS types under node_modules).

🧭 Using the UI in dsh

The browser client has no filesystem access — every panel renders from the dsh session stream (tool results the model echoes back). That is why the plugin's UI is built around one interaction paradigm: copy an instruction from a button → paste it back into the chat → the model calls the matching tool → the panel fills. Client buttons never spawn processes.

Starting an iteration (empty dashboard)

With no report yet, the convergence dashboard shows two buttons — 「完整迭代」 (full iteration) and 「仅评审」 (review-only) — each copying a natural-language instruction to the clipboard. These are not slash commands: the plugin registers no /iterate command; paste the text into the conversation and the model runs the iterate workflow through dsh's workflow tool. The full-iteration instruction also asks the model to preflight validation.commands first — if none is configured it stops and asks you to write one (the same fail-closed rule the workflow enforces), so an unprotected run never looks green.

While a run is active the dashboard switches to a running state (round + workflow-phase chips) instead of the static empty state, and the start buttons are hidden.

Triage panel shortcuts

Focus must be inside the triage panel (the handler ignores keys typed elsewhere):

• y — keep the finding for fixing; n — skip it; a — mark it known-intentional (write-back candidate)
• ↑ / ↓ — move between findings (auto-advances after a verdict)
• batch buttons y / n / a apply the verdict to all findings at once

To write verdicts back, mark entries with a and click 生成应用指令 — it copies an iterate_triage apply instruction for exactly those entries (the tool validates, dedupes by file|dimension|line, backs up, and rolls back on failure). Paste it back, then click 回读已写入条目 to copy an iterate_triage list instruction and confirm what actually landed — the write-back → readback closed loop.

Observatory tabs & shortcuts

The observatory below the input carries 11 tabs: the live activity stream (default) plus F1–F10:

F1 review threads · F2 convergence trend (incl. per-round comparison) · F3 finding locations · F4 fixes + rollback · F5 checkpoint resume · F6 run console · F7 decision timeline · F8 quality gate · F9 experience bank · F10 defense events

Press 1–9 to jump to F1–F9, 0 for F10, and - to return to the live stream.

Disk snapshot pull & export

• 拉取磁盘快照 (pull disk snapshot) — a new session (or a refresh) starts with empty panels even when .iterate/ already holds artifacts on disk. The pull button copies an instruction asking the model to call the read-side tools (iterate_status, iterate_transcript read, iterate_quality_gate read, iterate_experience list, iterate_defense_events list, iterate_history) and echo their full results into the stream; the session scanners then fill the dashboard, F2, F5, F8, F9, F10. Empty states distinguish "no data on disk" from "not pulled yet".
• 导出 JSON (export) — one click serializes the whole observatory to JSON: manifest + live feed + qualityGate + experienceBank + defenseEvents + report (download first, copy-to-clipboard fallback).

Config management from the settings page

The settings section copies a config-edit guide that lists the supported iterate.config.yaml fields — including validation.commands (with an explicit warning that an empty list means every round runs unprotected) — and offers a field picker: choose a field, and the button generates the matching iterate_config write instruction (schema-validated, auto-backup, auto-rollback) for you to paste back.

Reading back what actually landed — the matching 回读当前配置 / Read back current config button copies an iterate_config { operation: "read" } instruction; when the model echoes the result into the session, the card shows the current value of the selected field right under the picker (arrays inline, e.g. ["npm test","npm run lint"]). Three states are told apart honestly: *nothing read back yet*, *the value*, and *read back but this field is absent* (the built-in defaults are in play). If the clipboard refuses, the read instruction is revealed in the panel for manual copy — the button is never a dead end.

💬 Usage

dry-run mode (read-only review, no file changes)

When you want "just review repeatedly, modify nothing", an example prompt:

dry-run review this project, find all issues across all dimensions

The plugin auto-triggers the iterate workflow:

1. plan → read config, generate the review plan
2. loop → review dimensions in parallel each round, only new findings → deterministic aggregation / dedupe → convergence stats → stop when no new findings
3. meta-review → audit report consistency
4. report → output final result

normal mode (autonomous closed-loop iteration)

When you want "iterate this project / fix the issues found", an example prompt:

iterate on this project, fix all atomic issues

Workflow:

1. plan → read config
2. loop → parallel review → aggregate / dedupe → parallel atomic fixes → run validation commands → rollback on failure → log → stop when no new findings
3. report → output fix statistics

⚙️ Project configuration

Put iterate.config.yaml at the project root:

# Review goal (e.g. "Improve code quality of the project")
goal: "Improve code quality of the project"
# Review dimensions (pick from the plugin's predefined set or customize)
dimensions:
  - correctness
  - security
  - performance
  - maintainability
  - code-style
# Max review rounds
max_rounds: 3
# Review scope
review:
  scope: full  # full = whole project, changed-only = only changed files
# Atomic fix threshold (max lines a single fix may change; beyond requires force)
atomic:
  max_lines: 20
# Known intentionally-unfixed issues (filtered out, never re-reported)
personalization:
  known_intentional:
    - file: src/example.ts
      line: 42
      dimension: security
      reason: "Intentional for demonstration"
# Validation commands (run after fixes; results logged)
validation:
  commands:
    - npm test
    - npm run typecheck

The config can be read and validated-partially-written via iterate_config (auto backup, auto rollback on write failure).