dsh-plugin-manager

Every plugin finally speaks for itself — Chinese names, plain-language descriptions, one-click enable/disable, and in-UI notes editing for DeepSeek Harness.

Settings → Plugins → Plugin Manager · 165 plugins cataloged, one click to toggle, notes edited in place.

Overview · Compatibility · Install / Uninstall · Quick Start · Configuration · Permissions & Data · Features · Troubleshooting · Development

中文 · Español · 日本語 · Deutsch · Русский · Português · 한국어

🆕 2026-10-01 · v0.7.0 — Adapted to DSH 0.2.0 (0.2.0-rc.2) with a dual-form codec artifact that registers on both the 0.1.x and the 0.2.0 typert chains (0.2.0 switched from zod instances to create() factories) — the full e2e suite passes against both 0.2.0-rc.2 and 0.1.5-rc.3. Catalog gained the 0.2.0 rows (dsh-hmr, the DeepSeek LLM split, the official plugin manager rows); peer ranges widened to cover 0.2.0-rc.0+. Hot-reload still works on 0.2.0 (the dsh-hmr service watches the global patch file).

🆕 2026-10-01 · v0.6.0 — Adapted to DSH 0.1.5 (0.1.5-rc.3): the host and client halves build and pass the full e2e suite against the 0.1.5-rc.3 package set, and the test suite now runs hermetically (no local DSH install needed). Also fixes a locale-namespace collision with @linxin666/dsh-web-ui-all.

🆕 2026-08-14 · v0.3.0 — In-UI notes editing is live: click Edit notes on any card to rename a plugin or rewrite its description in place. No more hand-editing catalog.json.

🏷️ v0.4.0 — Package renamed to the owner-controlled scope @2768651338/dsh-plugin-manager (previous @dsh-external/* scope was not authorized).

🔧 v0.2.x — Fixed endpoint 404 under tsx source launch (strict ./typert registration) and the cordis inject access (ctx.get channel).

Overview

Problem. The built-in "Plugin list" in DeepSeek Harness shows only English module names with no descriptions — once you install many plugins, nobody can tell what each row does. Enable/disable previously required hand-editing cordis.patch.yml, which is easy to break.

Who it's for. Every DeepSeek Harness user, especially people who install many plugins and want to know what each one does, toggle them safely, and annotate the ones the catalog doesn't cover.

Compatibility

The official launcher boots via tsx from source; this plugin's strict ./typert registration is specifically designed to work under both plain-node and tsx source launch (covered by tests/claims.e2e.mjs). If you run a different DSH version, re-run the test suite before reporting issues.

DSH 0.2.0 note: the dsh-base bundle now ships an official plugin manager (@deepseek-ai/dsh-plugin-manager, row id plugin-manager). This plugin's bundle patch inserts the same row id, and the later bundle layer wins — so installing this plugin replaces the official host row. The official sidebar panel (@deepseek-ai/dsh-client-ui-plugin-manager) is a separate surface and may coexist with this plugin's Settings tab. If both host rows are ever loaded at the same time (the takeover did not happen as expected), the tab detects it at runtime and shows a compatibility warning banner.

Install / Uninstall

# Install (recommended, same bundle mechanism as dsh-navbar)
dsh plugin --profile web add github:2768651338/dsh-plugin-manager#main

# Alternative: install from a zip (download from the Release page), unzip to a path without spaces, then:
dsh plugin --profile web add file:/<unzipped-dir>/dsh-plugin-manager

# Alternative: build locally (clone this repository)
pnpm build   # tsc + tsdown → lib/index.js (host half) and lib/client.js (browser half)
dsh plugin --profile web add file:./dsh-plugin-manager

After installing, restart DeepSeek Harness and press Ctrl+F5 once. Open Settings → Plugins → Plugin Manager. The lib/ artifacts are committed, so GitHub installs need no local build.

Quick Start

Minimal reproducible walkthrough (2 minutes):

# 1. Install
dsh plugin --profile web add github:2768651338/dsh-plugin-manager#main
# 2. Restart DeepSeek Harness, press Ctrl+F5 in the web page

3. Open Settings → Plugins → Plugin Manager — you see the full catalog with Chinese names and descriptions.
4. Toggle one plugin: search for trajectory, click 停用 (Disable) on the 轨迹视图 card → the row turns 已停用 within ~1 second (host-side effect; browser-side plugins fully unload after a page refresh).
5. Annotate one plugin: click 编辑备注 (Edit notes) on the 联网搜索 card, rename it and add a note, click 保存 (Save) → the card updates immediately; 恢复默认 (Restore default) reverts it.

Configuration

Permissions & Data

Security model. This plugin ships no authentication of its own — who can reach its write operations (toggles, notes edits, backup import) is decided entirely by DSH's web-app trust barrier. Under the default configuration the web server listens on the loopback interface and only local sessions can call the RPC endpoints; that is the assumption this plugin is built on. If you configure the DSH web server to listen on a non-loopback address (the host/port launch options), anyone who can reach that port can toggle plugins, rewrite your cordis.patch.yml, and change profile dependencies — do not expose the web server to untrusted networks. Also note the tab footer displays two local file paths (the patch and override files) as returned by the list snapshot, so LAN-visible sessions can learn those paths.

Features

How It Works

Runtime dependencies: @deepseek-ai/cordis and @deepseek-ai/dsh-typert-protocol resolve through DSH's profiles/node_modules fallback links — no extra pnpm downloads.

Custom Notes

Click Edit notes on any card. Saving with both fields empty removes that plugin's customization. Power users may still edit ~/.dsh/plugin-manager/catalog.json directly:

{
  "@dsh-external/dsh-navbar": { "name": "对话导航条", "desc": "对话区右缘的消息节点导航" }
}

Precedence: override file > built-in catalog > English short name.

Troubleshooting

Project Structure

src/
  index.ts              host half: PluginManagerGateway (list / setEnabled / setOverride / removeOverride)
  patch-file.ts         surgical patch-file editor (pure functions)
  catalog.ts            built-in catalog + system-protection set
  types.ts              shared plain data types
  typert-host.ts        strict endpoint registration artifact (./typert)
  client/
    index.ts            browser half: mount remote namespace + register the tab
    remote.ts           client remote artifact (strict zod codecs)
    PluginManagerTab.tsx tab UI (list / toggles / notes editing)
    locales.ts          zh/en dictionaries
cordis.patch.yml        bundle patch (inserts the plugin-manager row)
lib/                    built artifacts (committed; GitHub installs skip building)
tests/                  smoke / end-to-end tests

Development

pnpm build                      # tsc + tsdown
pnpm lint                       # eslint (flat config, lenient rules)
pnpm typecheck                  # tsc --noEmit
pnpm test                       # patch-file / patch-yaml / fs-safe / client-util / backup smokes + claims/gateway/host e2e
node tests/patch-file.smoke.mjs # patch editor smoke tests
node tests/client-util.smoke.mjs# browser-half pure-function smoke tests
node tests/host-gateway.e2e.mjs # host gateway end-to-end (incl. override-file contents)
node tests/claims.e2e.mjs       # endpoint claims under plain-node and tsx source launch

CI (GitHub Actions) runs lint + typecheck + build + test on node 22/24 for every push and PR. Note the CI pins verify only the pinned dev versions below — before a release, re-run the suite manually against any newer DSH rc (see the compatibility note).

Artifact shape note: the two hand-written typert artifacts (src/client/remote.ts, src/typert-host.ts) keep their generator-aligned descriptor shapes but share one schema source (src/schemas.ts) — edit schemas there, not in the artifacts. If a future host ever requires byte-exact comparison against generator output, split the schemas back out.

The DSH host packages the tests boot against (dsh-app-boot, dsh-typert-*, dsh-api-gateway, …) are pinned devDependencies at the DSH 0.2.0-rc.2 versions, and every entry path is resolved via import.meta.resolve — no local DSH installation is needed to build, test, or typecheck. The dual-form codec artifacts are regression-verified by temporarily flipping the pins back to 0.1.5-rc.3 and re-running the full suite (both generations must pass).

Contributing. Fork → change → pnpm build → run the tests above → open a PR against main. Small fixes (docs, catalog entries, translations) are welcome without prior discussion. Report issues with the DSH version and the exact error detail shown in the tab.

License & Security

License: MIT — see LICENSE. Built on DeepSeek Harness's public plugin mechanism, not affiliated with DeepSeek.

Security: this plugin reads no credentials and sends nothing over the network. To report a security issue privately, use GitHub's Report a vulnerability on the Security tab — do not open a public issue with exploit details.

Star History