dsh-extension-hub

Manage DeepSeek Harness (DSH) skills and MCP servers from one place.

Skills management · MCP servers · Skill import · Plugin management · Plugin market

A service-oriented extension center for DeepSeek Harness: a zero-dependency persistence core and CLI, plus a durable settings-page UI embedded in DSH Web — create / edit / enable / disable skills and MCP servers, one-click import from Claude Code and OpenAI Codex, and a full plugin manager (official vs third-party, enable / disable / uninstall, check & update, plus a Plugin Market with a curated store and GitHub search).

🌏 中文 · English

Quick Start

Prerequisites: DSH installed and running (dsh web works), Node.js ≥ 22, pnpm ≥ 10.

dsh plugin --profile web add dsh-extension-hub@0.2.19

One command: the package ships its own composition patch (bundle layer), so the plugin row is wired into your profile automatically — no manual cordis.patch.yml edits. Restart dsh web, then open Settings → Extension Management.

Install once — use the header's Check Updates button to upgrade later.

Features

Built-in skills are read-only: the list also shows skills bundled with the deployment (shipped presets, e.g. the cordis preset's skills) and skills shipped inside user presets, marked "Built-in/Preset" and not editable / deletable / toggleable — they belong to the deployment or preset layer. To override, create a same-name skill in the user or project directory.

Plugin Management Guide

The Extension Management page ships a full plugin manager since v0.2.0, with four tabs: Skills / MCP Servers / Plugins / Plugin Market.

Managing installed plugins

The Plugins tab lists every plugin row in your DSH composition, split into two collapsible groups:

• Official Plugins — DeepSeek's own @deepseek-ai/* packages (collapsed by default). They can be disabled but not uninstalled; the cordis:include entry is the composition loader itself and is marked Core — it cannot be disabled or removed.
• Other Plugins — third-party and your own plugins (e.g. this one).

Click a plugin to see its details: description, source, repository link, entry id and module name. From the detail block you can:

• Enable / Disable — written to your profile cordis.patch.yml; takes effect after a dsh web restart. Disabling warns you that an unknown plugin may cause serious problems.
• Uninstall (non-official only) — removes the plugin row from the configuration, with a warning plus a second "Confirm uninstall?" step. If the plugin was installed via a GitHub clone, its local clone directory is deleted too.

The Other Plugins group header has Check Updates: it compares npm packages against the registry and local git clones against their origin HEAD. Updateable plugins get a green Update Available button next to their status label — click it to pull the new version (npm tarball or git pull), or use Update All to update every updateable plugin at once.

Discovering & installing new plugins

The Plugin Market tab has two sub-views:

• Curated (default) — a community-curated catalog (awesome-dsh-plugin, refreshed daily) with 11 categories, bilingual descriptions, star counts and ordering (Featured / Top / Newest). Entries with an npm mapping install from npm in seconds (registry tarball, with an anti-squatting check that the package points back at the listed repository); entries without one fall back to a GitHub clone. A 24h local cache keeps the view usable offline.
• Discover More — searches GitHub for repositories tagged dsh-plugin (a free-text query narrows the search). Each result shows stars and an "Installed" badge when the repo is already present locally.

Click a curated/discovered entry to open its detail page — description, stars, category (curated), install method and a link to the repository — then hit Install. Extension Hub:

1. Prefers the npm registry when the plugin publishes to npm: downloads the tarball into the profile node_modules without pnpm (no symlink/permission requirements) and registers a bundle row. Packages installed this way are managed by Extension Hub itself — keep updating them with its Check Updates; the dependency is declared in the profile manifest, so a later dsh plugin / pnpm install keeps it.
2. Otherwise clones the repository (shallow) into ~/.dsh/extension-hub/plugins/<repo> and verifies it ships a usable package.json entry. Clone installs support zero-dependency plugins only: packages with npm runtime dependencies are rejected (there is no dependency-install step), and packages that rely on a bundle patch (dsh.bundle.patch) are flagged because a clone cannot apply it. Be aware that a monorepo root (e.g. the repo of dsh-myrules is this very repository) clones as the root package, not the target plugin — use the npm or Add-ons install path for those.
3. Registers the plugin in your profile cordis.patch.yml (managed insert block) and self-checks the write.

Mixing install paths (Discussion #2889): Extension Hub installs write a profile patch row plus a dependency declaration. Do not combine this with the official dsh plugin add/list/update commands: DSH CLI appends every dependency declaring a dsh.bundle.patch to dsh.profile.bundles, duplicating the manual row and crashing dsh web on boot with duplicate loader entry id (see deepseek-harness Discussion #2889). If you already ran a dsh plugin command, remove the duplicated entries from dsh.profile.bundles before restarting.

After a dsh web restart the plugin appears in the Other Plugins group, where you can disable or uninstall it (GitHub-clone installs also remove the clone directory) and keep it updated with Check Updates (npm packages check the registry; local git clones update via git pull).

Installing runs third-party code. Only install repositories you trust, and check the repository's own README for install instructions — a repo tagged dsh-plugin may still be a skill, an MCP server, or need a custom setup.

Recent Updates

How it works

• The host half (lib/host.js) is a TypertRemoteService gateway exposed under the extensionHub wire namespace; the browser half mounts its Remote contribution and calls the mounted namespace service.
• The browser bundle is declared via dsh.client.platform: "web" in package.json; DSH's client-modules system scans it at boot, injects the boot manifest, and serves the bundle over /plugins/dsh-extension-hub/client.js — no web bundle rebuild required.
• All real reads/writes run inside the host process (outside the session file sandbox) and share the same lib/ code as the CLI.

Data sources (discovery scope)

Conversion: Claude/Codex stdio servers → DSH transport: stdio (command/args/env); http/sse → transport: streamable-http (url/headers). Skill name/description/whenToUse are preserved, license/allowed-tools fold into metadata.

Persistence locations

Skills

• Project scope --scope project → <target folder>/.dsh/skills/<name>/SKILL.md
• Global scope --scope global → ~/.dsh/skills/<name>/SKILL.md

Enable/disable rewrites the disable-model-invocation / user-invocable frontmatter flags; removal deletes the file.

MCP

• Global → rows are appended/updated inside the managed region (# >>> dsh-extension-hub … # <<< dsh-extension-hub) of ~/.dsh/profiles/<profile>/cordis.patch.yml.
• Project → writes a manifest <target folder>/.dsh/mcp-servers.yaml and generates a dedicated preset ~/.dsh/.agent-presets/<slug>-mcp/agent.cordis.yml (based on the shipped standard preset). Select that preset in the session roster to activate the servers.

Supported platforms

DSH itself runs on Windows, macOS and Linux; this plugin has no platform specifics — the CLI works anywhere Node.js runs, and the settings UI follows the DSH Web host.

Known limitations

• The YAML/TOML parsers are self-contained subsets covering the shapes that actually appear in DSH compositions and Codex config.toml; anything outside them is skipped or reported, never silently corrupted.
• Skill discovery matches DSH dsh-skill-filesystem: only <root>/<name>/SKILL.md and <root>/<name>.md are recognized; names must be kebab-case.
• Project MCP relies on the "generated preset + manually select the preset" mechanism; the tool does not switch presets between sessions for you.
• Project-scope enable/disable toggles apply to the generated preset (whether the servers load when that preset is selected); the manifest always keeps the full record.
• Global MCP removal/editing only affects manager-managed rows (inside the managed region); hand-written patch rows are untouched.
• The curated store is a snapshot of the community registry: it refreshes on load with a 24h local cache, so it may trail the live registry by up to a day. Plugins that need a build step at install time fall back to a GitHub clone instead of the npm tarball path.

Integrate with Extension Hub

DSH Extension Hub can integrate most plugins, letting users manage and keep every related feature updated in one place. If you are interested, your plugin is very welcome here too — together we can grow the DSH plugin ecosystem. Once integrated, your plugin appears in the Add-ons block of the Plugin Management tab, where users can install, disable, uninstall, and update it together with the main plugin.

Thank you for your open-source contribution to the DSH community!

Open an issue or reach out directly: Open an issue · Relistencode 1405650786@qq.com

Acknowledgments

This project builds on the open work of the DSH community. Thanks to:

• awesome-dsh-plugin — the community-curated plugin registry that powers the Curated view (daily-refreshed plugins.json, bilingual descriptions, npm mappings).
• dsh-market — the in-harness plugin market that demonstrated npm-first installs and registry-vs-repo anti-squatting checks.
• dsh-plugins-store — the static plugin marketplace whose catalog/verification approach informed the Discover data-source design.
• dshfind — the DSH learning site and plugin browser whose score/grade presentation inspired quality-signal ideas.

License

MIT