# dsh-web-plugin-manager

> Web-based plugin manager for DeepSeek Harness: visually manage plugin start/stop, installation, updates, and uninstallation. Includes quality gates, health checks, and a third-party plugin marketplace.

## Metadata

- Author: [@LX2000WASD](https://github.com/LX2000WASD)
- Repo: <https://github.com/LX2000WASD/dsh-web-plugin-manager.git>
- GitHub: [LX2000WASD/dsh-web-plugin-manager](https://github.com/LX2000WASD/dsh-web-plugin-manager)
- Stars: 61
- Language: TypeScript
- License: [MIT](https://spdx.org/licenses/MIT.html)
- Topics: `dsh`, `dsh-plugin`
- Forks: 4
- Open Issues: 0
- Last push: 2026-08-20T04:29:33.000Z
- Added: 2026-08-17T00:00:00.000Z

## Install

```bash
dsh plugin --profile web add github:LX2000WASD/dsh-web-plugin-manager
```

## Wiki

## One-Line Positioning

A "Plugin Control Center" for DeepSeek Harness. Centralized view, enable/disable, install, uninstall, and update DSH plugins in the Web settings panel, with pre-installation quality gates, post-run health checks, and a third-party plugin marketplace — avoiding the crashes caused by manually editing `cordis.patch.yml` and running bare `pnpm add`.

## Core Capabilities

- View all installed plugins under a profile in the Web UI (both bundle and non-bundle types), enable or disable on demand without restarting the profile
- One-click install/uninstall plugins, supporting npm package names, GitHub repositories, local paths, tarballs, and other sources
- Check and execute plugin updates (including the manager itself), with quality gate validation and automatic rollback on failure
- Health checks for dependency graphs, missing items, circular dependencies, duplicate line IDs, same-name registration conflicts, peer compatibility, and one-click fixes
- Browse third-party plugin marketplace, browse/search/filter by topic, combined with server-side installed-status checks to avoid duplicate installations
- Manage profile environments: enable/disable, copy/transfer plugins, create/rename/delete profiles (official read-only profiles cannot be modified), backup export and restore

## Technical Implementation

- **Language**: TypeScript (both server and browser sides are TS, client contains .tsx)
- **Key Dependencies**: `@deepseek-ai/cordis` (host framework), `@deepseek-ai/dsh-tools` (agent tools and guards), `@deepseek-ai/schemastery` (Config validation), `undici` (marketplace network requests)
- **Architecture Pattern**: Cordis dual-sided plugin — server side (`src/index.ts`) registers `PluginManagerService` and `/api2/plugin-manager/*` REST routes; browser side (`src/client/index.ts`) registers catalog/manager/environments three settings Tabs and kinds/marketplace two settings sections; communicates via same-origin fetch; installation chain installWithSource→installProtected is fully serial and mutually exclusive; uses live.ts to directly call loader `entry.update` so patch changes take effect without restart
- **Entry Files**: `src/index.ts:4669` (host apply) + `src/client/index.ts:75` (client apply)

## Applicable Scenarios

You will need it when encountering these situations during daily DSH usage: a profile crowded with plugins but forgotten what each does, wanting to install a third-party plugin but worried about breaking the profile, needing to copy a configured profile to another machine, or just trying to figure out which plugin depends on what and why something isn't working.

## Prerequisites and Compatibility

| Dependency | Minimum Version | Description |
|---|---|---|
| DSH Host | @deepseek-ai/cordis ^4.0.1, @deepseek-ai/dsh-tools ^0.1.0-rc.6 | Declared by peerDependencies |
| Validation Library | @deepseek-ai/schemastery ^3.18.1, js-yaml ^4.3.1 | Declared by peerDependencies |
| Node Types | @types/node ^22.0.0 | devDependencies, not hard-constrained in engines |
| Runtime Platform | Node host (cross-platform) + Web profile browser side | client.platform=web; host uses undici and node:fs, no native modules |
| Native Modules | None | Node built-in modules and undici only |

## Installation

```bash
dsh plugin --profile web add github:LX2000WASD/dsh-web-plugin-manager
```

## Configuration Options

| Config | Type | Description | Default |
|---|---|---|---|
| profile | string | Determines the target profile name for agent tools (plugin_status/install/uninstall/toggle) | `web` |

Other parameters (such as marketplace cache TTL, session TTL) are hardcoded in the source and not exposed via Config: `SESSION_TTL_MS` (15 minutes, src/installSession.ts:23), `REGISTRY_MAX_AGE_MS` (6 hours, src/registry.ts:80).

## FAQ

**Q: What is the relationship between this plugin and the official built-in plugin list?**

A: It explicitly disables the official read-only list `ui-settings-plugin-inventory` via `cordis.patch.yml:13-14`, registering its own catalog and manager Tabs as replacements; after removing this plugin, the official list automatically restores.

**Q: Strongly recommended to install the manager first before installing other plugins?**

A: Yes. The manager's quality gates run dependency graphs, undeclared imports, official package duplicates, and bundle patch line validation on every installation; health checks are available both at runtime and statically, significantly reducing "breaks after install, won't start after restart" situations.

**Q: What happens if I tell AI to install a plugin and it runs bare `dsh plugin add`?**

A: The tool guard registered by `src/guard.ts` will intercept `dsh plugin add/remove/update` and profile-directed `pnpm/npm/yarn/bun add/remove`, directly pointing to `plugin_install / plugin_uninstall / plugin_toggle` tools or `dshpm` CLI in the rejection reason, and the model will switch to the protected chain. There's also a permanent system prompt rule reminding about this.

**Q: What if environment variables like API Keys are needed during installation?**

A: `src/scan.ts` scans the repository's README/.env/package.json/yaml/install scripts before installation, matching TOKEN/KEY/SECRET/PASSWORD/PASS/CREDENTIAL pattern variables; on match, installation pauses and a form appears in the UI for filling in values, which are only injected into pnpm subprocess according to whitelist, other host-sensitive keys won't be passed to third-party prepare scripts.

**Q: How to use the command-line version?**

A: The plugin comes with a `dshpm` bin (in the profile's node_modules), with commands including `install / remove / update / mount / list / analyze / uninstall-kind`, all changes go through the exact same protected chain as the Web UI, and `--env KEY=value` can be used in non-interactive scenarios to continue installation.

**Q: How does the marketplace determine if a plugin I see is installed?**

A: Server-side `src/registry.ts` comprehensively determines via package name, repository URL bidirectional matching, git source (`gitHead`), and local directory detection; same-name package conflicts are automatically resolved; lists mark "installed" and disable duplicate installation.

**Q: Can health checks fix problems?**

A: Yes. Level A issues (duplicate line IDs, circular dependencies affecting startup) can be fixed with one click; Level B issues (peer version warnings, official package duplicates) require confirmation before fixing; semantic conflicts (same logic different names) cannot be detected because there's no same name to compare.

## Learning Curve

Beginner — after installation, new Tabs appear in "Settings", most operations can be done by clicking the UI; documentation only needed for advanced scenarios like CLI/quality gate whitelists.

## Known Issues and Limitations

- Disabling dependent entries may cause profile startup failure (official fail-loud design); need to manually delete the managed block in `cordis.patch.yml` to restore
- Installing bundle from git requires approving `pnpm allowBuilds` in terminal (command output echoes missing items)
- Random lines (mount lines without explicit IDs) cannot be enabled/disabled via this manager, because IDs change on every mount
- Git sub-package installation for monorepos requires specifying subdirectory with `#path:<dir>` convention, subdirectory must be within clone cache
- Quality gate may falsely flag plugins with undeclared runtime dependencies (conservative strategy), can be exempted via whitelist
- Official packages can only be peerDependencies by default, regular dependencies will install a second copy and hijack official loader lines; exemption whitelist is `@deepseek-ai/schemastery` and `@deepseek-ai/cosmokit` (see src/analyze.ts:55)
- Installation guard only intercepts agent tool calls, cannot prevent users from manually executing bare `dsh plugin` in terminal
- Local directory installation (non-git) update detection reports "undetectable"; git URL source requires manifest to record installed commit (`gitHead`)
- Health checks are static + best-effort: same-name registration conflicts rely on source code regex scanning (dynamically constructed names cannot be detected); semantic conflicts have no same name to check, not within detection scope
- Dependencies manually installed via official CLI will not be automatically mounted, this manager will show "not mounted" and provide "mount"/`dshpm mount`, won't擅自 change profile behavior
- Environment variable filtering only covers TOKEN/KEY/SECRET/PASSWORD/PASS/CREDENTIAL patterns, unmatched host variables may still enter pnpm resolution process during git source installation (installed as link semantics, third-party scripts not executed)
- Marketplace proxy only reads `HTTP_PROXY`/`HTTPS_PROXY`; system proxy/rule-based accelerators are ineffective on Node processes (undici doesn't read system proxy)
- Marketplace index project (DSH-Plugins-Marketplace) is third-party maintained; GitHub API unauthenticated rate limit of 60/h only affects star count enrichment for catalog unique entries, list itself is unaffected

---

This document is auto-generated by [deepseek-plugin.org](https://deepseek-plugin.org). HTML page: [dsh-web-plugin-manager](https://deepseek-plugin.org/plugins/LX2000WASD/dsh-web-plugin-manager)
Wiki generated by AI (model: `MiniMax-M2.7`)