One-Line Summary

dsh-plugin-hub is the plugin management panel for DeepSeek Harness: it packs plugin install/uninstall/start/stop, browsing the plugin marketplace, searching GitHub/Gitee/custom sources, installing skills and Agent presets, and one-click DSH framework upgrades—all into a single Tab in the settings page. No more returning to the terminal to run dsh commands.

Core Features

• One-click enable/disable of installed plugins in the "Plugin Management" Tab on the settings page (writes user patch layer, HMR takes effect in ~1 second), with automatic shielding of protected host infrastructure entries
• Browse built-in static plugin index (500 plugins + 300 skills, auto-refreshed every 6 hours via CI), search GitHub/Gitee/custom sources by keyword
• One-click install plugins or skills, automatically tries configured software sources in primary→backup order via npm registry, curl channel, and git channel; gives local AI fallback with cost authorization prompt on failure
• Software source management: add/edit/set primary npm registry source, built-in GitHub and Gitee (direct repo install mode), add arbitrary custom search sources with header authentication support
• Detect npm new versions for installed plugins and check sub-package配套 (compatibility), avoid half-updated mixing causing startup conflicts
• One-click DSH framework upgrade (backup → online install → verify → auto restart), with real-time progress, automatic rollback on failure, and timeout protection

Technical Implementation

• Language: JavaScript (ESM, Node built-in modules preferred)
• Key Dependencies: All Node.js built-in modules (node:fs/promises, node:https, node:child_process), zero external dependencies
• Architecture: Cordis plugin + custom HTTP route table, registers loopback /plugin-console/* routes via apply(ctx); client bundle injected into settings panel via dsh.client.inject
• Entry Files: lib/index.js (host side); lib/client.js (browser-side bundle, settings page Tab)

Use Cases

You've installed DSH and want to casually install/uninstall third-party plugins without memorizing dsh plugin add commands and version numbers; or you want to browse what dsh plugins are available on GitHub and check if your installed plugins have new versions; when prompted for framework upgrades, you can complete the upgrade with one click in the panel instead of manually backing up, running commands, and restarting.

Prerequisites & Compatibility

Installation

dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Configuration

This plugin requires no additional configuration in files. Runtime environment variables and software sources are set via UI in "Plugin Management → Software Sources", common items as follows:

FAQ

Q: Which DSH profile do I install this plugin into to see the GUI?

A: Install into DSH's built-in web profile. DSH's other profiles don't start Web GUI; this plugin's client bundle only loads in web profile; installing into other profile locations only gets background routes without interface.

Q: Why are some plugins on the panel marked "protected" with grayed-out toggles?

A: Those are host infrastructure entries (Cordis loader, HMR, WebServer, storage, settings chain, etc. 70+ core modules). Disabling would break hot reload itself, so the panel forbids toggling—this is a protection mechanism, not a bug.

Q: I see an "Authorization Pending" popup, should I agree?

A: It only pops up when all three deterministic channels (config source / curl / git) fail, explicitly telling you "Will call DeepSeek API model, may incur API costs". You can click "Cancel", or check "Don't remind me again", or turn it off completely in the AI fallback master switch at market page bottom (zero API costs after turning off).

Q: Why can't I search anything on Gitee source with keywords?

A: Gitee official search API has been discontinued, so Gitee source uses "direct repo install mode": enter complete repo path (supports Chinese and full URL), panel searches by exact path and installs, not keyword search.

Q: I added a custom registry but installation failed, what to do?

A: The panel will auto-fallback to built-in sources (npmmirror / npmjs) after custom source install failure continues trying; if all fail then goes to curl and git channels. You can also edit name or set as primary source in software source management; delete button is disabled to avoid accidentally deleting sources that plugin installations depend on.

Q: Why did my old custom functions disappear after DSH upgrade?

A: This is because DSH framework files were overwritten. This plugin detects version changes and automatically reapplies "cordis.patch.yml parsing tolerance patch" (issue #5), backs up old version snapshot to ~/.dsh/plugin-console/framework-backups/; if still abnormal after restart, you can manually run scripts/apply-framework-patch.cjs from the repo.

Q: I installed a skill but can't find it in DSH?

A: Skills are installed to ~/.dsh/skills/<name>/, discovered by scanning @deepseek-ai/dsh-skill-filesystem plugin. If that plugin isn't enabled in current profile, skills go dormant—enable dsh-skill-filesystem in profile's cordis.yml and restart.

Q: Where is data saved? Is uninstall clean?

A: Software source config: ~/.dsh/plugin-console-sources.json; framework upgrade snapshots: ~/.dsh/plugin-console/framework-backups/; installed skills: ~/.dsh/skills/<name>/; install timestamp: <profile>/node_modules/<pkg>/.dsh-installed-at. Uninstalling this plugin won't delete other installed plugins, but state files under ~/.dsh/plugin-console/ can be manually cleaned.

Learning Curve

Beginner — install to web profile and restart, common functions (toggle installed plugins, install/uninstall) are completed in a few clicks in the panel, no documentation needed; when encountering edge cases like "protected", "AI fallback authorization", "sub-package配套", just glance at README.

Known Issues & Limitations

• Host code changes require restarting DSH service to take effect (client changes only need page refresh); the restart button in the panel goes through daemon bring-up, no manual action needed
• Real-time GitHub search depends on GitHub accessibility (browser direct connection + server-side multi-channel race fallback); network black hole period may return in 5-15 seconds
• Version detection only works for packages published to npm; skill-type repos have no version concept
• Static index has 500 plugins + 300 skills cap per build, new repos need star climb or wait for next 6-hour CI cycle to enter index
• ★ marked search results need 1-3 seconds background completion, may temporarily show empty when opening market
• Gitee official search API has been abandoned, only supports direct repo install mode (exact owner/repo match), no keyword search
• Third-party bundle-type plugins (like some aggregator repo sub-packages) auto-install skipped by default (to prevent bundle incompatibility with DSH version causing startup crash), need manual install via "official install method" in detail panel

English: README.md | 中文: README.zh.md

---

DSH Plugin Hub (dsh-plugin-hub)

A plugin management panel for the DeepSeek Harness (DSH) Web GUI: one-click enable/disable of installed plugins, plus a multi-source plugin marketplace (GitHub / Gitee / custom sources) with one-click install — and an auto-collected static plugin & skill index refreshed by CI every 6 hours.

• Highlights
• One-click install
• Usage
• Features
• How it works
• Compatibility
• Project layout
• HTTP endpoints
• Local AI fallback & consent dialog
• Framework patch (cordis.patch.yml parse tolerance)
• Security
• Disclaimer
• Known limitations
• Help
• Ecosystem & discoverability
• Support
• Changelog
• License

---

Highlights

For plugin authors: add the dsh-plugin topic to your repo — the official topic list is how both the ecosystem and this hub discover you. For skills, add agent-skills / claude-skills / dsh-skill.

---

One-click install

Option 1: official command (recommended)

The plugin declares a dsh.bundle manifest, so a single command installs and enables it:

dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Uninstall / reinstall (update):

dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.

Option 2: deploy script (fallback when network is restricted)

Windows (PowerShell):

git clone https://github.com/Noob-stupid/dsh-plugin-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"

Linux / macOS:

git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh

The script copies the plugin into $DSH_HOME/profiles/<profile>/node_modules/ and idempotently appends an enable entry to cordis.patch.yml. Afterwards:

1. Restart the dsh service (host code changes need a process restart; CLI restarts the process, the desktop client exits and reopens);
2. Refresh the page → Settings → Plugins → Plugin Console.

Option 3: hand it to an AI in one sentence

Install the DSH plugin hub (dsh-plugin-hub): run dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub; if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to ~/.dsh/profiles/web/node_modules/ and register it in cordis.patch.yml (id: plugin-console, name: @deepseek-ai/dsh-plugin-console). Restart dsh web afterwards.

Requires: DSH ≥ 0.1.0-rc.6 (web profile, with dsh-client-modules / dsh-host-plugin-inventory).

---

Usage

1. Restart DSH → open the Web GUI → Settings → Plugins → Plugin Console.
2. Installed list: toggle plugins on/off (HMR applies within ~1s), search by name/id, expand details (version, repository, README summary).
3. Marketplace: empty query on the GitHub source opens the static index (instant); type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom); ⊞ merges all sources; ★ filters to dsh plugin add-installable packages.
4. Skills tab: switch 插件/技能 next to the search box to browse and install skills (cloned into ~/.dsh/skills/<name>/).
5. Install: click 添加到本地 → the chain runs in the background (safe to leave the page); 「检测更新」/「更新 → vX」 appear automatically for installed entries.

---

Features

Installed plugins (one-click toggle + details)

• Shows only third-party plugins by default (extra/non-bundled), tagged "Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);
• Lists every plugin entry (name, load state, enabled state); search by name/id;
• Disable = append - id: X + disabled: true to the user patch layer, effective via HMR;
• Enable = remove that entry; bundle-layer rows disabled by default are overridden with disabled: false;
• Tags "Patch-disabled / Patch-forced" distinguish user patch state;
• Infrastructure protection: host transport/hmr/storage/settings chain plugins (70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;
• Details panel: version, repository/homepage links and a README summary for each plugin;
• Version check: 检测更新 reads npm dist-tags.latest (curl channel, works even when node networking is blocked) and warns about subpackages that need syncing (depsOutdated).

Framework one-click upgrade (deepseek-harness card)

• The deepseek-harness card shows 「框架升级 → vX」 when a newer framework version is available (stable latest preferred; next channel when latest equals the installed version); clicking runs the full flow: backup config + framework snapshot (rollback point) → online install (service stays up, page never disconnects) → version verification → auto-restart to apply;
• Real-time progress: a DSH-Upgrade console window pops up showing live pnpm download progress; the in-panel progress card shows the waiting time;
• Upgrade protection: failed installs auto-rollback (robocopy, backup verified before upgrade), version check catches fake success, 10-min hard timeout, stall detection (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state cleanup — the framework is never left broken;
• pnpm channel: npm-cli.js freezes at startup in the schtasks task environment (0-byte debug log, no network requests ever sent); upgrades use corepack pnpm (starts in ~0.4s, installed rc.8 in 11.5s) against the npmmirror (China) registry, with dangerouslyAllowAllBuilds so native modules (node-pty/koffi) compile;
• Runtime bin resolution: under the pnpm layout @deepseek-ai/dsh is a Junction — the relaunch step resolves bin.js at runtime (follows the Junction to the current version) instead of using a path baked in at script-generation time;
• Card dismiss semantics: terminal states (done/failed) are permanently dismissed on ✕ (persisted); in-progress dismissal is session-only and the card returns after a refresh.

Marketplace (multi-source)

• Source switcher: click the login pill to switch between GitHub / Gitee / custom sources (persisted); title, loading text, placeholder and note all follow the source;
• GitHub: default query dsh-plugin, browser-direct with server fallback;
• Gitee: official search API is retired, so it uses direct-repo mode — enter owner/repo (Chinese paths and full URLs supported) to find and install a repository;
• Custom sources: add in Source Manager (URL template with {q}/{page} placeholders), optional header auth (e.g. Authorization: Bearer ...), and local/private http URLs;
• Multi-source summary: the ⊞ toggle searches GitHub + all custom sources in parallel, merging results with source labels;
• ★ official filter: shows only packages installable via dsh plugin add — root packages with a dsh.bundle manifest (official) or aggregate repos whose subpackage carries dsh.bundle (subpackage-installable); markers are enriched by the server (curl dual-channel) with a client-side fallback;
• Type badges: 官方 / 聚合 / 技能 (repo contains SKILL.md) recognized automatically.

Static index market (plugin & skill tabs)

Hybrid architecture: browsing uses the static index (instant, zero GitHub API calls), searching uses live channels (GitHub search API / multi-source parallel) — they complement each other: a brand-new repo can be found by live search even before it enters the index.

• Empty query on the GitHub source shows the static index (marketplace/index.json, jsDelivr CDN + 10-min host cache): 500+ plugins by stars, instant, zero GitHub API calls;
• 插件 / 技能 tabs next to the search box: the skills tab lists auto-collected agent-skills ∪ claude-skills ∪ dsh-skill repos (up to 300);
• Auto version check: installed entries in the market are checked against npm dist-tags.latest in the background — cards turn into 「更新 → vX」 buttons;
• Skill install: skill entries install by git-clone into ~/.dsh/skills/<name>/ (frontmatter name wins over repo name; SKILL.md found at repo root or first-level subdirectory). Installed skills show a grey 「已装」 badge.

Source Manager

The floating "Sources" button (right of the title row, semi-transparent) opens the manager:

• Install sources (registry): add / inline edit / set primary / restore defaults; private and intranet addresses supported; deletion is protected (install-critical);
• Search sources: built-in GitHub, Gitee + custom search sources (add/remove, 🔒 shows header count);
• Gitee login (optional): direct mode needs no login; login only raises rate limits — create a third-party app (gitee.com → Data management → Third-party apps, scopes user_info, projects), fill client_id / client_secret, save, then authorize.

---

How it works

Toggle semantics

The DSH web profile is composed of a bundle patch layer plus the user patch layer ($DSH_HOME/profiles/web/cordis.patch.yml); patches are per-key overrides. Toggling a plugin just appends/removes two YAML lines:

- id: plugin-entry-id
  disabled: true

The config watcher (HMR) recomposes within ~1s — no restart needed except for host code.

Install chain

configured registries (primary→backup, default npmmirror → npmjs)
  → curl manual install        (node networking blocked: tarball into node_modules)
  → git channel                (GitHub via proxy+direct, Gitee via its platform)
  → EPERM stale-dir cleanup retry
  → repository subpackage expansion (aggregate packages first)
  → local AI fallback          (behind an explicit cost-consent modal)

Skills install directly by git clone --depth 1 → copy SKILL.md bundle into ~/.dsh/skills/<name>/ (no npm, no patch, no restart).

Data sources

GitHub Actions (every 6h, repo token)
  └─ scripts/build-index.cjs: pages topic:dsh-plugin (500 by stars) + skills topics (300)
       └─ commits marketplace/index.json back to main
            └─ host reads it via jsDelivr CDN (10-min cache) → instant market, zero API calls
                 └─ live search still uses the GitHub search API (browser-direct + server channel)

Version detection & installed recognition

• Installed recognition: match installed entries by repository field or module name against market items (repo name → package name mapping);
• Version detection: check-update reads npm dist-tags.latest via curl; for aggregate packages it also compares subpackage declared vs actual versions (depsOutdated) to prevent mixed-version startup conflicts.

---

Compatibility

• Supports the DSH 0.1.0 series (0.1.0-rc.6 and siblings).
• The panel reads the running @deepseek-ai/dsh-web-app version: after a breaking upgrade (0.2 / 1.0) a compatibility warning appears instead of silent failure.
• Likely breaking seams: patch semantics, webServer.register, loader entry shape, dsh.client bundle format, settings.plugins.tab slot.
• Deploy scripts do not check versions; the in-panel warning is authoritative.

---

Project layout

lib/index.js       Host plugin (/plugin-console/* routes + patch I/O + multi-source search + install)
lib/client.js      Browser bundle (ModuleLoader format, settings tab)
scripts/build-index.cjs        Index builder (plugins --limit 500 / skills --skills --limit 300)
scripts/apply-framework-patch.cjs   Framework patch (issue #5, idempotent)
.github/workflows/registry.yml Auto-collection CI (every 6h + manual dispatch)
marketplace/index.json         Generated static index (jsDelivr CDN)
deploy.ps1 / deploy.sh   One-click deploy scripts (Windows / Linux·macOS)
test-harness.mjs   Logic self-test (state/toggle/validation/loopback; search SKIP by network)

---

HTTP endpoints

---

Local AI fallback & consent dialog

Installation goes through a deterministic channel chain: configured sources (primary→backup) → curl manual install → git channel → EPERM cleanup retry → repository subpackage expansion. Only when all deterministic channels fail does the local AI fallback take over.

What it is: a local AI subagent takes over the install — it diagnoses like a human (inspects repo structure, finds subpackages/aggregate packages, cleans leftovers), installs with the right package manager and writes the config. Note: this step calls a DeepSeek API model and may incur API costs.

Consent dialog (cost transparency):

1. After all deterministic channels fail, the task enters "waiting for authorization" and a top-most modal appears:
   • explicitly states "will call a DeepSeek API model, may incur API costs"
   • offers Approve, continue / Cancel (Cancel = zero cost)
   • auto-cancels after 10 minutes
2. The modal offers "Don't ask again" (auto-approve) — restorable at the bottom of the marketplace page.
3. The floating "AI fallback" toggle can disable the feature entirely: deterministic failures cancel the install, never calling a model API (zero cost).

---

Framework patch (cordis.patch.yml parse tolerance)

Problem (issue #5): if cordis.patch.yml contains a top-level [] placeholder plus later entries (two YAML root nodes), DSH fails at startup: end of the stream or a document separator is expected.

Fix location: parsePatchList in the DSH framework dsh-app-boot — on parse failure, top-level empty-array placeholder lines are dropped (treated as no-op) and parsing retries; normal files, pure [] files, and indented sub-arrays are unaffected.

Apply (re-run after every DSH upgrade, which overwrites framework files):

node scripts/apply-framework-patch.cjs

The script locates dsh-app-boot/lib/index.js in the npx cache, skips when already patched (idempotent), and keeps a .bak-issue5 backup on first apply.

---

Security

• All routes are loopback-only;
• GitHub metadata is used only to discover public plugins; npm installs keep full TLS validation against the registry;
• GitHub search is browser-direct; Gitee/custom source requests and headers (including credentials) are handled server-side only and never shipped to the browser;
• Custom source URLs accept https and local/private http only (127.0.0.1, localhost, 10.x, 192.168.x, 172.16-31.x, etc.);
• Skills are plain files (SKILL.md + assets) — installing a skill does not execute code; the git clone comes from the repo you chose, review the repo before installing.

---

Disclaimer

• The marketplace lists third-party repositories from GitHub; each plugin is developed and maintained by its own author and has no affiliation with DeepSeek Harness or this hub.
• This hub makes no warranty about any plugin's quality, reliability, security, license compliance or compatibility. Listing is not an endorsement — install means you have reviewed and accepted the risk. Read the repo source and README before installing.
• This hub is provided AS-IS; neither the hub nor its developers are liable for any damage (data loss, system damage, privacy leaks) caused by installing or using third-party plugins.

---

Known limitations

• Host code changes require a service restart (the panel's restart button is watchdog-safe); client changes just need a page refresh;
• Live GitHub search depends on GitHub reachability (browser-direct + server fallback; during network-blackout windows retry later);
• Version detection works for npm-published packages; skill-type repos have no version concept;
• The static index is capped (500 plugins / 300 skills per build); authors bump their star count or wait for the 6h CI cycle to enter the index;
• Skills are discovered by dsh-skill-filesystem — if the current profile does not enable that plugin, installed skills stay dormant until it is enabled and DSH restarted.

---

Help

• Panel missing: restart dsh → refresh → Settings → Plugins → Plugin Console.
• Toggle does nothing: infrastructure rows are "Protected" (by design); normal toggles take effect via HMR within 1-3s.
• Compatibility warning: a breaking upstream release arrived; see Compatibility.
• Search empty/fails: GitHub uses browser-direct (falls back to the server channel); Gitee is direct-repo mode (enter owner/repo); check custom-source URL/headers; retry during network blackout windows.
• ★ filter empty: ★ shows only dsh plugin add-installable packages (official + subpackage-bundle aggregates); markers are backfilled in 1-3s — no false "none" report.
• Install fails: confirm the repo has package.json and the package is published; npm failures fall back to git install; switch the primary source if npmmirror is unstable.
• Skill not found by DSH: enable @deepseek-ai/dsh-skill-filesystem in the profile (cordis.yml) and restart; skills live in ~/.dsh/skills/<name>/.

---

Ecosystem & discoverability

• Listed on awesome-dsh-plugin (the community main list) and DSH Directory;
• This hub's own auto-collection index (500+ plugins / 300 skills, refreshed by CI every 6h) includes any repo tagged dsh-plugin / agent-skills / claude-skills / dsh-skill — tag your repo and it appears in the market automatically, no application needed;
• If you build DSH plugins, this panel is your distribution channel: one-click install for every user of the hub.

Support

If this panel saves you time or makes DSH more fun to use:

• ⭐ Star this repo — it directly helps more DSH users find it;
• Share it with DSH users or in DSH communities;
• Submit your own plugin (tag it dsh-plugin) to grow the ecosystem;
• Found a bug or want a feature? Open an issue.

---

Changelog

See CHANGELOG.md.

---

License

MIT