zat-dsh-engine

一句话定位

zat-dsh-engine 是 DeepSeek Harness 的可视化插件市场：在网页端「设置 → 插件」里点开 🛒 插件市场，就能搜索 GitHub 上打 dsh-plugin 标签的全部社区插件、一键安装/更新/卸载，并自带国内镜像、AI 找插件、装前体检与安全扫描、对话管理和自更新。

核心能力

• 浏览和搜索 GitHub dsh-plugin 主题社区的全部插件，按 12 个分类筛选，支持中英双语简介和实时搜索（无需回车）
• 一键安装 / 更新 / 卸载：底层走宿主 pnpm，安装/卸载/启停都带实时进度条、自动回滚与一键备份；失败时还原 profile 并提示怎么救
• 装前体检 + 安全扫描：自动检查入口文件、构建脚本、官方包依赖写法、peer 依赖、运行命令、系统/CPU 支持、网络去向、混淆/可疑外发；客观硬伤直接拦，模糊风险只提示
• AI 找插件：模型调用 find_plugin 工具按用户描述搜索市场，每个候选自动附带装前体检与安全扫描结论（✅/⚠️/❌），不盲目推荐
• 国内无 VPN 也能用：镜像优先 → 系统代理 → 直连 → curl → wget → Node fetch 六级降级，npm 走 npmmirror 加速
• 一键检测 / 修复 / 启停 / 星标 / 自更新 / 对话管理：扫描全部已装插件的冲突/缺失依赖/系统兼容/挂载行重复；卡片上直接启停、复用本机 git 凭据点星（不弹登录窗）；设置页多出 🗑 对话管理标签页，可永久删除已归档会话

技术实现

• 语言: TypeScript（Node ESM 宿主 + 浏览器 CJS 客户端，React 18 写 UI）
• 关键依赖: @deepseek-ai/cordis ^4.0.1（宿主框架，peerDep）；@deepseek-ai/dsh-typert-protocol（Typert Remote 服务协议，peerDep）；js-yaml ^4.1.0（解析 cordis.patch.yml 的 !!js 语法）；zod ^4.0.0（手写 typert-loader 清单的 schema 定义）
• 架构模式: 双形态 Typert 插件 —— 宿主侧在 cordis Loader 里通过 cordis.patch.yml 注入一个 plugin-market 行（自动挂载一个 Remote 服务，命名空间 pluginMarket，22 个 @Remote 方法）；客户端侧在浏览器用 React 组件 + Typert strict descriptor 远程调用宿主方法，并在 settings.plugins.tab 和 settings.section 两个 slot 上注册 🛒 插件市场 与 🗑 对话管理 两个标签页
• 入口文件: 宿主入口 src/index.ts（export default ZatMarketGateway，4004 行）；客户端入口 src/client/index.tsx（export const inject、export async function apply(ctx)，1647 行）；构建配置 tsdown.config.ts（ESM + CJS 双产物，宿主走 Node ES2024、客户端走浏览器 CJS）

适用场景

日常用 DSH 网页端、想从社区里挑插件而不是手敲 dsh plugin add 命令的普通用户；在没 VPN 的国内环境想装/更新插件的人；插件装多了不确定哪个冲突、想一键体检修复的人；以及想用 AI 帮自己找插件、又想看到每个候选是不是真能装的人。

前置依赖与兼容性

安装方式

dsh plugin --profile web add github:mishibeikejie/zat-dsh-engine

安装后请重启 dsh，市场才会出现在设置页里。

配置项

其他系统代理、HTTP_PROXY / HTTPS_PROXY 等环境变量会被自动识别并优先用于网络请求；profile 名也可在 dsh plugin --profile <name> ... 里直接指定（src/index.ts:1850-1853 / src/index.ts:1693-1731）。

常见问题

Q: 「全部」视图最多只显示 1000 个插件，其他怎么找？

A: 这是 GitHub 搜索 API 单次查询的硬上限。在搜索框里输入关键词或用分类筛选，能绕过这个限制命中任意插件（src/index.ts:2430-2472）。

Q: 装某个插件之后 dsh 起不来了，怎么办？

A: 市场每次成功操作后都会把 package.json / cordis.patch.yml / pnpm-lock.yaml 这三个文件备份到 profile 目录下的 zat-backup/，并把装崩前的 bundle 列表从启用名单里移走。按 README 给的命令（macOS/Linux 用 cp ~/.dsh/profiles/<你的profile>/zat-backup/* ~/.dsh/profiles/<你的profile>/，Windows 用 PowerShell 的 Copy-Item）把三个文件拷回去重启即可（src/index.ts:960-1000 / README.zh.md:101-108）。

Q: 装了某个插件显示「不支持当前系统」被直接拦下来，是什么意思？

A: 这是装前体检的客观硬伤之一。插件的 package.json 里有 os（如 ["linux"]）或 cpu（如 ["!arm64"]）字段声明了支持范围，与你当前系统不匹配就会拦截——这种情况下装了也会让 dsh 起不来。如果插件确实能在你机器上跑，建议联系作者修正 manifest（src/index.ts:1302-1309 / src/index.ts:1497-1503）。

Q: 为什么点星标需要我提供 GitHub Token？我不想登录。

A: 市场从不强制弹窗——优先读 GITHUB_TOKEN / GH_TOKEN 环境变量、本地 zat-market.json 里你保存过的 Token，都没有才会非交互地读 git 凭据助手（只读已保存的，绝不触发登录弹窗）。没凭据也不会报错，只是点星会失败并提示怎么填 Token（src/index.ts:3868-3922）。

Q: 安装时报 pnpm 找不到怎么办？

A: 在设置页里点「🩺 一键检测」然后点「一键修复」，市场会自动跑 corepack enable，不行再 npm i -g pnpm，装好后继续原流程；终端里手动一行命令也能解决（src/index.ts:3684-3692）。

Q: 我装了某个插件，但市场列表里还是显示「安装」按钮？

A: 缓存里残留了旧的「未安装」状态。点一下列表右上角的刷新，或重启 dsh 让缓存重新加载；如果还是不行，跑「一键检测」通常能识别出冲突或禁用状态（src/index.ts:2404-2413 / src/index.ts:3528-3535）。

Q: 两个市场插件能同时装吗？

A: 不能。安装门会拦：两个市场类插件（mishibeikejie/zat-dsh-engine、lx2000wasd/dsh-web-plugin-manager、sanqi-normal/dsh-webui-market-plugin，或名称/行为符合「市场/插件市场」模式的）会注册相同的设置页与服务，互相覆盖甚至让 dsh 起不来（src/index.ts:62-66 / src/index.ts:1007-1037）。

Q: 市场怎么升级？会不会把自己卸了？

A: 启动后自动比对 GitHub HEAD 版本，新版就在标题旁显示更新按钮，点击走与安装相同的镜像回退链路。卸载接口明确拒绝从市场内部调用 uninstall('zat-dsh-engine')，必须用官方 dsh plugin remove（src/index.ts:2804-2876 / src/index.ts:3043-3047）。

上手难度

入门 — 装好重启即用，零配置即可浏览/搜索/安装社区插件；遇到 pnpm 缺失、网络不通、入口缺失、挂载行冲突等具体问题时，市场会用中英双语给出可操作的指引和「一键修复」按钮，不需要查文档。

已知问题与限制

• 同一个 profile 里两个插件声明了相同的 loader row id 时会被体检出来，禁用其中一方或手动选择；新装的插件如果与已启用插件 id 重复会在装前体检就拦住（src/index.ts:3542-3553 / src/index.ts:1310-1316）
• 大型 GitHub 源插件（整仓下载）在慢网下可能比较久，进度条会随 pnpm 实时输出更新；如果 60 秒内没动静，src/index.ts:1857-1968 这条链会自动换直连或镜像
• pnpm 默认会拦依赖的 prepare/preinstall 构建脚本，市场会在装前/出错时自动把对应包名写进 pnpm-workspace.yaml 的 allowBuilds 再重试一次；如果重试仍失败，需要手动确认（src/index.ts:2279-2295 / src/index.ts:939-954）
• 静态安全扫描只能提示、不能证明安全：它把混淆/读敏感凭据/可疑外发地址这类模式摆出来，但误判也常见（比如「给 Discord/Telegram 发通知」的插件就会命中 webhook 钩子），所以只警告不拦截——真正的硬拦截交给入口缺失/系统不支持这些客观项（src/index.ts:488-524 / src/index.ts:1354-1362）
• 通过 link: / 本地路径安装的市场自身不会从 GitHub 检查更新，避免本地改动被远程覆盖；想换回 GitHub 版需先卸载再装（src/index.ts:2809-2823）
• 当 DSH 安装在 macOS 的 /Applications 里且子进程拿不到完整 PATH 时，安装时市场会自动补 /opt/homebrew/bin、/usr/local/bin、~/.local/bin 等常见路径；极少数 PATH 完全为空的场景仍需在终端里启动 DSH（src/index.ts:1638-1666 / src/index.ts:1834-1855）
• 「全部」视图受 GitHub 搜索 API 单次 1000 条上限限制，搜索框和分类筛选能命中任意插件（src/index.ts:2430-2472）
• 同一候选插件如果名字/作者看起来像市场但实际不是，已通过功能特征检测（pnpm / dsh plugin / slots.register）+ 已知仓库清单的双重判断兜底，但仍可能漏掉新出现的同类插件（src/index.ts:78-82 / src/index.ts:1173-1177）

The visual plugin marketplace for DeepSeek Harness. Browse, search, install, update and uninstall community plugins — Wallpaper Engine style.

English · 中文说明

Zat-DSH Engine adds a Plugin Market tab to Settings → Plugins in the DeepSeek Harness web GUI. It lists the entire dsh-plugin topic community from GitHub, shows bilingual intros, and installs plugins with one click.

Features

• Full community catalog — live GitHub search of the dsh-plugin topic (1700+ repositories, growing daily)
• AI plugin finder — in any conversation just say what you need (e.g. "find me a plugin that lets the model see images") and the AI searches the market, recommends candidates, and reports each one's pre-install health + security scan (✅/⚠️/❌) — problems are reported honestly, nothing is blindly recommended
• 12 categories — Theme, Tools, Browser, Skills, Vision, Network, Agents, Data, Hardware, Design, Security…
• Live search — type to filter, no Enter key needed; clearing the box returns to the full list
• Bilingual intros — 999 pre-translated Chinese intros bundled; new plugins are translated on the fly by your current model; English UI shows the original GitHub description
• Install / Update / Uninstall — one click, powered by the official dsh plugin profile mechanism (pnpm under the hood)
• Monorepo-aware install — repositories that bundle several plugins install correctly: a single-plugin repo installs silently, multi-plugin repos offer a plain-language picker
• Installed detection — marks plugins you already have, with version comparison and an update badge when a newer version is released
• Cross-platform — full Windows and Linux support (PowerShell / sh, curl / wget, system-proxy aware)
• Network auto-adaptation — inherits your VPN/system proxy for fetching and installing; if GitHub is unreachable, requests automatically fall back to gh-proxy.com and recover. Works without a VPN: proxy → direct → mirror → built-in fetch fallback
• One-click enable/disable — toggle plugins right on the card (official core and the market itself are protected)
• Pre-install conflict gate + 🩺 health check — blocking two marketplaces at once, official-package hijack, duplicate patch rows / registered names; one-click health report on conflicts and dependency issues
• Pre-install health + security scan — every candidate is checked before install (entry files, build artifacts, dependency style, network destinations, OS support); the security scan catches obfuscation/credential theft/exfiltration but only warns (no false positives); objective issues (missing entries, unsupported OS) are blocked
• One-click check + repair — detects network/pnpm/entry/OS/past-error problems in one click, auto-fixes what it can (installs pnpm, enables plugins, fills deps), and explains the rest
• Safe by default — install/uninstall/toggle roll back automatically on failure; a last-known-good backup restores a broken profile with one command
• Live progress bar — install/update/uninstall show a bar right on the card (percent + live counts); progress survives leaving and re-entering the market
• One-click star — reuses your local git credentials to star repos; badge color legend, auto-fading notices
• Self-update — a button appears beside the title when a newer version of the marketplace itself is available

Installation

⚠️ Install it with the command below — do NOT hand-edit any patch file. Letting an AI "install" this project by pasting the repo URL and manually editing cordis.patch.yml breaks dsh: the market's own plugin-market row is auto-mounted by dsh from the bundled patch, and writing it by hand into two places (app.asar.unpacked/cordis.patch.yml and ~/.dsh/profiles/<profile>/cordis.patch.yml) duplicates the id and makes dsh fail to start. If dsh already won't start, delete the hand-written plugin-market row from your profile's cordis.patch.yml and reinstall with the command below.

From GitHub (recommended, after release)

dsh plugin --profile web add github:mishibeikejie/zat-dsh-engine

From China without a VPN (via the domestic mirror, verified)

dsh plugin --profile web add https://gh-proxy.com/https://github.com/mishibeikejie/zat-dsh-engine.git

Either command installs the same plugin. Once installed, the market's own search and install paths carry the mirror fallback, so networking is handled for you.

From a local checkout

git clone https://github.com/mishibeikejie/zat-dsh-engine.git
dsh plugin --profile web add ./zat-dsh-engine

From npm (if published later)

dsh plugin --profile web add zat-dsh-engine

Replace web with your profile name if you use a different one (headless etc.).

Requirements: a working dsh installation, pnpm and curl on PATH, and a profile that has been initialized (dsh plugin --profile web add creates it on first use).

Usage

1. Restart dsh after installing.
2. Open the web GUI → Settings → Plugins.
3. Click the 🛒 Plugin Market tab on the right of the plugin list.
4. Browse, search, filter by category or install state, and click Install on any card.
5. Restart dsh to activate installed plugins.

Update

dsh plugin --profile web add github:mishibeikejie/zat-dsh-engine

Re-running add updates to the latest commit. The marketplace also detects its own updates and shows an Update button beside the title.

Uninstall

dsh plugin --profile web remove zat-dsh-engine

FAQ

The market shows at most 1000 plugins in the All view. GitHub's search API caps any query at 1000 results. Search and category filters reach every plugin regardless.

Why do I need a model for Chinese intros? 999 intros ship with the plugin. Only plugins released after the snapshot are translated on the fly, using the model you selected in dsh.

Is the mirror safe? The mirror is only used when a direct GitHub request fails, and only for public repository metadata.

dsh won't start after installing a plugin — how do I recover? After every successful install/uninstall/toggle, the market backs up the last known-good state into the zat-backup/ folder inside your profile directory. Restore it by copying the three files back over the profile directory.

In the commands below, web is your profile name: everyone using the web GUI has the profile web (unless you started dsh with a custom name — if unsure, open the market and look at the "Profile:" line in the footer; use whatever it says):

# Windows (PowerShell)
Copy-Item "$HOME\.dsh\profiles\web\zat-backup\*" "$HOME\.dsh\profiles\web\" -Force

# macOS / Linux
cp ~/.dsh/profiles/web/zat-backup/* ~/.dsh/profiles/web/

Then start dsh again. This restores the state right after the last successful operation, so the plugin that broke startup is removed from the enabled list and the profile boots normally.

Can I install two marketplace plugins at once? No — the install gate blocks it: two market/manager plugins register the same settings pages and services, which can take dsh down. Uninstall the current one first if you want to switch.

Permissions & trust (security-review perspective)

This marketplace is at heart a package manager, and that job itself requires strong capabilities. A security review will always see the behaviors below — here is what each one is for and where its boundaries are:

• Running shell commands: install/update/uninstall means running pnpm. The market only runs the pnpm/curl/wget/powershell commands it assembles itself; during install, pnpm runs the plugin's own prepare/postinstall scripts (standard behavior for every package manager) — the market scans those scripts first and warns ahead of time about network downloads or high-risk patterns.
• Reading git credentials: used in exactly two places — starring a repo and the "set GitHub token" feature. Credentials only go to api.github.com; they are never written to disk, logged, or sent anywhere else.
• The gh-proxy.com mirror: only as a fallback when a direct GitHub request fails, and only for public repository metadata. A plugin's own network behavior after install has nothing to do with the mirror.
• Reading/writing profile files: install/uninstall/toggle must edit the profile's package.json etc. Every change is backed up to zat-backup/ first, and failed operations restore automatically.
• Pre-install health + security scan: every candidate and every installed plugin is scanned for structural, dependency, and security patterns (obfuscation, credential theft, suspicious exfiltration, system modification), with all network destinations listed before install; security findings only warn (never block), while objective issues like missing entries or unsupported OS are blocked.

Each of these is the minimal permission set required for the market to work; if a review questions a specific behavior, this section is the reference.

Changelog

v0.6.1

• Removed a stray third-party theme dependency (@deepseek-ai/dsh-client-ui-aqua) that was forcing an unaudited glassmorphism theme into every install and triggering pnpm 11's exotic-subdep block — the market never used it, so installs are now clean
• New: hand-written duplicate patch row detection — the health check flags a plugin-market-style insert id in your profile cordis.patch.yml that duplicates a plugin's own bundled patch id (the classic "an AI hand-copied the row into two patch files" failure), and one-click repair removes the duplicate row so dsh starts again
• Installation warning added to the README: use dsh plugin add, never hand-edit patch files

v0.6.0

• Fix install failures: network requests now try the mirror first with 2–4s per-path timeouts, so a dropped/timing-out proxy no longer stalls installs; skill packs can now be installed in one click into ~/.dsh/skills; file-in-use/permission errors are no longer misreported as network issues
• "Installed" is now served locally and instantly (7ms), unaffected by network/proxy outages; an installed plugin no longer shows an "Install" button in the "All" list (state stays in sync)
• Opening a card detail and going back keeps the list at its previous scroll position
• Detail README now shows a failure notice within 10s instead of spinning forever
• Skills show the correct star count after install

v0.5.0

• One-click check + repair: real detection (network/pnpm/entry files/OS support/past errors), auto-fixes what it can (installs pnpm, enables plugins, fills missing deps), and explains the rest clearly
• System compatibility: cards show "supported systems" (Windows/macOS/Linux); unsupported plugins are blocked before install
• Category search fixed (no more 422) + search-term hardening (OR/symbols/Chinese all work) + auto mirror on rate limit
• Install/update now falls back to two mirrors (gh-proxy + ghfast), so it works without a VPN; triple-retry updates, no more false downgrade prompts
• Security scan only warns (no false positives, notification plugins no longer flagged); every error is now one line: what went wrong + how to fix
• npm/locally-installed plugins are visible, manageable, update-checkable (via the npm registry) and updatable in "Installed"; install and detail show "how to use"

v0.4.4

• Fix: no more automatic GitHub login popup when you're not signed in; starring no longer forces a login redirect
• Fix: installing a plugin now falls back to the domestic mirror when direct GitHub fails, so it works without a VPN; a missing pnpm now yields a clear error
• New: the Sessions page is now two columns — the right "Archived" column lists archived sessions separately, deletable directly
• Fix: plugins installed from npm/locally (no repo address) now appear in "Installed" and can be uninstalled/toggled
• Fix: installing a plugin whose entry files are missing (uncommitted build artifacts) is now blocked up front instead of failing in pnpm
• New: cards show "supported systems" (Windows/macOS/Linux), auto-detected for new plugins; plugins that don't support the current OS are blocked in the health check and install gate

v0.4.3

• New: say what you need in any chat and the AI finds plugins, with a pre-install health + security scan per candidate
• The scan catches missing files, bad deps, credential theft, suspicious exfiltration — ❌ ones can't install
• Fix: no more "update to an older version" prompts

v0.4.2

• Fix: health check falsely reported "multiple marketplace plugins" (aliased entries counted twice)
• Fix: install/update auto-discovers pnpm (nvm, corepack and npm-global installs all work)
• Update summary wraps instead of overflowing

v0.4.1

• New "Sessions" section (right below Agent Presets in Settings): lists every session with its title, one-click permanent delete, running/subagent sessions protected
• Fix: searching Chinese or special characters returned 400
• Fix: the update button gave no feedback — now a live progress bar with a completion notice
• Fix: deleted sessions left a stale "ungrouped" entry in the sidebar

v0.4.0

• Enable/disable plugins in one click, right on the card (official core and the market itself are protected)
• Pre-install conflict gate (market-vs-market, official-package hijack, duplicate patch rows / registered names) + one-click health check
• Auto-rollback on install/uninstall/toggle; last-known-good backup restores a broken profile with one command
• Live progress bar on the card (percent + live pnpm counts) that survives leaving and re-entering the market
• Works without a VPN: system proxy → direct → China mirror → built-in fetch fallback; mirror ≈7 MB/s
• Installed/installable filters served in one shot; paged results deduped
• One-click star, badge color legend, auto-fading notices

Sponsor

If Zat-DSH Engine saves you time, consider supporting the author:

• GitHub Sponsors: https://github.com/sponsors/mishibeikejie

Every bit of support keeps the catalog data, translations and feature updates coming.

License

MIT