# zat-dsh-engine

> DSH web client plugin marketplace: browse and search the dsh-plugin community, one-click install, update, and uninstall. Built-in China mirror, AI plugin search, pre-installation health checks, and conversation management.

## Metadata

- Author: [@mishibeikejie](https://github.com/mishibeikejie)
- Repo: <https://github.com/mishibeikejie/zat-dsh-engine.git>
- GitHub: [mishibeikejie/zat-dsh-engine](https://github.com/mishibeikejie/zat-dsh-engine)
- Stars: 76
- Language: TypeScript
- License: [MIT](https://spdx.org/licenses/MIT.html)
- Topics: `deepseek-harness`, `dsh`, `dsh-plugin`
- Forks: 4
- Open Issues: 6
- Last push: 2026-08-19T11:59:34.000Z
- Added: 2026-08-17T00:00:00.000Z

## Install

```bash
dsh plugin --profile web add github:mishibeikejie/zat-dsh-engine
```

## Wiki

## One-Line Positioning

zat-dsh-engine is the DeepSeek Harness Plugin Marketplace: click the 🛒 Plugin Market in "Settings → Plugins" on the web interface to search all community plugins on GitHub tagged with dsh-plugin, install/update/uninstall them with one click, plus built-in domestic mirror, AI plugin finding, pre-install health check and security scanning, conversation management, and auto-update.

## Core Capabilities

- Browse and search all plugins in the GitHub `dsh-plugin` topic community, filter by 12 categories, support bilingual (Chinese/English) descriptions and real-time search (no Enter key needed)
- One-click install / update / uninstall: uses host pnpm underneath, install/uninstall/start-stop all with real-time progress bar, auto-rollback and one-click backup; on failure restores profile and prompts how to fix
- Pre-install health check + security scan: automatically checks entry files, build scripts, official package dependency写法, peer dependencies, runtime commands, system/CPU support, network destinations, obfuscation/suspicious outbound; blocks objective hard failures, only warns about ambiguous risks
- AI find plugins: model calls `find_plugin` tool to search the marketplace by user description, each candidate comes with pre-install health check and security scan conclusions (✅/⚠️/❌), no blind recommendations
- Works in China without VPN: mirror first → system proxy → direct connection → curl → wget → Node fetch six-level fallback, npm uses npmmirror acceleration
- One-click detect / fix / start-stop / star / auto-update / conversation management: scan all installed plugins for conflicts/missing dependencies/system compatibility/mount row duplication; directly start-stop on cards, use local git credentials to star (no login popup); Settings page gains 🗑 Conversation Management tab, can permanently delete archived sessions

## Technical Implementation

- **Language**: TypeScript (Node ESM host + browser CJS client, React 18 UI)
- **Key dependencies**: `@deepseek-ai/cordis` ^4.0.1 (host framework, peerDep); `@deepseek-ai/dsh-typert-protocol` (Typert Remote service protocol, peerDep); `js-yaml` ^4.1.0 (parsing cordis.patch.yml's `!!js` syntax); `zod` ^4.0.0 (hand-written schema definition for typert-loader manifest)
- **Architecture**: Dual-form Typert plugin — host side injects a `plugin-market` entry in cordis Loader via `cordis.patch.yml` (auto-mounts a Remote service, namespace `pluginMarket`, 22 `@Remote` methods); client side uses React components + Typert strict descriptor to remotely call host methods, and registers 🛒 Plugin Market and 🗑 Conversation Management two tabs on `settings.plugins.tab` and `settings.section` slots
- **Entry files**: Host entry `src/index.ts` (`export default ZatMarketGateway`, 4004 lines); Client entry `src/client/index.tsx` (`export const inject`, `export async function apply(ctx)`, 1647 lines); Build config `tsdown.config.ts` (ESM + CJS dual output, host uses Node ES2024, client uses browser CJS)

## Use Cases

Regular users who use DSH web interface and want to pick plugins from the community instead of manually typing `dsh plugin add` commands; people in China without VPN who want to install/update plugins; people with many plugins unsure which ones conflict and want one-click health check and fix; and people who want AI to help find plugins while seeing whether each candidate can actually be installed.

## Prerequisites and Compatibility

| Dependency | Min Version | Description |
|---|---|---|
| DSH | >= 0.1.0-rc.6 | Client needs five shared client packages (`@deepseek-ai/dsh-client-connection`, `-locale`, `-runtime`, `-ui-settings`, `-dsh-api-remotes`) (package.json#dsh.client.inject); host needs `@deepseek-ai/dsh-tools`, `dsh-subprocess`, `dsh-fs`, `dsh-llm`, `dsh-typert-protocol`, `cordis` all as peerDep |
| Node.js | Not declared | package.json sets no `engines`; `@types/node ^26.2.0`, TypeScript targets ES2024, uses `node:fs`, `node:path` built-in modules |
| pnpm | Any resolvable | Install/update/plugin build scripts all rely on host's built-in pnpm; when missing, one-click fix will first `corepack enable`, then if that fails `npm i -g pnpm` (src/index.ts:3464-3471 / src/index.ts:3684-3692) |
| Platform | macOS / Windows / Linux | Cross-platform code; Windows alone goes PowerShell (`-NoProfile -NonInteractive`), PowerShell hides window; non-Windows goes `/bin/sh -c` (src/index.ts:32 / src/index.ts:767-789) |
| Native modules | None | Only uses Node.js built-in modules and two pure JS dependencies: `js-yaml` / `zod` |
| System commands | curl / git (optional) | Network requests auto-fallback between curl → wget → Node fetch; starring requires git credential helper configured |

## Installation

```bash
dsh plugin --profile web add github:mishibeikejie/zat-dsh-engine
```

> After installation, please restart dsh for the marketplace to appear in Settings.

## Configuration

| Config | Type | Description | Default |
|---|---|---|---|
| `plugin-market` node `config.mirror` in `cordis.patch.yml` | string | Domestic mirror address; install/search/star all fallback to direct connection after mirror fails | `https://gh-proxy.com/` |
| Environment variable `DSH_HOME` | path | Override dsh main directory; when not set, infer from `~/.dsh` (on Windows uses `USERPROFILE` / `C:\Users`) | `~/.dsh` |
| Environment variable `DSH_PROFILE` | string | Override profile name to operate on; when not set, pick from profiles directory (prefers `web`) | First profile with package.json |
| Environment variable `GITHUB_TOKEN` / `GH_TOKEN` | string | Takes precedence over `zat-market.json` and git credentials; when non-empty, all GitHub API requests include token (rate limit rises from 60/h to 5000/h) | None |
| `githubToken` in profile directory `zat-market.json` | string | GitHub Token manually entered at marketplace bottom, only written locally, not sent to any server; next starring prioritizes it | None |

> Other system proxies, HTTP_PROXY / HTTPS_PROXY etc. environment variables are automatically recognized and prioritized for network requests; profile name can also be directly specified in `dsh plugin --profile <name> ...` (src/index.ts:1850-1853 / src/index.ts:1693-1731).

## FAQ

**Q: The "All" view only shows up to 1000 plugins, how do I find the rest?**

A: This is a hard limit from GitHub search API single query. Enter keywords in the search box or use category filters to bypass this limit and hit any plugin (src/index.ts:2430-2472).

**Q: dsh won't start after installing a certain plugin, what do I do?**

A: The marketplace backs up package.json / cordis.patch.yml / pnpm-lock.yaml to `zat-backup/` in the profile directory after each successful operation, and removes the crashed bundle from the enabled list. Copy the three files back using the command in README (macOS/Linux: `cp ~/.dsh/profiles/<yourprofile>/zat-backup/* ~/.dsh/profiles/<yourprofile>/`, Windows: PowerShell's `Copy-Item`) and restart (src/index.ts:960-1000 / README.zh.md:101-108).

**Q: A plugin shows "Current system not supported" and gets blocked, what does that mean?**

A: This is one of the objective hard failures from pre-install health check. The plugin's package.json has `os` (e.g., `["linux"]`) or `cpu` (e.g., `["!arm64"]`) fields declaring supported range, and gets blocked if they don't match your current system — in such cases installing would also break dsh. If the plugin actually runs on your machine, contact the author to fix the manifest (src/index.ts:1302-1309 / src/index.ts:1497-1503).

**Q: Why do I need to provide a GitHub Token to star? I don't want to log in.**

A: The marketplace never forces a popup — it first reads `GITHUB_TOKEN` / `GH_TOKEN` environment variables, then the Token you've saved in local `zat-market.json`, and only then reads git credential helper non-interactively (only reads saved ones, never triggers login popup). Without credentials, it won't error, just failing to star and prompting how to fill in Token (src/index.ts:3868-3922).

**Q: Installation reports `pnpm` not found, what should I do?**

A: Click "🩺 One-click Detect" in Settings then "One-click Fix", the marketplace will automatically run `corepack enable`, if that fails then `npm i -g pnpm`, then continue the original flow; manually running one command in terminal also works (src/index.ts:3684-3692).

**Q: I installed a plugin, but the marketplace list still shows "Install" button?**

A: Cache retains old "not installed" state. Click the refresh button in the top-right of the list, or restart dsh to reload cache; if still not fixed, running "One-click Detect" usually identifies conflicts or disabled states (src/index.ts:2404-2413 / src/index.ts:3528-3535).

**Q: Can two marketplace plugins be installed at the same time?**

A: No. The install gate blocks: two marketplace plugins (mishibeikejie/zat-dsh-engine, lx2000wasd/dsh-web-plugin-manager, sanqi-normal/dsh-webui-market-plugin, or name/behavior matching "marketplace/plugin market" pattern) would register the same settings page and service, covering each other or even breaking dsh (src/index.ts:62-66 / src/index.ts:1007-1037).

**Q: How does the marketplace upgrade? Will it uninstall itself?**

A: After startup, it auto-compares with GitHub HEAD version, shows an update button next to the title if there's a new version, clicking uses the same mirror fallback chain as installation. The uninstall interface explicitly rejects calling `uninstall('zat-dsh-engine')` from within the marketplace, must use official `dsh plugin remove` (src/index.ts:2804-2876 / src/index.ts:3043-3047).

## Learning Curve

Beginner — after installation and restart, it's ready to use with zero config to browse/search/install community plugins; when encountering specific issues like missing pnpm, network issues, missing entry, mount row conflicts, etc., the marketplace gives bilingual actionable guidance and "One-click Fix" buttons, no documentation lookup needed.

## Known Issues and Limitations

- When two plugins in the same profile declare the same loader row id, it gets detected during health check, disable one or manually select; newly installed plugins with duplicate id to enabled plugins get blocked at pre-install health check (src/index.ts:3542-3553 / src/index.ts:1310-1316)
- Large GitHub source plugins (full repo download) may take a while on slow networks, progress bar updates with pnpm real-time output; if nothing happens within 60 seconds, the chain at src/index.ts:1857-1968 auto-switches to direct connection or mirror
- pnpm blocks dependency prepare/preinstall build scripts by default, the marketplace automatically writes corresponding package names to `pnpm-workspace.yaml`'s `allowBuilds` and retries on pre-install/failure; if retry still fails, manual confirmation needed (src/index.ts:2279-2295 / src/index.ts:939-954)
- Static security scan can only warn, cannot prove safety: it presents patterns like obfuscation/reading sensitive credentials/suspicious outbound addresses, but false positives are common (e.g., plugins "sending notifications to Discord/Telegram" will match webhook hooks), so it only warns instead of blocking — real hard blocking left to objective items like missing entry/unsupported system (src/index.ts:488-524 / src/index.ts:1354-1362)
- Marketplaces installed via `link:` / local path won't check for updates from GitHub to avoid local changes being overwritten by remote; to switch back to GitHub version, first uninstall then reinstall (src/index.ts:2809-2823)
- When DSH is installed in macOS /Applications and subprocess can't get full PATH, the marketplace automatically supplements common paths like `/opt/homebrew/bin`, `/usr/local/bin`, `~/.local/bin` during installation;极少数 PATH completely empty scenarios still require launching DSH from terminal (src/index.ts:1638-1666 / src/index.ts:1834-1855)
- "All" view is limited by GitHub search API single query 1000 items limit, search box and category filters can hit any plugin (src/index.ts:2430-2472)
- If a candidate plugin's name/author looks like a marketplace but actually isn't, it's covered by dual detection: functional feature detection (pnpm / dsh plugin / slots.register) + known repository list, but may still miss newly emerging similar plugins (src/index.ts:78-82 / src/index.ts:1173-1177)

---

This document is auto-generated by [deepseek-plugin.org](https://deepseek-plugin.org). HTML page: [zat-dsh-engine](https://deepseek-plugin.org/plugins/mishibeikejie/zat-dsh-engine)
Wiki generated by AI (model: `MiniMax-M2.5`)