一句话定位

dsh-plugin-hub 是 DeepSeek Harness 的插件管理面板:把"装/卸/启/停"插件、浏览插件市场、搜索 GitHub/Gitee/自定义源、安装技能和 Agent 预设、以及一键升级 DSH 框架这件事,全部塞进设置页的一个 Tab,不用再回到终端敲 dsh 命令。

核心能力

• 在设置页的「插件管理」Tab 一键启用/停用已装插件(写用户补丁层,HMR 约 1 秒生效),受保护的宿主基础设施行自动屏蔽开关
• 浏览内置静态插件索引(500 个插件 + 300 个技能,每 6 小时自动收录 CI 刷新),打开 GitHub/Gitee/自定义源做关键词搜索
• 一键安装插件或技能,自动按主→备顺序尝试配置的软件源、curl 通道、git 通道,失败时给出本地 AI 兜底并弹费用授权
• 软件源管理:添加/编辑/设主源 npm registry,内置 GitHub 与 Gitee(仓库直装模式),可加任意自定义搜索源支持请求头认证
• 检测已装插件的 npm 新版本并提示子包配套情况,避免半更新混搭导致启动冲突
• DSH 框架一键升级(备份 → 在线安装 → 校验 → 自动重启),带实时进度、失败自动回滚、超时保护

技术实现

• 语言: JavaScript (ESM, Node 内置模块优先)
• 关键依赖: 全部走 Node.js 内置模块(node:fs/promises, node:https, node:child_process),外部依赖为零
• 架构模式: Cordis 插件 + 自定义 HTTP 路由表,通过 apply(ctx) 注册环回 /plugin-console/* 路由;客户端 bundle 通过 dsh.client.inject 注入 settings 面板
• 入口文件: lib/index.js(宿主端);lib/client.js(浏览器端 bundle,设置页 Tab)

适用场景

你已经装好 DSH 想随手装/卸第三方插件,又不想记 dsh plugin add 命令和版本号;或者你想在浏览器里看 GitHub 上有哪些 dsh 插件可以装、看自己装的插件是不是有新版本;遇到框架升级提示时,在面板里点一下就能完成升级,而不是手动备份、跑命令、重启。

前置依赖与兼容性

安装方式

dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

配置项

本插件无需在文件里写额外配置。运行时所需的环境变量与软件源都在「插件管理 → 软件源」面板里通过 UI 设置,常见条目如下:

常见问题

Q: 这个插件装到哪个 DSH profile 才能看到 GUI?

A: 装到 DSH 自带的 web profile。DSH 的其他 profile 不会启动 Web GUI,本插件的客户端 bundle 只在 web profile 加载;装到其他 profile 位置只有后台路由没有界面。

Q: 面板上为什么有些插件标着"受保护"且开关是灰的?

A: 那是宿主基础设施行(Cordis 加载器、HMR、WebServer、存储、设置链等 70+ 个核心模块)。停用会破坏热加载本身,所以面板禁止开关,这是保护机制不是 bug。

Q: 看到"等待授权"弹窗,要不要同意?

A: 只有在配置源 / curl / git 三条确定性通道全部失败时才弹出,明确告诉你"将调用 DeepSeek API 模型,可能产生 API 费用"。可以点"取消",也可以勾选"以后不再提醒",或在市场页底部的 AI 兜底总开关里彻底关掉(关掉后零 API 费用)。

Q: Gitee 源为什么输入关键词搜不到东西?

A: Gitee 官方搜索 API 已停用,所以 Gitee 源走"仓库直装模式":输入完整仓库路径(支持中文和完整 URL),面板按路径精确查找并安装,不是关键词搜索。

Q: 添加了一个自定义 registry 但安装失败,怎么办?

A: 面板会在自定义源安装失败后,自动回退到内置源(npmmirror / npmjs)继续尝试;若都失败再走 curl 和 git 通道。也可以在软件源管理里编辑名称或设为主源;删除按钮被禁,避免误删插件安装依赖的源。

Q: DSH 升级后为什么旧的自定义功能突然消失?

A: 这是因为 DSH 框架文件被覆盖。本插件会检测到版本变化并自动重打"cordis.patch.yml 解析容错补丁"(issue #5),备份旧版本快照到 ~/.dsh/plugin-console/framework-backups/;若重启后仍异常,可手动跑仓库里的 scripts/apply-framework-patch.cjs。

Q: 装的技能在 DSH 里找不到?

A: 技能被装到 ~/.dsh/skills/<名称>/,由 @deepseek-ai/dsh-skill-filesystem 插件扫描发现。若当前 profile 没启用该插件,技能会休眠——在 profile 的 cordis.yml 启用 dsh-skill-filesystem 并重启即可。

Q: 数据保存在哪里?卸载是否干净?

A: 软件源配置: ~/.dsh/plugin-console-sources.json;框架升级快照: ~/.dsh/plugin-console/framework-backups/;已装技能: ~/.dsh/skills/<名称>/;安装时间标记: <profile>/node_modules/<pkg>/.dsh-installed-at。卸载本插件不会删除其他已装插件,但 ~/.dsh/plugin-console/ 目录下的状态文件可手动清理。

上手难度

入门 — 装到 web profile 重启即用,常用功能(开关已装插件、装/卸)在面板里点几下就完成,无需读文档;遇到"受保护""AI 兜底授权""子包配套"等边界时回到 README 翻一眼即可。

已知问题与限制

• 宿主代码变更需重启 DSH 服务才能生效(客户端变更只需刷新页面);面板自带的重启按钮会走守护拉起,无需手动
• 实时 GitHub 搜索依赖 GitHub 可达性(浏览器直连 + 服务端多通道竞速兜底);网络黑洞期可能 5-15 秒返回
• 版本检测只对已发布到 npm 的包生效;技能类仓库没有版本概念
• 静态索引每次构建收录 500 个插件 + 300 个技能上限,新仓库需 star 爬升或等下一轮 6 小时 CI 进入索引
• 搜索结果打 ★ 标记需 1-3 秒后台补全,刚打开市场时可能暂时显示空
• Gitee 官方搜索 API 已废弃,仅支持仓库直装模式(按 owner/repo 精确匹配),不支持关键词搜索
• 第三方 bundle 型插件(如某些聚合仓库子包)自动装配已默认跳过(防止 bundle 与 DSH 版本不兼容导致启动崩溃),需按详情面板的"官方安装方式"手动安装

English: README.md | 中文: README.zh.md

---

DSH Plugin Hub (dsh-plugin-hub)

A plugin management panel for the DeepSeek Harness (DSH) Web GUI: one-click enable/disable of installed plugins, plus a multi-source plugin marketplace (GitHub / Gitee / custom sources) with one-click install — and an auto-collected static plugin & skill index refreshed by CI every 6 hours.

• Highlights
• One-click install
• Usage
• Features
• How it works
• Compatibility
• Project layout
• HTTP endpoints
• Local AI fallback & consent dialog
• Framework patch (cordis.patch.yml parse tolerance)
• Security
• Disclaimer
• Known limitations
• Help
• Ecosystem & discoverability
• Support
• Changelog
• License

---

Highlights

For plugin authors: add the dsh-plugin topic to your repo — the official topic list is how both the ecosystem and this hub discover you. For skills, add agent-skills / claude-skills / dsh-skill.

---

One-click install

Option 1: official command (recommended)

The plugin declares a dsh.bundle manifest, so a single command installs and enables it:

dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Uninstall / reinstall (update):

dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.

Option 2: deploy script (fallback when network is restricted)

Windows (PowerShell):

git clone https://github.com/Noob-stupid/dsh-plugin-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"

Linux / macOS:

git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh

The script copies the plugin into $DSH_HOME/profiles/<profile>/node_modules/ and idempotently appends an enable entry to cordis.patch.yml. Afterwards:

1. Restart the dsh service (host code changes need a process restart; CLI restarts the process, the desktop client exits and reopens);
2. Refresh the page → Settings → Plugins → Plugin Console.

Option 3: hand it to an AI in one sentence

Install the DSH plugin hub (dsh-plugin-hub): run dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub; if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to ~/.dsh/profiles/web/node_modules/ and register it in cordis.patch.yml (id: plugin-console, name: @deepseek-ai/dsh-plugin-console). Restart dsh web afterwards.

Requires: DSH ≥ 0.1.0-rc.6 (web profile, with dsh-client-modules / dsh-host-plugin-inventory).

---

Usage

1. Restart DSH → open the Web GUI → Settings → Plugins → Plugin Console.
2. Installed list: toggle plugins on/off (HMR applies within ~1s), search by name/id, expand details (version, repository, README summary).
3. Marketplace: empty query on the GitHub source opens the static index (instant); type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom); ⊞ merges all sources; ★ filters to dsh plugin add-installable packages.
4. Skills tab: switch 插件/技能 next to the search box to browse and install skills (cloned into ~/.dsh/skills/<name>/).
5. Install: click 添加到本地 → the chain runs in the background (safe to leave the page); 「检测更新」/「更新 → vX」 appear automatically for installed entries.

---

Features

Installed plugins (one-click toggle + details)

• Shows only third-party plugins by default (extra/non-bundled), tagged "Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);
• Lists every plugin entry (name, load state, enabled state); search by name/id;
• Disable = append - id: X + disabled: true to the user patch layer, effective via HMR;
• Enable = remove that entry; bundle-layer rows disabled by default are overridden with disabled: false;
• Tags "Patch-disabled / Patch-forced" distinguish user patch state;
• Infrastructure protection: host transport/hmr/storage/settings chain plugins (70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;
• Details panel: version, repository/homepage links and a README summary for each plugin;
• Version check: 检测更新 reads npm dist-tags.latest (curl channel, works even when node networking is blocked) and warns about subpackages that need syncing (depsOutdated).

Framework one-click upgrade (deepseek-harness card)

• The deepseek-harness card shows 「框架升级 → vX」 when a newer framework version is available (stable latest preferred; next channel when latest equals the installed version); clicking runs the full flow: backup config + framework snapshot (rollback point) → online install (service stays up, page never disconnects) → version verification → auto-restart to apply;
• Real-time progress: a DSH-Upgrade console window pops up showing live pnpm download progress; the in-panel progress card shows the waiting time;
• Upgrade protection: failed installs auto-rollback (robocopy, backup verified before upgrade), version check catches fake success, 10-min hard timeout, stall detection (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state cleanup — the framework is never left broken;
• pnpm channel: npm-cli.js freezes at startup in the schtasks task environment (0-byte debug log, no network requests ever sent); upgrades use corepack pnpm (starts in ~0.4s, installed rc.8 in 11.5s) against the npmmirror (China) registry, with dangerouslyAllowAllBuilds so native modules (node-pty/koffi) compile;
• Runtime bin resolution: under the pnpm layout @deepseek-ai/dsh is a Junction — the relaunch step resolves bin.js at runtime (follows the Junction to the current version) instead of using a path baked in at script-generation time;
• Card dismiss semantics: terminal states (done/failed) are permanently dismissed on ✕ (persisted); in-progress dismissal is session-only and the card returns after a refresh.

Marketplace (multi-source)

• Source switcher: click the login pill to switch between GitHub / Gitee / custom sources (persisted); title, loading text, placeholder and note all follow the source;
• GitHub: default query dsh-plugin, browser-direct with server fallback;
• Gitee: official search API is retired, so it uses direct-repo mode — enter owner/repo (Chinese paths and full URLs supported) to find and install a repository;
• Custom sources: add in Source Manager (URL template with {q}/{page} placeholders), optional header auth (e.g. Authorization: Bearer ...), and local/private http URLs;
• Multi-source summary: the ⊞ toggle searches GitHub + all custom sources in parallel, merging results with source labels;
• ★ official filter: shows only packages installable via dsh plugin add — root packages with a dsh.bundle manifest (official) or aggregate repos whose subpackage carries dsh.bundle (subpackage-installable); markers are enriched by the server (curl dual-channel) with a client-side fallback;
• Type badges: 官方 / 聚合 / 技能 (repo contains SKILL.md) recognized automatically.

Static index market (plugin & skill tabs)

Hybrid architecture: browsing uses the static index (instant, zero GitHub API calls), searching uses live channels (GitHub search API / multi-source parallel) — they complement each other: a brand-new repo can be found by live search even before it enters the index.

• Empty query on the GitHub source shows the static index (marketplace/index.json, jsDelivr CDN + 10-min host cache): 500+ plugins by stars, instant, zero GitHub API calls;
• 插件 / 技能 tabs next to the search box: the skills tab lists auto-collected agent-skills ∪ claude-skills ∪ dsh-skill repos (up to 300);
• Auto version check: installed entries in the market are checked against npm dist-tags.latest in the background — cards turn into 「更新 → vX」 buttons;
• Skill install: skill entries install by git-clone into ~/.dsh/skills/<name>/ (frontmatter name wins over repo name; SKILL.md found at repo root or first-level subdirectory). Installed skills show a grey 「已装」 badge.

Source Manager

The floating "Sources" button (right of the title row, semi-transparent) opens the manager:

• Install sources (registry): add / inline edit / set primary / restore defaults; private and intranet addresses supported; deletion is protected (install-critical);
• Search sources: built-in GitHub, Gitee + custom search sources (add/remove, 🔒 shows header count);
• Gitee login (optional): direct mode needs no login; login only raises rate limits — create a third-party app (gitee.com → Data management → Third-party apps, scopes user_info, projects), fill client_id / client_secret, save, then authorize.

---

How it works

Toggle semantics

The DSH web profile is composed of a bundle patch layer plus the user patch layer ($DSH_HOME/profiles/web/cordis.patch.yml); patches are per-key overrides. Toggling a plugin just appends/removes two YAML lines:

- id: plugin-entry-id
  disabled: true

The config watcher (HMR) recomposes within ~1s — no restart needed except for host code.

Install chain

configured registries (primary→backup, default npmmirror → npmjs)
  → curl manual install        (node networking blocked: tarball into node_modules)
  → git channel                (GitHub via proxy+direct, Gitee via its platform)
  → EPERM stale-dir cleanup retry
  → repository subpackage expansion (aggregate packages first)
  → local AI fallback          (behind an explicit cost-consent modal)

Skills install directly by git clone --depth 1 → copy SKILL.md bundle into ~/.dsh/skills/<name>/ (no npm, no patch, no restart).

Data sources

GitHub Actions (every 6h, repo token)
  └─ scripts/build-index.cjs: pages topic:dsh-plugin (500 by stars) + skills topics (300)
       └─ commits marketplace/index.json back to main
            └─ host reads it via jsDelivr CDN (10-min cache) → instant market, zero API calls
                 └─ live search still uses the GitHub search API (browser-direct + server channel)

Version detection & installed recognition

• Installed recognition: match installed entries by repository field or module name against market items (repo name → package name mapping);
• Version detection: check-update reads npm dist-tags.latest via curl; for aggregate packages it also compares subpackage declared vs actual versions (depsOutdated) to prevent mixed-version startup conflicts.

---

Compatibility

• Supports the DSH 0.1.0 series (0.1.0-rc.6 and siblings).
• The panel reads the running @deepseek-ai/dsh-web-app version: after a breaking upgrade (0.2 / 1.0) a compatibility warning appears instead of silent failure.
• Likely breaking seams: patch semantics, webServer.register, loader entry shape, dsh.client bundle format, settings.plugins.tab slot.
• Deploy scripts do not check versions; the in-panel warning is authoritative.

---

Project layout

lib/index.js       Host plugin (/plugin-console/* routes + patch I/O + multi-source search + install)
lib/client.js      Browser bundle (ModuleLoader format, settings tab)
scripts/build-index.cjs        Index builder (plugins --limit 500 / skills --skills --limit 300)
scripts/apply-framework-patch.cjs   Framework patch (issue #5, idempotent)
.github/workflows/registry.yml Auto-collection CI (every 6h + manual dispatch)
marketplace/index.json         Generated static index (jsDelivr CDN)
deploy.ps1 / deploy.sh   One-click deploy scripts (Windows / Linux·macOS)
test-harness.mjs   Logic self-test (state/toggle/validation/loopback; search SKIP by network)

---

HTTP endpoints

---

Local AI fallback & consent dialog

Installation goes through a deterministic channel chain: configured sources (primary→backup) → curl manual install → git channel → EPERM cleanup retry → repository subpackage expansion. Only when all deterministic channels fail does the local AI fallback take over.

What it is: a local AI subagent takes over the install — it diagnoses like a human (inspects repo structure, finds subpackages/aggregate packages, cleans leftovers), installs with the right package manager and writes the config. Note: this step calls a DeepSeek API model and may incur API costs.

Consent dialog (cost transparency):

1. After all deterministic channels fail, the task enters "waiting for authorization" and a top-most modal appears:
   • explicitly states "will call a DeepSeek API model, may incur API costs"
   • offers Approve, continue / Cancel (Cancel = zero cost)
   • auto-cancels after 10 minutes
2. The modal offers "Don't ask again" (auto-approve) — restorable at the bottom of the marketplace page.
3. The floating "AI fallback" toggle can disable the feature entirely: deterministic failures cancel the install, never calling a model API (zero cost).

---

Framework patch (cordis.patch.yml parse tolerance)

Problem (issue #5): if cordis.patch.yml contains a top-level [] placeholder plus later entries (two YAML root nodes), DSH fails at startup: end of the stream or a document separator is expected.

Fix location: parsePatchList in the DSH framework dsh-app-boot — on parse failure, top-level empty-array placeholder lines are dropped (treated as no-op) and parsing retries; normal files, pure [] files, and indented sub-arrays are unaffected.

Apply (re-run after every DSH upgrade, which overwrites framework files):

node scripts/apply-framework-patch.cjs

The script locates dsh-app-boot/lib/index.js in the npx cache, skips when already patched (idempotent), and keeps a .bak-issue5 backup on first apply.

---

Security

• All routes are loopback-only;
• GitHub metadata is used only to discover public plugins; npm installs keep full TLS validation against the registry;
• GitHub search is browser-direct; Gitee/custom source requests and headers (including credentials) are handled server-side only and never shipped to the browser;
• Custom source URLs accept https and local/private http only (127.0.0.1, localhost, 10.x, 192.168.x, 172.16-31.x, etc.);
• Skills are plain files (SKILL.md + assets) — installing a skill does not execute code; the git clone comes from the repo you chose, review the repo before installing.

---

Disclaimer

• The marketplace lists third-party repositories from GitHub; each plugin is developed and maintained by its own author and has no affiliation with DeepSeek Harness or this hub.
• This hub makes no warranty about any plugin's quality, reliability, security, license compliance or compatibility. Listing is not an endorsement — install means you have reviewed and accepted the risk. Read the repo source and README before installing.
• This hub is provided AS-IS; neither the hub nor its developers are liable for any damage (data loss, system damage, privacy leaks) caused by installing or using third-party plugins.

---

Known limitations

• Host code changes require a service restart (the panel's restart button is watchdog-safe); client changes just need a page refresh;
• Live GitHub search depends on GitHub reachability (browser-direct + server fallback; during network-blackout windows retry later);
• Version detection works for npm-published packages; skill-type repos have no version concept;
• The static index is capped (500 plugins / 300 skills per build); authors bump their star count or wait for the 6h CI cycle to enter the index;
• Skills are discovered by dsh-skill-filesystem — if the current profile does not enable that plugin, installed skills stay dormant until it is enabled and DSH restarted.

---

Help

• Panel missing: restart dsh → refresh → Settings → Plugins → Plugin Console.
• Toggle does nothing: infrastructure rows are "Protected" (by design); normal toggles take effect via HMR within 1-3s.
• Compatibility warning: a breaking upstream release arrived; see Compatibility.
• Search empty/fails: GitHub uses browser-direct (falls back to the server channel); Gitee is direct-repo mode (enter owner/repo); check custom-source URL/headers; retry during network blackout windows.
• ★ filter empty: ★ shows only dsh plugin add-installable packages (official + subpackage-bundle aggregates); markers are backfilled in 1-3s — no false "none" report.
• Install fails: confirm the repo has package.json and the package is published; npm failures fall back to git install; switch the primary source if npmmirror is unstable.
• Skill not found by DSH: enable @deepseek-ai/dsh-skill-filesystem in the profile (cordis.yml) and restart; skills live in ~/.dsh/skills/<name>/.

---

Ecosystem & discoverability

• Listed on awesome-dsh-plugin (the community main list) and DSH Directory;
• This hub's own auto-collection index (500+ plugins / 300 skills, refreshed by CI every 6h) includes any repo tagged dsh-plugin / agent-skills / claude-skills / dsh-skill — tag your repo and it appears in the market automatically, no application needed;
• If you build DSH plugins, this panel is your distribution channel: one-click install for every user of the hub.

Support

If this panel saves you time or makes DSH more fun to use:

• ⭐ Star this repo — it directly helps more DSH users find it;
• Share it with DSH users or in DSH communities;
• Submit your own plugin (tag it dsh-plugin) to grow the ecosystem;
• Found a bug or want a feature? Open an issue.

---

Changelog

See CHANGELOG.md.

---

License

MIT