Noob-stupid/dsh-plugin-hub

Web & Desktop — both supported.

English: README.md | 中文: README.zh.md

DSH Plugin Gating Hub (dsh-plugin-gating-hub)

*Renamed from dsh-plugin-hub — old URLs redirect.*

Framework-upgrade safety and plugin-version gating for DSH. A failed upgrade rolls back. A framework changed by any update channel is still guarded. A version the host cannot take is refused, not installed.

Install (npm, one line)

dsh plugin --profile web add @noob-stupid/dsh-plugin-console

Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.

Three hard guarantees

• 🛡️ Contract pre-check → rollback point → auto-rollback. A data-driven contract pre-check

runs first (message contract / dependency API / config schema / removed API / loader contract); then config backup + a full-tree rollback point. A failed install or relaunch auto-rolls the tree back, a 「roll back to previous」 button restores the last version, and plugins the new framework cannot load are auto-disabled — version check catches fake success, 15-min timeout + stall detection.

• 👁️ Even when another update channel changes the framework. An environment fingerprint

catches changes made by the official desktop updater or a manual pnpm: it auto-runs a read-only pre-flight, and disables a row only with hard evidence (package unresolvable / file:// target gone / named in a boot-failure log). @deepseek-ai/* and protected / core rows are never auto-disabled; each auto-disable writes a one-command recovery record.

• 🔒 Plugin install & upgrade gating. Version/declaration gate (dsh.engines.framework /

engines.dsh / @deepseek-ai/* ranges, built-in zero-dependency semver), a repo-size gate on source channels, and explicit handling of non-registry sources — a bare version is written back only once the registry really resolves it, otherwise the package is materialized as link:. Install scripts are never auto-authorized, and pnpm's supply-chain gate is never bypassed.

Discovery layer on top: a built-in multi-source plugin market & index (500+ plugins /

300+ skills, zero GitHub API calls) — and every source is swappable: install source

(incl. a private intranet registry), search source (URL template + headers), index source

(self-hosted intranet index), Git source (incl. a local file:// bare repo), so plugins can be

installed on an intranet-only or fully offline machine.

Why DSH Plugin Gating Hub

• 🛡️ Framework upgrade safety, end-to-end — one-click upgrade: config backup + full-tree

checkpoint (rollback point) → online install (service stays up, page never disconnects) → version verification → auto-restart. A failed install auto-rolls the whole tree back, version check catches fake success, 15-min hard timeout + stall detection — the framework is never left broken. → details

• ↩️ One-click rollback to the previous version — after an upgrade the framework card keeps

a 「roll back to previous」 button: stop service → restore full tree → relaunch → health check, state visible throughout.

• 🚫 Incompatible plugins auto-disabled — the adapt gate force-disables plugins the new

framework cannot load (enable locked; the server rejects /toggle with 409 — unbypassable); 「Check update → Update & adapt」auto-verifies and unlocks them.

• 🔒 Plugin upgrade gating — a version/declaration gate (dsh.engines.framework /

engines.dsh + @deepseek-ai/* ranges, built-in zero-dependency semver engine) decides whether a plugin version may run on this host, so an upgrade can't silently take plugins out.

• 🧩 Built-in discovery layer — multi-source plugin market (GitHub / Gitee / custom sources)

plus the static index of dsh-plugin repos (500+ by stars) and a Skills tab (up to 300); browse, search, one-click install, zero GitHub API calls (served via CDN). Every source is swappable — private intranet npm registry, custom search source (URL template + headers), self-hosted index source, Git source (incl. local file:// bare repo) — so an intranet-only / offline machine can still browse and install.

• 🤖 AI Empower — give the console a package name or GitHub repo, the local AI

reads its docs and drafts a safe, confirmable deployment plan (install / config / start / health-check); server components get an automatic control card. → details

Install

# npm release (recommended: prebuilt, no git / build authorization needed)
dsh plugin --profile web add @noob-stupid/dsh-plugin-console

# or install from GitHub source (needs git; allowBuilds authorization on first add)
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-gating-hub

Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.

More install options (deploy script / hand it to an AI)

Option 2: deploy script (fallback when network is restricted)

Windows (PowerShell):

git clone https://github.com/Noob-stupid/dsh-plugin-gating-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"

Linux / macOS:

git clone https://github.com/Noob-stupid/dsh-plugin-gating-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh

The script copies the plugin into $DSH_HOME/profiles//node_modules/ and idempotently appends an enable entry to cordis.patch.yml. Afterwards:

1. Restart the dsh service (host code changes need a process restart; CLI restarts the

process, the desktop client exits and reopens);

1. Refresh the page → Settings → Plugins → Plugin Console.

Option 3: hand it to an AI in one sentence

Install the DSH plugin hub (dsh-plugin-hub): run dsh plugin --profile web add @noob-stupid/dsh-plugin-console (npm release); if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-gating-hub to ~/.dsh/profiles/web/node_modules/ and register it in cordis.patch.yml (id: plugin-console, name: @noob-stupid/dsh-plugin-console). Restart dsh web afterwards.

Requires: DSH ≥ 0.1.0-rc.6 (web profile, with dsh-client-modules / dsh-host-plugin-inventory).

Highlights

· Benefit · Detail 🤖 · AI Empower · Give the console a package name or GitHub repo — the local AI reads docs, drafts a deployment plan (install / write config / start service / health check) and executes it safely after your confirmation; server-type components get an automatic control card 🛡️ · Framework upgrade safety & adapt gate · Force-disables plugins incompatible with the new framework (enable locked; 「Check update → Update & adapt」auto-verifies and unlocks); full-tree checkpoint before upgrade, automatic rollback on relaunch failure, one-click rollback to the previous version 🏠 · Family-bundle cards & safety · Same-root subpath exports group into one family card (collapse/expand, batch check-update, one-click unlock-adapted, known-check preview); never-crash safety (pre-enable import probe + patch auto-heal + exports fallback); adapt-gate source-scan hard criterion & migrate detection; deleting a bundle sub-row disables only that row 🚀 · Server component cards · Left-side floating card auto-aligned to the main panel: start / stop / status / open Web UI buttons, multi-server dropdown, collapsible 🧩 · Plugin & skill hub · Auto-collected index of dsh-plugin topic repos (500+ by stars) plus a Skills tab (agent-skills ∪ claude-skills ∪ dsh-skill, up to 300) — browse, search, one-click install, no GitHub API calls 🤖 · Auto-collection CI · GitHub Actions reruns build-index every 6 hours (manual trigger available); authors just add the dsh-plugin / agent-skills / claude-skills / dsh-skill topic — no application needed ⚡ · Instant, rate-limit-free · The index is served as a static marketplace/index.json via jsDelivr CDN (10-min host cache); terminal users make zero GitHub API calls 🔄 · Version detection & one-click update · Semver-based; installed entries match npm dist-tags.latest / beta; subpackage mismatch warnings prevent mixed-version breakage 🔀 · Multi-source · GitHub / Gitee (direct-repo mode) / custom search sources (URL template + header auth + private http); ⊞ merges GitHub + all custom sources in parallel 🔒 · Safe by default · Loopback-only routes; AI fallback behind an explicit cost-consent modal; infrastructure rows are toggle-protected

📑 目录 / Table of Contents

• Highlights
• AI 赋能与服务器组件控制
• One-click install
• Usage
• Features
• How it works
• Compatibility
• Project layout
• HTTP endpoints
• 安全
• Known limitations
• Help & Ecosystem
• Contributing
• Changelog
• License

Usage

1. Restart DSH → open the Web GUI → Settings → Plugins → Plugin Console.
2. Installed list: toggle plugins on/off (HMR applies within ~1s), search by name/id,

expand details (version, repository, README summary).

1. 市场: empty query on the GitHub source opens the static index (instant);

type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom); ⊞ merges all sources; ★ filters to dsh plugin add-installable packages.

1. Skills tab: switch 插件/技能 next to the search box to browse and install skills

(cloned into ~/.dsh/skills//).

1. Install: click 添加到本地 → the chain runs in the background (safe to leave the page);

「检测更新」/「更新 → vX」 appear automatically for installed entries.

Screenshots · 界面一览

入口挂在官方插件管理页自己的插槽（plugins.bundle.config，key = 包名）：装完之后它出现在

「设置 → 插件 → 已安装」里我们这一条下面，用的是官方容器与官方风格 —— 不是 DOM 注入，官方更新也不怕。

1 · 已安装列表里的入口（官方页，点开我们这条即见）

2 · 「升级安全」面板（就地展开：运行模式 / 框架版本 / 回滚点 / 环境指纹 / 补声明 / 契约预检 / 各功能入口）

3 · 框架升级 / 回滚（可选目标版本、常驻的升级进度、一键回滚上一版）

4 · 门控明细（谁被隔离、为什么：升级预扫 or 启动失败隔离，附来源与时间）

Features

Installed plugins (one-click toggle + details)

• Shows only third-party plugins by default (extra/non-bundled), tagged

"Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);

• Lists every plugin entry (name, load state, enabled state); search by name/id;
• Disable = append - id: X + disabled: true to the user patch layer, effective via HMR;
• Enable = remove that entry; bundle-layer rows disabled by default are overridden with

disabled: false;

• Tags "Patch-disabled / Patch-forced" distinguish user patch state;
• Infrastructure protection: host transport/hmr/storage/settings chain plugins

(70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;

• Details panel: version, repository/homepage links and a README summary for each plugin;
• Version check: 检测更新 reads npm dist-tags.latest (curl channel, works even when

node networking is blocked) and warns about subpackages that need syncing (depsOutdated).

Framework one-click upgrade (deepseek-harness card)