packages/dsh-plugin-manager
zhu1090093659/dsh-web设置 → 插件 分区里的插件管理 Tab:从 npm/git 安装带进度、下次启动生效的启停开关、安装冲突对账可撤销、失败一键转交修复会话。
English | 中文
A curated market for literature search, reference management, writing and review plugins. Open Plugins → Installed → dsh-research, or use Settings → Research plugins. Each Install button adds the selected plugin to the profile you are running.
dsh plugin --profile web add dsh-researchRestart DSH Desktop or dsh web, then open Plugins → Installed → dsh-research. Settings → Research plugins remains available, including on older Harness versions.
The catalog behind the panel lives at dsh-research.com — the same list, in a browser, at /plugins. Each entry says what the plugin does and where it stops, and there is a walkthrough that goes from an empty machine to a finished talk. The site is generated from one JSON file; the panel fetches that same file, so the two can never drift apart.
The official market already installs anything in the community registry, and does it well. What it cannot do is tell a researcher which of its eleven hundred plugins are theirs. That is the part this does.
The panel runs dsh plugin --profile add for you — the same command you would type. Four things fence it:
· Allowlist · The browser may ask for any package name; only a package this catalog lists is ever spawned. The catalog is a static file we publish. Same-origin · A state-changing route reachable from any page would let a site you visited install into your profile. One at a time · Two concurrent dsh plugin add runs race on one package.json and can leave a profile half-written. Your profile, not a guess · The target comes from the --profile this host booted, so running a test profile never mutates your real one.
Set allowInstall: false to keep the panel read-only.
The bundle inserts one row (id: research-market). Override it from your profile's cordis.patch.yml (a patch replaces the whole config, so restate every key you keep):
- id: research-market
config:
catalogUrl: https://dsh-research.com/v1/market.json
profile: web # defaults to the profile this host booted
allowInstall: true
cacheSeconds: 900
timeoutMs: 8000catalogUrl accepts any endpoint answering the DSH Community Market provider contract. Point it at your own and the panel lists yours instead.
market.json. Nothing reaches it unread: installing someone else's package from a button we drew makes us the first place their bug gets reported.ctx.shell cannot write to a profile, that a macOS app launched from the Dock has no Homebrew on PATH, that pnpm v10 hangs without a TTY unless CI is set, and that Windows dsh is a .cmd shim.MIT