Noob-stupid/dsh-plugin-hub

English: README.md | 中文: README.zh.md

DSH Plugin Hub (dsh-plugin-hub)

Manage all your DeepSeek Harness plugins in one panel: one-click enable/disable,

a 500+ plugin & skill marketplace with one-click install, and one-click framework

upgrade with auto-rollback.

Why DSH Plugin Hub

• 🧩 Plugin & skill hub — auto-collected index of dsh-plugin repos (500+ by

stars) plus a Skills tab; browse, search, one-click install, zero GitHub API calls (served via CDN).

• 🚀 One-click framework upgrade — backup → online install (service stays up) →

verify → auto-rollback on failure. Tested end-to-end.

• 🤖 AI Empower — give the console a package name or GitHub repo, the local AI

reads its docs and drafts a safe, confirmable deployment plan (install / config / start / health-check); server components get an automatic control card. → details

Install

# npm release (recommended: prebuilt, no git / build authorization needed)
dsh plugin --profile web add @noob-stupid/dsh-plugin-console

# or install from GitHub source (needs git; allowBuilds authorization on first add)
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub

Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.

More install options (deploy script / hand it to an AI)

Option 2: deploy script (fallback when network is restricted)

Windows (PowerShell):

git clone https://github.com/Noob-stupid/dsh-plugin-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"

Linux / macOS:

git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh

The script copies the plugin into $DSH_HOME/profiles//node_modules/ and idempotently appends an enable entry to cordis.patch.yml. Afterwards:

1. Restart the dsh service (host code changes need a process restart; CLI restarts the

process, the desktop client exits and reopens);

1. Refresh the page → Settings → Plugins → Plugin Console.

Option 3: hand it to an AI in one sentence

Install the DSH plugin hub (dsh-plugin-hub): run dsh plugin --profile web add @noob-stupid/dsh-plugin-console (npm release); if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to ~/.dsh/profiles/web/node_modules/ and register it in cordis.patch.yml (id: plugin-console, name: @noob-stupid/dsh-plugin-console). Restart dsh web afterwards.

Requires: DSH ≥ 0.1.0-rc.6 (web profile, with dsh-client-modules / dsh-host-plugin-inventory).

Highlights

· Benefit · Detail 🤖 · AI Empower · Give the console a package name or GitHub repo — the local AI reads docs, drafts a deployment plan (install / write config / start service / health check) and executes it safely after your confirmation; server-type components get an automatic control card 🛡️ · Framework upgrade safety & adapt gate · Force-disables plugins incompatible with the new framework (enable locked; 「Check update → Update & adapt」auto-verifies and unlocks); full-tree checkpoint before upgrade, automatic rollback on relaunch failure, one-click rollback to the previous version 🏠 · Family-bundle cards & safety · Same-root subpath exports group into one family card (collapse/expand, batch check-update, one-click unlock-adapted, known-check preview); never-crash safety (pre-enable import probe + patch auto-heal + exports fallback); adapt-gate source-scan hard criterion & migrate detection; deleting a bundle sub-row disables only that row 🚀 · Server component cards · Left-side floating card auto-aligned to the main panel: start / stop / status / open Web UI buttons, multi-server dropdown, collapsible 🧩 · Plugin & skill hub · Auto-collected index of dsh-plugin topic repos (500+ by stars) plus a Skills tab (agent-skills ∪ claude-skills ∪ dsh-skill, up to 300) — browse, search, one-click install, no GitHub API calls 🤖 · Auto-collection CI · GitHub Actions reruns build-index every 6 hours (manual trigger available); authors just add the dsh-plugin / agent-skills / claude-skills / dsh-skill topic — no application needed ⚡ · Instant, rate-limit-free · The index is served as a static marketplace/index.json via jsDelivr CDN (10-min host cache); terminal users make zero GitHub API calls 🔄 · Version detection & one-click update · Semver-based; installed entries match npm dist-tags.latest / beta; subpackage mismatch warnings prevent mixed-version breakage 🔀 · Multi-source · GitHub / Gitee (direct-repo mode) / custom search sources (URL template + header auth + private http); ⊞ merges GitHub + all custom sources in parallel 🔒 · Safe by default · Loopback-only routes; AI fallback behind an explicit cost-consent modal; infrastructure rows are toggle-protected

📑 目录 / Table of Contents

• Highlights
• AI 赋能与服务器组件控制
• One-click install
• Usage
• Features
• How it works
• Compatibility
• Project layout
• HTTP endpoints
• Security
• Known limitations
• Help & Ecosystem
• Contributing
• Changelog
• License

Usage

1. Restart DSH → open the Web GUI → Settings → Plugins → Plugin Console.
2. Installed list: toggle plugins on/off (HMR applies within ~1s), search by name/id,

expand details (version, repository, README summary).

1. Marketplace: empty query on the GitHub source opens the static index (instant);

type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom); ⊞ merges all sources; ★ filters to dsh plugin add-installable packages.

1. Skills tab: switch 插件/技能 next to the search box to browse and install skills

(cloned into ~/.dsh/skills//).

1. Install: click 添加到本地 → the chain runs in the background (safe to leave the page);

「检测更新」/「更新 → vX」 appear automatically for installed entries.

Features

Installed plugins (one-click toggle + details)

• Shows only third-party plugins by default (extra/non-bundled), tagged

"Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);

• Lists every plugin entry (name, load state, enabled state); search by name/id;
• Disable = append - id: X + disabled: true to the user patch layer, effective via HMR;
• Enable = remove that entry; bundle-layer rows disabled by default are overridden with

disabled: false;

• Tags "Patch-disabled / Patch-forced" distinguish user patch state;
• Infrastructure protection: host transport/hmr/storage/settings chain plugins

(70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;

• Details panel: version, repository/homepage links and a README summary for each plugin;
• Version check: 检测更新 reads npm dist-tags.latest (curl channel, works even when

node networking is blocked) and warns about subpackages that need syncing (depsOutdated).

Framework one-click upgrade (deepseek-harness card)

• The deepseek-harness card shows 「框架升级 → vX」 when a newer framework version is

available (stable latest preferred; next channel when latest equals the installed version); clicking runs the full flow: backup config + framework snapshot (rollback point) → online install (service stays up, page never disconnects) → version verification → auto-restart to apply;

• Real-time progress: a DSH-Upgrade console window pops up showing live pnpm download

progress; the in-panel progress card shows the waiting time;

• Upgrade protection: failed installs auto-rollback (robocopy, backup verified before

upgrade), version check catches fake success, 15-min hard timeout, stall detection (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state cleanup — the framework is never left broken;

• pnpm channel: npm-cli.js freezes at startup in the schtasks task environment (0-byte

debug log, no network requests ever sent); upgrades use corepack pnpm (starts in ~0.4s, installed rc.8 in 11.5s) against the npmmirror (China) registry, with dangerouslyAllowAllBuilds so native modules (node-pty/koffi) compile;

• Runtime bin resolution: under the pnpm layout @deepseek-ai/dsh is a Junction — the

relaunch step resolves bin.js at runtime (follows the Junction to the current version) instead of using a path baked in at script-generation time;

• Card dismiss semantics: terminal states (done/failed) are permanently dismissed on ✕

(persisted); in-progress dismissal is session-only and the card returns after a refresh.

Marketplace (multi-source)

• Source switcher: click the login pill to switch between **GitHub / Gitee / custom

sources** (persisted); title, loading text, placeholder and note all follow the source;

• GitHub: default query dsh-plugin, browser-direct with server fallback;
• Gitee: official search API is retired, so it uses direct-repo mode — enter

owner/repo (Chinese paths and full URLs supported) to find and install a repository;

• Custom sources: add in Source Manager (URL template with {q}/{page} placeholders),

optional header auth (e.g. Authorization: Bearer ...), and local/private http URLs;

• Multi-source summary: the ⊞ toggle searches GitHub + all custom sources in parallel,

merging results with source labels;

• ★ official filter: shows only packages installable via dsh plugin add — root packages

with a dsh.bundle manifest (official) or aggregate repos whose subpackage carries `dsh.bundle` (subpackage-installable); markers are enriched by the server (curl dual-channel) with a client-side fallback;

• Type badges: 官方 / 聚合 / 技能 (repo contains SKILL.md) recognized automatically.

Static index market (plugin & skill tabs)

Hybrid architecture: browsing uses the static index (instant, zero GitHub API calls),

searching uses live channels (GitHub search API / multi-source parallel) — they complement

each other: a brand-new repo can be found by live search even before it enters the index.