deepseekplugins

DeepSeek Harness plugin

dsh-plugin-manager-chfhub99

DeepSeek Harness plugin bundle: a pluginManager service, plugin_* agent tools, and a Web management UI (plugins / MCP / skills)

Workflow & Automation
Jump to install

Source facts

Repository
CHF-hub99/dsh-plugin-manager
Latest update
Aug 15, 2026
Category
Workflow & Automation
GitHub stars
1
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/CHF-hub99/dsh-plugin-manager
Plugin: dsh-plugin-manager-chfhub99
Author: CHF-hub99

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

dsh-plugin-manager

!Version !License

> A plugin management system for DeepSeek Harness — manage plugins, MCP servers and skills through a Web GUI and agent tools. > DeepSeek Harness 插件管理系统 —— 通过 Web 界面和 Agent 工具管理插件、MCP 服务器和技能。

---

✨ Features / 功能特性

🧩 Management UI (Web GUI) / 管理界面

Sidebar entry opens a full-screen Management System with three pages. 侧边栏入口打开全屏管理系统，包含三个页面。

Page / 页面Features / 功能
Plugins / 插件Install (by package name), uninstall, enable/disable; default view shows only user-installed plugins with a toggle for all; status dots and source badges / 安装（包名）、卸载、启用/禁用；默认只显示用户安装的插件（可切换全部）；状态点与来源徽标
MCPAdd via form (stdio / streamable-http), import from JSON / .dxt / .mcpb bundles, enable/disable, remove / 表单添加（stdio / streamable-http）、从 JSON / .dxt / .mcpb 包导入、启用/禁用、移除
Skills / 技能Upload archives (.zip / .tar.gz), frontmatter validation, remove; authorization status display / 压缩包上传（.zip / .tar.gz）、frontmatter 校验、卸载；授权状态展示

🤖 Agent Tools / Agent 工具

The plugin also registers model-facing tools so the agent can manage the same resources from a conversation. 插件同时注册模型可见的工具，让 Agent 能在对话中管理同样的资源。

Tool / 工具Purpose / 用途
plugin_listList all loader entries with live status / 列出所有插件及其实时状态
plugin_setEnable / disable a plugin (live + persistent) / 启用/禁用插件（实时+持久）
plugin_install / plugin_uninstallInstall / remove a plugin package / 安装/卸载插件包
skill_list / skill_remove / skill_dir_addSkill discovery and removal / 技能发现、卸载、自定义目录
mcp_list / mcp_add / mcp_removeMCP server management / MCP 服务器管理

📦 Installation / 安装

# from npm registry (after publishing)
dsh plugin --profile web add dsh-plugin-manager

# or from a local checkout
dsh plugin --profile web add /path/to/dsh-plugin-manager

# or from GitHub
dsh plugin --profile web add github:YOUR_USERNAME/dsh-plugin-manager

Then restart the profile: 然后重启 profile：

dsh web   # restart the web profile

The 🧩 管理系统 entry appears at the bottom of the sidebar. 侧边栏底部会出现 🧩 管理系统 入口。

🔧 How it works / 工作原理

Browser (Client, pure DOM)                Host (Node)
┌─────────────────────┐                  ┌──────────────────────────┐
│ Sidebar 🧩 entry     │                  │ pluginManager service      │
│ Full-screen overlay  │── fetch ────────▶│  · list / setEnabled /     │
│  · Plugins page      │  JSON-RPC        │    install / uninstall     │
│  · MCP page          │  /plugin-manager │  · skillList / skillRemove │
│  · Skills page       │  /api/*          │  · mcpList / mcpAdd / …    │
│  · uploads (multipart)│── POST ────────▶│  · archive extract +       │
└─────────────────────┘                  │    frontmatter validation  │
                                          └──────────────────────────┘

Key design points / 关键设计

  • Host service (ctx.pluginManager): reads the live Cordis Loader, mutates entries in memory (immediate effect) and persists changes to the profile cordis.patch.yml (survives restarts). It deliberately never serializes the composed loader tree back into cordis.yml.
  • 宿主服务：读取实时 Cordis Loader，内存中修改 entry（立即生效）并持久化到 profile 的 cordis.patch.yml（重启保留）。刻意不把组合树写回 cordis.yml。
  • HTTP API gateway: JSON-RPC-style endpoints under /plugin-manager/api/*, registered on the profile webserver (loopback only).
  • HTTP API 网关：/plugin-manager/api/* 下的 JSON-RPC 端点，注册在 profile webserver（仅回环）。
  • Client half: built with tsdown into the DSH window.__ModuleLoader__.load bundle format; the UI is pure DOM (no React in the overlay) to avoid shell render-boundary issues.
  • 客户端：tsdown 构建为 DSH 的 __ModuleLoader__.load bundle 格式；UI 用纯 DOM（overlay 不经过 React）避免渲染边界问题。
  • MCPB import: .dxt/.mcpb bundles are validated with the official @anthropic-ai/mcpb schema; server.mcp_config maps directly to the dsh-mcp-client config.
  • MCPB 导入：用官方 @anthropic-ai/mcpb schema 校验；server.mcp_config 直接映射为 dsh-mcp-client 配置。
  • Skill upload: archives extract into ~/.dsh/skills/ (the official user skill root; the filesystem provider watches it — no restart needed). Frontmatter is validated (name + description required) and rejected uploads are rolled back.
  • 技能上传：解压到 ~/.dsh/skills/（官方用户技能根目录；文件系统提供者自动监听，无需重启）。校验 frontmatter（必须含 name + description），失败的自动回滚。

🛡️ Security / 安全

  • Loopback-only API (same exposure as the DSH web GUI itself).
  • API 仅回环（与 DSH Web GUI 本身同等的暴露面）。
  • Zip-slip protection on archive extraction (validates all entry paths before writing).
  • 解压时 zip-slip 防护（写入前校验所有条目路径）。
  • Skill removal restricted to kebab-case names under ~/.dsh/skills/ (path-traversal safe).
  • 技能删除仅限 ~/.dsh/skills/ 下的 kebab-case 名称（防路径穿越）。
  • Upload size caps (50 MiB archives, 1 MiB JSON bodies) and multipart field limits.
  • 上传大小限制（50 MiB 压缩包、1 MiB JSON）和 multipart 字段上限。

🧪 Tests / 测试

npm install
node scripts/smoke.mjs                # service layer
node scripts/smoke-api.mjs            # HTTP API gateway
node scripts/smoke-upload.mjs         # archive upload + extraction
node scripts/smoke-mcp-import.mjs     # MCP JSON / MCPB import
node scripts/smoke-skill-validate.mjs # skill frontmatter validation
node scripts/smoke-skill-remove.mjs   # skill removal security
node scripts/smoke-client-modules.mjs # client bundle discovery

🏗️ Development / 开发

npm install
node scripts/build-client.mjs   # rebuild lib/client.js after client/ changes

Recommended workflow: develop against a throwaway profile (dsh --profile dev --port 3081) before deploying to your main profile. 推荐工作流：先在临时 profile（dsh --profile dev --port 3081）开发验证，再部署到主 profile。

📄 License / 许可证

MIT

Back to searchOpen GitHub repository

More related plugins

View category