dsh-plugin-manager

Manage DeepSeek Harness plugins without editing config files.

The shipped workflow is: drop a package into the profile, hand-edit cordis.patch.yml, restart, repeat. This plugin gives the web GUI a 插件管理 (Manage) tab — right inside Settings → Plugins — where you can:

• install a plugin by npm package name (with optional JSON config),
• enable / disable any loader entry with one click (applied live, no restart),
• uninstall plugins again,
• see the whole composed Loader tree, the profile's dependencies and bundles, and which rows the manager itself installed.

It writes your profile's cordis.patch.yml for you (a delimited auto-managed block; your hand-written patches are preserved byte-for-byte) and the running server's user-patch watcher (HMR) applies the change immediately.

It also ships a CLI (dsh-plugin-manager) and a chat command (/plugin).

Components

Piece	Role
lib/index.js	Host half: JSON API under /plugin-manager/api + the /plugin chat command
lib/client.js	Browser half: the 插件管理 tab in Settings → Plugins
lib/core.mjs	Shared logic: managed-block editing of cordis.patch.yml, pnpm runner, bundle reconcile
bin/dsh-plugin-manager.mjs	Standalone CLI (works even while the server is stopped)

Install

npm: @osskn4w7/dsh-plugin-manager

# Option A — standard dsh bundle install:
dsh plugin --profile web add @osskn4w7/dsh-plugin-manager
# then restart dsh web (bundle patch layers load at boot)

# Option B — live install without a restart (from this checkout):
dsh-plugin-manager bootstrap --profile web
# or by hand: pnpm add file:… in the profile dir, then enable the entry,
# then refresh the browser (Settings → Plugins → 插件管理)

Use one option, not both (the row would be inserted twice). bootstrap installs this package into $DSH_HOME/profiles/web via pnpm and wires its Loader entry into cordis.patch.yml. Because the profile patch file is watched live, the host half activates immediately; refresh the browser once so the client bundle is picked up.

To use the CLI standalone (outside a profile checkout):

npm i -g @osskn4w7/dsh-plugin-manager
dsh-plugin-manager list --profile web

Requirements: pnpm on PATH, the web profile (or any profile with the web bundle), and a loopback-bound server (the default).

Publishing (maintainers)

The package lives on npm as @osskn4w7/dsh-plugin-manager and on GitHub as OSSKn4w7/dsh-plugin-manager.

npm version patch          # or minor / major — bumps version + git tag
npm publish --registry=https://registry.npmjs.org/ --access public
git push && git push --tags

Notes:

• The default npm registry on this machine is an npmmirror mirror — always pass --registry=https://registry.npmjs.org/ (mirrors are read-only).
• The account has 2FA enabled (auth-and-writes): publish either with --otp <code> or with a granular access token that has bypass 2FA enabled (create it at npmjs.com settings; its direct-publish ability is scheduled to end January 2027 in favor of a 2FA-approval flow).
• The bin entry (dsh-plugin-manager) is included in the published tarball via the package's files whitelist.

How enabling/disabling works

• Plain plugin (no dsh.bundle in its manifest): install runs pnpm add and inserts a live Loader entry into the managed block — enabled immediately.
• Bundle plugin (declares dsh.bundle): install runs pnpm add and reconciles the name into dsh.profile.bundles in package.json (same rule as dsh plugin --profile … add). Bundle patch layers are read at boot, so it reports needsRestart; after restart its entries appear and can be toggled.
• Enable/disable: adds/removes an id-targeted disabled patch in the managed block. The watcher recomposes the tree live.

CLI

dsh-plugin-manager list [--json] [--profile web]
dsh-plugin-manager enable <entry-id>   # or: disable
dsh-plugin-manager install <pkg> [--config '{"a":1}']
dsh-plugin-manager remove <pkg>
dsh-plugin-manager bootstrap

Chat command

In the web chat, /plugin list, /plugin enable <id>, /plugin disable <id>, /plugin install <pkg>, /plugin remove <pkg>.

Notes

• The managed block in cordis.patch.yml is delimited by # >>> dsh-plugin-manager … >>> / # <<< dsh-plugin-manager <<<; edits inside it are overwritten. Everything outside is yours.
• The HTTP API is loopback-only (matching the server's default bind) and carries no auth — do not expose the web server to a network you do not trust.
• A disabled row whose id no longer exists in the composed tree logs a benign loader warning; the manager drops such patches for packages it uninstalls.

License

MIT