Preface

DeepSeek Harness (DSH) adopts an “everything is a plugin” architecture: bundles in profiles, mount lines, skills, and agent presets are often scattered across cordis.patch.yml, terminal commands, and multiple directories. Installing a new plugin typically requires running dsh plugin add, modifying the patch, restarting the profile, and manually troubleshooting dependency conflicts or startup failures.

dsh-web-plugin-manager consolidates these operations into a Web UI: viewing installed plugins, real-time enabling/disabling, installation and uninstallation, update detection, health checks, environment (profile) management, and a built-in plugin marketplace. It covers both bundle and non-bundle plugins and includes the dshpm CLI, ensuring command-line changes also follow the same quality gates and rollback pipeline.

What is this

One-sentence positioning: Manage the entire plugin lifecycle with a single click in the DSH Web UI, featuring a built-in marketplace index and installation quality gates.

Core Features

Viewing and Real-time Enabling/Disabling

Combines display of layer stacks, dependencies, mount lines, and runtime entries. Manually installed but unmounted dependencies are marked as “Unmounted” and can be mounted with one click. Enabling/disabling works by editing managed blocks and applying them directly via the loader, taking effect in real time and persisting after restarts. Uninstalling a bundle plugin simultaneously removes runtime entries and leftover managed blocks.

Installation and Uninstallation

Uses the official dsh plugin CLI with additional quality gates and automatic rollback: full dependency chain scanning and bundle patch line validation during installation; rolls back on failure. Non-bundle plugins automatically write mount lines and load in real time. Supports npm package names, GitHub repositories, git URLs, tarballs, and local paths; git source installations scan for required environment variables (in TOKEN/KEY/SECRET patterns) beforehand and pause to prompt if missing.

In addition to regular plugins, it supports direct installation and recording of skills (SKILL.md → ~/.dsh/skills) and agent presets (agent.cordis.yml → ~/.dsh/.agent-presets).

Update Detection

Supports npm dist-tag, git HEAD, and installed commit comparisons. Updates include quality gates; on failure, it automatically reverts to the previous version. The manager itself can also self-update via the UI. Note: dsh plugin add without @latest will not cross-version upgrade; use dshpm update or add ...@latest instead.

Health Checks

Offline analysis of dependency graphs: missing dependencies, circular dependencies, duplicate line IDs, same-name registration conflicts (services/tools/sections/routes), peer version issues, and duplicate official packages. Runtime appends pending and failed diagnostics. Grade A issues can be fixed with one click; Grade B issues require confirmation before fixing.

Environment Management

In the UI, enable/disable, copy, or transfer plugins; create, rename, or delete profiles (official profiles are read-only); backup export and import restore, with differential comparison and item-by-item protected restoration.

Plugin Marketplace

Static indexing covers all topic:dsh-plugin entries (approximately 3,100), with multi-source fallback, gzip compression, disk caching, and freshness gating; supplemented by awesome curated selections and dsh.so independent verification/security scan badges (L1–L5). Supports installed detection, update detection, and same-name package conflict resolution.

Agent Tools and CLI

Injects plugin_status / plugin_search / plugin_install / plugin_uninstall / plugin_toggle tools into agents and intercepts raw dsh plugin / npm / pnpm change commands, guiding them through the protected pipeline. The dshpm bin reuses the same installProtected process as the Web UI, skipping live application when no host process is running, with consistent file-level operations.

Installation and Enabling

The official recommendation is to install the manager first, then other plugins, so that subsequent installations go through quality gate checks.

# Method 1 (Recommended): Install from npm (must include @latest)
dsh plugin --profile <name> add dsh-web-plugin-manager@latest

Build from source:

cd /path/to/dsh-web-plugin-manager
pnpm install && pnpm run build
dsh plugin --profile <name> add .

After restarting the profile, the Web UI’s “Settings” will show a “Plugin Management” tab, along with “Skills & Presets” and “Marketplace” primary menus.

If a profile cannot start due to unverified plugins, troubleshoot first with dsh --profile <name> --patch <empty.yml>, or manually clean up corresponding dependencies and cordis.patch.yml lines, then install the manager to take over.

Typical Usage

Managing Plugins in the Web UI

  1. Open “Settings → Plugin Management” to view installed plugin cards and layer stacks.
  2. When a new version is needed, click “Check Updates”; for a target card, click “Update”; after updating, restart the profile to take effect.
  3. Browse entries in the “Marketplace” and follow prompts to install; if a git source lacks environment variables, fill in the inline UI form to continue.

Using dshpm in the Terminal

dshpm is installed into the profile’s node_modules with the plugin, or can be invoked directly via node <profile>/node_modules/dsh-web-plugin-manager/dist/cli.js.

dshpm install <source> [--env KEY=value ...] --profile <name>
dshpm remove <name>    --profile <name>
dshpm update <name>    --profile <name>
dshpm mount <name>     --profile <name>
dshpm list             --profile <name>
dshpm analyze          --profile <name>

<source> can be an npm package name, github:user/repo, git URL, tarball, or local path. analyze exits with code 1 if issues are found, suitable for scripting or CI checks.

Upgrading the Manager Itself

dshpm update dsh-web-plugin-manager --profile NAME
# Equivalent to
dsh plugin --profile NAME add dsh-web-plugin-manager@latest

For pnpm 11 users, if the same-day release cannot resolve to the latest version, set minimumReleaseAge: 0 in the profile’s pnpm-workspace.yaml; when mirror source dist-tags lag, use --registry=https://registry.npmjs.org to force the official source.

Applicable Scenarios and Notes

Who is this for

  • Users who frequently switch between the Web UI and multiple profiles and want a unified view of plugin status.
  • Developers who need to batch-install community plugins without manually modifying patches and troubleshooting dependency conflicts each time.
  • Teams that want agents to install plugins through quality gates instead of raw dsh plugin add commands.

Prerequisites before use

  • Plugins run with the permissions of the current dsh process; review source code and licenses before installing from the marketplace or git sources.
  • Disabling plugins depended on by other entries may cause profile startup failures (official fail-loud design); recovery requires manually editing the profile’s cordis.patch.yml.
  • Bundle installations from git may require running pnpm allowBuilds in the terminal (the command output will prompt).
  • Random mount lines without explicit IDs cannot be enabled/disabled via this; manually installed plugins show as “Unmounted” and need “Mount” or dshpm mount; the manager does not arbitrarily modify profiles.
  • Installation guards only intercept agent tool calls; they cannot prevent users from manually executing raw dsh plugin in the terminal.
  • Marketplace indexes are maintained by third parties (DSH-Plugins-Marketplace); some repositories may have been deleted or made private; Node processes read HTTP_PROXY / HTTPS_PROXY, but system proxy rules do not apply to undici.

For more complete feature and limitation details, see docs/feature-reference.md in the repository.

Conclusion

dsh-web-plugin-manager centralizes DSH plugin viewing, enabling/disabling, installation, updates, health checks, and environment management into a Web UI, using quality gates and dshpm to unify the installation pipeline, reducing the chance of “install and crash, restart and fail.” It is recommended to install as the first plugin in a profile and then manage other community plugins accordingly.