Preface¶

The philosophy of DSH is “everything is a plugin”. However, in practice, installing plugins usually follows two paths: opening a terminal to run dsh plugin add, or searching in the plugin market. The former is not user-friendly for those who rarely touch the command line, while the latter has limited coverage—plugins not listed in the market won’t have an installation entry on the interface. dsh-plugin-install fills this gap: it adds a new “Install” tab in the DSH settings page; inputting the package name allows installing any third-party plugin without opening the terminal or going through the plugin market. Below is an introduction to its functions, installation method, and notes.

What is this¶

dsh-plugin-install is a client-side plugin maintained by qinyre, targeting the Web platform (where dsh.client.platform in package.json is "web"), current version 0.3.10, MIT license. Runtime dependencies are minimal: peer dependency @deepseek-ai/cordis ^4.0.1, and dependency yaml ^2.9.0.

One-sentence positioning: Install any DSH plugin by package name in the settings page. The package name supports three forms—npm spec, github:user/repo, or local path.

Core Features¶

Installation, Uninstallation, and Updates Follow the Same CLI Path¶

Plugins do not maintain a second set of state. Installation, removal, and updates on the interface are all executed via dsh plugin add / remove, exactly consistent with manual operations in the command line, and the synchronization of dsh.profile.bundles is handled by the CLI.

One-Click Update Check, Avoiding Downgrades¶

The installed list can check for updates with one click, with check methods varying by source:

npm installation: compare with the registry’s latest version number;
github installation: compare with the repository HEAD commit;
local link: label truthfully, no check performed.

Before updating, it verifies the direction: if the registry’s latest is not higher than the installed version, execution is rejected. After the update completes, it verifies the actually landed version number, and truthfully prompts if inconsistent with the registry latest, rather than falsely reporting success.

Positively Handling pnpm 11’s Release Cool-down Period¶

pnpm 11 defaults to a 24-hour release cool-down period. Plugins attach --config.minimum-release-age=0 with every add and remove to circumvent this; if the old version of pnpm doesn’t recognize the parameter, it will automatically remove the retry.

At the same time, before every operation, it performs a strategy validation on the entire lockfile, intercepting entries published within the window with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. When the operation fails, the failure banner carries the real diagnosis printed by pnpm to standard output, rather than just a summary from the forwarder.

Activation Method and Restart¶

Pure client-side plugins refresh the page to take effect; plugins with relatively complex composition will explicitly prompt the need to restart. The “Restart Service” button on the page is available in both host environments: DSH Desktop, and running dsh web independently.

Security Protection for Write Operations¶

The spec uses character whitelist validation, rejecting parameter injection and shell metacharacters;
The update target can only be taken from the installed list;
POST requests require same-origin;
Only one write operation is allowed at a time.

The service itself only binds to the loopback address, forming a defense-in-depth with the above measures.

Installation and Activation¶

Execute the installation command:

dsh plugin --profile web add dsh-plugin-install

After the above steps, open the Web UI’s Settings → Plugins to see the “Install” tab. Uninstallation is done on the same page, or execute:

dsh plugin --profile web remove dsh-plugin-install

If you are using the desktop client DSH Desktop (github.com/qinyre/dsh-Desktop), it comes pre-installed with this plugin and requires no manual installation.

Typical Usage¶

In the “Install” tab, input the package name to install; npm spec, github:user/repo, and local path forms are all accepted.

Developers can also install local source code checkouts directly from the command line; the prepare script inside the package will automatically build lib/:

dsh plugin --profile web add file:/path/to/dsh-plugin-install

When participating in development, pull dependencies first, then execute type checking, testing, and building as needed:

npm install
npm run typecheck
npm test
npm run build

End-to-end smoke tests are disabled by default, requiring the deepseek-harness source code checkout in the same directory, and Node ≥ 22.19:

DSH_DESKTOP_PLUGIN_SMOKE=1 npm test

Applicable Scenarios and Notes¶

Suitable for:

Daily operation of DSH mainly in the Web UI, not wanting to open a terminal just to install a plugin;
Wanting to try third-party plugins not listed in the market;
Local plugin development, hoping to quickly install into the web profile to verify effects.

Two notes: First, third-party plugins run with the permissions of the current DSH process; before installing plugins from unknown sources, you should check the source code and license first, then decide whether to install; second, the security measures like the internal spec whitelist and same-origin validation target injection risks and cannot replace the review of the plugin’s own source code.

Conclusion¶

dsh-plugin-install moves the task of “installing plugins” from the terminal into the settings page, while not creating a separate state set—all operations still go through dsh plugin add / remove, combined with the handling of the pnpm 11 cool-down period and update direction verification. Every installation and update clicked on the interface results in the same as the command line.

Project address:

GitHub: https://github.com/qinyre/dsh-plugin-install
Community Directory Page: https://www.skillhub.cn/plugins/qinyre/dsh-plugin-install

The directory page comes from a community-maintained independent plugin directory, with no official affiliation to DeepSeek or Huafan.

dsh-plugin-install: Install any third-party plugin in the DSH settings page.