Preface

DeepSeek Harness (DSH) adopts an “everything is a plugin” architecture. As usage deepens, the number of official built-in plugins and third-party community plugins gradually increases, making mixed management inconvenient. dsh-plugins-hub provides independent management panels for these two plugin categories within Settings, supporting update checking, one-click updates, uninstallation, and real-time enable/disable from multiple sources such as npm and Git.

Core Features

  • Group management: In Settings → Plugins, Third-party plugins is expanded by default, while Official plugins is collapsed. Official plugins are represented as a read-only list, while third-party plugins support viewing details and taking actions.
  • Multi-source support: Supports plugin management from multiple sources, including npm, Git, and local links.
  • Security mechanisms: All host routes only accept local loopback requests, and write operations require the custom header x-dsh-plugins-hub. Package names and entry ids must match a whitelist regular expression. Commands are executed using execFile argument arrays to avoid command injection.
  • Protected entries: The hot reload chain, Web service chain, Settings panel, and this plugin itself cannot be uninstalled or disabled. Official built-in plugins can only be disabled and cannot be uninstalled.

Installation and Activation

Installing the plugin requires command-line execution. After installation, the DSH Web service must be restarted for changes to take effect.

dsh plugin --profile web add dsh-plugins-hub
dsh web

After installation, go to Settings → Plugins → Third-party plugins to use it.

Plugin Grouping and Determination

The plugin list is divided into two grouped cards: Third-party plugins and Official plugins. Plugin categorization is not based on package name, but on where the package is actually resolved:

  • Third-party: Resolved in the profile’s own node_modules (including link: / file: dependencies).
  • Official: Resolved only through the installation closure ~/.dsh/profiles/node_modules.
  • Fallback: When resolution fails, fall back to display based on the @deepseek-ai/ prefix heuristic.

Update and Activation Timing

  • Enable / Disable: Modifies the profile’s cordis.patch.yml. DSH’s configuration hot reload reorganizes the plugin tree within 1–3 seconds, no restart required.
  • Update / Uninstall: Equivalent to dsh plugin --profile web add|remove, and synchronizes dsh.profile.bundles. Uninstalling a non-bundle plugin changes its insert row to disabled: true. A restart of dsh web is required for full effect.

Supported sources and their behaviors are as follows:

Source Check update Update Uninstall Enable / Disable
npm Compare registry latest pnpm add <name>@latest ✅ ✅
git Use git ls-remote to compare commit pnpm add <original spec> ✅ ✅
link: / file: Read directory git status If workspace is clean, git pull --ff-only ✅ ✅
Official built-in — — ❌ ✅ (write to patch layer)

Security Mechanisms

  • Network boundary: All host routes only accept local loopback requests, and validate Host / Origin. Write operations also require the custom header x-dsh-plugins-hub.
  • Command execution: No shell command string concatenation is used; all execution goes through execFile argument arrays.
  • Protected entries: The hot reload chain (cordis-plugin-timer / cordis-plugin-hmr), Web service chain (dsh-host-webserver / dsh-web-app, etc.), Settings panel, and this plugin itself cannot be disabled or uninstalled.

Architecture

The host side does not import any @deepseek-ai/* packages. All functionality is consumed via duck typing (loader.entries(), webServer.register), so no peer dependency closure is required, and it can continue to load across DSH versions.

References