Introduction

The design philosophy of DeepSeek Harness (DSH) is “everything is a plugin”. In integrated package management, the official desktop client mainly provides the runtime environment, and users often need to manually handle exporting, installing, and switching between multiple environments for .dspack files. dsh-packforge/dsh-pack-plugin, as a pure Plan B plugin bundle, aims to fill this gap. It does not depend on modifying the official source code; instead, it injects integrated package management capabilities into the official desktop client in the form of a standalone npm package.

Positioning and Architecture

This plugin is a self-contained standalone npm package injected into the desktop client through the official DSH bundle mechanism. It mainly consists of two parts: the Host side (Node.js) handles file operations, dependency reconstruction, and system proxy processing, while the Client side (browser bundle) handles UI interaction and task display.

  • Zero official source changes: It does not touch apps/desktop or apps/desktop-host.
  • Zero third-party plugins: It does not rely on third-party plugins other than runtime services.
  • Self-contained: Runtime dependencies are only fflate (ZIP processing), proxy-agent (download proxy), and proxy-from-env.

Core Features

The plugin provides full workflow management from exporting to running:

  1. Exporting and Installing: Supports packaging a profile into a .dspack file, or exporting from a source repository. Installation supports local files, URLs, and marketplace packages, and performs sha256 and size validation before installation.
  2. Multi-Profile Switching: Uses Windows Junction (hard link) technology for pointer switching. When switching the active profile, the system automatically redirects the profiles/desktop pointer without reinstalling.
  3. Isolation Management: Home-level skills and .agent-presets are independently pointer-switched and isolated according to profile switching, ensuring different environments do not interfere with each other.
  4. Marketplace and Configuration: Built-in marketplace browsing (supports lazy loading of the index), and provides the workspace configuration file .dshpkcfg for saving profile metadata settings.
  5. Task Center: Operations such as exporting and installing are performed in a non-blocking mode, with progress bars and timelines displayed in the Task Center view.
  6. Download Proxy: After configuring the proxy on the About page, it applies to marketplace indexes, package detail downloads, and .dspack installations. If not configured, it falls back to environment variables (HTTP_PROXY, etc.) or the system proxy.

Multi-Profile Switching and Isolation

The core logic of profile switching lies in the profiles/desktop pointer. The plugin implements switching by deleting the old junction and creating a new junction.

  • Hard rule: When deleting a junction, unlink (lstat semantics) must be used; rm -r must never be used, otherwise it will recursively delete the contents of the target directory.
  • First migration: Before switching a profile to the real desktop directory for the first time, the desktop process must be exited first, renamed to default, and then pointer switching is performed. The plugin uses an unmanaged helper to complete this process.
  • Home-level isolation: skills and .agent-presets are located in the Home root directory; the plugin also makes them junctions pointing to the slots of each profile, so they are switched together when changing profiles.

Format Contract and Security Rules

The plugin follows the pack-structure v3 r2 standard.

  • Security rules: When packaging, sensitive or redundant files such as node_modules, dist, secrets, nested archives, .dshpkcfg, and .dsh-pack are automatically filtered.
  • Workspace configuration: .dshpkcfg is a UTF-8 encoded JSON file using 2-space indentation and supports only whitelisted fields (such as name, dshVersion, exportContent, etc.).
  • Vendor tiers: Export supports three modes: auto (default), off (disabled), and full (fully embedded). In embedded mode, dependency tarballs are placed in vendor-blobs/, and local files are read with priority during installation.

Notes

  1. Runtime permissions: The plugin runs with the permissions of the current DSH process; the source code and license should be checked before installation.
  2. Dependency validation: Before installation, the vendor field inside the package is pre-validated with sha256 to ensure package integrity.
  3. Process management: Before first migration or switching to the real desktop directory, the desktop process must be closed; otherwise, file locking errors may occur.

Conclusion

This plugin provides a standardized integrated package management solution for the DSH desktop client. It interacts with official runtime services through an RPC channel and implements profile management, marketplace browsing, and task center features without modifying official code. It is suitable for users who frequently switch between multiple development environments or configurations.