dsh-plugin-manager

The moment you load several community plugins into DeepSeek Harness, silently turning one off means flipping through profile/package.json, editing the bundles array, and restarting the entire dsh process. Worse, an accidental disable of a system component can leave Harness completely unable to boot. dsh-plugin-manager collapses that ritual into a single click inside the WebUI: Settings > Plugins > Plugin Manager. Every user plugin gets a toggle on the right; flip it and the change is live immediately, no restart required.

Under the hood it calls the Cordis loader entry.update({ disabled }) hot-swap path, the same mechanism the official dsh-market theme switch uses, so toggling is near-instant. By default the browser page auto-refreshes after each switch so front-end plugins (desktop pets, sidebars, etc.) come fully online right away; you can opt into manual-refresh mode and the preference is remembered in localStorage. Disabled plugin IDs are persisted to a local state.json and replayed as disabled on the next startup until you re-enable them. A one-click Restore All button clears every held-disabled entry at once. System components are listed read-only with no toggle, making it impossible to disable core infrastructure by mistake.

It is built for users running multiple DSH plugins at the same time -- including custom entries such as MCP bridges added via cordis.patch.yml -- who want to quickly switch individual plugins on or off during debugging or demos without paying a full restart each time. A minimal same-origin HTTP API (list / toggle / reset) is exposed for scripting or external tool integration. On the security side, the host uses only Node built-in modules (fs, os, path) with no network calls, no child processes, and no eval; the client renders plugin names through React with automatic escaping, and every request is a same-origin fetch, keeping the attack surface as small as possible.