dsh-workshop

Once you have a handful of third-party plugins loaded in DeepSeek Harness, questions start piling up: who actually published this entry, is that @deepseek-ai/ prefix legitimate or a spoof, and can I toggle a plugin off without a full uninstall? dsh-workshop is a lightweight management tab built for exactly those moments—giving you an at-a-glance identity label and a one-click hot toggle for every loaded entry.\n\nIts identity detection ignores scope prefixes entirely and resolves origins from pnpm-lock.yaml: entries absent from the lockfile ship with dsh as built-ins; semantic version numbers mean npm packages; codeload.github.com URLs indicate a GitHub tarball pinned to a commit; file: paths point to local development directories. A GitHub package squatting on the @deepseek-ai/ scope gets an explicit warning badge. Toggling writes a disabled: true line into your user patch layer (cordis.patch.yml); HMR reassembles in one to three seconds with no restart needed, and the 44 infrastructure patterns are locked against accidental disable. Risk labels come from a hand-maintained JSON list that takes effect immediately on edit; unrated third-party entries show as unrated while built-ins show as officially maintained.\n\nIt suits independent developers or small teams already running DeepSeek Harness with more than a couple of third-party plugins, who want quick toggling and clear provenance without reaching for an uninstall. If your priority is auditing and tracing where each plugin comes from rather than extending functionality, this tab fills that gap neatly.