dsh-plugins-hub

In the DSH (DeepSeek Harness) plugin ecosystem, a profile can easily accumulate over a hundred official built-in plugins alongside third-party packages sourced from npm, Git remotes, or local directories. Telling them apart, knowing which ones can be safely uninstalled, and spotting available updates has traditionally meant digging through CLI logs and patch files. dsh-plugins-hub solves this inside the Settings > Plugins tab: first it classifies every plugin as official or third-party by resolving where the package actually lands on disk (not by guessing from the package name), then it renders a card for each third-party plugin showing version, install method, runtime status, update status, and Git branch state so every management decision is grounded in real data.

The plugin covers the full lifecycle. Update checking compares the npm registry latest tag using strict semver precedence (a down-revision is never reported as an update), diffs the remote HEAD against the commit pinned in the lockfile for Git-sourced plugins, and reads the local Git working-tree status for link/file dependencies. Each card offers update, pull-source, enable, disable, open-directory, and uninstall actions. Enable and disable rewrite only the target line in the profile patch layer and take effect through DSH hot-reload within one to three seconds, with no restart needed. Update and uninstall sync the bundle configuration and surface a restart-command prompt. Uninstalling a non-bundle plugin also flips its associated patch insert line to disabled: true so the next boot does not crash on a missing package. Protected chains (hot-reload, web server, the settings panel itself, and this plugin) can neither be disabled nor uninstalled. All host routes accept loopback-only requests, validate Host and Origin headers, and every external call uses an argument array rather than a shell string.

This plugin is aimed at developers who run DSH and maintain several third-party plugins at the same time -- whether they arrived via pnpm add from the npm registry, a GitHub Git reference, or a link: path into a local development tree. Instead of scrolling through CLI output or hand-editing patch files, they get a single panel to check status, apply updates, and uninstall with confidence.