@bisibility/dsh-plugin
左侧边栏中的 Bisibility 面板，以及它管理的 Bisibility MCP 连接
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:CorgiCorner/bisibility-dsh-plugin#4698b211ac60ff9208029061654858333c51bb2bPlugin 以 @bisibility/dsh-plugin 发布，当前版本为 0.2.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
bisibility for DeepSeek Harness - SEO tools for your AI agent
Part of bisibility - an open-source SEO platform for keyword research, backlink analysis, and Google rank tracking. This repository contains the DeepSeek Harness plugin.
Ask your agent where you rank. No tabs, no exports, just answers.
A sidebar panel signs you in to bisibility once with OAuth, and the DeepSeek Harness agent gets the bisibility MCP tools: rank tracking, keyword research, backlinks, and AI visibility. No API key to paste, no token in a config file.
The market is an experimental DeepSeek Harness feature, so its Discover tab is hidden until you switch it on:
Open Plugins and select More beside Experimental plugins.
Switch on Custom plugin markets. A Discover tab appears next to Installed at the top of the Plugins page.
Open Discover, select Add index source, and paste:
https://corgicorner.github.io/bisibility-dsh-plugin/index.json
The index URL goes into Add index source, not into Add plugin.
Select bisibility, confirm the source and commit, and install it.
Quit and reopen DeepSeek Harness, then select Connect account in the bisibility panel.
Paste this release, pinned to its tag:
git+https://github.com/CorgiCorner/bisibility-dsh-plugin.git#v0.2.3
Without a tag, the address installs the latest release:
git+https://github.com/CorgiCorner/bisibility-dsh-plugin.git
The same addresses work with the CLI, for example
dsh plugin add git+https://github.com/CorgiCorner/bisibility-dsh-plugin.git#v0.2.3.
Then quit and reopen DeepSeek Harness and select Connect account.
DeepSeek Harness has no in-place upgrade for plugins outside its own catalog. When a newer version exists, the bisibility panel shows "bisibility X.Y.Z is available", and the bisibility card in Discover shows Update available (with a market source added). That label is a status, not a button. To update:
Your sign-in survives the reinstall: the OAuth records live in ~/.dsh/.credentials.yaml,
not in the plugin. To roll back, install an older version from the card's Versions list
or its tag. The panel reads the market index at most every six hours; release notes say what
each update needs.
@bisibility/dsh-plugin: import failed. Another copy of the
plugin is installed, for example an older local install under a different name.
Remove every bisibility entry on the Plugins page, install it again from the market,
then quit and reopen the app.The hosted Bisibility MCP resource (https://bisibility.com/api/mcp) is an OAuth
2.1 protected resource, while the shipped MCP client
(@deepseek-ai/dsh-mcp-client) only accepts a static Authorization header.
This bundle closes that gap without forking the client:
| Piece | Role |
|---|---|
index.js (Host) | OAuth 2.1 authorization-code flow with dynamic client registration and PKCE S256, token storage, loopback MCP proxy, MCP client mount |
client.js (browser) | Left-sidebar entry (sidebar.panellist, id bisibility), the main panel, and the New Bisibility conversation action |
cordis.patch.yml | Declares the panel row and the bisibility agent preset; the MCP client row is created at runtime |
POST /bisibility/oauth/open, which registers a public OAuth
client on first use, builds the PKCE challenge, and opens the authorization
URL in the default browser. GET /bisibility/oauth/start returns the same URL
without launching anything.GET /bisibility/oauth/callback validates state, exchanges the code, and
stores the refresh token in the harness credential store
(BISIBILITY_OAUTH_REFRESH_TOKEN), never in a patch file or the environment.
A pending sign-in stays valid for 15 minutes, across a Host reload.@deepseek-ai/dsh-mcp-client against
the loopback proxy, so the client never starts against an unauthenticated
endpoint.POST /bisibility/mcp forwards to the resource with a fresh Bearer token,
refreshing it 60 seconds before expiry. Requests carrying a browser Origin
or Sec-Fetch-Site header are refused, so a web page cannot drive paid tools
through the proxy. The other OAuth routes, except the callback, require the
DeepSeek Harness session and answer 401 without it.X-Bisibility-Client: bisibility-dsh-plugin/<version>. When Bisibility answers 426 because the
installed version is below its minimum, the panel shows Update required with
that minimum and a button to the Plugins page.If you sign in from a signed-out browser, Bisibility may land on its dashboard instead of returning to the harness. You are signed in at that point; press Connect account once more to finish.
The patch also declares an empty agent preset with id bisibility. The panel's
primary action starts a new conversation with that preset, so the session log
records it. Scopes requested: read write offline_access.
Timeouts: 30 s for client registration and each token request, 10 s for the
account lookup, and 300 s for one MCP tool call. The proxy waits 30 s longer and
answers 504 on its own timeout.
Role ids (bisibility, preset-bisibility) and route paths
(/bisibility/oauth/*, /bisibility/mcp) are stable. Overrides in your profile
cordis.patch.yml address rows by id, so a change to either is a breaking release.
link: dependency, for example
through the Plugins page with the absolute path of the checkout.client.js, copy, styles, and locale load in the browser half: reload the page.
Development builds have Reload Page (Cmd+R); in the packaged app open DevTools with
F12 and run location.reload(), or quit and reopen the app.index.js and cordis.patch.yml load in the Host: remove and add the plugin again,
or restart the app.client.js and the patch row name must equal the package
name; npm run check enforces both.npm ci, npm run check, and node --test. Against a running Host,
node scripts/check.mjs --host http://127.0.0.1:3000 expects 401 from
/bisibility/oauth/status, 200 from an MCP initialize, and 403 for a request with
an Origin header.~/.dsh/.credentials.yaml under BISIBILITY_OAUTH_*. Remove
those entries to test a first sign-in.