DeepSeek Harness Plugin Hub

发布与管理完整 Harness Profiles,发现适合你的插件。

探索

插件目录环境预设文档中心动态

社区

发布插件联系我们报告问题

相关链接

Plugin Hub GitHubDeepSeek Harness 官方项目系统状态隐私说明
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

独立、非官方社区项目,与 DeepSeek 官方无隶属、授权或背书关系。

Photo Skins — DeepSeek Harness 插件(DSH Plugin)
← Plugins

dsh-photo-skins

Photo Skins

dsh Web GUI 的照片皮肤:将自己的照片导入为 UI 皮肤(背景层 + 自动提取强调色)

插件会安装到这里;不确定时保持 web。

npx -y @deepseek-ai/dsh plugin --profile web add dsh-photo-skins@0.2.0
README兼容性版本
Photo skins demoPhoto skins demoPhoto skins demo

兼容性与来源证明

Photo Skins 以 dsh-photo-skins 发布,当前版本为 0.2.0。Plugin Hub 会校验它的 manifest,并保存精确安装来源,便于复现安装结果。

DSH 兼容范围
*
运行环境
web
发布来源
npm
Registry 更新时间
2026/8/31

版本

0.2.0stable
2026/8/31
0.1.0stable
2026/8/31

相关插件

正在加载相关插件…

最新版
0.2.0
DSH
*
HMR
重启进程
Tree shaking
未声明可安全裁剪
解包体积
156.2 kB
文件数
9
Surface
web
许可证
BSD-3-Clause
发布源
npm
GitHub
★ 2
周下载
0
最近提交
2026/8/31
查看源码 ↗
README Badge

点击下方 Badge 复制 Markdown,粘贴到 README 即可。

这是你的 Plugin?认领权益 · 优先安全扫描

验证 package.json 声明的 GitHub 仓库,即可管理这个公开页面。认领后,Hub 会优先安排当前版本的安全扫描,并在通过后公开展示结果。

认领这个 Plugin →
报告问题
DeepSeek Harness Plugin Hub
ProfilesPlugins分类动态文档登录管理 Profiles
ProfilesPlugins分类动态文档登录

相关插件

继续浏览 ui-customization 分类下经过校验的插件。

Web App@deepseek-ai/dsh-web-appdsh 浏览器界面捆绑包:位于 dsh-base 之上的 Web 补丁层,加上运行时粘合插件(提供前端 dist、Web 界面提示符、bash 运行时变量和 URL 行)Experimental Agent Team Web Profile@deepseek-ai/dsh-experimental-agent-team-web-profile用于 Agent Teams Remote 和 UI 插件的实验性 Web 配置层Remote Web Ui@linxin666/dsh-remote-web-ui通过扫码配对访问 dsh Web GUI,共享一个官方界面:设置按钮旁的二维码可将手机和 PC 配对到同一个 Web GUI(手机采用竖屏触控适配层,PC 使用完整桌面界面),通过一次性令牌和 rClient Ui Git Graph@linxin666/dsh-client-ui-git-graph外部 dsh Web GUI 插件:空会话 Git 分支选择器和 Git 图,包含实际的主机端 Git 操作与防护,作为 dsh 配置文件包

README

🪄 dsh-photo-skins

中文 | English

Import once. Auto-accent once. Turn any photo into a skin for the DSH Web GUI.

Photo skins demo Photo skins for the DSH Web GUI: import your own photos and turn them into the interface skin. The photo paints the backdrop behind the GUI, and the accent colors are extracted from the photo automatically (dominant color as the accent, photo-tinted light/dark readability veils). Rendering controls: fit (cover/contain), blur (0-100px, global or split empty/content), dim (0-100%) and the auto-accent toggle.

0831Updates - A cordis plugin: enhance Web-Reach, page, reading and RSS.

✨ Core Feature

📥 Import photos three ways

Photo skins demo

  • File picker, drag-and-drop, or paste — pick whichever you like
  • Supports PNG / JPG / WebP / GIF, up to 25MB each

👗 Try on / apply / remove

  • Manage everything from the first-level "Photo skins" settings section
  • "Try on" previews temporarily without touching the applied photo
  • "Apply" writes the skin in one click; "Remove" clears the local copy

🎨 Automatic accent extraction

  • The photo's dominant color becomes the interface accent
  • Derives light/dark scrim tints so the readability veils pick up the photo's own tone
  • Exposes CSS variables --dsw-photo-accent / --dsw-photo-accent-soft / --dsw-photo-accent-contrast

🖼️ Rendering controls

Photo skins demo

  • Fit: cover / contain
  • Blur: 0–100px, global or split
  • Dim: 0–100%, keeping foreground content readable
  • Accent-from-photo: toggle on/off anytime

💾 Local persistence

  • The applied photo persists through the photo-skins settings namespace and survives reloads

🚀 Install

From npm:

dsh plugin --profile web add dsh-photo-skins

From this repository (development):

pnpm install && pnpm build
dsh plugin --profile web add link:.

Then refresh the running Web GUI (restart dsh web if the new section does not appear).

Storage

Photos are stored under <DSH_HOME>/photo-skins/<id>/ (original.<ext> plus a manifest.json with the display name, type, size and import time). Nothing is uploaded or shared; removal deletes the local copy.

Web-Reach

Web-Reach is in the same plugin and free to use. It wires "web search" into DSH's web capability seam (ctx.web) and additionally registers two native tools that the Agent calls automatically during a conversation when it needs current information:

  • web_search: contributed as one of three ctx.web search providers — DuckDuckGo (no key; scraping-based, needs a reachable network path to duckduckgo.com), Exa free (hosted MCP; the default backend, marked "recommended" in the card), or Exa API key (requires a saved key).
  • web_fetch: Jina Reader turns any public page into Markdown (no key).
  • rss_fetch: parses an RSS 2.0 / Atom feed into its entries (no key).

Web search is a master switch: the "Web search" toggle above the composer shows the active backend and turns it on/off, sharing the same web-reach namespace as the card so the two stay in sync. When enabled (the default), the plugin points ctx.web's searchProviderId at the chosen backend. when disabled, the official DeepSeek-native search is restored.

The key entry only appears for the "Exa API key" mode. The key is stored in the web-reach settings namespace as a secret, redacted on the wire and never read back by the browser (write-only). Search queries and page URLs are sent to third-party services (DuckDuckGo / Exa / Jina Reader) — the data leaves this machine. See Security model below.

🔒 Security model

  • All routes (/api/photo-skins/*) sit behind a same-origin fence (Sec-Fetch-Site / Origin): cross-site webpages cannot read, import or delete your photos.
  • Uploads are validated by file magic bytes, not by name or declared content-type — a renamed SVG or executable is rejected (415). SVG is deliberately unsupported (script risk).
  • Uploads are capped at 25MB (413) and written atomically (tmp + rename).
  • Stored ids are generated and validated against a whitelist regex, so no path can escape the store directory.
  • Web-Reach search providers and tools run in the host process (there is no browser-exposed route), and every outbound fetch is SSRF-gated: only public http(s) URLs are fetched, and loopback / link-local / private / reserved IP ranges, plus cloud-metadata hostnames and IP-obfuscation forms, are refused. Redirects are re-validated and capped; responses are timeout-bounded (15-20s) and size-capped (2 MiB); provider/tool execution honours the turn's cancellation signal. The Exa hosted-MCP endpoint (https://mcp.exa.ai/mcp) passes the same SSRF gate.
  • The DuckDuckGo search path sends only a text query term (never a URL) and reports the decoded result URLs back without fetching them.
  • The Exa API key is an optional role('secret') settings field: stripped at the wire boundary, the browser never receives the plaintext; the provider reads it only host-side at execution time. Choosing "Exa API key" without a saved key leaves that provider unavailable and search fails loudly rather than silently downgrading.
  • Exa free (MCP) uses Exa's official hosted MCP endpoint, currently advertised as keyless; its keyless status is not verified by this plugin and may change.

🛠️ Development

Requirements: Node.js ^22.19 || >=24, pnpm

pnpm install
pnpm typecheck   # tsc --noEmit
pnpm test        # vitest run
pnpm build       # tsdown -> lib/ (host) + lib/client.js (browser bundle)

License

BSD-3-Clause. See THIRD_PARTY_NOTICES.md for attribution of incorporated portions.