dsh-plugin-manager
用于 DeepSeek Harness (DSH) 和 Cordis 的 Web 插件管理器：检查、启用、禁用、分组和管理运行时插件
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-manager@0.1.0Plugin Manager 以 dsh-plugin-manager 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
DeepSeek Harness Plugin Manager is a Web-based plugin manager for DeepSeek Harness (DSH) and its Cordis plugin runtime. It lets operators inspect, search, enable, disable, group, and batch-manage runtime plugins from the Harness Plugins settings page.
This is a community project, not an official DeepSeek Harness package.
cordis.patch.yml so it survives restart.Install the package into the web profile:
dsh plugin --profile web add dsh-plugin-manager
dsh --profile web
Open Settings -> Plugins -> Plugin list. The manager replaces Harness's read-only list while keeping runtime status visible and adding category grouping, search, and enable/disable controls. Removing the package later uses:
dsh plugin --profile web remove dsh-plugin-manager
For a local checkout or tarball:
pnpm install
pnpm run build
pnpm pack
dsh plugin --profile web add ./dsh-plugin-manager-0.1.0.tgz
Git installs run the prepare build and require explicit build-script authorization under pnpm 10 and newer. Published npm packages and tarballs already contain lib/ and do not need install-time build permission.
"Disable" means persisting disabled: true and asking Cordis to stop the configured plugin; it does not uninstall the dependency. Ordinary leaf plugins are switched in the running process when their lifecycle permits it. If the desired state is saved but does not settle before the timeout, the UI reports that a profile restart is required instead of treating the saved change as a failure. The manager writes only its own marked patch rows and leaves user-authored rows untouched. If a local entry id is ambiguous, the operation fails instead of changing the wrong plugin.
By default, the manager protects its own entry and Loader ancestors, the root Include and profile HMR services, plus the API gateway, Web server, client runtime, settings shell, client module loader, connection, locale, and Host runner. These entries keep profile changes and the management page alive and cannot safely be disabled from that page. Add deployment-specific ids through the Cordis row config:
- id: dsh-plugin-manager
name: dsh-plugin-manager
config:
protectedEntries: [my-auth-provider]
settleTimeoutMs: 8000
The Web API follows the same trusted-host decision as the Harness connection. Anyone allowed to use the trusted Web control plane can invoke plugin enablement, so do not expose the Harness Web server to untrusted networks.
Official and third-party packages share one open functional grouping rule. A package can declare dsh.pluginManager.group in package.json; packages that declare the same group id appear together regardless of publisher. Without a declaration, repository.directory in the form packages/<group>/<package> supplies a best-effort fallback for any repository. Missing or invalid metadata falls back to Ungrouped. Group ids use lowercase letters, digits, dots, underscores, and hyphens. A future rich dsh-plugin.json manifest and detail view are intentionally outside this release.
{
"dsh": {
"pluginManager": {
"group": "llm"
}
}
}
Groups are collapsed by default and directly list Loader entries by their configured ids, such as include, timer, and tool-web; imported module specifiers are intentionally hidden. A group toggle changes every mutable entry and skips protected infrastructure. Green means fully enabled, while yellow means the group is partially enabled.
pnpm install
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check
Pushing a vX.Y.Z tag runs .github/workflows/publish.yml. The workflow verifies that the tag matches package.json, runs the test, typecheck, and build gates, and publishes through npm Trusted Publishing with GitHub OIDC. It does not use a long-lived NPM_TOKEN.
Before using the workflow, configure the npm package's Trusted Publisher with GitHub owner hrhgit, repository deepseek-harness-plugin-manager, workflow filename publish.yml, no environment, and npm publish as the allowed action. npm exposes this setting only on an existing package, so the initial 0.1.0 release must first be published with a granular access token that has permission for this package and Bypass two-factor authentication enabled. Configure Trusted Publishing immediately afterward and revoke the bootstrap token.
For each later release, update and commit the version, then push the commit and its tag:
npm version patch
git push origin main --follow-tags
The package has one Host entry, one browser entry, generated Typert Remote artifacts, and one dsh.bundle patch. It targets the pre-release 0.1.x Harness APIs; review release notes before upgrading peer dependencies.
dsh.bundle provenance and compatibility metadata.Recommended GitHub topics: deepseek-harness, dsh, cordis, plugin-manager, plugin-management, web-ui, deepseek, typescript.
Search phrases that accurately describe this project include DeepSeek Harness plugin manager, DSH plugin management Web UI, Cordis plugin enable and disable, and DeepSeek Harness plugin bundle manager.