dsh-vibe-pack
事务性仅数据 DSH 配置包，具备完整性、所有权和回滚功能
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:LeemanCheung/dsh-vibe-pack#501d6dc022b5862d50b609f2da545970110119a9Vibe Pack 以 dsh-vibe-pack 发布，当前版本为 1.0.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A transactional, data-only configuration pack manager for DeepSeek Harness. It previews, installs, diffs, exports, and uninstalls independently versioned resources under $DSH_HOME while tracking ownership and protecting user modifications.
Vibe Pack reviewed install plan
Generated with GPT Image from the implemented Client layout and feature set; runtime appearance follows the active DSH theme and viewport.
A source is a local directory or a ZIP-compatible .dshpack/.zip archive containing dshpack.yaml and every manifest-listed payload. The strict version-1 manifest contains an id, version, compatibility ranges, 1–10,000 files, SHA-256 for every file, create/replace/merge modes, ownership metadata, and bounded display metadata.
Pack files are data only. Accepted payload extensions are JSON/YAML/.dshskin, Markdown/text/TOML/INI, and PNG/JPEG/WebP/GIF images; executable or unknown extensions are rejected. No script, hook, shell command, JavaScript module, URL fetch, symlink, YAML alias/tag/anchor, embedded credential, traversal path, duplicate archive path, or undeclared payload executes or installs. Archives are checked against compressed, expanded, per-file, byte, and entry limits before payload use.
Preview reports create/replace/merge actions and conflicts. Existing unowned files, files owned by another pack, create-mode collisions, and resources modified after installation require an explicit force choice. Force transfers only manifest-listed ownership; it is never implied.
Install and uninstall are serialized and guarded by an on-disk transaction lock. Each target is backed up before fixed-order atomic writes. Failed operations restore targets in reverse order and report partial rollback errors. The ledger is written atomically at $DSH_HOME/.dsh-vibe-pack/ledger.json. Uninstall protects modified resources unless force is explicit.
Every managed read and mutation resolves the real filesystem location first. A symbolic link or Windows junction that leaves the configured DSH root is rejected before preview, backup, export, directory creation, write, or removal.
Merge mode accepts JSON or YAML objects, recursively merges object keys, replaces arrays/scalars, rejects prototype keys and secrets, and emits deterministic data. Export verifies that installed resources still match the ledger and produces a portable .dshpack archive.
Settings → Vibe Pack provides mandatory preview, digest-bound install, ledger history, Diff, independently confirmed Uninstall, and .dshpack download. The generated Typert namespace is vibePack. The CLI defaults --root to $DSH_HOME; pass it only to manage an explicit test root.
dsh-pack --root $env:DSH_HOME inspect ./my-pack
dsh-pack --root $env:DSH_HOME plan ./my-pack.dshpack
dsh-pack --root $env:DSH_HOME install ./my-pack.dshpack
dsh-pack --root $env:DSH_HOME history
dsh-pack --root $env:DSH_HOME diff my-pack
dsh-pack --root $env:DSH_HOME export my-pack > my-pack.dshpack
dsh-pack --root $env:DSH_HOME uninstall my-pack
Use --force only after reviewing reported ownership or modification conflicts.
dsh plugin --profile web add github:LeemanCheung/dsh-vibe-pack
Restart the existing DSH Web process and refresh its page.
This plugin adds no model prompt, tools, messages, token usage, or KV-cache content. Pack inspection and mutation happen on the Host through explicit UI or CLI operations.
The transaction lock fails loud after an unclean process exit and may need manual removal after confirming no Vibe Pack process is active. Remote operations are shared with trusted clients in the same DSH Web composition. The format provides SHA-256 integrity and ownership checks, not publisher signatures or network distribution.
From the repository root run corepack pnpm typecheck, corepack pnpm test, corepack pnpm build, and corepack pnpm pack:check. See TEST_PLAN.md for security acceptance cases.
Version 1.0.1 is marked compatible with the DSH 0.1.2-rc.1 web profile after Windows QA loaded its Host service, browser Client, generated Remote namespace, and Settings section in both the isolated QA instance on port 3081 and the existing local profile on port 3080. The Settings panel successfully loaded an empty ledger. Automated coverage contains 14 passing tests, including existing and missing-target junction escapes.
CI is configured to rebuild the committed lib artifacts on both Windows and Linux and reject any tracked or untracked difference.
MIT. See LICENSE.