@dsh-external/dsh-plugin-manager

Readme

# @dsh-external/dsh-plugin-manager

**English** | [简体中文](README.zh-CN.md)

![version](https://img.shields.io/badge/version-1.0.1-blue)
![license](https://img.shields.io/badge/license-MIT-green)
![dsh](https://img.shields.io/badge/DeepSeek%20Harness-plugin-4f8cff)

A complete plugin manager for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — visual management, AI-powered translation, one-click summaries, AI search, share-and-install, and bulk updates, in a single installable package with an in-app plugin market.

---

## ✨ Key Features

| | Feature | What it does |
|---|---|---|
| 🖥️ | **Visual plugin management** | Card-based inventory of installed plugins & presets: enable/disable, delete, version check, categorize — all from one panel, no CLI needed |
| 🌐 | **AI auto-translation** | Switch the entire panel between Chinese / English, or any custom language — translated by your own model (pick a cheap model!), cached locally and persisted |
| 📝 | **One-click AI summaries** | Let AI write a one-line summary for every installed plugin; incremental + diff-aware, so it never wastes tokens re-summarizing unchanged plugins |
| 🔍 | **AI plugin search** | Describe what you need in plain words — the agent generates queries, scans GitHub (`topic:dsh-plugin` + wide net), picks the best candidates by relevance & stars, one-click install |
| 🔗 | **One-click share & install** | Package one or many plugins/presets into a single `dshpm://` link; send it to anyone, they paste and install everything at once |
| ⬆️ | **One-click updates** | Check and update all plugins (npm & GitHub sources) and GitHub-hosted presets in one click, with version selection when multiple tags exist |


## 📸 Screenshots

| Plugin Manager Panel | Plugin Market |
| --- | --- |
| ![Plugin Manager](/docs/screenshots/screenshot-1.png) | ![Plugin Market](/docs/screenshots/screenshot-2.png) |

## 📦 Install

```sh
# From GitHub (recommended)
dsh plugin --profile web add github:yunniees/DSH-Plugin-Manager

# Or from a local checkout (for development)
dsh plugin --profile web add /path/to/dsh-plugin-manager
```

The repo ships prebuilt artifacts (`lib/`) following the official "ship build output" publishing path — **no `allowBuilds` grant, no `prepare` script, works out of the box**. To pin a revision: `github:yunniees/DSH-Plugin-Manager#<commit>`.

Restart the Harness web UI after installing (the plugin depends on `webServer` and `llm` services in the main profile). You'll find the **Plugin Manager** entry at the bottom of the sidebar, next to Settings.

## 🚀 Usage

1. Open the **Plugin Manager** entry in the sidebar.
2. Pick an AI model from the top dropdown (needed for AI features; reuse your existing DSH provider — this plugin holds **no API keys**).
3. **Overview**: AI auto-classify uncategorized plugins; AI summaries (incremental); each card's **More** menu: check update / pick version / delete / share.
4. **Market**: browse, search, or **AI search** (type a requirement in plain words); enable **AI Intro** for per-plugin descriptions (long-press the button to clear its cache); scroll for infinite loading.
5. **Presets**: toggle, check updates, pick versions, share links.
6. **Share**: generate a `dshpm://` link from any card's More menu; recipients paste it in the Share panel and everything installs in one go.

## 🔒 Security

- **No hardcoded keys** — all AI calls reuse DSH's configured providers; the plugin never stores or reads API keys.
- **Local-only** — the HTTP API binds to loopback; nothing is logged or sent out.
- **Input whitelisting** — repo names, preset names, version tags and filenames are regex-validated against injection and path traversal.
- **Privacy** — state files hold only UI data (categories, summaries, language); `settings.yaml` is read for provider/model names only.

## 🛠️ Development

```sh
npm install          # typescript + tsdown, build-time only
npm run typecheck    # host + client type check (must be 0 errors)
npm run build        # typecheck + compile host + bundle client → lib/
```

- Host source: `src/index.ts` (Cordis bundle plugin, Node)
- Client source: `src/client/index.ts` (vanilla DOM + CSS variables, no framework)

> Always run `npm run build` after changing client source — otherwise the assembled bundle stays stale.

## ❓ FAQ

**Q: The market loads slowly or fails?**
Official sources are tried first (via your proxy), then domestic mirrors take over **without** going through your proxy node. On total failure a "Load failed, click to retry" button appears. Note that the GitHub search API (`api.github.com`) is unstable from mainland China — a gh-proxy.com fallback kicks in automatically.

**Q: Why must I pick a model first?**
All AI features reuse the providers already configured in DSH; this plugin holds no API keys. Pressing an AI button without a model selection shows a hint.

**Q: "GitHub API rate limited"?**
Anonymous GitHub search is ~10 req/min; one AI search fires several queries concurrently, so rapid repeated use can hit the limit. You'll get a clear error and can retry.

**Q: What is `allowBuilds`?**
DSH requires an explicit build grant for git-sourced plugins (pnpm ≥10). This plugin auto-grants and notifies when installing others — and because its own repo ships prebuilt `lib/`, it **never** requires a grant itself.

**Q: What can One-Click Update update?**
npm-sourced plugins via the npm registry (explicit versions bypass the lockfile), GitHub-sourced plugins to latest HEAD or a chosen tag, and GitHub-hosted presets. Locally-linked plugins prompt you to `git pull` manually.

**Q: What does deleting a plugin do?**
Confirmed deletes run `dsh plugin remove` (uninstalls from the profile and removes files); deleting a preset removes its directory.

## 📚 Documentation

Go deeper in [`ARCHITECTURE.md`](ARCHITECTURE.md) — mandatory rules, unified call layers, translation architecture, anti-regression patterns, and the release checklist.

## 📄 License

MIT — see [LICENSE](LICENSE).