dsh-extension-hub

dsh-extension-hub

New in v0.2.19 — the Add-ons block now carries dsh-pocket: DeepSeek Harness in your pocket — run dsh web on your PC and sync access from your phone by scanning a QR code (LAN + public network, real-time screen mirroring). (click to expand earlier highlights)

New in v0.2.18 — the Add-ons block now carries odai-dsh-plugin (profile-wide Odai governance & responsibility routing) and dsh-cost-meter (session cost & token statistics, budgets, balances and Coding Plan quotas).

New in v0.2.15 — the Add-ons block now carries dsh-vision-toolkit: a more powerful vision toolkit — paste an image directly for image understanding, UI restoration, long-screenshot analysis, and more visual tasks.

New in v0.2.8 — one-command install: the package now ships a bundle layer, so dsh plugin --profile web add dsh-extension-hub wires the plugin row into your profile automatically (no more manual cordis.patch.yml edits in the quick start).

New in v0.2.7 — the Add-ons block now also carries dsh-recall: conversation history recall for DSH — literal/fuzzy/semantic retrieval over every past session, fully local & offline.

New in v0.2.6 — A curated plugin store inside DSH: browse 400+ community-curated plugins (11 categories, bilingual descriptions), install from npm in seconds with anti-squatting checks, search every GitHub dsh-plugin repo — and keep them updated. Plus dsh-myrules — a companion plugin to edit your host-wide global instructions from the settings page. And a new Add-ons block in the Plugin Management tab: install, disable, uninstall and update companion features together with the main plugin.

Manage DeepSeek Harness (DSH) skills and MCP servers from one place.

Skills management · MCP servers · Skill import · Plugin management · Plugin market

A service-oriented extension center for DeepSeek Harness: a zero-dependency persistence core and CLI, plus a durable settings-page UI embedded in DSH Web — create / edit / enable / disable skills and MCP servers, one-click import from Claude Code and OpenAI Codex, and a full plugin manager (official vs third-party, enable / disable / uninstall, check & update, plus a Plugin Market with a curated store and GitHub search).

🌏 中文 · English

Quick Start

Prerequisites: DSH installed and running (dsh web works), Node.js ≥ 22, pnpm ≥ 10.

dsh plugin --profile web add dsh-extension-hub@0.2.19

One command: the package ships its own composition patch (bundle layer), so the plugin row is wired into your profile automatically — no manual cordis.patch.yml edits. Restart dsh web, then open Settings → Extension Management.

Install once — use the header's Check Updates button to upgrade later.

Features

Feature	CLI	Settings UI
List skills / MCP (enabled state, scope)	✅	✅
Create / edit / delete skills	✅	✅ (form + Markdown body)
Enable / disable skills & MCP	✅	✅
Create / edit / delete MCP (stdio / streamable-http)	✅	✅
Import skills & MCP from Claude / Codex and other tools	✅	✅
Project-scope install with folder picker	✅ (folder cmd)	✅ (DSH directory picker)
Manage plugins (official vs other, enable / disable / uninstall)	—	✅
Plugin Market: curated store (npm install) + GitHub search	—	✅
Check & update third-party plugins	—	✅
dsh-myrules — edit host-wide global instructions (Customize page); search "dsh-myrules" in the plugin manager to disable or uninstall it	—	✅
Add-on manager: install / disable / uninstall companion features, update together with the main plugin	—	✅

Built-in skills are read-only: the list also shows skills bundled with the deployment (shipped presets, e.g. the cordis preset's skills) and skills shipped inside user presets, marked "Built-in/Preset" and not editable / deletable / toggleable — they belong to the deployment or preset layer. To override, create a same-name skill in the user or project directory.

Plugin Management Guide

The Extension Management page ships a full plugin manager since v0.2.0, with four tabs: Skills / MCP Servers / Plugins / Plugin Market.

Managing installed plugins

The Plugins tab lists every plugin row in your DSH composition, split into two collapsible groups:

• Official Plugins — DeepSeek's own @deepseek-ai/* packages (collapsed by default). They can be disabled but not uninstalled; the cordis:include entry is the composition loader itself and is marked Core — it cannot be disabled or removed.
• Other Plugins — third-party and your own plugins (e.g. this one).

Click a plugin to see its details: description, source, repository link, entry id and module name. From the detail block you can:

• Enable / Disable — written to your profile cordis.patch.yml; takes effect after a dsh web restart. Disabling warns you that an unknown plugin may cause serious problems.
• Uninstall (non-official only) — removes the plugin row from the configuration, with a warning plus a second "Confirm uninstall?" step. If the plugin was installed via a GitHub clone, its local clone directory is deleted too.

The Other Plugins group header has Check Updates: it compares npm packages against the registry and local git clones against their origin HEAD. Updateable plugins get a green Update Available button next to their status label — click it to pull the new version (npm tarball or git pull), or use Update All to update every updateable plugin at once.

Discovering & installing new plugins

The Plugin Market tab has two sub-views:

• Curated (default) — a community-curated catalog (awesome-dsh-plugin, refreshed daily) with 11 categories, bilingual descriptions, star counts and ordering (Featured / Top / Newest). Entries with an npm mapping install from npm in seconds (registry tarball, with an anti-squatting check that the package points back at the listed repository); entries without one fall back to a GitHub clone. A 24h local cache keeps the view usable offline.
• Discover More — searches GitHub for repositories tagged dsh-plugin (a free-text query narrows the search). Each result shows stars and an "Installed" badge when the repo is already present locally.

Click a curated/discovered entry to open its detail page — description, stars, category (curated), install method and a link to the repository — then hit Install. Extension Hub:

1. Prefers the npm registry when the plugin publishes to npm: downloads the tarball into the profile node_modules without pnpm (no symlink/permission requirements) and registers a bundle row. Packages installed this way are managed by Extension Hub itself — keep updating them with its Check Updates; the dependency is declared in the profile manifest, so a later dsh plugin / pnpm install keeps it.
2. Otherwise clones the repository (shallow) into ~/.dsh/extension-hub/plugins/ and verifies it ships a usable package.json entry. Clone installs support zero-dependency plugins only: packages with npm runtime dependencies are rejected (there is no dependency-install step), and packages that rely on a bundle patch (dsh.bundle.patch) are flagged because a clone cannot apply it. Be aware that a monorepo root (e.g. the repo of dsh-myrules is this very repository) clones as the root package, not the target plugin — use the npm or Add-ons install path for those.
3. Registers the plugin in your profile cordis.patch.yml (managed insert block) and self-checks the write.

Mixing install paths (Discussion #2889): Extension Hub installs write a profile patch row plus a dependency declaration. Do not combine this with the official dsh plugin add/list/update commands: DSH CLI appends every dependency declaring a dsh.bundle.patch to dsh.profile.bundles, duplicating the manual row and crashing dsh web on boot with duplicate loader entry id (see deepseek-harness Discussion #2889). If you already ran a dsh plugin command, remove the duplicated entries from dsh.profile.bundles before restarting.

After a dsh web restart the plugin appears in the Other Plugins group, where you can disable or uninstall it (GitHub-clone installs also remove the clone directory) and keep it updated with Check Updates (npm packages check the registry; local git clones update via git pull).

Installing runs third-party code. Only install repositories you trust, and check the repository's own README for install instructions — a repo tagged dsh-plugin may still be a skill, an MCP server, or need a custom setup.

Recent Updates

Recent updates (click to expand)

• 2026-08 — v0.2.19: new add-on dsh-pocket — run dsh web on your PC and sync access from your phone by scanning a QR code (LAN + public network, real-time screen mirroring); install / disable / uninstall from the Add-ons block, updates together with the main plugin.
• 2026-08 — v0.2.18: two new add-ons — odai-dsh-plugin (profile-wide Odai governance & responsibility routing) and dsh-cost-meter (session cost & token statistics, budgets, balances, Coding Plan quotas, 90+ model price catalog); install / disable / uninstall from the Add-ons block, updates together with the main plugin.
• 2026-08 — v0.2.17: npm installs of bundle-patch add-ons now warn against mixing install paths — DSH CLI's bundle reconcile (dsh plugin add/list/update) appends every dependency declaring dsh.bundle.patch to dsh.profile.bundles, duplicating the manual row and crashing dsh web on boot (duplicate loader entry id, see Discussion #2889); the README now carries the same guidance.
• 2026-08 — v0.2.16: add-on installs now warn about missing runtime dependencies — the npm installer checks the downloaded package's dependencies against the profile and appends a reminder to the result message when any are absent (the install still completes; a profile-level pnpm install fixes loading after restart).
• 2026-08 — v0.2.15: new add-on dsh-vision-toolkit — a more powerful vision toolkit (paste an image directly for image understanding, UI restoration, long-screenshot analysis, and more visual tasks); install / disable / uninstall from the Add-ons block, updates together with the main plugin.
• 2026-08 — v0.2.14: fix: add-ons / installed badges now see the bundle layer — a feature or plugin installed via the official dsh plugin add (bundle) path is detected as installed (its row lives in the bundle's own patch, not the profile patch), so the Add-ons block no longer offers a duplicate install that would crash dsh web; installNpmPlugin refuses packages already registered by a bundle layer; bundle-installed add-ons are uninstalled via dsh plugin remove (guided in the UI) instead of profile-patch deletion.
• 2026-08 — v0.2.13: fix (issue #2) — hostPatchPath() no longer auto-probes the profiles directory (a scan could hit a headless profile before web and make the MCP list read/write the wrong composition); extension management is bound to the web profile, with an explicit profile name still supported.
• 2026-08 — v0.2.12: review fixes — MCP discovery now follows Claude/Codex precedence (project .mcp.json > project .claude.json > user configs; Codex project > global) instead of the reversed order; the MCP list shows home-level rows ($DSH_HOME/cordis.patch.yml, read-only, badge-marked); composition and state writes are atomic (temp+rename, lock retries) so a crash cannot corrupt cordis.patch.yml; clone-install rejection messages distinguish a missing package.json from a missing build output (git installs fetch sources, not artifacts); README notes that npm-installed plugins stay managed by Extension Hub across later dsh plugin/pnpm runs.
• 2026-08 — v0.2.11: docs — quick-start install command pinned to the current release (the published tarball had carried the v0.2.8 command).
• 2026-08 — v0.2.10: complete Windows fix for GitHub-clone installs — clone rows now register a file:// URL pointing at the clone's entry file (v0.2.9 pointed at the clone directory, which Node ESM still rejects with ERR_UNSUPPORTED_DIR_IMPORT and crashed dsh web); clone installs also refuse packages with npm runtime dependencies (there is no dependency-install step) and warn when a package relies on a bundle patch that a clone cannot apply. To repair a broken row by hand, edit cordis.patch.yml and point name at the entry file, e.g. name: file:///C:/Users/you/.dsh/extension-hub/plugins/foo/lib/index.js.
• 2026-08 — v0.2.9: Windows GitHub-clone install fix (first pass) — clone rows switched from raw drive-letter paths to file:// module names; superseded by v0.2.10 (entry-file URLs).
• 2026-08 — v0.2.8: one-command install — the package now ships a bundle patch (cordis.patch.yml), so dsh plugin --profile web add dsh-extension-hub wires the plugin row into your profile automatically; the quick start no longer requires manual cordis.patch.yml edits.
• 2026-08 — v0.2.7: new add-on dsh-recall — conversation history recall for DSH (three-layer literal/fuzzy/semantic retrieval over every past session, fully local & offline); install / disable / uninstall from the Add-ons block, updates together with the main plugin.
• 2026-08 — v0.2.6: new Add-ons block in the Plugin Management tab — install / disable / enable / uninstall companion features (dsh-myrules) without leaving the page; the header Check Updates now checks the main plugin AND installed add-ons together and updates everything at once; collapsible block; feature i18n keys aligned with their ids; "Integrate with Extension Hub" invitation section added to both READMEs.
• 2026-08 — v0.2.5: new companion plugin dsh-myrules (packages/dsh-myrules) — a Customize (个性化) page in Settings that edits the host-wide global instructions ($DSH_HOME/AGENTS.md, injected into every session, new sessions apply immediately); theme-inverted primary buttons across the plugin manager, slim save button, percentage budget meter; rolling .bak backup removed.
• 2026-08 — v0.2.4: Plugin Market with a Curated store + npm install path — the Plugin Market tab now leads with a Curated view of the community catalog (awesome-dsh-plugin, 11 categories, bilingual descriptions, Featured/Top/Newest ordering, 24h offline cache) beside Discover More (GitHub search); plugins with an npm mapping now install from the npm registry via tarball (no pnpm, anti-squatting repo check) with GitHub clone as fallback; settings tab renamed to Plugin Market; curated view no longer hangs on load (client-side method registration); quoted (@scope) row ids match in install