dsh-plugin-manager

DSH web plugin: unified manager for profile bundles and MCP integrations (Settings → Plugins → 管理).

Toggles write managed disable overrides into the profile cordis.patch.yml and take effect through config hot-reload — no restart required.

Architecture

This plugin has two halves:

Node half (src/index.ts, exports ".") — mounts the /plugin-manager/api/* JSON API:
- plugins.list — the full inventory: profile bundles + manual patch inserts, joined with live Loader entry state.
- plugin.toggle — enable/disable one item; writes a managed disabled override block at the end of the profile's cordis.patch.yml.
Browser half (src/client/index.ts, exports "./client") — registers the 管理 tab in Settings → Plugins:
- One card per bundle / entry with a live status dot and an enable/disable switch.
- zh/en locale dictionaries.
- Switches hold optimistic state (card border highlighted) until the live Loader state converges via config hot-reload.

Build

pnpm install
pnpm build        # produces lib/index.js + lib/client.js
pnpm typecheck    # tsc --noEmit
pnpm watch        # rebuild on save

How toggles work

The user clicks a switch in the 管理 tab.
The browser calls POST /plugin-manager/api/plugin.toggle with { key, disabled }.
The host finds the item, rewrites the managed block (delimited by # >>> dsh-plugin-manager >>> / # <<< dsh-plugin-manager <<<) at the end of the profile's cordis.patch.yml.
The launcher watches that file and hot-reloads the config — the change takes effect live.

System bundles (@deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app, @deepseek-ai/dsh-headless) are never toggleable.

Trust fence

Every route passes the same browser-trust fence as the /api gateway: Host-header loopback or a configured trusted authority passes; cross-site browser markers are refused. This is a DNS-rebinding / cross-site defense, not authentication.

License

MIT

dsh-plugin-manager

같은 패키지 이름의 다른 저장소

설치

문서