dsh-plugin-repo

Self-hosted plugin repository for DeepSeek Harness — a pure Cordis plugin (no changes to @deepseek-ai/* packages).

Each device runs its own repo over HTTP: list / upload / download .tgz, detect non-official plugins, install with version checks, and pull or push packages across devices. Official @deepseek-ai/* plugins are never listed or modified.

Install

# from npm
dsh plugin --profile web add dsh-plugin-repo

# or from a release tarball
dsh plugin --profile web add ./dsh-plugin-repo-1.7.0.tgz

Restart DSH, then open Settings → 插件仓库. Prefer a hard refresh (Ctrl+Shift+R) after upgrades.

Settings UI (v1.8)

Tab	Purpose
本机	Local .tgz repo + installed plugins (dual pane)
跨设备同步	Connect to another DSH; pull → local or push → remote
高级	Extra search roots for discovering plugins

Installed plugins (v1.7+):

• 启用 / 关闭 — toggles dsh.profile.bundles without removing dependencies (restart required)
• 删除 — uninstall from web profile when plugin is disabled (pnpm remove / dsh plugin remove)
• 从 npm 安装 — pnpm add / dsh plugin add into web profile
• DSH 版本适配 — reads peerDependencies and compares with running @deepseek-ai/dsh

Cross-device sync uses a dual pane (local | remote). Badges show concrete versions (本机 1.5.2 > 对方 1.5.0). Use 选需推送 / 选需拉取 to select only packages that differ (including version unknown → default push). Push confirms warn on downgrade; equal packages show as already synced. 最近推送 records persist under repoDir/push-history.json across restarts and explain whether remote was already unknown vs push stripped the version.

Cross-device access (v1.8+)

Cross-device requests are issued by the local DSH server (not the browser). This plugin does not embed login credentials.

When the remote device uses dsh-local-hanaccount:

1. Recommended: pair devices in Settings → 访问控制 → 对等设备 on both sides. Outbound fetch from DSH will automatically attach the peer Bearer token.
2. Single-side hc: on the device with hc, add /pluginrepo to 显式暴露 (exclude) so LAN peers can sync without pairing.

Plain LAN http://ip:3080 without hc continues to work. On HTTP 401/403 the UI points to hc pairing or explicit expose — not HTTP Basic in this plugin.

Repository storage

Default under the configured repoDir (often ~/.dsh/plugin-repo or a custom path):

• packages/<name>.tgz — non-official packages
• index.json — metadata (name, version, filename, size, uploadedAt)

HTTP API (on the DSH web port, e.g. http://127.0.0.1:3080)

Method	Path	Description
GET	/pluginrepo	HTML landing
GET	/pluginrepo/api/packages	List repo packages
GET	/pluginrepo/api/unofficial	Installed + repo non-official plugins
POST	/pluginrepo/api/upload	Upload .tgz (raw body; ?name= optional)
GET	/pluginrepo/download/<file>.tgz	Download
GET/POST	/pluginrepo/api/remote	List another device’s packages (POST body: host, optional port)
POST	/pluginrepo/api/remote-pull	Pull from another device into this repo
POST	/pluginrepo/api/remote-push	Push local-repo .tgz to another device
POST	/pluginrepo/api/install	Plan / confirm install into local profile
POST	/pluginrepo/api/profile/enable	Enable plugin in dsh.profile.bundles
POST	/pluginrepo/api/profile/disable	Disable plugin (remove from bundles)
POST	/pluginrepo/api/profile/uninstall	Uninstall disabled plugin from profile
POST	/pluginrepo/api/npm-add	Install from npm registry (spec, confirm)
DELETE	/pluginrepo/api/packages/<key>	Delete a repo package

Remote address parse order: scheme → host → port. Bare host → http + port 3080; https:// → port 443; explicit :port wins. Userinfo in URLs is stripped and ignored.

Model tools

• repo_list / repo_unofficial / repo_push / repo_pull / repo_delete
• repo_remote / repo_remote_pull / repo_remote_push
• repo_install (requires installConfirm=true to apply)

Configuration

Optional plugin config:

• repoDir — absolute repository directory
• logLevel — silent | info

Note: Use schemastery-style config (fields optional by default). Do not call zod’s .optional() on schemastery schemas.

License

MIT