dsh-third-party-plugins-manage

A DeepSeek Harness profile bundle that adds a 第三方插件 (Third-party plugins) tab to Settings → Plugins. It lists the plugins installed under the web profile's node_modules (i.e. the profile manifest dependencies, everything outside the official @deepseek-ai/dsh-* set) and offers three actions per plugin:

• 启/停用 (enable/disable) — written through the profile patch layer (cordis.patch.yml, a { id, disabled: true } entry per loader row id). The boot HMR watcher re-applies the patch layer, so toggling takes effect live, without restarting dsh web.
• 删除 (delete) — rewrites the profile manifest (removes the dependency and its bundle entry) and deletes the package directory from node_modules. A dsh web restart completes the unload.
• 更新 (update) — on each list load, checks the npm registry for the latest version of registry-sourced plugins and shows a green, clickable 更新 button when an update is available; clicking it runs pnpm add <name>@<version> in the profile. A dsh web restart activates the new version.

How it works

• lib/index.js (host) registers four exact HTTP routes under /_dsh/plugins/third-party/… (list, set-enabled, remove, update) and reads the live loader (ctx.loader) to map each dependency to its row ids and enabled state. It uses node:fs directly and the yaml library to round-trip the patch file safely (unknown !!js tags and comments are preserved). Update detection queries registry.npmjs.org for the latest dist-tag of registry-sourced dependencies.
• lib/client.js (browser, window.__ModuleLoader__ bundle) registers the 第三方插件 tab (settings.plugins.tab, id third-party) and renders the list with toggle, update, and delete buttons.

Install

dsh plugin --profile web add dsh-third-party-plugins-manage
# restart dsh web to activate the tab

User data ($DSH_HOME settings, credentials, sessions) is never touched. Uninstall with dsh plugin --profile web remove dsh-third-party-plugins-manage.

License

MIT