dsh-extension-hub

New in v0.2.0 — Now you can manage your plugins properly. Extension Hub manages official and third-party plugins, lets you enable them as you see fit, install open-source third-party plugins directly inside DSH, and keep them updated at any time.

Manage DeepSeek Harness (DSH) skills and MCP servers from one place.

Skills management · MCP servers · Skill import · Plugin management

A service-oriented extension center for DeepSeek Harness: a zero-dependency persistence core and CLI, plus a durable settings-page UI embedded in DSH Web — create / edit / enable / disable skills and MCP servers, one-click import from Claude Code and OpenAI Codex, and a full plugin manager (official vs third-party, enable / disable / uninstall, check & update, and a GitHub-powered plugin discover & install page).

🌏 中文 · English

Quick Start

Prerequisites: DSH installed and running (dsh web works), Node.js ≥ 22, pnpm ≥ 10.

macOS / Linux (Windows with Git Bash or WSL works too):

cd ~/.dsh/profiles/web
pnpm add dsh-extension-hub
grep -q "name: dsh-extension-hub" cordis.patch.yml || cat >> cordis.patch.yml <<'EOF'

- insert:
    - id: extension-hub
      name: dsh-extension-hub
EOF

Windows (PowerShell 5.1+ / pwsh):

cd "$env:USERPROFILE\.dsh\profiles\web"
pnpm add dsh-extension-hub
if (-not (Select-String -Path cordis.patch.yml -Pattern 'name: dsh-extension-hub' -Quiet)) {
  Add-Content -Path cordis.patch.yml -Value "`n- insert:`n    - id: extension-hub`n      name: dsh-extension-hub"
}

Restart dsh web, then open Settings → Extension Management.

Install once — the plugin keeps itself up to date automatically.

Features

Feature	CLI	Settings UI
List skills / MCP (enabled state, scope)	✅	✅
Create / edit / delete skills	✅	✅ (form + Markdown body)
Enable / disable skills & MCP	✅	✅
Create / edit / delete MCP (stdio / streamable-http)	✅	✅
Import skills & MCP from Claude / Codex and other tools	✅	✅
Project-scope install with folder picker	✅ (folder cmd)	✅ (DSH directory picker)

Built-in skills are read-only: the list also shows skills bundled with the deployment (shipped presets, e.g. the cordis preset's skills) and skills shipped inside user presets, marked "Built-in/Preset" and not editable / deletable / toggleable — they belong to the deployment or preset layer. To override, create a same-name skill in the user or project directory.

| Import skills & MCP from Claude / Codex and other tools | ✅ | ✅ | | Project-scope install with folder picker | ✅ (folder cmd) | ✅ (DSH directory picker) | | Manage plugins (official vs other, enable / disable / uninstall) | — | ✅ | | Discover & install GitHub dsh-plugin repositories | — | ✅ | | Check & update third-party plugins | — | ✅ |

Built-in skills are read-only: the list also shows skills bundled with the deployment (shipped presets, e.g. the cordis preset's skills) and skills shipped inside user presets, marked "Built-in/Preset" and not editable / deletable / toggleable — they belong to the deployment or preset layer. To override, create a same-name skill in the user or project directory.

Plugin Management Guide

The Extension Management page ships a full plugin manager since v0.2.0, with four tabs: Skills / MCP Servers / Plugins / Discover.

Managing installed plugins

The Plugins tab lists every plugin row in your DSH composition, split into two collapsible groups:

• Official Plugins — DeepSeek's own @deepseek-ai/* packages (collapsed by default). They can be disabled but not uninstalled; the cordis:include entry is the composition loader itself and is marked Core — it cannot be disabled or removed.
• Other Plugins — third-party and your own plugins (e.g. this one).

Click a plugin to see its details: description, source, repository link, entry id and module name. From the detail block you can:

• Enable / Disable — written to your profile cordis.patch.yml; takes effect after a dsh web restart. Disabling warns you that an unknown plugin may cause serious problems.
• Uninstall (non-official only) — removes the plugin row from the configuration, with a warning plus a second "Confirm uninstall?" step. If the plugin was installed through the Discover tab, its local clone is deleted too.

The Other Plugins group header has Check Updates: it compares npm packages against the registry and local git clones against their origin HEAD. Updateable plugins get a green Update Available button next to their status label — click it to pull the new version (npm tarball or git pull), or use Update All to update every updateable plugin at once.

Discovering & installing new plugins

The Discover tab searches GitHub for repositories tagged dsh-plugin (a free-text query narrows the search). Each result shows stars and an "Installed" badge when the repo is already present locally.

Click a repository to open its detail page — description, stars, language, last update and a link to the repository — then hit Install. Extension Hub:

1. Clones the repository (shallow) into ~/.dsh/extension-hub/plugins/<repo>
2. Verifies it ships a usable package.json entry
3. Registers it in your profile cordis.patch.yml as a local-path plugin row

After a dsh web restart the plugin appears in the Other Plugins group, where you can disable or uninstall it (which also removes the clone) and keep it updated with Check Updates (local git clones update via git pull).

Installing runs third-party code. Only install repositories you trust, and check the repository's own README for install instructions — a repo tagged dsh-plugin may still be a skill, an MCP server, or need a custom setup.

Recent Updates

Recent updates (click to expand)

• 2026-08 — v0.2.3: fix: patch persistence semantics — 0.2.2's flat-row writer was wrong for patch files (a bare top-level - id: row means "override" and silently no-ops; rows must be wrapped in - insert:). Reverted all patch writes to the managed insert-block region; the profile patch was rebuilt to the correct format. This restores plugin loading after restart.
• 2026-08 — v0.2.2: unified flat-row patch persistence (CLI and UI write the same loader-compatible format); MCP list reads merged rows (region and flat formats); scalar quoting fix for @-prefixed names; uninstall removes discover-installed clone directories.
• 2026-08 — v0.2.1: Discover tab pagination ("Load more", 30 per page), plugin detail as a modal popup, truthful "Installed" badges (verified against the config row, not just the clone dir), install write-back verification, horizontal-overflow fixes.
• 2026-08 — v0.2.0: full plugin manager — official vs third-party grouping (vendor-scope based), core protection for the composition loader, enable / disable / uninstall with confirmations, per-plugin check & update (npm registry + local git clones, Update All), and a GitHub-powered Discover tab that clones and installs dsh-plugin repositories in one click.
• 2026-08 — v0.1.4: package the v0.1.3 changelog into the published artifact (registry-sync release).
• 2026-08 — v0.1.3: strict Typert descriptors (./typert) fix /api/extensionHub/* 404 in layouts where the protocol package loads twice; one-click update downloads the npm tarball directly (no pnpm).
• 2026-08 — "Check Updates" button in the header: compares the local package version against the npm registry.
• 2026-08 — Section renamed to Extension Management with a header ("Manage plugins, skills and MCP"); import moved from its own tab into the Skills and MCP Servers pages.
• 2026-08 — Full zh/en i18n (83 keys), project folder picker, built-in skill read-only layer.
• Initial release — CLI + durable settings UI + zero-dependency persistence core.

How it works

• The host half (lib/host.js) is a TypertRemoteService gateway exposed under the extensionHub wire namespace; the browser half mounts its Remote contribution and calls the mounted namespace service.
• The browser bundle is declared via dsh.client.platform: "web" in package.json; DSH's client-modules system scans it at boot, injects the boot manifest, and serves the bundle over /plugins/dsh-extension-hub/client.js — no web bundle rebuild required.
• All real reads/writes run inside the host process (outside the session file sandbox) and share the same lib/ code as the CLI.

Data sources (discovery scope)

Source	Skills	MCP
Claude	<repo>/.claude/skills/*/SKILL.md, ~/.claude/skills/*/SKILL.md	<repo>/.mcp.json, ~/.claude.json, ~/.claude/.claude.json
Codex	<repo>/.codex/skills/*/SKILL.md, ~/.codex/skills/*/SKILL.md	~/.codex/config.toml, <repo>/.codex/config.toml

Conversion: Claude/Codex stdio servers → DSH transport: stdio (command/args/env); http/sse → transport: streamable-http (url/headers). Skill name/description/whenToUse are preserved, license/allowed-tools fold into metadata.

Persistence locations

Skills

• Project scope --scope project → <target folder>/.dsh/skills/<name>/SKILL.md
• Global scope --scope global → ~/.dsh/skills/<name>/SKILL.md

Enable/disable rewrites the disable-model-invocation / user-invocable frontmatter flags; removal deletes the file.

MCP

• Global → rows are appended/updated inside the managed region (# >>> dsh-extension-hub … # <<< dsh-extension-hub) of ~/.dsh/profiles/<profile>/cordis.patch.yml.
• Project → writes a manifest <target folder>/.dsh/mcp-servers.yaml and generates a dedicated preset ~/.dsh/.agent-presets/<slug>-mcp/agent.cordis.yml (based on the shipped standard preset). Select that preset in the session roster to activate the servers.

Supported platforms

DSH itself runs on Windows, macOS and Linux; this plugin has no platform specifics — the CLI works anywhere Node.js runs, and the settings UI follows the DSH Web host.

Known limitations

• The YAML/TOML parsers are self-contained subsets covering the shapes that actually appear in DSH compositions and Codex config.toml; anything outside them is skipped or reported, never silently corrupted.
• Skill discovery matches DSH dsh-skill-filesystem: only <root>/<name>/SKILL.md and <root>/<name>.md are recognized; names must be kebab-case.
• Project MCP relies on the "generated preset + manually select the preset" mechanism; the tool does not switch presets between sessions for you.
• Project-scope enable/disable toggles apply to the generated preset (whether the servers load when that preset is selected); the manifest always keeps the full record.
• Global MCP removal/editing only affects manager-managed rows (inside the managed region); hand-written patch rows are untouched.

License

MIT