@1e0zj/dsh-plugin-mall 0.1.12 → 0.1.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +186 -123
- package/cordis.patch.yml +12 -0
- package/package.json +1 -1
- package/src/github.js +189 -52
- package/src/index.js +31 -13
- package/src/installer.js +374 -39
package/README.md
CHANGED
|
@@ -1,123 +1,186 @@
|
|
|
1
|
-
# dsh-plugin-mall
|
|
2
|
-
|
|
3
|
-
**An open plugin marketplace for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh): search every GitHub repo tagged `topic:dsh-plugin`, automatically verify which ones are real dsh plugins, install and update with one click.**
|
|
4
|
-
|
|
5
|
-
[中文说明](#中文说明) · [Install](#install) · [Why another marketplace](#why-another-marketplace)
|
|
6
|
-
|
|
7
|
-
Two surfaces: a **Settings → Plugins → Marketplace** tab in the dsh web UI, and five agent tools usable from any session.
|
|
8
|
-
|
|
9
|
-
## Why another marketplace?
|
|
10
|
-
|
|
11
|
-
Curated lists only show what has been reviewed and merged. This marketplace is open by construction: **any repo tagged `topic:dsh-plugin` is discoverable the moment it is pushed** — no submission, no approval queue. To keep that openness usable:
|
|
12
|
-
|
|
13
|
-
- **Automatic verification** — every search result's `package.json` is fetched (jsDelivr/raw dual-source CDN, no API quota) and checked for the official `dsh.bundle` / `dsh.client` manifest. Verified plugins get a green badge; the default "verified only" view filters out ~73% of topic noise (empty repos and unrelated projects riding the tag).
|
|
14
|
-
- **Anti-squatting** — an install prefers the npm tarball only when the registry entry's `repository` URL points back to the same GitHub repo; anything else falls back to the explicit `github:` spec.
|
|
15
|
-
- **npm-first installs** — registry tarballs are smaller than whole-repo GitHub downloads and come with integrity checks.
|
|
16
|
-
- **Update management** — installed plugins are compared against the registry `latest`; one-click update per plugin.
|
|
17
|
-
- **Resilience** — rate-limit circuit breaker, GitHub's 1000-result search window handled gracefully, `corepack enable pnpm` self-heal when pnpm is missing, one-click dsh restart (loopback-only, `allowRestart: false` to disable).
|
|
18
|
-
|
|
19
|
-
## Install
|
|
20
|
-
|
|
21
|
-
```powershell
|
|
22
|
-
# from npm
|
|
23
|
-
dsh plugin --profile web add @1e0zj/dsh-plugin-mall
|
|
24
|
-
|
|
25
|
-
# from GitHub
|
|
26
|
-
dsh plugin --profile web add github:1e0zj/dsh-plugin-mall
|
|
27
|
-
|
|
28
|
-
# local development
|
|
29
|
-
dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
|
|
30
|
-
```
|
|
31
|
-
|
|
32
|
-
Restart dsh after installing.
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
#
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
1
|
+
# dsh-plugin-mall
|
|
2
|
+
|
|
3
|
+
**An open plugin marketplace for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh): search every GitHub repo tagged `topic:dsh-plugin`, automatically verify which ones are real dsh plugins, install and update with one click.**
|
|
4
|
+
|
|
5
|
+
[中文说明](#中文说明) · [Install](#install) · [Why another marketplace](#why-another-marketplace)
|
|
6
|
+
|
|
7
|
+
Two surfaces: a **Settings → Plugins → Marketplace** tab in the dsh web UI, and five agent tools usable from any session.
|
|
8
|
+
|
|
9
|
+
## Why another marketplace?
|
|
10
|
+
|
|
11
|
+
Curated lists only show what has been reviewed and merged. This marketplace is open by construction: **any repo tagged `topic:dsh-plugin` is discoverable the moment it is pushed** — no submission, no approval queue. To keep that openness usable:
|
|
12
|
+
|
|
13
|
+
- **Automatic verification** — every search result's `package.json` is fetched (jsDelivr/raw dual-source CDN, no API quota) and checked for the official `dsh.bundle` / `dsh.client` manifest. Verified plugins get a green badge; the default "verified only" view filters out ~73% of topic noise (empty repos and unrelated projects riding the tag).
|
|
14
|
+
- **Anti-squatting** — an install prefers the npm tarball only when the registry entry's `repository` URL points back to the same GitHub repo; anything else falls back to the explicit `github:` spec.
|
|
15
|
+
- **npm-first installs** — registry tarballs are smaller than whole-repo GitHub downloads and come with integrity checks. Lookups follow the registry pnpm actually installs from (profile `.npmrc` → `pnpm config get registry` → npmjs), so a mirror user keeps npm-first instead of silently falling back to whole-repo clones.
|
|
16
|
+
- **Update management** — installed plugins are compared against the registry `latest`; one-click update per plugin.
|
|
17
|
+
- **Resilience** — rate-limit circuit breaker, GitHub's 1000-result search window handled gracefully, `corepack enable pnpm` self-heal when pnpm is missing, one-click dsh restart (loopback-only, `allowRestart: false` to disable).
|
|
18
|
+
|
|
19
|
+
## Install
|
|
20
|
+
|
|
21
|
+
```powershell
|
|
22
|
+
# from npm
|
|
23
|
+
dsh plugin --profile web add @1e0zj/dsh-plugin-mall
|
|
24
|
+
|
|
25
|
+
# from GitHub
|
|
26
|
+
dsh plugin --profile web add github:1e0zj/dsh-plugin-mall
|
|
27
|
+
|
|
28
|
+
# local development — currently unusable, see the note below
|
|
29
|
+
dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
Restart dsh after installing.
|
|
33
|
+
|
|
34
|
+
> **`link:` cannot be set up right now**, for reasons upstream of this plugin. Under
|
|
35
|
+
> `link:` Node loads from the project's real path, so bare imports must resolve from
|
|
36
|
+
> the project's own `node_modules` — which requires `npm install` inside the project
|
|
37
|
+
> first. That fails: the framework packages' registry dist-tags currently straddle two
|
|
38
|
+
> release trains (`dsh-tools` latest is still `0.0.1-rc.x` while `dsh-app-boot` is on
|
|
39
|
+
> `0.1.0-rc.x`), their peer ranges do not intersect, and npm stops with ERESOLVE.
|
|
40
|
+
> Neither escape hatch helps — `--legacy-peer-deps` skips peers so bare imports still
|
|
41
|
+
> will not resolve, and `--force` plants a mixed-train copy of the framework inside the
|
|
42
|
+
> project, which `link:` would then load instead of the host's, causing exactly the
|
|
43
|
+
> duplicate-module crash described under 开发说明. Until those dist-tags line up,
|
|
44
|
+
> develop against a local tarball — `npm pack`, then install the `.tgz` with a `file:`
|
|
45
|
+
> spec (recipe in the 安装 section below). Do not hand-overwrite files under
|
|
46
|
+
> `node_modules`: they are hard-linked into pnpm's global store, and any later
|
|
47
|
+
> `pnpm add/remove` rebuilds the tree and restores them anyway.
|
|
48
|
+
|
|
49
|
+
## Agent tools
|
|
50
|
+
|
|
51
|
+
| Tool | What it does |
|
|
52
|
+
|---|---|
|
|
53
|
+
| `market_search` | Search GitHub repos tagged `topic:dsh-plugin` (star-ranked, keyword filter, server-side `stars:>=1` noise floor) |
|
|
54
|
+
| `market_info` | Inspect one repo: stars, license, package.json, whether it declares `dsh.bundle.patch` / `dsh.client` |
|
|
55
|
+
| `market_install` | Install a plugin into a profile as a background job (npm-first spec resolution) |
|
|
56
|
+
| `market_uninstall` | Remove a plugin: `pnpm remove` + bundle-layer reconcile + client-row cleanup |
|
|
57
|
+
| `market_installed` | List a profile's installed plugins and their bundle status |
|
|
58
|
+
|
|
59
|
+
---
|
|
60
|
+
|
|
61
|
+
# 中文说明
|
|
62
|
+
|
|
63
|
+
**dsh 插件市场** — 搜索 GitHub `dsh-plugin` 话题下的 DeepSeek Harness 插件仓库，自动验证哪些是真 dsh 插件，一键安装与更新。
|
|
64
|
+
|
|
65
|
+
与策展列表不同：**任何打上 `topic:dsh-plugin` 的仓库推送后立即可被发现**——无需投稿、无需审批。为保证开放性可用，做了这些事：
|
|
66
|
+
|
|
67
|
+
- **自动验证**：逐仓库拉取 `package.json`（jsDelivr/raw 双源 CDN，不占 API 配额），按官方 `dsh.bundle` / `dsh.client` 声明打徽章；默认"只看已验证"视图过滤约 73% 的话题噪音
|
|
68
|
+
- **防抢注**：仅当 npm registry 条目的 `repository` 指回同一 GitHub 仓库时才用 npm 安装，否则回退 `github:` 源
|
|
69
|
+
- **npm 优先安装**：registry tarball 比整仓库下载更小且带完整性校验；查询用的 registry 跟随 pnpm 实际安装源（profile `.npmrc` → `pnpm config get registry` → npmjs），换了镜像也不会退化成整仓库克隆
|
|
70
|
+
- **更新管理**：已装插件与 registry `latest` 比对，逐个一键更新
|
|
71
|
+
- **工程韧性**：限流熔断、GitHub 1000 条搜索上限优雅处理、pnpm 缺失时 `corepack` 自愈、一键重启 dsh（仅 loopback，可 `allowRestart: false` 关闭）
|
|
72
|
+
|
|
73
|
+
## 安装
|
|
74
|
+
|
|
75
|
+
```powershell
|
|
76
|
+
# 从 npm
|
|
77
|
+
dsh plugin --profile web add @1e0zj/dsh-plugin-mall
|
|
78
|
+
|
|
79
|
+
# 从 GitHub
|
|
80
|
+
dsh plugin --profile web add github:1e0zj/dsh-plugin-mall
|
|
81
|
+
|
|
82
|
+
# 本地开发 —— 目前装不起来，见下方说明
|
|
83
|
+
dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
装完**重启 dsh**（`dsh web` 进程）后生效。
|
|
87
|
+
|
|
88
|
+
> **`link:` 目前用不了**，原因在上游、与本插件无关。`link:` 下 Node 从项目的真实
|
|
89
|
+
> 路径加载模块，裸导入只能从项目自己的 `node_modules` 解析，所以得先在项目里
|
|
90
|
+
> `npm install` 一次 —— 而这一步会失败：框架包在 registry 上的 dist-tags 眼下横跨
|
|
91
|
+
> 两条发布线（`dsh-tools` 的 latest 还停在 `0.0.1-rc.x`，`dsh-app-boot` 已经是
|
|
92
|
+
> `0.1.0-rc.x`），二者对 `dsh-invariants` 的 peer 区间无交集（`^0.0.1-rc.x` 只收
|
|
93
|
+
> `0.0.1-rc.x`，`^0.1.0-rc.x` 只收 `0.1.x`），npm 以 ERESOLVE 中止。
|
|
94
|
+
> 两个逃生口都不解决问题：`--legacy-peer-deps` 跳过 peer，裸导入照样解析不了；
|
|
95
|
+
> `--force` 会在项目里装一套**混版本的框架副本**，`link:` 加载的就是那套而不是宿主
|
|
96
|
+
> 那套 —— 正好踩中下面「开发说明」里讲的双副本身份分裂崩溃。
|
|
97
|
+
>
|
|
98
|
+
> 在上游 dist-tags 对齐前，本地开发用**本地 tarball**：
|
|
99
|
+
>
|
|
100
|
+
> ```bash
|
|
101
|
+
> npm pack # 产出 1e0zj-dsh-plugin-mall-<ver>.tgz
|
|
102
|
+
> dsh plugin --profile web remove @1e0zj/dsh-plugin-mall
|
|
103
|
+
> dsh plugin --profile web add file:C:\code\dsh-plugin-mall\1e0zj-dsh-plugin-mall-0.1.13.tgz
|
|
104
|
+
> ```
|
|
105
|
+
>
|
|
106
|
+
> 这样 pnpm 的规范副本本身就是新代码，后续任何 `pnpm add/remove` 重建依赖树都不会
|
|
107
|
+
> 把它换掉；顺带还验证了 `files` 字段没漏文件。改完代码重新 `npm pack` + 重装即可。
|
|
108
|
+
>
|
|
109
|
+
> **不要用直接覆盖 `node_modules` 里文件的办法。** 它有两个坑：
|
|
110
|
+
> 一是 pnpm 装出来的文件是**硬链接**（与全局 store 共享 inode），直接 `cp` 覆盖会
|
|
111
|
+
> 穿透硬链接改掉 store 里的内容且 pnpm 不会察觉，必须先 `rm` 再写；二是**任何一次
|
|
112
|
+
> pnpm 操作都会重建整棵树**，按 lockfile 从 store 把你覆盖的文件还原回去 —— 而通过
|
|
113
|
+
> 本插件装/卸任何插件都会触发 `pnpm add/remove`，也就是说测试市场的安装功能这个动作
|
|
114
|
+
> 本身就会抹掉被测代码。（已加载进内存的模块不受影响，重启后才会退回旧版。）
|
|
115
|
+
>
|
|
116
|
+
> 通过 npm/GitHub 安装则没有上述任何问题：pnpm 把真实拷贝装进 profile 的
|
|
117
|
+
> `node_modules`，框架包由宿主经 `profiles/node_modules` 里指向全局 dsh 的软链提供，
|
|
118
|
+
> 版本天然一致。
|
|
119
|
+
>
|
|
120
|
+
> 另：Windows 上 `file:`/`link:` 的路径**不能含空格**。pnpm 是经 cmd 拉起的，
|
|
121
|
+
> Node 只把参数用空格拼接、不逐参加引号，带空格的路径会被拆成两个参数；
|
|
122
|
+
> 自己加引号也不行（`"` 属于被拦截的 shell 元字符）。市场会直接拒绝并说明原因。
|
|
123
|
+
|
|
124
|
+
## 工作原理
|
|
125
|
+
|
|
126
|
+
- 双面包（dual-face）插件：`dsh.bundle` 半边挂在 **host 平面**（profile bundle 层），
|
|
127
|
+
注册 5 个 agent 工具（进 global 层，所有会话可见，与 MCP 工具同理）；
|
|
128
|
+
`dsh.client` 半边是浏览器插件，往设置页插件区注册「插件市场」tab
|
|
129
|
+
（`settings.plugins.tab` slot；手写无构建，经 `window.__ModuleLoader__` 加载）。
|
|
130
|
+
- 浏览器 → 服务端走 Connection 服务的独立 RPC 通道 `/market`
|
|
131
|
+
（loopback-only，与 `/api` 通道互不干扰）；页面发起的安装任务用进程内
|
|
132
|
+
tracker 跟踪 —— web host 层没有 job 控制器，`ctx.jobs` 无法在会话外起任务。
|
|
133
|
+
- `market_install` 复刻官方 `dsh plugin add` 的流程：在 profile 目录跑
|
|
134
|
+
`pnpm add <spec>`，成功后把声明了 `dsh.bundle.patch` 的依赖登记进
|
|
135
|
+
`dsh.profile.bundles`（layer 列表），声明了 `dsh.client` 的依赖自动在
|
|
136
|
+
profile 的 `cordis.patch.yml` 注册加载行，与官方 reconcile 逻辑一致。
|
|
137
|
+
- `market_uninstall` 复刻官方 `dsh plugin remove` 的流程：在 profile 目录跑
|
|
138
|
+
`pnpm remove <package>`，成功后从 `dsh.profile.bundles` 剔除该依赖的
|
|
139
|
+
bundle 条目，并删掉 `cordis.patch.yml` 里由安装流程注册的客户端加载行
|
|
140
|
+
（文本级精准移除，用户手写的行不受影响）。
|
|
141
|
+
- 安装源解析：`github:owner/repo` 优先改写为同名 npm 包（仅当 registry
|
|
142
|
+
条目的 repository 指回该仓库，防止抢注），否则用 GitHub 全仓库 spec。
|
|
143
|
+
- GitHub 源的插件、以及带原生模块的包安装时要跑构建脚本，pnpm 默认拦截；
|
|
144
|
+
本插件检测到拦截后会把包名自动合并进 profile 的 `pnpm-workspace.yaml` 的
|
|
145
|
+
`allowBuilds` 并自动重试一次。合并时跟随文件里已有的形状（pnpm 两种都认：
|
|
146
|
+
序列 `- name` 和映射 `name: true`，但**混在一起就是无效 YAML**），没有已有
|
|
147
|
+
形状时用 pnpm 自己写的映射格式；pnpm 留下的未决占位符
|
|
148
|
+
（`name: set this to true or false`）会被改写成 `true` 而不是当作已放行。
|
|
149
|
+
- **对 profile 配置的每一次写入都是先写后校验、解析不过就回滚**
|
|
150
|
+
（`writeChecked`）：装别人的插件失败，绝不能留下 dsh 或 pnpm 加载不了的
|
|
151
|
+
profile。覆盖 `pnpm-workspace.yaml`、`package.json`、`cordis.patch.yml`
|
|
152
|
+
三处。`allowBuilds` 是持久化的安全配置，所以安装最终失败时这次放宽会被
|
|
153
|
+
**撤销** —— 否则一个没装成的插件会让那个包名从此静默获得构建脚本执行权。
|
|
154
|
+
- 配置（`cordis.patch.yml` 中可改）：`defaultProfile`（默认装进哪个 profile，
|
|
155
|
+
默认 `web`）、`apiBase`（GitHub API 地址）、`npmRegistry`（npm 查询源，留空
|
|
156
|
+
则跟随 pnpm 实际安装源）、`rawSources`（验证用的 package.json 源模板列表，
|
|
157
|
+
`{repo}` 会替换成 owner/name，留空用内置的 jsDelivr + raw 双源）、
|
|
158
|
+
`perPageMax`（搜索单页上限）、`allowRestart`（是否允许一键重启，默认 `true`）。
|
|
159
|
+
|
|
160
|
+
## 发布
|
|
161
|
+
|
|
162
|
+
```bash
|
|
163
|
+
npm publish --access public
|
|
164
|
+
# 或在 GitHub 建仓库并打上 topic：dsh-plugin
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
## 开发说明
|
|
168
|
+
|
|
169
|
+
- 插件形态：`package.json` 里 `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }`，
|
|
170
|
+
patch 文件把 `dsh-plugin-mall` 这一行 insert 进装配树；**同一行同时是
|
|
171
|
+
client 插件行**（`dsh.client` 声明让 client-modules 扫描并服务
|
|
172
|
+
`/plugins/<id>/client.js`）。
|
|
173
|
+
- **`@deepseek-ai/*` 框架包必须声明为 `peerDependencies`**：装成 dependencies
|
|
174
|
+
会把宿主模块副本 hoist 进 profile，cordis loader 双副本加载、Symbol 身份
|
|
175
|
+
分裂，宿主的工具调度全线崩溃。宿主经 `profiles/node_modules` fallback
|
|
176
|
+
提供框架包。
|
|
177
|
+
- node 半边导出具名成员 `{ name, inject, Config, apply }`，**不要** `export default`
|
|
178
|
+
（cordis loader 会做 `exports.default ?? exports` 解包，default 会吞掉 inject/Config）；
|
|
179
|
+
client 半边是 `window.__ModuleLoader__.load({id, factory})`，导出 `{ apply, inject }`。
|
|
180
|
+
- 单测 `src/github.js`（无 harness 依赖）：`node src/github.js --self-test`，
|
|
181
|
+
加 `--offline` 只跑不联网的 fixture（宿主依赖检测的判据固化在那里 ——
|
|
182
|
+
它当初的实测对象 dsh-TUI 已被上报修复，网络上不再有可复现的回归用例，
|
|
183
|
+
所以改 `HOST_PACKAGES` 前请先跑这组）。
|
|
184
|
+
- `src/installer.js` 也有一组 fixture，固化 `allowBuilds` 合并的全部形状
|
|
185
|
+
（改 `mergeAllowBuilds` 前必跑）。它有宿主依赖，所以要从**已安装副本**运行：
|
|
186
|
+
`node ~/.dsh/profiles/web/node_modules/@1e0zj/dsh-plugin-mall/src/installer.js --self-test`
|
package/cordis.patch.yml
CHANGED
|
@@ -9,5 +9,17 @@
|
|
|
9
9
|
defaultProfile: web
|
|
10
10
|
# GitHub REST API base (override for self-hosted mirrors/proxies).
|
|
11
11
|
apiBase: https://api.github.com
|
|
12
|
+
# npm registry for anti-squatting, update checks and the host-dependency
|
|
13
|
+
# guard. Empty = follow whatever pnpm installs from (the profile's
|
|
14
|
+
# .npmrc, then `pnpm config get registry`, then npmjs), which is what
|
|
15
|
+
# you want on a mirror — set this only to pin a different one.
|
|
16
|
+
npmRegistry: ''
|
|
17
|
+
# package.json sources for plugin verification, tried in order until one
|
|
18
|
+
# answers; `{repo}` is replaced with owner/name. Empty = jsDelivr then
|
|
19
|
+
# raw.githubusercontent.com. Override for a self-hosted reverse proxy.
|
|
20
|
+
rawSources: []
|
|
12
21
|
# Upper bound for market_search perPage.
|
|
13
22
|
perPageMax: 30
|
|
23
|
+
# Whether the marketplace tab may restart the dsh process. Set false when
|
|
24
|
+
# something else (systemd, pm2, …) owns the process lifecycle.
|
|
25
|
+
allowRestart: true
|