@hyzyn/dsh-plugin-kit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-plugin-kit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,312 @@
+# dsh-plugin-kit · DSH Plugin Family
+
+[中文](README.md) | English
+
+<p align="center">
+  <img src="https://img.shields.io/github/v/release/hyzyn/dsh-plugin-kit?style=flat-square" alt="Version">
+  &nbsp;
+  <img src="https://img.shields.io/github/stars/hyzyn/dsh-plugin-kit?style=flat-square" alt="Stars">
+  &nbsp;
+  <img src="https://img.shields.io/github/forks/hyzyn/dsh-plugin-kit?style=flat-square" alt="Forks">
+  &nbsp;
+  <img src="https://img.shields.io/npm/v/@hyzyn%2Fdsh-all?style=flat-square&label=npm" alt="npm">
+  &nbsp;
+  <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="License">
+</p>
+
+Repo gates: `pnpm typecheck` / `pnpm build` / `pnpm aggregate`.
+
+<p align="center">
+  <strong>The plugin family for the DeepSeek Harness (DSH) Web GUI</strong><br>
+  <em>Environment variables · MCP servers · Prompt · Profile · RSS · Global search · Codegraph · Plugin scaffolding</em>
+</p>
+
+<p align="center">
+
+[What It Is](#what-it-is) · [Feature Plugins](#feature-plugins) · [Quick Start](#quick-start) · [Developing a New Plugin](#developing-a-new-plugin) · [FAQ](#faq) · [Known Limitations](#known-limitations) · [Contributing](#contributing)
+
+</p>
+
+## What It Is
+
+dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (DSH) Web GUI: environment variable / secret management, MCP server configuration, Prompt management, Profile management, RSS / news aggregation, global search, and Codegraph integration, plus a one-command scaffolding tool for generating new plugins. Everything mounts into `dsh web` through the official profile mechanism, so no DSH source changes are needed. Install the plugins individually, or install everything at once with the aggregate package.
+
+![Example of DSH plugin management cards](docs/dsh-plugin-kit-mcp.png)
+
+| Capability | Stock dsh web | dsh-plugin-kit family |
+| --- | --- | --- |
+| Environment variables | CLI / manual config | Web GUI card, saves directly into `process.env` |
+| MCP servers | Manual patch / CLI | Visual card + connection test + hot reload after saving |
+| Prompt management | Manual config | Visual editing + versioning / A/B testing / export & sharing |
+| Profile management | CLI | Visual create / copy / rename / delete |
+| RSS aggregation | None | Multiple sources + daily “Today’s Worth Reading” digest |
+| Global search | Session titles/content only | Unified sidebar search over sessions, Prompts, and MCP tools |
+| Codegraph integration | None | Code-graph card: index status / symbol search / callers-callees-impact / one-click sync-index |
+| Plugin development | Hand-written boilerplate | `pnpm create-plugin` scaffolding + `@hyzyn/dsh-kit` type helpers |
+
+## Feature Plugins
+
+### Environment Variables / Secrets Management (@hyzyn/dsh-env)
+
+- **What it does**: add, edit, or delete environment variables and secrets in the Web GUI. After saving, they are immediately written into the current process’s `process.env`, so both the host and subsequently started child processes can read them without restarting.
+- **How to use**: open Settings → Plugins → “Environment Variables / Secrets Management” → add a key-value pair → (check “Secret” for sensitive entries to show them as password fields) → save.
+- **Supports**: plain strings; `js:` prefixed expressions (e.g. `js:process.env.API_KEY`); secret marking.
+- **Where it is stored**: the managed block of `~/.dsh/env.yml` (auto-generated; do not edit by hand).
+- **Note**: key names may only contain letters, digits, and underscores, and must not be duplicated.
+
+![Environment variables / secrets management plugin](docs/dsh-plugin-kit-env.png)
+
+### MCP Server Configuration (@hyzyn/dsh-mcp)
+
+- **What it does**: add MCP servers to DSH. After saving, they hot-load into `mcp__<server name>__<tool name>` tools within 1–2 seconds, so models can call them directly without restarting.
+- **How to use**: open Settings → Plugins → “MCP Server Configuration” → add a server (choose transport) → (it is recommended to click “Connection Test” first) → save.
+- **Supports**: two transports — stdio (local subprocess, e.g. `npx -y @modelcontextprotocol/server-filesystem`) and streamable-http (remote service); `js:` prefixed expressions (e.g. `js:process.env.GITHUB_TOKEN`); enable/disable, edit, delete; status badges.
+- **Where it is stored**: the managed block of `~/.dsh/cordis.patch.yml`.
+- **Note**: **do not** manually append plugin lines to this file, otherwise DSH may fail to start with `duplicate loader entry id`.
+
+![MCP server configuration plugin](docs/dsh-plugin-kit-mcp.png)
+
+### Prompt Management (@hyzyn/dsh-prompt)
+
+- **What it does**: visually edit systemPrompt. When enabled, its content is injected as a systemPrompt section and takes effect immediately after saving.
+- **How to use**: open Settings → Plugins → “Prompt Management” → create/edit a Prompt (multiple versions can be saved) → enable.
+- **Supports**: version switching/rollback; A/B testing (choose A/B versions for the same Prompt and randomly match them by weight); export JSON/Markdown, one-click copy & share, import from JSON.
+- **Where it is stored**: the managed block of `~/.dsh/prompts.yml`.
+- **Note**: each Prompt must have at least one version, and a single version’s content must be ≤ 500KB.
+
+![Prompt management plugin](docs/dsh-plugin-kit-promat.png)
+
+### Profile Management (@hyzyn/dsh-profile)
+
+- **What it does**: visually view all DSH profiles under `~/.dsh/profiles`, with create, copy, rename, and delete operations for maintaining multiple DSH environments.
+- **How to use**: open Settings → Plugins → “Profile Management” → view the profile list → create / copy / rename / delete; set a port for each profile and copy a startup command with `--port`.
+- **Supports**: initialization status, bundle layer and dependency display; create from basic / `web` / `headless` templates; copy excludes `node_modules` and lock files and automatically installs dependencies; rename; port configuration and startup command copy.
+- **Where it is stored**: directly manages the `~/.dsh/profiles/<name>` directory.
+- **Note**: deletion is recursive — confirm twice before operating; the built-in `web` default profile cannot be deleted, while `headless` can be deleted; after creating a new profile, dependencies are installed on demand when you first run `dsh plugin --profile <name> add ...`.
+
+![Profile management configuration UI](docs/dsh-plugin-kit-profile.png)
+
+![Example of starting a headless profile from the command line](docs/dsh-plugin-kit-profile-example-headless1.png)
+
+### Global Search (@hyzyn/dsh-search)
+
+- **What it does**: adds a “Global Search” entry to the Web GUI sidebar. Type a keyword and it searches historical sessions, managed Prompts, currently loaded MCP tools, and the official RSS / RSSHub routes curated by [awesome-rsshub-routes](https://jackyst0.github.io/awesome-rsshub-routes/) at once.
+- **How to use**: after installing, click or focus the global search box below “New Session” in the sidebar → type a keyword → click a session result to open it and try to locate the matching text; clicking a Prompt / MCP tool result tries to jump to the matching settings card, and falls back to copying the content / tool name if navigation is unavailable; clicking an RSS feed result copies its subscribe URL.
+- **Supports**: full-text session search via DSH’s built-in `sessionQuery`; Prompt name / description / version content; `mcp__`-prefixed MCP tools; RSS feed name / category / URL (name matches first); configurable per-category result limits; keyword highlighting in results.
+- **Where it is stored**: no separate config; Prompts are read from the managed block of `~/.dsh/prompts.yml`; RSS feeds ship as a bundled snapshot and silently refresh from the upstream OPML every 12 hours at runtime (falling back to the snapshot when offline).
+- **Note**: requires the host `sessionQuery` / `tools` services; if absent, that category returns an empty list without affecting the others. If the `session-query` full-text index is configured with `openAt: "never"`, session search automatically degrades to per-session scanning; session results are filtered to currently visible/jumpable sessions.
+
+![Global search plugin](docs/dsh-plugin-kit-search.png)
+
+### RSS / News Aggregation (@hyzyn/dsh-rss)
+
+- **What it does**: subscribe to multiple RSS / Atom sources and automatically compile a daily “Today’s Worth Reading” Markdown digest, injected into systemPrompt for the model to reference.
+- **How to use**: after installing, click “Today’s Worth Reading” in the sidebar below “New Session” to view news directly; you can also open Settings → Plugins → “RSS / News Aggregation” to toggle built-in channels, add custom channels (validated on save), and manage categories and aggregation settings. Saving refreshes the digest automatically.
+- **Built-in channels**: Ruanyifeng, sspai, Solidot, Hacker News, Juejin, ITHome, 36Kr (36Kr’s official feed is blocked by anti-bot protection, so the built-in entry uses a third-party RSSHub mirror) — check to show, uncheck to stop fetching.
+- **Custom channels**: enter any RSS / Atom URL; it is validated with a real fetch on save — homepages, non-feed pages, and empty feeds are rejected with a clear error and not saved.
+- **Categories**: a channel’s category is picked from the category list, and the digest (Markdown, systemPrompt, modal) is grouped by category; categories in use are merged into the list automatically on save.
+- **Supports**: RSS 2.0 / Atom parsing, deduplication, per-source item limits, daily scheduled generation, startup catch-up generation, custom output directory, and the built-in channel library.
+- **Where it is stored**: `~/.dsh/rss-digest/YYYY-MM-DD.md` (override with `DSH_RSS_DIGEST_DIR`).
+- **Note**: the first startup will fetch feeds over the network; unreachable sources are listed in the digest’s “fetch failed” section and do not block the remaining sources.
+
+![RSS / News Aggregation settings card](docs/dsh-plugin-kit-rss-setting.png)
+
+![Sidebar “Today’s Worth Reading” modal: grouped by category, each source links to its website](docs/dsh-plugin-kit-rss-view.png)
+
+### Codegraph Integration (@hyzyn/dsh-codegraph)
+
+- **What it does**: code-graph integration — the “Codegraph” card under Settings → Plugins shows index status, symbol search, callers / callees / impact, and one-click sync / index. On install it automatically injects a CodeGraph usage guideline into systemPrompt so the model prefers `codegraph_explore` / `codegraph explore` over grep / read in indexed projects.
+- **How to use**: open Settings → Plugins → “Codegraph” → view index status, search symbols, click a result to inspect source and call chains / impact, or run Sync / rebuild index manually.
+- **Supports**: index status (version, file / symbol / edge counts, last indexed time, pending changes); symbol search with node / callers / callees / impact details; **the default path follows the active session’s workspace directory** (switches when you switch projects; a manual input temporarily overrides it); one-click incremental sync and full rebuild.
+- **Where it is stored**: the index lives in the project’s `.codegraph/` directory (created by `codegraph index`); the plugin has no config file of its own.
+- **Note**: the target project needs a Codegraph index first; unindexed projects return guidance to fall back to regular tools. Indexing / rebuilding are local CLI operations that consume real disk and CPU.
+
+![Codegraph settings card](docs/dsh-plugin-kit-codegraph.png)
+
+## Quick Start
+
+### System Requirements
+
+- DeepSeek Harness installed and `dsh web` starts normally.
+- No extra requirements for npm installs; installing from this repository requires Node.js >= 22.19 and pnpm 10.
+
+### Three-Step Setup
+
+1. Install the aggregate package: `dsh plugin --profile web add @hyzyn/dsh-all`
+2. Restart `dsh web`; all management cards appear under Settings → Plugins
+3. Open “Settings > Plugins” and use the cards as needed; changes take effect immediately after saving
+
+### Install from npm (recommended)
+
+The plugins are published to npm (under the `@hyzyn` scope). Install everything with one command:
+
+```sh
+dsh plugin --profile web add @hyzyn/dsh-all
+```
+
+After installation, restart `dsh web` and open Settings → Plugins to see all the cards. If you only want one plugin, see “Install a Single Plugin” below.
+
+### Install from the GitHub Repository (Development / Debugging)
+
+The plugin packages are already on npm; installing from the repository is for development and debugging (requires Node.js >= 22.19 and pnpm 10).
+The repository root is itself a DSH bundle (`package.json#dsh.bundle.patch`, generated by `pnpm aggregate`),
+so `dsh plugin add link:$(pwd)` recognizes and mounts the whole family as one plugin:
+
+```sh
+# 1. Clone the repository
+git clone https://github.com/hyzyn/dsh-plugin-kit.git
+cd dsh-plugin-kit
+
+# 2. Install dependencies and build
+pnpm install
+pnpm build
+
+# 3. Link the family into the web profile (the root bundle is equivalent to installing @hyzyn/dsh-all)
+dsh plugin --profile web add link:$(pwd)
+
+# 4. Restart dsh web
+dsh web
+```
+
+> ⚠️ If the web profile already has `@hyzyn/dsh-all` or any `@hyzyn/dsh-<pkg>` installed, do **not**
+> add the root bundle (or `packages/all`) again — duplicate plugin rows cause a
+> `duplicate loader entry id` error at startup.
+
+> If you only want one subpackage, replace step 3 with `dsh plugin --profile web add link:$(pwd)/packages/<name>`, e.g. `packages/mcp`.
+
+> With the `dsh` field declared on the root package, GitHub DSH plugin marketplaces
+> (e.g. DSH-Plugins-Marketplace, which detects plugins by the `dsh` field or
+> `@deepseek-ai/*` dependencies) now classify this repository as a DSH plugin
+> (cordis-plugin) instead of flagging it as "non-plugin".
+
+### Install a Single Plugin
+
+If you do not want the whole family, you can install any plugin individually (published on npm, use the package name directly):
+
+```sh
+dsh plugin --profile web add @hyzyn/dsh-env     # Environment variables / secrets management
+dsh plugin --profile web add @hyzyn/dsh-mcp     # MCP server configuration
+dsh plugin --profile web add @hyzyn/dsh-prompt  # Prompt management
+dsh plugin --profile web add @hyzyn/dsh-profile # Profile management
+dsh plugin --profile web add @hyzyn/dsh-rss     # RSS / news aggregation
+dsh plugin --profile web add @hyzyn/dsh-search  # Global search
+dsh plugin --profile web add @hyzyn/dsh-codegraph # Codegraph integration
+```
+
+### Verify and Uninstall
+
+After installing, restart `dsh web`; the corresponding card appearing under Settings → Plugins means it worked. You can also use `dsh --profile web --dump-config` to confirm the plugin configuration layer is mounted. If a card does not appear, you probably forgot to restart `dsh web`.
+
+Uninstall: `dsh plugin --profile web remove @hyzyn/dsh-all` (or the corresponding `@hyzyn/dsh-<package>`), then restart `dsh web`.
+
+### Installation Troubleshooting
+
+<details>
+<summary><strong>Expand for common installation problems</strong></summary>
+
+<br>
+
+> **Card does not appear?** Restart `dsh web`; make sure you are using the official `dsh-web-app` settings panel (the browser half depends on the core slots service).
+
+> **No tools appear after saving an MCP server?** Wait 1–2 seconds for HMR; check the status badge and conflict hints in the card; click “Connection Test” before saving.
+
+> **Getting `duplicate loader entry id`?** Most likely you manually added plugin lines to `~/.dsh/cordis.patch.yml`. Remove the duplicate lines — plugin lines should only be mounted by bundle patches; the managed block is only for server configuration.
+
+> **`npm install` / `npm view` reports EPERM?** There may be root-owned files in the local `~/.npm` cache (a historical npm bug). Run `sudo chown -R $(id -u):$(id -g) ~/.npm` to fix it. pnpm is not affected.
+
+</details>
+
+## Developing a New Plugin
+
+```sh
+pnpm create-plugin <name> [id]
+# Example: pnpm create-plugin timer          → packages/timer (@hyzyn/dsh-timer, plugin id: timer)
+# Example: pnpm create-plugin pet-tracker pt → packages/pet-tracker (plugin id: pt)
+```
+
+The script copies the `packages/hello` template, replaces the package name and plugin id, and automatically updates the aggregate package. Then:
+
+1. Edit `packages/<name>/src/index.ts` to write your plugin logic;
+2. Build and install locally for debugging:
+
+```sh
+pnpm --filter @hyzyn/dsh-<name> build
+dsh plugin --profile web add link:$(pwd)/packages/<name>
+```
+
+### What a Plugin Package Looks Like (using hello as an example)
+
+| File / field | Purpose |
+| --- | --- |
+| `package.json#dsh.bundle.patch` | Points to `cordis.patch.yml`, declaring this package as a bundle patch layer |
+| `cordis.patch.yml` | Inserts one line to mount the plugin into the profile lineup |
+| `src/index.ts` | Host half: exports a Cordis plugin shaped like `{ name, inject, apply }` |
+| `package.json#dsh.client` | Optional: declares the browser half; Web GUI loads it as `/plugins/<id>/client.js` |
+
+There are two ways to inject services: use `inject: ['tools', 'webServer']` and then access `ctx.tools` directly; or call `ctx.get('tools')` at runtime and check for null. Use schemastery to export a same-name `Config` schema for configuration.
+
+## FAQ
+
+<details>
+<summary><strong>I restarted, but there is still no card under Settings → Plugins?</strong></summary>
+
+A: First make sure the plugin was installed into the `web` profile (the `--profile web` flag), then use `dsh --profile web --dump-config` to confirm the plugin configuration layer is mounted. If it still does not work, see “Installation Troubleshooting” above. Refreshing the page is not enough — restart the `dsh web` process.
+
+</details>
+
+<details>
+<summary><strong>Changes to plugin code do not take effect?</strong></summary>
+
+A: Run `pnpm build` again, then restart `dsh web`. If you changed the browser half, you may also need to clear the browser cache or do a hard refresh.
+
+</details>
+
+<details>
+<summary><strong>No tools appear after saving an MCP server?</strong></summary>
+
+A: Wait 1–2 seconds for HMR; check the status badge and conflict hints in the card; click “Connection Test” before saving. If it still fails, check whether the server process can actually start and whether the address is reachable.
+
+</details>
+
+<details>
+<summary><strong>Getting `duplicate loader entry id`?</strong></summary>
+
+A: Most likely you manually added plugin lines to `~/.dsh/cordis.patch.yml`. Remove the duplicate lines — plugin lines should only be mounted by bundle patches; the managed block is only for server configuration.
+
+</details>
+
+<details>
+<summary><strong>`npm install` / `npm view` reports EPERM?</strong></summary>
+
+A: There may be root-owned files in the local `~/.npm` cache (a historical npm bug). Run `sudo chown -R $(id -u):$(id -g) ~/.npm` to fix it. pnpm is not affected.
+
+</details>
+
+## Known Limitations
+
+- The managed block in `~/.dsh/cordis.patch.yml` is only for MCP server configuration; manually adding plugin lines can cause `duplicate loader entry id` at startup.
+- Profile deletion is recursive and irreversible after the in-panel confirmation. The built-in `web` profile is protected; `headless` can be deleted.
+- RSS needs network access on first startup. An unreachable source does not block other sources, but that source may be missing from the day’s digest.
+- The browser half depends on the official `dsh-web-app` settings panel slots service; non-official Web GUIs may not show the management cards.
+- Installing from the repository requires Node.js >= 22.19 and pnpm 10; it is for development/debugging only. npm installs are not affected.
+
+## Contributing
+
+- Generate new plugins with the scaffolding command: `pnpm create-plugin <name> [id]`, instead of writing boilerplate by hand.
+- Follow Conventional Commits for commit messages (e.g. `fix(mcp): fix connection test timeout`). For user-visible changes, please include screenshots or verification evidence.
+- Run the gates before submitting: `pnpm typecheck && pnpm build && pnpm aggregate`.
+- After adding or removing plugins, run `pnpm aggregate` to regenerate the `packages/all` manifest.
+
+## License
+
+This repository is licensed under the [MIT](LICENSE) license.
+
+## Contributors
+
+<div align="center">
+
+**Like this project? Give it a star.**
+
+[Report Bug](https://github.com/hyzyn/dsh-plugin-kit/issues) · [Request Feature](https://github.com/hyzyn/dsh-plugin-kit/issues) · [View Releases](https://github.com/hyzyn/dsh-plugin-kit/releases)
+
+</div>

package/README.md

@@ -0,0 +1,311 @@
+# dsh-plugin-kit · DSH 插件全家桶
+
+中文 | [English](README.en.md)
+
+<p align="center">
+  <img src="https://img.shields.io/github/v/release/hyzyn/dsh-plugin-kit?style=flat-square" alt="Version">
+  &nbsp;
+  <img src="https://img.shields.io/github/stars/hyzyn/dsh-plugin-kit?style=flat-square" alt="Stars">
+  &nbsp;
+  <img src="https://img.shields.io/github/forks/hyzyn/dsh-plugin-kit?style=flat-square" alt="Forks">
+  &nbsp;
+  <img src="https://img.shields.io/npm/v/@hyzyn%2Fdsh-all?style=flat-square&label=npm" alt="npm">
+  &nbsp;
+  <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="License">
+</p>
+
+仓库门禁：`pnpm typecheck` / `pnpm build` / `pnpm aggregate`。
+
+<p align="center">
+  <strong>DeepSeek Harness（DSH）Web GUI 的插件全家桶</strong><br>
+  <em>环境变量 · MCP 服务器 · Prompt · Profile · RSS · 全局搜索 · Codegraph 集成 · 插件脚手架</em>
+</p>
+
+<p align="center">
+
+[是什么](#是什么) · [功能插件](#功能插件) · [快速开始](#快速开始) · [开发新插件](#开发新插件) · [常见问题](#常见问题) · [已知限制](#已知限制) · [参与贡献](#参与贡献)
+
+</p>
+
+## 是什么
+
+dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合：环境变量 / 密钥管理、MCP 服务器配置、Prompt 管理、Profile 管理、RSS / 新闻聚合、全局搜索、Codegraph 集成，外加一条命令生成新插件的开发脚手架。所有插件都走官方 profile 机制挂载到 `dsh web`，不改 DSH 源码；可以逐个安装，也可以用聚合包一次装齐。
+
+![DSH 插件管理卡片示例](docs/dsh-plugin-kit-mcp.png)
+
+| 能力 | 原生 dsh web | dsh-plugin-kit 全家桶 |
+| --- | --- | --- |
+| 环境变量管理 | 命令行 / 手改配置 | Web GUI 卡片，保存即写入 `process.env` |
+| MCP 服务器 | 手改 patch / 命令行 | 可视化卡片 + 连接测试 + 保存后热加载 |
+| Prompt 管理 | 手改配置 | 可视化编辑 + 版本管理 / A/B 测试 / 导出分享 |
+| Profile 管理 | 命令行 | 可视化创建 / 复制 / 重命名 / 删除 |
+| RSS 聚合 | 无 | 多源订阅 + 每日「今日值得读」自动摘要 |
+| 全局搜索 | 仅会话标题/内容 | 侧边栏统一搜索历史会话、Prompt、MCP 工具、RSS 订阅源 |
+| Codegraph 集成 | 无 | 代码图谱卡片：索引状态 / 符号搜索 / 调用链 / 影响面 / 一键 sync-index |
+| 插件开发 | 手写样板 | `pnpm create-plugin` 脚手架 + `@hyzyn/dsh-kit` 类型助手 |
+
+## 功能插件
+
+### 环境变量 / 密钥管理（@hyzyn/dsh-env）
+
+- **做什么**：在 Web GUI 里增删改环境变量和密钥，保存后立即写入当前进程的 `process.env`，宿主和之后启动的子进程都能读到，无需重启。
+- **怎么用**：打开 设置 → 插件 →「环境变量 / 密钥管理」→ 添加键值 →（敏感条目勾选「密钥」，以密码框显示）→ 保存。
+- **支持**：普通字符串；`js:` 前缀表达式（如 `js:process.env.API_KEY`）；密钥标记。
+- **存哪里**：`~/.dsh/env.yml` 的托管区块（自动生成，请勿手改）。
+- **注意**：键名只允许字母 / 数字 / 下划线，且不能重复。
+
+![环境变量 / 密钥管理插件](docs/dsh-plugin-kit-env.png)
+
+### MCP 服务器配置（@hyzyn/dsh-mcp）
+
+- **做什么**：给 DSH 添加 MCP 服务器，保存后 1~2 秒内热加载为 `mcp__<服务器名>__<工具名>` 工具，模型即可直接调用，无需重启。
+- **怎么用**：打开 设置 → 插件 →「MCP 服务器配置」→ 添加服务器（选传输方式）→（建议先点「连接测试」）→ 保存。
+- **支持**：两种传输——stdio（本地子进程，如 `npx -y @modelcontextprotocol/server-filesystem`）与 streamable-http（远程服务）；`js:` 前缀表达式（如 `js:process.env.GITHUB_TOKEN`）；启用 / 停用、编辑、删除；状态徽章。
+- **存哪里**：`~/.dsh/cordis.patch.yml` 的托管区块。
+- **注意**：**不要**手工往该文件里追加插件行，否则启动时报 `duplicate loader entry id` 直接退出。
+
+![MCP 服务器配置插件](docs/dsh-plugin-kit-mcp.png)
+
+### Prompt 管理（@hyzyn/dsh-prompt）
+
+- **做什么**：可视化编辑 systemPrompt，启用后其内容作为 systemPrompt section 注入，保存即生效。
+- **怎么用**：打开 设置 → 插件 →「Prompt 管理」→ 新建 / 编辑 Prompt（可保存多个版本）→ 启用。
+- **支持**：版本切换 / 回滚；A/B 测试（为同一 Prompt 选 A/B 两版并按权重随机命中）；导出 JSON / Markdown、一键复制分享、从 JSON 导入。
+- **存哪里**：`~/.dsh/prompts.yml` 的托管区块。
+- **注意**：每个 Prompt 至少一个版本，单版本内容 ≤ 500KB。
+
+![Prompt 管理插件](docs/dsh-plugin-kit-promat.png)
+
+### Profile 管理（@hyzyn/dsh-profile）
+
+- **做什么**：可视化查看 `~/.dsh/profiles` 下的全部 DSH profile，支持创建、复制、重命名、删除，方便维护多套 DSH 环境。
+- **怎么用**：打开 设置 → 插件 →「Profile 管理」→ 查看 profile 列表 → 新建 / 复制 / 重命名 / 删除；可为每个 profile 设置端口并复制带 `--port` 的启动命令。
+- **支持**：初始化状态、bundle 层与依赖展示；基础模板 / `web` / `headless` 模板新建；复制排除 `node_modules` 与锁文件并自动安装依赖；重命名；端口配置与复制启动命令。
+- **存哪里**：直接管理 `~/.dsh/profiles/<name>` 目录。
+- **注意**：删除为递归删除，操作前请二次确认；内置的 `web` 默认 profile 不允许删除，`headless` 可以删除；新建后首次使用 `dsh plugin --profile <name> add ...` 时按需安装依赖。
+
+![Profile 管理配置界面](docs/dsh-plugin-kit-profile.png)
+
+![命令行启动 headless profile 示例](docs/dsh-plugin-kit-profile-example-headless1.png)
+
+### 全局搜索（@hyzyn/dsh-search）
+
+- **做什么**：在 Web GUI 侧边栏加一个「全局搜索」入口，输入关键词后同时搜索历史会话、Prompt 管理里的提示词、当前已加载的 MCP 工具，以及 [awesome-rsshub-routes](https://jackyst0.github.io/awesome-rsshub-routes/) 收录的官方 RSS 与 RSSHub 路由（RSS 订阅源）。
+- **怎么用**：安装后在侧边栏「新建会话」下方点击 / 聚焦全局搜索框 → 输入关键词 → 点击会话会打开并尝试定位到匹配文字；点击 Prompt / MCP 工具会尝试跳转到对应设置卡片，跳转失败时自动复制内容 / 工具名；点击 RSS 订阅源会复制订阅地址。
+- **支持**：历史会话全文搜索（走 DSH 自带 sessionQuery 索引）；Prompt 名称 / 描述 / 版本内容；`mcp__` 前缀 MCP 工具；RSS 订阅源名称 / 分类 / URL（名称命中优先）；单类结果数量可配置；结果关键词高亮。
+- **存哪里**：无独立配置；Prompt 读取 `~/.dsh/prompts.yml` 的托管区块；RSS 订阅源内置快照，运行时每 12 小时从上游 OPML 静默刷新（离线自动回退快照）。
+- **注意**：需要宿主已安装 `sessionQuery` / `tools` 服务；缺失时对应类别返回空列表，不影响其它类别。若 `session-query` 全文索引配置为 `openAt: "never"`，历史会话会自动降级为逐会话扫描；会话结果会过滤为当前可跳转的可见会话。
+
+![全局搜索插件](docs/dsh-plugin-kit-search.png)
+
+### Codegraph 集成（@hyzyn/dsh-codegraph）
+
+- **做什么**：代码图谱集成——设置 → 插件 里的「Codegraph」卡片提供索引状态、符号搜索、callers / callees / impact 查看和一键 sync / index；安装后自动向 systemPrompt 注入 CodeGraph 使用指引，模型在已索引项目里优先用 `codegraph_explore` / `codegraph explore` 查询代码而不是 grep / read。
+- **怎么用**：打开 设置 → 插件 →「Codegraph」→ 查看索引状态、搜索符号、点击结果查看源码与调用链 / 影响面、手动 Sync / 重建索引。
+- **支持**：索引状态（版本、文件 / 符号 / 边数量、最后索引时间、待同步变更）；符号搜索与 node / callers / callees / impact 详情；**默认路径跟随当前活动会话的工作目录**（切换项目会话自动切换，手动输入可临时覆盖）；一键增量 sync 与全量重建。
+- **存哪里**：索引在项目 `.codegraph/` 目录（由 `codegraph index` 生成）；插件无独立配置文件。
+- **注意**：查询目标项目需要先有 Codegraph 索引；未索引项目会返回指引改用常规工具。索引 / 重建为本地 CLI 操作，消耗真实磁盘与 CPU。
+
+![Codegraph 设置卡片](docs/dsh-plugin-kit-codegraph.png)
+
+### RSS / 新闻聚合（@hyzyn/dsh-rss）
+
+- **做什么**：订阅多个 RSS / Atom 源，每天自动汇总成一篇「今日值得读」Markdown，并注入 systemPrompt 供模型直接引用。
+- **怎么用**：安装后可在侧边栏「新建会话」下方点击「今日值得读」直接查看新闻；也可打开 设置 → 插件 →「RSS / 新闻聚合」勾选内置渠道、添加自定义渠道（保存时即时校验地址）、维护新闻分类与聚合设置，保存后自动刷新。
+- **内置渠道**：阮一峰、少数派、Solidot、Hacker News、掘金、IT之家、36氪（36氪官方 feed 被反爬拦截，内置为第三方 RSSHub 镜像），勾选即展示、取消勾选即不抓取。
+- **自定义渠道**：填写任意 RSS / Atom 地址，保存时真实抓取校验——官网首页、非 feed、抓不到内容的地址会报错且不保存。
+- **新闻分类**：渠道的分类从「新闻分类」列表里选择；digest（Markdown、systemPrompt、弹窗）按分类分组展示，保存时自动把使用中的分类合并进列表。
+- **支持**：RSS 2.0 / Atom 解析、按来源去重、每源条数限制、每日定时生成、启动补生成、自定义输出目录、内置渠道库。
+- **存哪里**：`~/.dsh/rss-digest/YYYY-MM-DD.md`（可用 `DSH_RSS_DIGEST_DIR` 覆盖）。
+- **注意**：首次安装启动时会联网抓取一次；某个源不可达时会在 digest 的「抓取失败」里列出，不影响其它源。
+
+![RSS / 新闻聚合设置卡片](docs/dsh-plugin-kit-rss-setting.png)
+
+![侧边栏「今日值得读」弹窗：按分类分组，来源带「查看更多」直达官网](docs/dsh-plugin-kit-rss-view.png)
+
+## 快速开始
+
+### 系统要求
+
+- 已安装 DeepSeek Harness，`dsh web` 可正常启动。
+- npm 安装方式无额外要求；从仓库安装需要 Node.js >= 22.19 与 pnpm 10。
+
+### 三步上手
+
+1. 安装聚合包：`dsh plugin --profile web add @hyzyn/dsh-all`
+2. 重启 `dsh web`，设置 → 插件 里出现全部管理卡片
+3. 打开「设置 > 插件」按需使用各卡片，保存后即时生效
+
+### 从 npm 安装（推荐）
+
+插件已发布到 npm（`@hyzyn` scope），一条命令装齐：
+
+```sh
+dsh plugin --profile web add @hyzyn/dsh-all
+```
+
+装完重启 `dsh web`，打开 设置 → 插件 即可看到全部卡片。只想用某一个插件，见下文「单独安装某个插件」。
+
+### 从 GitHub 仓库安装（开发调试）
+
+插件包已在 npm 发布，仓库安装仅供开发调试（需要 Node.js >= 22.19 与 pnpm 10）。
+仓库根目录本身也是一个 DSH bundle（`package.json#dsh.bundle.patch`，由 `pnpm aggregate` 生成），
+`dsh plugin add link:$(pwd)` 即可把整个全家桶识别并挂载为一个插件：
+
+```sh
+# 1. 克隆仓库
+git clone https://github.com/hyzyn/dsh-plugin-kit.git
+cd dsh-plugin-kit
+
+# 2. 安装依赖并构建
+pnpm install
+pnpm build
+
+# 3. 把全家桶链接进 web profile（根包即 bundle，等价于安装 @hyzyn/dsh-all）
+dsh plugin --profile web add link:$(pwd)
+
+# 4. 重启 dsh web
+dsh web
+```
+
+> ⚠️ 如果 web profile 里已经装过 `@hyzyn/dsh-all` 或任一 `@hyzyn/dsh-<包名>`，
+> 不要再 add 根包（或 `packages/all`），否则插件行重复挂载会在启动时报
+> `duplicate loader entry id`。
+
+> 只想用某个子包：第 3 步改为 `dsh plugin --profile web add link:$(pwd)/packages/<name>` 即可，例如 `packages/mcp`。
+
+> 根包声明了 `dsh` 字段后，GitHub 的 DSH 插件市场（如 DSH-Plugins-Marketplace，
+> 按 `dsh.bundle` / `@deepseek-ai/*` 依赖识别）会把本仓库识别为 DSH 插件
+> （cordis-plugin），不再标记「非 DSH 插件」。
+
+### 单独安装某个插件
+
+不想装全家桶时，可单独安装任意插件（npm 已发布，直接用包名）：
+
+```sh
+dsh plugin --profile web add @hyzyn/dsh-env     # 环境变量 / 密钥管理
+dsh plugin --profile web add @hyzyn/dsh-mcp     # MCP 服务器配置
+dsh plugin --profile web add @hyzyn/dsh-prompt  # Prompt 管理
+dsh plugin --profile web add @hyzyn/dsh-profile # Profile 管理
+dsh plugin --profile web add @hyzyn/dsh-rss     # RSS / 新闻聚合
+dsh plugin --profile web add @hyzyn/dsh-search  # 全局搜索
+dsh plugin --profile web add @hyzyn/dsh-codegraph # Codegraph 集成
+```
+
+### 验证与卸载
+
+装好重启 `dsh web`，打开 设置 → 插件 出现对应卡片就是生效了；也可以用 `dsh --profile web --dump-config` 确认插件配置层已挂载。卡片没出现，多半是装完没重启 `dsh web`。
+
+卸载：`dsh plugin --profile web remove @hyzyn/dsh-all`（或对应的 `@hyzyn/dsh-<包名>`），然后重启 `dsh web`。
+
+### 安装排障
+
+<details>
+<summary><strong>展开查看常见安装问题</strong></summary>
+
+<br>
+
+> **卡片没出现？** 重启 `dsh web`；确认用的是官方 `dsh-web-app` 设置面板（浏览器半体依赖核心 slots 服务）。
+
+> **MCP 服务器保存后没有工具？** 等 1~2 秒 HMR；在卡片里看状态徽章与冲突提示；保存前先点「连接测试」。
+
+> **报 `duplicate loader entry id`？** 多半是手工往 `~/.dsh/cordis.patch.yml` 加了插件行。删掉重复行——插件行只由 bundle 补丁挂载，托管区块只放服务器配置。
+
+> **`npm install` / `npm view` 报 EPERM？** 本机 `~/.npm` 缓存存在 root-owned 文件（历史 npm bug），执行 `sudo chown -R $(id -u):$(id -g) ~/.npm` 修复。pnpm 不受影响。
+
+</details>
+
+## 开发新插件
+
+```sh
+pnpm create-plugin <name> [id]
+# 例：pnpm create-plugin timer          → packages/timer（@hyzyn/dsh-timer，插件 id: timer）
+# 例：pnpm create-plugin pet-tracker pt → packages/pet-tracker（插件 id: pt）
+```
+
+脚本会复制 `packages/hello` 模板、替换包名与插件 id，并自动更新聚合包。然后：
+
+1. 编辑 `packages/<name>/src/index.ts` 写插件逻辑；
+2. 构建并本地安装调试：
+
+```sh
+pnpm --filter @hyzyn/dsh-<name> build
+dsh plugin --profile web add link:$(pwd)/packages/<name>
+```
+
+### 插件包长什么样（以 hello 为例）
+
+| 文件 / 字段 | 作用 |
+| --- | --- |
+| `package.json#dsh.bundle.patch` | 指向 `cordis.patch.yml`，声明本包是 bundle 补丁层 |
+| `cordis.patch.yml` | `insert` 一行，把插件挂进 profile 阵容 |
+| `src/index.ts` | 宿主半体：导出 `{ name, inject, apply }` 形状的 Cordis 插件 |
+| `package.json#dsh.client` | 可选：声明浏览器半体，Web GUI 以 `/plugins/<id>/client.js` 加载 |
+
+服务注入两种写法：`inject: ['tools', 'webServer']` 后直接 `ctx.tools`；或运行时 `ctx.get('tools')` 判空。配置用 schemastery 导出同名 `Config` schema。
+
+## 常见问题
+
+<details>
+<summary><strong>装完重启了，设置 → 插件里还是没有卡片？</strong></summary>
+
+A: 先确认插件装进了 `web` profile（命令里的 `--profile web`），再用 `dsh --profile web --dump-config` 确认插件配置层已挂载；还不行就看上文「安装排障」。注意页面刷新不够，要重启 `dsh web` 进程。
+
+</details>
+
+<details>
+<summary><strong>改了插件代码不生效？</strong></summary>
+
+A: 重新 `pnpm build` 后重启 `dsh web`。如果改的是浏览器半体，可能还需要清一下浏览器缓存或硬刷新。
+
+</details>
+
+<details>
+<summary><strong>MCP 服务器保存后没有工具？</strong></summary>
+
+A: 等 1~2 秒 HMR；在卡片里看状态徽章与冲突提示；保存前先点「连接测试」。仍不行就检查服务器进程是否真的能启动、地址是否可达。
+
+</details>
+
+<details>
+<summary><strong>报 `duplicate loader entry id`？</strong></summary>
+
+A: 多半是手工往 `~/.dsh/cordis.patch.yml` 加了插件行。删掉重复行——插件行只由 bundle 补丁挂载，托管区块只放服务器配置。
+
+</details>
+
+<details>
+<summary><strong>`npm install` / `npm view` 报 EPERM？</strong></summary>
+
+A: 本机 `~/.npm` 缓存存在 root-owned 文件（历史 npm bug），执行 `sudo chown -R $(id -u):$(id -g) ~/.npm` 修复。pnpm 不受影响。
+
+</details>
+
+## 已知限制
+
+- MCP 的 `~/.dsh/cordis.patch.yml` 里托管区块只应放服务器配置；手工追加插件行会导致 `duplicate loader entry id` 启动失败。
+- Profile 删除为递归删除，面板内会二次确认，但一旦执行不可撤销；内置 `web` profile 受保护，`headless` 可删。
+- RSS 首次启动需要联网抓取；某个源不可达不会阻塞其它源，但当天 digest 可能缺少该源内容。
+- 浏览器半体依赖官方 `dsh-web-app` 的设置面板 slots 服务，非官方 Web GUI 可能不显示管理卡片。
+- 仓库安装需要 Node.js >= 22.19 与 pnpm 10，仅供开发调试；npm 安装不受影响。
+
+## 参与贡献
+
+- 新插件用脚手架生成：`pnpm create-plugin <name> [id]`，避免手写样板。
+- 提交信息遵循 Conventional Commits（如 `fix(mcp): 修复连接测试超时`），用户可见变更请附截图或验证证据。
+- 提交前过门禁：`pnpm typecheck && pnpm build && pnpm aggregate`。
+- 增删插件后记得跑 `pnpm aggregate` 重新生成 `packages/all` 聚合清单。
+
+## 许可证
+
+本仓库以 [MIT](LICENSE) 授权。
+
+## 贡献者
+
+<div align="center">
+
+**喜欢这个项目？点个 Star。**
+
+[报告 Bug](https://github.com/hyzyn/dsh-plugin-kit/issues) · [请求功能](https://github.com/hyzyn/dsh-plugin-kit/issues) · [查看 Releases](https://github.com/hyzyn/dsh-plugin-kit/releases)
+
+</div>

package/cordis.patch.yml

@@ -0,0 +1,47 @@
+# AUTO-GENERATED by scripts/aggregate.mjs — do not edit
+# 重新生成：pnpm aggregate
+
+# from self
+- insert:
+    - id: dsh-plugin-kit
+      name: '@hyzyn/dsh-plugin-kit'
+
+# from ../packages/codegraph
+- insert:
+    - id: codegraph
+      name: '@hyzyn/dsh-codegraph'
+
+# from ../packages/env
+- insert:
+    - id: env-manager
+      name: '@hyzyn/dsh-env'
+
+# from ../packages/hello
+- insert:
+    - id: hello
+      name: '@hyzyn/dsh-hello'
+
+# from ../packages/mcp
+- insert:
+    - id: mcp-config
+      name: '@hyzyn/dsh-mcp'
+
+# from ../packages/profile
+- insert:
+    - id: profile-manager
+      name: '@hyzyn/dsh-profile'
+
+# from ../packages/prompt
+- insert:
+    - id: prompt-manager
+      name: '@hyzyn/dsh-prompt'
+
+# from ../packages/rss
+- insert:
+    - id: rss-digest
+      name: '@hyzyn/dsh-rss'
+
+# from ../packages/search
+- insert:
+    - id: global-search
+      name: '@hyzyn/dsh-search'

package/lib/index.js

@@ -0,0 +1,8 @@
+/**
+ * dsh-plugin-kit — 全家桶根 bundle 的插件体（与 packages/all 同构）：
+ * 无宿主逻辑，仅作为 bundle patch 载体与依赖伞。安装根包 = 挂载仓库内
+ * 全部插件（见根 cordis.patch.yml，由 `pnpm aggregate` 自动生成）。
+ */
+export const name = 'dsh-plugin-kit'
+export const inject = []
+export function apply() {}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@hyzyn/dsh-plugin-kit",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "通用 DSH 插件库（pnpm monorepo）：模板插件、插件开发工具包、一键聚合安装包。根包同时是全家桶 bundle（dsh.bundle.patch），DSH 与插件市场可直接识别安装。",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "build": "pnpm -r build",
+    "typecheck": "pnpm -r typecheck",
+    "create-plugin": "node scripts/create-plugin.mjs",
+    "aggregate": "node scripts/aggregate.mjs"
+  },
+  "devDependencies": {
+    "typescript": "~5.7.2"
+  },
+  "packageManager": "pnpm@10.30.3",
+  "license": "MIT",
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@hyzyn/dsh-codegraph": "0.1.0",
+    "@hyzyn/dsh-env": "0.1.1",
+    "@hyzyn/dsh-hello": "0.1.0",
+    "@hyzyn/dsh-mcp": "0.1.0",
+    "@hyzyn/dsh-profile": "0.1.1",
+    "@hyzyn/dsh-prompt": "0.1.0",
+    "@hyzyn/dsh-rss": "0.1.1",
+    "@hyzyn/dsh-search": "0.1.0"
+  }
+}