dsh-enhancement-suite 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Scorp1o117
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,122 @@
+# DeepSeek Harness Enhancement Suite
+
+[![中文文档](https://img.shields.io/badge/%E4%B8%AD%E6%96%87%E6%96%87%E6%A1%A3-blue)](README.zh.md) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Node](https://img.shields.io/badge/node-%3E%3D22.18-green)](package.json)
+
+**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace**
+
+The official entry point and one-command installer for the four Scorp1o117 plugins that enhance [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH). This suite is a real installer — not a link collection: it drives the official `dsh plugin` CLI, mounts what needs mounting, and checks the result.
+
+> **This repository does not vendor or replace the individual plugins.**
+> **Each plugin remains independently maintained in its own upstream repository.**
+
+---
+
+## 👁️ dsh-tool-vision
+
+给文本模型增加视觉能力和图片桥接。
+
+[![npm](https://img.shields.io/npm/v/dsh-tool-vision)](https://www.npmjs.com/package/dsh-tool-vision) [![license](https://img.shields.io/npm/l/dsh-tool-vision)](https://github.com/Scorp1o117/dsh-tool-vision/blob/main/LICENSE)
+
+[→ upstream repository](https://github.com/Scorp1o117/dsh-tool-vision)
+
+## 🎭 dsh-soul-md
+
+为 Agent 增加 soul.md 人设、会话/工作区 Persona 和可演化人格。
+
+[![npm](https://img.shields.io/npm/v/dsh-soul-md)](https://www.npmjs.com/package/dsh-soul-md) [![license](https://img.shields.io/npm/l/dsh-soul-md)](https://github.com/Scorp1o117/dsh-soul-md/blob/main/LICENSE)
+
+[→ upstream repository](https://github.com/Scorp1o117/dsh-soul-md)
+
+## 🧠 dsh-tdai-memory
+
+完整的长期分层记忆、召回与搜索。
+
+[![npm](https://img.shields.io/npm/v/dsh-tdai-memory)](https://www.npmjs.com/package/dsh-tdai-memory) [![license](https://img.shields.io/npm/l/dsh-tdai-memory)](https://github.com/Scorp1o117/dsh-tdai-memory/blob/main/LICENSE)
+
+[→ upstream repository](https://github.com/Scorp1o117/dsh-tdai-memory)
+
+## 🛒 dsh-plugin-marketplace
+
+直接在 DSH Web UI 中发现和浏览插件。
+
+[![npm](https://img.shields.io/npm/v/dsh-plugin-marketplace)](https://www.npmjs.com/package/dsh-plugin-marketplace) [![license](https://img.shields.io/npm/l/dsh-plugin-marketplace)](https://github.com/Scorp1o117/dsh-plugin-marketplace/blob/main/LICENSE)
+
+[→ upstream repository](https://github.com/Scorp1o117/dsh-plugin-marketplace)
+
+---
+
+## Requirements
+
+- **Node.js >= 22.18** — the full suite inherits the `dsh-tdai-memory` engine requirement
+- **dsh CLI** on `PATH` — the official DeepSeek Harness CLI (`dsh plugin --profile <p> add <pkg>` is the install mechanism)
+- A target profile (default: `web`)
+
+## Install & usage
+
+From this repository (no install needed):
+
+```bash
+node bin/dsh-enhance.mjs list
+node bin/dsh-enhance.mjs install --dry-run
+node bin/dsh-enhance.mjs install
+node bin/dsh-enhance.mjs doctor
+```
+
+As a global command (once published to npm):
+
+```bash
+npm install -g dsh-enhancement-suite
+dsh-enhance list
+dsh-enhance install
+```
+
+## CLI
+
+```
+dsh-enhance list                          Show the plugin registry (installed state per profile)
+dsh-enhance install                       Install all four plugins into a profile
+dsh-enhance update                        Update installed plugins to the latest versions
+dsh-enhance doctor                        Check Node, dsh CLI, profile and per-plugin state
+
+  --profile <name>     target profile (default: web)
+  --only <keys>        comma-separated selection: vision,soul,memory,marketplace (or package names)
+  --dry-run            print what would run without executing anything
+```
+
+Examples:
+
+```bash
+dsh-enhance install --dry-run                    # preview everything
+dsh-enhance install --profile web --only vision,soul
+dsh-enhance update --profile headless
+```
+
+## How it installs
+
+1. Every plugin is installed through the **official CLI**: `dsh plugin --profile <profile> add <package>`. This suite never loads the plugins through its own dependency graph or its own cordis patch — the four upstream packages stay independent in the profile.
+2. `dsh-plugin-marketplace` declares `dsh.bundle.patch`, so `dsh plugin add` reconciles it into `dsh.profile.bundles` and its bundle layer auto-mounts it.
+3. The other three are plain dependencies; the suite appends their mount rows to the profile's `cordis.patch.yml` with the same safe, idempotent logic the marketplace's own one-click install uses (an empty `[]` patch is replaced correctly, duplicates are skipped, and a flow-style array is refused instead of corrupted).
+4. Restart `dsh web` and the plugins load.
+
+Every step reports a clear `✓` / `✗`, failures are never swallowed, and no API key is read, printed, or forwarded.
+
+## Integration / Adoption
+
+The following plugins are adopted and shipped built-in by the **Deepseek Harness EAC** desktop client:
+
+- 👁️ `dsh-tool-vision`
+- 🎭 `dsh-soul-md`
+- 🧠 `dsh-tdai-memory`
+
+[Deepseek-Harness-EAC](https://github.com/zouyuxuan122/Deepseek-Harness-EAC)
+
+> Note: EAC's built-in marketplace implementation is a separate project; it does not use `dsh-plugin-marketplace`.
+
+## Documentation
+
+- [Architecture](docs/architecture.md) — design decisions, manifest schema, safety rules
+- [plugins.json](plugins.json) — the plugin manifest (npm name, repo, category, display name, description)
+
+## License
+
+MIT — see [LICENSE](LICENSE). Each plugin keeps its own MIT license in its upstream repository.

package/README.zh.md

@@ -0,0 +1,122 @@
+# DeepSeek Harness Enhancement Suite
+
+[![English](https://img.shields.io/badge/English-blue)](README.md) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Node](https://img.shields.io/badge/node-%3E%3D22.18-green)](package.json)
+
+**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace**
+
+四个 Scorp1o117 插件的官方总入口和一键安装套件，为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）增强能力。这是一个真正可用的一键安装器，而不是链接合集：它驱动官方 `dsh plugin` CLI、自动处理挂载、并检查结果。
+
+> **本仓库不复制、不替代任何独立插件。**
+> **每个插件都在各自的 upstream 仓库独立维护。**
+
+---
+
+## 👁️ dsh-tool-vision
+
+给文本模型增加视觉能力和图片桥接。
+
+[![npm](https://img.shields.io/npm/v/dsh-tool-vision)](https://www.npmjs.com/package/dsh-tool-vision) [![license](https://img.shields.io/npm/l/dsh-tool-vision)](https://github.com/Scorp1o117/dsh-tool-vision/blob/main/LICENSE)
+
+[→ upstream 仓库](https://github.com/Scorp1o117/dsh-tool-vision)
+
+## 🎭 dsh-soul-md
+
+为 Agent 增加 soul.md 人设、会话/工作区 Persona 和可演化人格。
+
+[![npm](https://img.shields.io/npm/v/dsh-soul-md)](https://www.npmjs.com/package/dsh-soul-md) [![license](https://img.shields.io/npm/l/dsh-soul-md)](https://github.com/Scorp1o117/dsh-soul-md/blob/main/LICENSE)
+
+[→ upstream 仓库](https://github.com/Scorp1o117/dsh-soul-md)
+
+## 🧠 dsh-tdai-memory
+
+完整的长期分层记忆、召回与搜索。
+
+[![npm](https://img.shields.io/npm/v/dsh-tdai-memory)](https://www.npmjs.com/package/dsh-tdai-memory) [![license](https://img.shields.io/npm/l/dsh-tdai-memory)](https://github.com/Scorp1o117/dsh-tdai-memory/blob/main/LICENSE)
+
+[→ upstream 仓库](https://github.com/Scorp1o117/dsh-tdai-memory)
+
+## 🛒 dsh-plugin-marketplace
+
+直接在 DSH Web UI 中发现和浏览插件。
+
+[![npm](https://img.shields.io/npm/v/dsh-plugin-marketplace)](https://www.npmjs.com/package/dsh-plugin-marketplace) [![license](https://img.shields.io/npm/l/dsh-plugin-marketplace)](https://github.com/Scorp1o117/dsh-plugin-marketplace/blob/main/LICENSE)
+
+[→ upstream 仓库](https://github.com/Scorp1o117/dsh-plugin-marketplace)
+
+---
+
+## 环境要求
+
+- **Node.js >= 22.18** —— 完整套件继承 `dsh-tdai-memory` 的引擎要求
+- **dsh CLI** 在 `PATH` 上 —— 安装机制是官方 CLI：`dsh plugin --profile <p> add <pkg>`
+- 目标 profile（默认：`web`）
+
+## 安装与使用
+
+从本仓库直接运行（无需安装）：
+
+```bash
+node bin/dsh-enhance.mjs list
+node bin/dsh-enhance.mjs install --dry-run
+node bin/dsh-enhance.mjs install
+node bin/dsh-enhance.mjs doctor
+```
+
+发布到 npm 后作为全局命令使用：
+
+```bash
+npm install -g dsh-enhancement-suite
+dsh-enhance list
+dsh-enhance install
+```
+
+## CLI
+
+```
+dsh-enhance list                          查看插件清单（含 profile 内的安装状态）
+dsh-enhance install                       把四个插件安装进 profile
+dsh-enhance update                        更新已安装插件到最新版本
+dsh-enhance doctor                        检查 Node、dsh CLI、profile 与各插件状态
+
+  --profile <name>     目标 profile（默认：web）
+  --only <keys>        逗号分隔的选择：vision,soul,memory,marketplace（或包名）
+  --dry-run            只打印将要执行的操作，不实际执行
+```
+
+示例：
+
+```bash
+dsh-enhance install --dry-run                    # 预览全部操作
+dsh-enhance install --profile web --only vision,soul
+dsh-enhance update --profile headless
+```
+
+## 安装方式
+
+1. 每个插件都通过**官方 CLI** 安装：`dsh plugin --profile <profile> add <package>`。本套件绝不通过自身的依赖图或自己的 cordis patch 间接加载插件——四个 upstream 包在 profile 中保持独立。
+2. `dsh-plugin-marketplace` 声明了 `dsh.bundle.patch`，`dsh plugin add` 会把它对账进 `dsh.profile.bundles`，由 bundle 层自动挂载。
+3. 其余三个是普通依赖；套件用与 marketplace 一键安装相同的安全、幂等逻辑，把挂载行追加到 profile 的 `cordis.patch.yml`（空 `[]` 补丁会被正确替换、重复挂载会被跳过、流式数组会被拒绝而不是损坏）。
+4. 重启 `dsh web` 即可加载。
+
+每一步都有清晰的 `✓` / `✗` 反馈，失败绝不吞掉，且不读取、不打印任何 API Key。
+
+## 集成 / 采用
+
+以下插件已被 **Deepseek Harness EAC** 桌面客户端内置采用：
+
+- 👁️ `dsh-tool-vision`
+- 🎭 `dsh-soul-md`
+- 🧠 `dsh-tdai-memory`
+
+[Deepseek-Harness-EAC](https://github.com/zouyuxuan122/Deepseek-Harness-EAC)
+
+> 注意：EAC 内置的 marketplace 实现是另一个项目，并没有使用 `dsh-plugin-marketplace`。
+
+## 文档
+
+- [架构说明](docs/architecture.md) —— 设计决策、manifest 结构、安全规则
+- [plugins.json](plugins.json) —— 插件 manifest（npm 包名、仓库、分类、显示名、描述）
+
+## License
+
+MIT —— 见 [LICENSE](LICENSE)。各插件在各自 upstream 仓库保留独立的 MIT License。

package/bin/dsh-enhance.mjs

@@ -0,0 +1,467 @@
+#!/usr/bin/env node
+/**
+ * dsh-enhance — DeepSeek Harness Enhancement Suite CLI.
+ *
+ * Zero-dependency, cross-platform (Windows / Linux / macOS) installer and
+ * registry for the four Scorp1o117 DSH plugins:
+ *
+ *   vision      dsh-tool-vision          Vision
+ *   soul        dsh-soul-md              Persona
+ *   memory      dsh-tdai-memory          Memory
+ *   marketplace dsh-plugin-marketplace   Marketplace
+ *
+ * Install always prefers the official DeepSeek Harness plugin CLI
+ * (`dsh plugin --profile <profile> add <package>`); this suite never loads
+ * the plugins through its own dependency graph. Non-bundle plugins are then
+ * mounted into the profile's cordis.patch.yml with the same safe, idempotent
+ * logic the marketplace itself uses.
+ *
+ * Safety rules:
+ *  - subprocesses are spawned with argument ARRAYS, never shell strings;
+ *  - no API keys are read, printed, or forwarded;
+ *  - every failure is reported explicitly with a non-zero exit code.
+ */
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const MANIFEST = JSON.parse(readFileSync(join(ROOT, "plugins.json"), "utf8"));
+const PKG = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+const PLUGINS = MANIFEST.plugins;
+const DEFAULT_PROFILE = MANIFEST.defaultProfile ?? "web";
+/** Short keys and full package names are both accepted for --only. */
+const KEY_ALIASES = new Map(PLUGINS.map((p) => [p.key, p.name]));
+const NODE_MIN = MANIFEST.node ?? ">=22.18";
+
+const ok = (msg) => console.log(`  ✓ ${msg}`);
+const bad = (msg) => console.log(`  ✗ ${msg}`);
+const info = (msg) => console.log(`  · ${msg}`);
+const head = (msg) => console.log(`\n${msg}`);
+
+// ── tiny helpers ────────────────────────────────────────────────────────────
+
+class CliError extends Error {}
+
+function dshHome() {
+  return process.env.DSH_HOME || join(homedir(), ".dsh");
+}
+
+function profileDir(profile) {
+  return join(dshHome(), "profiles", profile);
+}
+
+function profileManifest(profile) {
+  try {
+    return JSON.parse(readFileSync(join(profileDir(profile), "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function installedManifest(pkg, profile) {
+  try {
+    return JSON.parse(readFileSync(join(profileDir(profile), "node_modules", pkg, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/** Locate the dsh CLI on PATH (dsh.cmd / dsh.exe on Windows, dsh elsewhere). */
+function findDsh() {
+  const override = process.env.DSH_ENHANCE_DSH_BIN;
+  if (override) return override;
+  const names = process.platform === "win32" ? ["dsh.cmd", "dsh.exe", "dsh"] : ["dsh"];
+  const entries = (process.env.PATH ?? "").split(process.platform === "win32" ? ";" : ":").filter(Boolean);
+  for (const dir of entries) {
+    for (const name of names) {
+      const candidate = join(dir, name);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+/**
+ * Spawn one subprocess with an argument array (never a shell string).
+ * On Windows the resolved .cmd shim is executed through the shell with
+ * per-argument quoting applied by Node, which keeps every argument opaque.
+ */
+function run(bin, args, { capture = false } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(bin, args, {
+      shell: process.platform === "win32",
+      stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
+      windowsHide: true,
+    });
+    let stdout = "";
+    let stderr = "";
+    if (capture) {
+      child.stdout.on("data", (d) => { stdout += d; });
+      child.stderr.on("data", (d) => { stderr += d; });
+    }
+    child.on("error", (error) => resolve({ code: -1, stdout, stderr, error }));
+    child.on("close", (code) => resolve({ code: code ?? -1, stdout, stderr }));
+  });
+}
+
+/** Minimal semver compare (numeric dotted triples), enough for the Node gate. */
+function parseVersion(v) {
+  const m = /^(\d+)\.(\d+)(?:\.(\d+))?/.exec(String(v).trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)] : null;
+}
+function versionGte(current, minimum) {
+  const c = parseVersion(current);
+  const m = parseVersion(minimum);
+  if (!c || !m) return false;
+  for (let i = 0; i < 3; i += 1) {
+    if (c[i] > m[i]) return true;
+    if (c[i] < m[i]) return false;
+  }
+  return true;
+}
+
+function installedVersion(pkg, profile) {
+  return installedManifest(pkg, profile)?.version ?? null;
+}
+
+/** Bundle plugins are auto-mounted by their own dsh.bundle layer. */
+function isBundlePackage(pkg, profile) {
+  const manifest = installedManifest(pkg, profile);
+  return Boolean(manifest && typeof manifest.dsh?.bundle?.patch === "string" && manifest.dsh.bundle.patch.length > 0);
+}
+
+function isInProfileBundles(pkg, profile) {
+  return (profileManifest(profile)?.dsh?.profile?.bundles ?? []).includes(pkg);
+}
+
+function isMountedInPatch(pkg, profile) {
+  try {
+    const src = readFileSync(join(profileDir(profile), "cordis.patch.yml"), "utf8");
+    return src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Append a mount row for `pkg` to the profile's cordis.patch.yml (idempotent).
+ * Mirrors the marketplace's own logic: bundle plugins are skipped (their
+ * bundle layer auto-mounts them), an empty `[]` patch is replaced with a
+ * block-style insert list, and a non-empty flow-style array is refused
+ * rather than corrupted.
+ */
+function ensureMounted(pkg, profile) {
+  const patch = join(profileDir(profile), "cordis.patch.yml");
+  if (!existsSync(patch)) return { changed: false, note: "cordis.patch.yml not found; mount manually" };
+  if (isInProfileBundles(pkg, profile)) return { changed: false, note: "already mounted via dsh.profile.bundles" };
+  if (isBundlePackage(pkg, profile)) return { changed: false, note: "bundle plugin: auto-mounted via its own dsh.bundle layer" };
+  let src = readFileSync(patch, "utf8");
+  if (src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`)) return { changed: false, note: "already mounted in cordis.patch.yml" };
+  const id = pkg.replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]/g, "-") || pkg;
+  const row = `\n    - id: ${id}\n      name: '${pkg}'`;
+  const emptyArray = /^(\s*(?:#[^\n]*\n?)*)\[\s*\]\s*$/.exec(src);
+  if (emptyArray) {
+    const next = `${emptyArray[1]}- insert:${row}\n`;
+    if (process.env.DSH_ENHANCE_DRY_RUN !== "1") writeFileSync(patch, next, "utf8");
+    return { changed: true, note: "mounted in cordis.patch.yml" };
+  }
+  const insertAt = src.search(/^- insert:\s*$/m);
+  if (insertAt >= 0) {
+    const next = src.slice(0, insertAt + "- insert:".length) + row + src.slice(insertAt + "- insert:".length);
+    if (process.env.DSH_ENHANCE_DRY_RUN !== "1") writeFileSync(patch, next, "utf8");
+    return { changed: true, note: "mounted in cordis.patch.yml" };
+  }
+  if (/^\s*\[/.test(src)) return { changed: false, note: "patch file uses a flow-style array; mount manually" };
+  if (process.env.DSH_ENHANCE_DRY_RUN !== "1") writeFileSync(patch, `${src}\n- insert:${row}\n`, "utf8");
+  return { changed: true, note: "mounted in cordis.patch.yml" };
+}
+
+function resolveSelection(only) {
+  if (only.length === 0) return [...PLUGINS];
+  const seen = new Set();
+  const selected = [];
+  for (const raw of only) {
+    const token = raw.trim();
+    const name = KEY_ALIASES.get(token) ?? token;
+    const plugin = PLUGINS.find((p) => p.name === name);
+    if (!plugin) throw new CliError(`unknown plugin "${token}" (valid: ${PLUGINS.map((p) => `${p.key} (${p.name})`).join(", ")})`);
+    if (!seen.has(plugin.name)) {
+      seen.add(plugin.name);
+      selected.push(plugin);
+    }
+  }
+  return selected;
+}
+
+function parseArgs(argv) {
+  const out = {
+    command: null,
+    profile: DEFAULT_PROFILE,
+    only: [],
+    dryRun: false,
+    help: false,
+    version: false,
+    unknown: [],
+  };
+  const positional = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") out.help = true;
+    else if (arg === "--version" || arg === "-V") out.version = true;
+    else if (arg === "--dry-run") out.dryRun = true;
+    else if (arg === "--profile") {
+      out.profile = argv[i + 1];
+      if (!out.profile) throw new CliError("--profile requires a value");
+      i += 1;
+    } else if (arg.startsWith("--profile=")) out.profile = arg.slice("--profile=".length);
+    else if (arg === "--only") {
+      const value = argv[i + 1];
+      if (!value) throw new CliError("--only requires a value (comma-separated keys or package names)");
+      out.only.push(...value.split(",").map((s) => s.trim()).filter(Boolean));
+      i += 1;
+    } else if (arg.startsWith("--only=")) {
+      out.only.push(...arg.slice("--only=".length).split(",").map((s) => s.trim()).filter(Boolean));
+    } else if (arg.startsWith("-") && arg !== "-") out.unknown.push(arg);
+    else positional.push(arg);
+  }
+  out.command = positional[0] ?? null;
+  return out;
+}
+
+function printHelp() {
+  console.log(`dsh-enhance — DeepSeek Harness Enhancement Suite v${PKG.version}
+
+Usage:
+  dsh-enhance <command> [options]
+
+Commands:
+  list                          Show the plugin registry (installed state per profile)
+  install                       Install all four plugins into a profile
+  update                        Update installed plugins to the latest versions
+  doctor                        Check Node, dsh CLI, profile and per-plugin state
+
+Options:
+  --profile <name>              Target profile (default: ${DEFAULT_PROFILE})
+  --only <keys>                 Comma-separated selection: ${PLUGINS.map((p) => p.key).join(",")} (or package names)
+  --dry-run                     Print what would run without executing anything
+  --help, -h                    Show this help
+  --version, -V                 Show the suite version
+
+Examples:
+  dsh-enhance list
+  dsh-enhance install --dry-run
+  dsh-enhance install --profile web --only vision,soul
+  dsh-enhance doctor
+
+Notes:
+  - Install prefers the official CLI: dsh plugin --profile <profile> add <package>
+  - Requires Node ${NODE_MIN} (dsh-tdai-memory constraint)
+  - This suite never loads plugins through its own dependency graph`);
+}
+
+// ── commands ────────────────────────────────────────────────────────────────
+
+function cmdList(profile) {
+  console.log(`DeepSeek Harness Enhancement Suite v${PKG.version} — ${PLUGINS.length} plugins`);
+  console.log(`Profile: ${profile}`);
+  head("");
+  for (const p of PLUGINS) {
+    const version = installedVersion(p.name, profile);
+    const state = version ? `✓ installed (${version})` : "✗ not installed";
+    console.log(`  ${p.emoji} ${p.key.padEnd(12)} ${p.name.padEnd(26)} ${state}`);
+    console.log(`     ${p.descriptionEn} — ${p.repo}`);
+  }
+  head("");
+  console.log(`Node requirement: ${NODE_MIN} (running ${process.version})`);
+}
+
+async function cmdInstall(profile, only, dryRun) {
+  const plugins = resolveSelection(only);
+  const dsh = findDsh();
+  if (!dsh) {
+    bad("dsh CLI not found on PATH — install dsh first (https://github.com/deepseek-ai/deepseek-harness)");
+    process.exitCode = 1;
+    return;
+  }
+  head(`Installing ${plugins.length} plugin(s) into profile "${profile}"`);
+  const failures = [];
+  for (const p of plugins) {
+    info(`${p.emoji} ${p.name}`);
+    const addArgs = ["plugin", "--profile", profile, "add", p.name];
+    if (dryRun) {
+      ok(`would run: dsh ${addArgs.join(" ")}`);
+    } else {
+      const result = await run(dsh, addArgs);
+      if (result.code !== 0) {
+        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+        bad(`${p.name} install failed (${result.code}): ${tail || result.error?.message || "unknown error"}`);
+        failures.push(`${p.name}: dsh plugin add exited ${result.code}`);
+        continue;
+      }
+      ok(`installed via dsh plugin add`);
+    }
+    const mount = ensureMounted(p.name, profile);
+    if (dryRun) {
+      info(`would ${mount.changed ? "mount" : "skip mounting"}: ${mount.note}`);
+      ok(`OK (dry-run)`);
+    } else if (mount.changed) {
+      ok(mount.note);
+    } else {
+      info(mount.note);
+    }
+  }
+  head("");
+  const failed = failures.length;
+  const succeeded = plugins.length - failed;
+  console.log(`${succeeded}/${plugins.length} plugin(s) OK${failed > 0 ? `, ${failed} failed` : ""}.`);
+  if (failed > 0) {
+    console.log("Failures:");
+    for (const f of failures) console.log(`  ✗ ${f}`);
+    console.log("Fix the reported plugin(s) and re-run dsh-enhance install. No partial state was hidden.");
+    process.exitCode = 1;
+  } else {
+    console.log("Restart dsh web for the new plugins to load.");
+  }
+}
+
+async function cmdUpdate(profile, only, dryRun) {
+  const plugins = resolveSelection(only);
+  const dsh = findDsh();
+  if (!dsh) {
+    bad("dsh CLI not found on PATH");
+    process.exitCode = 1;
+    return;
+  }
+  head(`Updating ${plugins.length} plugin(s) in profile "${profile}"`);
+  const failures = [];
+  for (const p of plugins) {
+    if (!installedManifest(p.name, profile)) {
+      info(`${p.emoji} ${p.name}: not installed — run "dsh-enhance install" first`);
+      continue;
+    }
+    const args = ["plugin", "--profile", profile, "update", p.name];
+    if (dryRun) {
+      ok(`would run: dsh ${args.join(" ")}`);
+    } else {
+      const result = await run(dsh, args);
+      if (result.code !== 0) {
+        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+        bad(`${p.name} update failed (${result.code}): ${tail || result.error?.message || "unknown error"}`);
+        failures.push(`${p.name}: dsh plugin update exited ${result.code}`);
+        continue;
+      }
+      ok(`updated: ${p.name} → ${installedVersion(p.name, profile) ?? "latest"}`);
+    }
+    const mount = ensureMounted(p.name, profile);
+    if (!dryRun && mount.changed) ok(mount.note);
+  }
+  head("");
+  if (failures.length > 0) {
+    for (const f of failures) console.log(`  ✗ ${f}`);
+    process.exitCode = 1;
+  } else {
+    console.log("Update finished. Restart dsh web to load the new versions.");
+  }
+}
+
+function cmdDoctor(profile) {
+  let healthy = true;
+  head("DeepSeek Harness Enhancement Suite — doctor");
+  const nodeOk = versionGte(process.versions.node, NODE_MIN.replace(/^>=\s*/, ""));
+  if (nodeOk) ok(`Node ${process.versions.node} (>= ${NODE_MIN.replace(/^>=\s*/, "")})`);
+  else {
+    bad(`Node ${process.versions.node} — this suite requires ${NODE_MIN} (dsh-tdai-memory constraint)`);
+    healthy = false;
+  }
+  const dsh = findDsh();
+  if (dsh) {
+    ok(`dsh CLI found: ${dsh}`);
+  } else {
+    bad("dsh CLI not found on PATH — install DeepSeek Harness first");
+    healthy = false;
+  }
+  const pdir = profileDir(profile);
+  if (existsSync(pdir)) ok(`profile "${profile}" exists: ${pdir}`);
+  else {
+    bad(`profile "${profile}" not found at ${pdir} — create it with "dsh plugin --profile ${profile} add <package>"`);
+    healthy = false;
+  }
+  head("");
+  for (const p of PLUGINS) {
+    const version = installedVersion(p.name, profile);
+    if (!version) {
+      bad(`${p.emoji} ${p.name}: not installed`);
+      healthy = false;
+      continue;
+    }
+    ok(`${p.emoji} ${p.name}: installed (${version})`);
+    const mounted = isInProfileBundles(p.name, profile) || isMountedInPatch(p.name, profile) || isBundlePackage(p.name, profile);
+    if (mounted) info(`   mounted: ${isInProfileBundles(p.name, profile) ? "dsh.profile.bundles" : isMountedInPatch(p.name, profile) ? "cordis.patch.yml" : "own dsh.bundle layer"}`);
+    else {
+      bad(`   not mounted — run "dsh-enhance install"`);
+      healthy = false;
+    }
+  }
+  head("");
+  if (healthy) {
+    console.log("Doctor finished: all checks passed. No API keys are read or printed.");
+  } else {
+    console.log("Doctor finished with failures — fix the reported items, then re-run.");
+    process.exitCode = 1;
+  }
+}
+
+// ── entry ───────────────────────────────────────────────────────────────────
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.unknown.length > 0) {
+    bad(`unknown option(s): ${args.unknown.join(", ")}`);
+    printHelp();
+    process.exitCode = 1;
+    return;
+  }
+  if (args.version) {
+    console.log(PKG.version);
+    return;
+  }
+  if (args.help || !args.command) {
+    printHelp();
+    if (!args.help) process.exitCode = 1;
+    return;
+  }
+  if (args.dryRun) process.env.DSH_ENHANCE_DRY_RUN = "1";
+  try {
+    switch (args.command) {
+      case "list":
+        cmdList(args.profile);
+        break;
+      case "install":
+        await cmdInstall(args.profile, args.only, args.dryRun);
+        break;
+      case "update":
+        await cmdUpdate(args.profile, args.only, args.dryRun);
+        break;
+      case "doctor":
+        cmdDoctor(args.profile);
+        break;
+      default:
+        bad(`unknown command "${args.command}"`);
+        printHelp();
+        process.exitCode = 1;
+    }
+  } catch (error) {
+    if (error instanceof CliError) {
+      bad(error.message);
+      process.exitCode = 1;
+    } else {
+      bad(`unexpected error: ${error?.stack ?? error}`);
+      process.exitCode = 1;
+    }
+  }
+}
+
+main();

package/bin/validate-manifest.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * validate-manifest — validates plugins.json for the suite.
+ *
+ * Checks: exactly four plugins, no duplicate names/keys, all required
+ * fields present, repo URLs are https github.com links. Exits non-zero on
+ * any violation. Used by CI and `npm run check`.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const REQUIRED = ["key", "name", "displayName", "emoji", "category", "repo", "description", "descriptionEn"];
+
+let failed = false;
+const fail = (message) => {
+  failed = true;
+  console.error(`✗ ${message}`);
+};
+
+const manifest = JSON.parse(readFileSync(join(ROOT, "plugins.json"), "utf8"));
+if (!Array.isArray(manifest.plugins)) {
+  fail("plugins.json: missing plugins array");
+} else {
+  if (manifest.plugins.length !== 4) fail(`expected exactly 4 plugins, got ${manifest.plugins.length}`);
+  const names = manifest.plugins.map((p) => p.name);
+  const keys = manifest.plugins.map((p) => p.key);
+  if (new Set(names).size !== names.length) fail("duplicate plugin names");
+  if (new Set(keys).size !== keys.length) fail("duplicate plugin keys");
+  for (const p of manifest.plugins) {
+    for (const field of REQUIRED) {
+      if (typeof p[field] !== "string" || p[field].length === 0) fail(`${p.name ?? "?"}: missing required field ${field}`);
+    }
+    if (!/^https:\/\/github\.com\//.test(p.repo ?? "")) fail(`${p.name ?? "?"}: repo must be an https github.com URL`);
+  }
+}
+
+if (failed) {
+  console.error("plugins.json validation FAILED");
+  process.exitCode = 1;
+} else {
+  console.log(`plugins.json OK: ${manifest.plugins.map((p) => p.name).join(", ")}`);
+}

package/docs/architecture.md

@@ -0,0 +1,102 @@
+# Architecture — dsh-enhancement-suite
+
+## Positioning
+
+`dsh-enhancement-suite` is the **official entry point and installer** for the four
+Scorp1o117 DeepSeek Harness plugins. It is deliberately **not** a wrapper that
+owns the plugins:
+
+- The four upstream repositories are the single source of truth for each plugin.
+- This repository vendors **no plugin source code**.
+- The suite's only runtime artifact is a zero-dependency CLI plus a manifest.
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│ dsh-enhancement-suite (this repo)                            │
+│   README / docs / manifest / CLI                            │
+│   └── bin/dsh-enhance.mjs  ── spawns ──▶  dsh plugin CLI    │
+│                                              │              │
+│   plugins.json (registry metadata only)      │ installs     │
+└──────────────────────────────────────────────│──────────────┘
+                                               ▼
+        ┌───────────────┬───────────────┬───────────────┬──────────────────┐
+        │ dsh-tool-vision│ dsh-soul-md   │ dsh-tdai-memory│ dsh-plugin-      │
+        │ (upstream)     │ (upstream)    │ (upstream)     │ marketplace      │
+        └───────────────┴───────────────┴───────────────┴──────────────────┘
+```
+
+## Why the official CLI, and why not transitive dependencies
+
+Installing through `dsh plugin --profile <p> add <pkg>` (which forwards to pnpm
+inside the profile and reconciles `dsh.profile.bundles`) keeps the plugins
+resolvable from the **profile root**, exactly as if the user installed them by
+hand. Loading the plugins as dependencies of this suite package would make them
+resolve through the suite's `node_modules` chain, which pnpm may place outside
+the profile — plugins then fail to load at boot. Hence:
+
+- `package.json` has **zero dependencies**.
+- The suite never emits its own cordis patch for the four plugins.
+- Mounting (when required) is written into the **profile's own**
+  `cordis.patch.yml`, with the same idempotent logic the marketplace uses.
+
+## Plugin manifest (`plugins.json`)
+
+| Field | Meaning |
+|---|---|
+| `key` | Short CLI key (`vision`, `soul`, `memory`, `marketplace`) |
+| `name` | npm package name (also the `dsh plugin add` argument) |
+| `displayName` | Display name |
+| `emoji` | Card emoji used by the CLI/README |
+| `category` | Suite category |
+| `repo` | Upstream GitHub repository (source of truth) |
+| `description` / `descriptionEn` | Bilingual one-line descriptions |
+
+CI validates: exactly four plugins, no duplicate names/keys, all required
+fields present, `repo` is an https GitHub URL.
+
+## Install flow
+
+1. `dsh plugin --profile <profile> add <package>` (official CLI).
+2. If the installed package declares `dsh.bundle.patch` (currently only
+   `dsh-plugin-marketplace`) → the reconcile step already registered it in
+   `dsh.profile.bundles`; the bundle layer auto-mounts it. **No patch edit.**
+3. Otherwise (plain dependency) → append a mount row to the profile's
+   `cordis.patch.yml`:
+   - idempotent (scans for `name: '<pkg>'`);
+   - an empty `[]` patch (optionally after comment lines) is **replaced**
+     with a block-style `- insert:` list — appending after `[]` would create
+     two top-level YAML documents and crash boot;
+   - a non-empty flow-style array is **refused** with a manual-mount message;
+   - a package already in `dsh.profile.bundles` is skipped.
+4. `update` maps to `dsh plugin --profile <profile> update <package>`, then
+   re-runs the idempotent mount check.
+
+## Safety rules
+
+- **No shell string concatenation.** Every subprocess is spawned with an
+  argument array; on Windows the `.cmd` shim is executed with Node's
+  per-argument quoting (`shell: true` + args array, never a joined command
+  string).
+- **No secrets.** The CLI never reads, prints, or forwards API keys; it does
+  not touch environment secrets or the credentials store.
+- **No swallowed failures.** Each plugin's install/update reports its own
+  `✓`/`✗`; failures are collected, summarized, and reflected in the exit code
+  (non-zero on any failure). Partial state is never hidden.
+- **`--dry-run`** prints the exact commands and patch edits without executing.
+
+## Doctor checks
+
+- Node version ≥ `22.18` (suite-wide requirement inherited from
+  `dsh-tdai-memory`).
+- `dsh` CLI present on `PATH` (override with `DSH_ENHANCE_DSH_BIN`).
+- Target profile directory exists.
+- Per plugin: installed version, mount state (bundles / patch / own bundle
+  layer).
+
+## Versioning and release
+
+- Suite version follows semver; the README badges query npm **live** for the
+  four plugins, so version numbers are never hard-coded.
+- npm publishing is intentionally not automated yet; CI only syntax-checks the
+  CLI, validates the manifest, and optionally cross-checks npm availability
+  (network failures are informational, `continue-on-error`).

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "dsh-enhancement-suite",
+  "version": "0.1.0",
+  "description": "Enhancement suite for DeepSeek Harness — the official installer and registry for Scorp1o117's Vision, Soul/Persona, Memory & Marketplace plugins.",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.18"
+  },
+  "bin": {
+    "dsh-enhance": "./bin/dsh-enhance.mjs"
+  },
+  "files": [
+    "bin",
+    "plugins.json",
+    "README.md",
+    "README.zh.md",
+    "LICENSE",
+    "docs"
+  ],
+  "scripts": {
+    "check": "node --check bin/dsh-enhance.mjs && node bin/validate-manifest.mjs && node bin/dsh-enhance.mjs --help && node bin/dsh-enhance.mjs list",
+    "prepublishOnly": "npm run check"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "ai-agent",
+    "vision",
+    "memory",
+    "persona",
+    "plugin-marketplace"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Scorp1o117/dsh-enhancement-suite.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Scorp1o117/dsh-enhancement-suite/issues"
+  },
+  "homepage": "https://github.com/Scorp1o117/dsh-enhancement-suite",
+  "dependencies": {}
+}

package/plugins.json

@@ -0,0 +1,47 @@
+{
+  "suite": "dsh-enhancement-suite",
+  "node": ">=22.18",
+  "defaultProfile": "web",
+  "plugins": [
+    {
+      "key": "vision",
+      "name": "dsh-tool-vision",
+      "displayName": "dsh-tool-vision",
+      "emoji": "👁️",
+      "category": "Vision",
+      "repo": "https://github.com/Scorp1o117/dsh-tool-vision",
+      "description": "给文本模型增加视觉能力和图片桥接。",
+      "descriptionEn": "Adds vision capability and image bridging to text-only models."
+    },
+    {
+      "key": "soul",
+      "name": "dsh-soul-md",
+      "displayName": "dsh-soul-md",
+      "emoji": "🎭",
+      "category": "Persona",
+      "repo": "https://github.com/Scorp1o117/dsh-soul-md",
+      "description": "为 Agent 增加 soul.md 人设、会话/工作区 Persona 和可演化人格。",
+      "descriptionEn": "soul.md personas, session/workspace persona switching, and an evolving personality with long-term memory."
+    },
+    {
+      "key": "memory",
+      "name": "dsh-tdai-memory",
+      "displayName": "dsh-tdai-memory",
+      "emoji": "🧠",
+      "category": "Memory",
+      "repo": "https://github.com/Scorp1o117/dsh-tdai-memory",
+      "description": "完整的长期分层记忆、召回与搜索。",
+      "descriptionEn": "Full long-term layered memory (L0-L3), recall and search."
+    },
+    {
+      "key": "marketplace",
+      "name": "dsh-plugin-marketplace",
+      "displayName": "dsh-plugin-marketplace",
+      "emoji": "🛒",
+      "category": "Marketplace",
+      "repo": "https://github.com/Scorp1o117/dsh-plugin-marketplace",
+      "description": "直接在 DSH Web UI 中发现和浏览插件。",
+      "descriptionEn": "Discover and browse plugins directly inside the DSH Web UI."
+    }
+  ]
+}