dsh-plugin-shop 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +110 -33
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,64 +1,141 @@
|
|
|
1
|
+
<div align="center">
|
|
2
|
+
|
|
1
3
|
# dsh-plugin-shop
|
|
2
4
|
|
|
5
|
+
**The plugin store for [DeepSeek Harness](https://github.com/deepseek-harness)** — browse a catalog of
|
|
6
|
+
dsh plugins, install one with a single confirmation, and manage what you have, from a tab inside Settings.
|
|
7
|
+
|
|
8
|
+
[](https://www.npmjs.com/package/dsh-plugin-shop)
|
|
9
|
+
[](https://github.com/LivXue/dsh-plugin-shop/blob/main/LICENSE)
|
|
10
|
+
[](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/plugin.yml)
|
|
11
|
+
[](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/daily.yml)
|
|
12
|
+
|
|
3
13
|
English | [中文](https://github.com/LivXue/dsh-plugin-shop/blob/main/packages/dsh-plugin-shop/docs/README.zh.md)
|
|
4
14
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
has a newer version.
|
|
15
|
+
</div>
|
|
16
|
+
|
|
17
|
+
---
|
|
9
18
|
|
|
10
19
|
## Install
|
|
11
20
|
|
|
21
|
+
Two tracks below. They do the same thing; pick the one that matches who is reading.
|
|
22
|
+
|
|
23
|
+
### 🧑 For people
|
|
24
|
+
|
|
25
|
+
```sh
|
|
26
|
+
dsh plugin --profile web add dsh-plugin-shop
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
Replace `web` with your profile if you use another one. Then restart `dsh` once — a
|
|
30
|
+
newly added bundle is not applied to a running process — and open
|
|
31
|
+
|
|
32
|
+
> **Settings → Plugins → Plugin store**
|
|
33
|
+
|
|
34
|
+
You land on a shelf of plugin cards with a search box. The first load reads the catalog
|
|
35
|
+
over the network and can take a few seconds; a shimmering skeleton stands in until the
|
|
36
|
+
cards arrive.
|
|
37
|
+
|
|
38
|
+
### 🤖 For agents
|
|
39
|
+
|
|
40
|
+
Non-interactive, no prompts, nothing to confirm. `--profile` is **mandatory** —
|
|
41
|
+
without it `dsh plugin` exits with
|
|
42
|
+
`error: required option '--profile <name>' not specified`.
|
|
43
|
+
|
|
44
|
+
**1. Resolve a profile name.** Profiles are directories under `$DSH_HOME/profiles`
|
|
45
|
+
(`$DSH_HOME` defaults to `~/.dsh`). `node_modules` appears there too and is *not* a
|
|
46
|
+
profile.
|
|
47
|
+
|
|
12
48
|
```sh
|
|
13
|
-
dsh
|
|
49
|
+
ls -1 "${DSH_HOME:-$HOME/.dsh}/profiles" | grep -v '^node_modules$'
|
|
14
50
|
```
|
|
15
51
|
|
|
16
|
-
|
|
52
|
+
**2. Install.**
|
|
53
|
+
|
|
54
|
+
```sh
|
|
55
|
+
dsh plugin --profile <profile> add dsh-plugin-shop
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
**3. Verify — do not skip this.** A zero exit from step 2 means pnpm resolved the
|
|
59
|
+
package, not that the profile will load it. Assert on the bundle list:
|
|
60
|
+
|
|
61
|
+
```sh
|
|
62
|
+
dsh plugin --profile <profile> list --depth 0
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
`dsh-plugin-shop` must appear with a resolved version. If you would rather read the
|
|
66
|
+
manifest directly, the same fact lives at
|
|
67
|
+
`$DSH_HOME/profiles/<profile>/package.json` under `dsh.profile.bundles`.
|
|
68
|
+
|
|
69
|
+
**4. Restart the profile** — `dsh --profile <profile>`, or `dsh web` for the web
|
|
70
|
+
profile. Enabling or disabling an *already installed* plugin is hot; adding a new
|
|
71
|
+
bundle is not.
|
|
72
|
+
|
|
73
|
+
#### Failure modes
|
|
74
|
+
|
|
75
|
+
| What you see | What it means | What to do |
|
|
76
|
+
|---|---|---|
|
|
77
|
+
| `error: required option '--profile <name>' not specified` | `--profile` was omitted | Pass it; there is no default |
|
|
78
|
+
| A version older than npm's `latest` gets installed | pnpm 11 holds back very recently published versions | Expected, not an error; the newest lands once its cooldown passes |
|
|
79
|
+
| `client bundles not found ... lib/client.js` | the copy on disk was built without its browser half | Install from npm rather than from a source checkout, or run `pnpm build` in that checkout |
|
|
80
|
+
| `no profile directory found above <path>` | the plugin could not locate its profile | Please report it — this is resolved from `ctx.baseUrl` and should not fail |
|
|
81
|
+
| The tab is missing after a restart | the bundle is not in the profile's `bundles` | Re-run step 3; if it is absent, step 2 did not complete |
|
|
17
82
|
|
|
18
83
|
## What it does
|
|
19
84
|
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
- **Spot outdated installs** against the catalog's current version.
|
|
85
|
+
| | |
|
|
86
|
+
|---|---|
|
|
87
|
+
| **Browse & search** | 1800+ packages harvested from npm by the `dsh-plugin` keyword, shown with the author's own summary when they declared one |
|
|
88
|
+
| **Install** | One confirmation. An unreviewed plugin requires an explicit acknowledgement first — an installed plugin holds the same privileges as a built-in one |
|
|
89
|
+
| **Enable / disable** | Applies to an installed plugin without a restart |
|
|
90
|
+
| **Outdated installs** | Compared against the catalog's current version |
|
|
27
91
|
|
|
28
92
|
## How it is put together
|
|
29
93
|
|
|
30
|
-
Two halves
|
|
94
|
+
Two halves ship in this one package, and the split between them is the security
|
|
95
|
+
boundary:
|
|
96
|
+
|
|
97
|
+
| Half | Entry | Can reach | Cannot reach |
|
|
98
|
+
|---|---|---|---|
|
|
99
|
+
| **Host** | `dsh-plugin-shop` | The network (catalog fetch and sha256 verify), the filesystem (cache), `dsh plugin add` under a per-profile mutex | — |
|
|
100
|
+
| **Client** | `dsh-plugin-shop/client` | Exactly five `store/*` Remote methods | The network, the filesystem |
|
|
101
|
+
|
|
102
|
+
Compromising the browser half buys an attacker those five calls and nothing more.
|
|
31
103
|
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
network nor the filesystem; every effect goes through those five methods.
|
|
104
|
+
## Configuration
|
|
105
|
+
|
|
106
|
+
| Variable | Effect |
|
|
107
|
+
|---|---|
|
|
108
|
+
| `DSH_STORE_CATALOG_URL` | Point the store at your own catalog mirror instead of the public one |
|
|
38
109
|
|
|
39
110
|
## The catalog
|
|
40
111
|
|
|
41
112
|
Built daily from the public npm registry and published as static JSON:
|
|
42
113
|
|
|
43
|
-
- `https://LivXue.github.io/dsh-plugin-shop/v1/index.json
|
|
44
|
-
|
|
45
|
-
- `https://LivXue.github.io/dsh-plugin-shop/v1/plugins.<sha256>.json` — the data
|
|
114
|
+
- [`/v1/index.json`](https://LivXue.github.io/dsh-plugin-shop/v1/index.json) — the pointer, carrying `schemaVersion`, `builtAt`, and the content hash
|
|
115
|
+
- `/v1/plugins.<sha256>.json` — the data, content-addressed and safe to cache indefinitely
|
|
46
116
|
|
|
47
|
-
|
|
117
|
+
The pointer is small enough to poll. The store verifies the data file's sha256 against
|
|
118
|
+
the pointer before trusting a byte of it.
|
|
48
119
|
|
|
49
120
|
## What it does not claim
|
|
50
121
|
|
|
51
|
-
A listing is not an endorsement.
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
122
|
+
A listing is not an endorsement.
|
|
123
|
+
|
|
124
|
+
`capabilities` is whatever the author wrote about their own package. **There is no
|
|
125
|
+
sandbox in v0**, and the interface never renders that field as an enforced permission
|
|
126
|
+
list. The `verified` tier means a human read *that exact version*; a newer publish
|
|
127
|
+
downgrades it to `verified-stale` and keeps the review pinned to the version it was
|
|
128
|
+
actually given — so passing review once cannot buy trust for every future release.
|
|
129
|
+
|
|
130
|
+
## For plugin authors
|
|
56
131
|
|
|
57
|
-
|
|
132
|
+
Add `"keywords": ["dsh-plugin"]` to `package.json` and publish. The daily build finds
|
|
133
|
+
you; nothing is submitted to this project. Declare a `dsh.catalog` section to control
|
|
134
|
+
your own category, summary and capabilities — or omit it, and the catalog derives a
|
|
135
|
+
listing from your npm `description`.
|
|
58
136
|
|
|
59
|
-
|
|
60
|
-
[docs/schema.md](https://github.com/LivXue/dsh-plugin-shop/blob/main/docs/schema.md).
|
|
137
|
+
Full reference: [docs/schema.md](https://github.com/LivXue/dsh-plugin-shop/blob/main/docs/schema.md).
|
|
61
138
|
|
|
62
139
|
## License
|
|
63
140
|
|
|
64
|
-
MIT
|
|
141
|
+
[MIT](https://github.com/LivXue/dsh-plugin-shop/blob/main/LICENSE) © LivXue
|
package/package.json
CHANGED