dsh-enterprise

DSH 企业版客户端插件 · DSH Enterprise Client Plugin

统一企业登录 · 模型自动配置 · 策略治理 Unified sign-in · Auto model provisioning · Policy governance

独立源码开放项目，非 DeepSeek 官方产品 · Independent source-available project, not an official DeepSeek product

简体中文 · English · 最新下载

🇨🇳 简体中文

它解决了什么问题

装了 DSH 终端的用户电脑上，模型要自己配：填地址、贴密钥、选默认模型——配错一个就用不了，改一次密码就得挨台重配。管理员对终端也没有约束力：想强制登录、想下架某个插件、想拦住敏感内容外发，全都做不到。

这个插件装进用户 DSH 终端后，一条龙解决：

• 用户只登录一次 — 账号密码换企业令牌，模型列表、默认模型、凭证全部自动配好，登录即可用；配置坏了在设置页一键修复
• 终端始终与服务器对齐 — 登录、修复、启动对账三条路保障终端模型列表与企业目录一致
• 策略自动下发 — 服务器下发的策略（心跳开关、插件管控、内容规则）在终端自动生效，支持灰度与回执
• 插件管控 — 自动清理企业允许清单之外的插件，提供企业插件市场统一安装入口
• 未登录即阻断 — 可开启强制登录，不登录不让用
• 敏感内容拦截 — URL 拦截与文本 DLP 规则在终端侧生效，带命中记录

安装

企业部署：网关自带接入页

插件不单独安装——它是企业客户端，必须配 dsh-enterprise-gateway 使用。管理员只需把一个地址发给用户：

http://<网关IP>:8899/

用户浏览器打开后，页面自动识别系统，按分步指引复制一条命令回车即可——命令自动携带本网关地址，装完落在登录页。IT 不用拼参数，内网可用（脚本由网关自托管，不经公网）。

1. 安装并启动一次 DSH Desktop，退出
2. PowerShell 执行：

npm i -g pnpm
cd $env:USERPROFILE\.dsh\profiles\desktop
pnpm add dsh-enterprise

3. package.json 的 dsh.profile.bundles 加入 "dsh-enterprise"
4. 启动 DSH Desktop，访问 /plugins/enterprise 登录

原版 DSH（CLI，任意系统）

dsh plugin --profile ent add dsh-enterprise

启动后访问 Web 界面 /plugins/enterprise 登录。可选预填网关地址：

mkdir -p ~/.dsh/enterprise && echo "http://<网关IP>:8899" > ~/.dsh/enterprise/gateway-url.txt

企业批量部署：管理员把网关接入页地址（http://<网关IP>:8899/）发给用户即可，用户照页面指引一条命令完成安装；插件统一管控由网关「插件管控 → 插件仓库」收口。

功能一览

| 功能 | 说明 | | --- | --- | | 企业登录 | 内置登录页，登录成功自动写模型配置与凭证 | | 一键修复 | 配置异常时重建 Provider / 模型 / 凭证 | | 策略心跳 | 定期上报设备状态、续期令牌，断网用本地缓存保底 | | 策略灰度 | 拉取最新策略 → 缓存 → 回执，管理员可见推进度 | | 插件管控 | 允许清单之外的插件启动即清理；企业市场安装 | | 规则引擎 | URL 拦截 / 文本 DLP 本地判定，宿主钩子执行 |

环境要求

| 依赖 | 版本 / 说明 | | --- | --- | | 运行环境 | DSH Desktop（任意支持插件的版本）或原版 DSH CLI | | Node.js | 仅从源码构建时需要 ^22.19.0 / >=24.0.0；npm 安装无需单独准备 | | npm 依赖 | 零依赖 — 构建脚本与运行时都不装任何包 | | 插件权限 | fs:read / fs:write / net:loopback（仅访问本机回环地址） |

从源码构建（开发者）

git clone https://github.com/mafeis/dsh-enterprise.git
cd dsh-enterprise
node build.mjs                        # 构建 → lib/
dsh plugin --profile ent add file:./
node --test "test/*.test.mjs"         # 单元测试
node test/test-enforce.mjs            # 插件管控端到端冒烟

文档

| 文档 | 内容 | | --- | --- | | 客户端插件核心文档 | 模块结构、登录链路、心跳保活、策略管控、规则引擎、排错 |

🇬🇧 English

What problem does it solve

On user machines running DSH, models must be configured by hand: enter the endpoint, paste the key, pick a default model — one typo and nothing works, and every password change means reconfiguring every machine. Admins have no leverage over terminals either: enforcing sign-in, disabling a plugin, or blocking sensitive content from leaving are all impossible.

Install this plugin into the user's DSH terminal and all of it just works:

• One sign-in, everything configured — credentials are exchanged for an enterprise token; model list, default model and credentials are written automatically. Broken config? One-click repair in the settings panel
• Terminals stay in sync — sign-in, repair and startup reconciliation keep the terminal's model list aligned with the enterprise catalog
• Policy delivered automatically — server-side policies (heartbeat, plugin governance, content rules) take effect on the terminal, with staged rollout and acknowledgements
• Plugin governance — plugins outside the enterprise allowlist are cleaned up on startup; an enterprise marketplace provides a single install source
• No sign-in, no usage — mandatory sign-in can be enforced
• Sensitive content blocking — URL interception and text DLP rules run locally, with hit records

Installation

Enterprise rollout: gateway setup page

The plugin is not installed standalone — it is the enterprise client and requires dsh-enterprise-gateway. The admin only sends users one URL:

http://<gateway-ip>:8899/

Opening it in a browser detects the OS automatically and walks the user through copying one command — the command carries the gateway address by itself and lands on the sign-in page. No parameters to assemble, works on intranets (scripts are served by the gateway itself).

1. Install DSH Desktop, launch once, quit
2. In PowerShell:

npm i -g pnpm
cd $env:USERPROFILE\.dsh\profiles\desktop
pnpm add dsh-enterprise

3. Add "dsh-enterprise" to dsh.profile.bundles in package.json
4. Start DSH Desktop, sign in at /plugins/enterprise

Stock DSH (CLI, any OS)

dsh plugin --profile ent add dsh-enterprise

Sign in at /plugins/enterprise in the web UI. Optional, prefill the gateway URL:

mkdir -p ~/.dsh/enterprise && echo "http://<gateway-ip>:8899" > ~/.dsh/enterprise/gateway-url.txt

Enterprise rollout: send users the gateway setup page URL (http://<gateway-ip>:8899/) — they follow the on-screen steps and finish with one command. Plugin governance is centralized in the gateway's plugin repo.

Features

| Feature | Description | | --- | --- | | Enterprise sign-in | Built-in login page; model config and credentials written automatically | | One-click repair | Rebuilds provider / models / credentials when config goes wrong | | Policy heartbeat | Periodic device report and token renewal; local cache keeps things running offline | | Staged rollout | Fetch → cache → ack, so admins can see rollout progress | | Plugin governance | Non-allowlisted plugins removed on startup; enterprise marketplace installs | | Rules engine | Local URL / text DLP evaluation, enforced via host hooks |

Requirements

| Dependency | Version / Notes | | --- | --- | | Runtime | DSH Desktop (any plugin-capable version) or stock DSH CLI | | Node.js | Only needed when building from source: ^22.19.0 / >=24.0.0; the npm install needs no extra setup | | npm packages | Zero dependencies — neither build script nor runtime installs anything | | Plugin permissions | fs:read / fs:write / net:loopback (loopback only) |

Build from source (developers)

git clone https://github.com/mafeis/dsh-enterprise.git
cd dsh-enterprise
node build.mjs                        # Build → lib/
dsh plugin --profile ent add file:./
node --test "test/*.test.mjs"         # Unit tests
node test/test-enforce.mjs            # End-to-end smoke test

Documentation

| Document | Contents | | --- | --- | | Client plugin core docs | Module layout, sign-in flow, heartbeat, policy governance, rules engine, troubleshooting (Chinese) |

🔗 Related / 相关项目

• dsh-enterprise-gateway — 企业网关服务端 · Enterprise gateway server (this plugin pairs with it · 插件与之配对使用)

🤝 友情链接 / Friend Links

收录 DSH 生态相关项目。

| 项目 | 简介 | 链接 | | --- | --- | --- | | DSH Desktop | 基于 DeepSeek Harness 构建的开源桌面客户端，推荐作为本插件的运行环境。 | GitHub · 官网 | | DeepSeek Harness | DSH 官方上游：核心智能体、插件系统与 Web UI。 | GitHub · DeepSeek 官网 |

🙏 致谢 / Acknowledgements

• 插件能力来自 DeepSeek Harness 的插件体系与运行时
• 推荐使用 DSH Desktop 运行本插件，获得开箱即用的桌面体验

Built on the DeepSeek Harness plugin system and runtime. DSH Desktop is the recommended way to run this plugin. Thanks to the upstream open-source projects.

📄 License

DSH 企业版社区许可 · DSH Enterprise Community License v1.0（源码开放）

• 个人及 ≤30 人的机构 — 免费使用、修改、内部部署 · Free for individuals and organizations of ≤30 people
• >30 人的机构 — 需商业授权 · Commercial license required: [email protected]