dsh-plugin-repo

Self-hosted plugin repository for DeepSeek Harness — a pure Cordis plugin (no changes to @deepseek-ai/* packages).

Each device runs its own repo over HTTP: list / upload / download .tgz, detect non-official plugins, install with version checks, and pull or push packages across devices. Official @deepseek-ai/* plugins are never listed or modified.

Install

# from npm
dsh plugin --profile web add dsh-plugin-repo

# or from a release tarball
dsh plugin --profile web add ./dsh-plugin-repo-1.7.0.tgz

Restart DSH, then open Settings → 插件仓库. Prefer a hard refresh (Ctrl+Shift+R) after upgrades.

Settings UI (v1.8)

| Tab | Purpose | | --- | --- | | 本机 | Local .tgz repo + installed plugins (dual pane) | | 跨设备同步 | Connect to another DSH; pull → local or push → remote | | 高级 | Extra search roots for discovering plugins |

Installed plugins (v1.7+):

• 启用 / 关闭 — toggles dsh.profile.bundles without removing dependencies (restart required)
• 删除 — uninstall from web profile when plugin is disabled (pnpm remove / dsh plugin remove)
• 从 npm 安装 — pnpm add / dsh plugin add into web profile
• DSH 版本适配 — reads peerDependencies and compares with running @deepseek-ai/dsh

Cross-device sync uses a dual pane (local | remote). Badges show concrete versions (本机 1.5.2 > 对方 1.5.0). Use 选需推送 / 选需拉取 to select only packages that differ (including version unknown → default push). Push confirms warn on downgrade; equal packages show as already synced. 最近推送 records persist under repoDir/push-history.json across restarts and explain whether remote was already unknown vs push stripped the version.

Cross-device access (v1.8+)

Cross-device requests are issued by the local DSH server (not the browser). This plugin does not embed login credentials.

When the remote device uses dsh-local-hanaccount:

1. Recommended: pair devices in Settings → 访问控制 → 对等设备 on both sides. Outbound fetch from DSH will automatically attach the peer Bearer token.
2. Single-side hc: on the device with hc, add /pluginrepo to 显式暴露 (exclude) so LAN peers can sync without pairing.

Plain LAN http://ip:3080 without hc continues to work. On HTTP 401/403 the UI points to hc pairing or explicit expose — not HTTP Basic in this plugin.

Repository storage

Default under the configured repoDir (often ~/.dsh/plugin-repo or a custom path):

• packages/<name>.tgz — non-official packages
• index.json — metadata (name, version, filename, size, uploadedAt)

HTTP API (on the DSH web port, e.g. http://127.0.0.1:3080)

| Method | Path | Description | | --- | --- | --- | | GET | /pluginrepo | HTML landing | | GET | /pluginrepo/api/packages | List repo packages | | GET | /pluginrepo/api/unofficial | Installed + repo non-official plugins | | POST | /pluginrepo/api/upload | Upload .tgz (raw body; ?name= optional) | | GET | /pluginrepo/download/<file>.tgz | Download | | GET/POST | /pluginrepo/api/remote | List another device’s packages (POST body: host, optional port) | | POST | /pluginrepo/api/remote-pull | Pull from another device into this repo | | POST | /pluginrepo/api/remote-push | Push local-repo .tgz to another device | | POST | /pluginrepo/api/install | Plan / confirm install into local profile | | POST | /pluginrepo/api/profile/enable | Enable plugin in dsh.profile.bundles | | POST | /pluginrepo/api/profile/disable | Disable plugin (remove from bundles) | | POST | /pluginrepo/api/profile/uninstall | Uninstall disabled plugin from profile | | POST | /pluginrepo/api/npm-add | Install from npm registry (spec, confirm) | | DELETE | /pluginrepo/api/packages/<key> | Delete a repo package |

Remote address parse order: scheme → host → port. Bare host → http + port 3080; https:// → port 443; explicit :port wins. Userinfo in URLs is stripped and ignored.

Model tools

• repo_list / repo_unofficial / repo_push / repo_pull / repo_delete
• repo_remote / repo_remote_pull / repo_remote_push
• repo_install (requires installConfirm=true to apply)

Configuration

Optional plugin config:

• repoDir — absolute repository directory
• logLevel — silent | info

Note: Use schemastery-style config (fields optional by default). Do not call zod’s .optional() on schemastery schemas.

License

MIT