mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00

Files

imccyu 825a63ab01 feat(sdk): add dsh-plugin-fetch source + fetcher seam

Greenfield #2 "建插件" modules for the forthcoming `dsh-sdk create <source>`
command, in a new foundation-independent package so it touches none of the
dsh-scripts / dsh-helper / create-sdk hotspots the foundation refactor edits.

- `resolvePluginSource(spec)` parses `owner/repo[/subdir]#ref` (github) or
  `pkg@version` (npm) into a `PluginSource` discriminated union, failing loud on
  an ambiguous or malformed spec.
- `PluginFetcher<S>` seam + `fetchPlugin` tag dispatch returning a common
  `FetchedPlugin` (temp dir + immutable provenance).
- `GigetFetcher` (github) over @bluwy/giget-core: resolve `#ref` to a commit SHA
  first, download that SHA; provenance pins the SHA. Chosen over unjs/giget for
  its single runtime dep and absent install/action surface.
- `PacoteFetcher` (npm) over pacote: resolve the manifest, then extract the
  tarball verified against its registry integrity. Registry-only is enforced by
  the source resolver; extract runs no lifecycle scripts.
- Branded `CommitSha`/`Integrity`; network + temp-dir boundaries are injected so
  the logic is unit-tested at 100% per-file coverage without network.

Wiring (package.json pin, cordis.yml via ProjectEditSession with a confirmed
diff, install --ignore-scripts) and the launcher command registration land
later with the foundation.

2026-07-18 16:08:12 +08:00

1.3 KiB

Raw Blame History

SDK packages

Developer tooling for creating, editing, building, and running DeepSeek Harness projects.

The feature RFC owns the developer workflow; the architecture RFC owns the package and project-editing boundaries.

Package	Role
`helper`	Project aggregate, edit session, builtin features, project documents, templates, package managers, and prompt abstraction
`scripts`	The `dsh-sdk` launcher: `start`, `dev`, `build`, and interactive `config`
`create-sdk`	The `npm create @deepseek-ai/sdk` initializer
`plugin-fetch`	Fetch an external plugin (github/npm) into a temp dir — pinned and un-executed — for `dsh-sdk create`

@deepseek-ai/create-sdk is the one package-name exception to the repository's @deepseek-ai/dsh-* rule: npm's scoped initializer convention requires that name for npm create @deepseek-ai/sdk.

Generated projects keep cordis.yml as the only runtime plugin tree. dsh-sdk dev adds TypeScript and local-workspace resolution around that same file; it does not create a development-only config.

1.3 KiB Raw Blame History

SDK packages

1.3 KiB

Raw Blame History