dsh-advanced-settings

A searchable, Visual Studio Code-style settings page inside the Harness Settings panel, generated from every live plugin's Cordis Config schema.

Features

• One row per Config leaf field, grouped by plugin, with a search box that matches plugin names, field paths and labels, plus a "modified only" filter.
• Volatile fields save immediately through ctx.settings.mutate (revision-guarded, no plugin reload). Counters, caps, providers and other live-tunable values apply on the spot.
• Ordinary fields ask first: the row's Apply opens a confirmation listing the plugin about to reload; the write goes through ctx.configEditor.edit and is rolled back by the runtime if it fails.
• Secrets stay on the Host. Schema role('secret') fields and credential-looking names (apiKey, token, password, …) are stripped server-side; the page only shows a masked set / not set marker. Names ending in Env are variable names, not values, so they stay visible.
• Complex schemas degrade gracefully: nested objects flatten into rows (deeper than four levels becomes a JSON row), enums use a DSH dropdown, primitive arrays use chips, object/map/union values open a JSON editor.
• JSON editing uses CodeMirror 6 with the official @codemirror/theme-one-dark on dark pages and CodeMirror's built-in light theme otherwise, plus JSON linting. A Edit as text action opens the profile's configuration document for anything the forms cannot express.
• Local-only writes: the Host API accepts writes from loopback clients (or a loopback browser origin) only, and never returns a secret value.

Install

With the DSH Plugin Manager

Install the npm package as a bundle in the active profile:

plugin_manager install_bundle  →  dsh-advanced-settings

Then open Settings → Advanced settings. The page registers as a settings.section with id advanced-settings, order 40.

From a local checkout

plugin_manager install_bundle  →  /absolute/path/to/dsh-plugins/advanced-settings

Page layout

The Settings panel is a centered 800 px modal whose left navigation belongs to the shell, so this section renders inside the ~564 px content column:

• toolbar: search, Modified filter, expand/collapse all, refresh, Edit as text
• grouped rows: label, path breadcrumb, tags (Modified, Reload, Secret, Expression, Disabled), a type-appropriate control, reset and copy-path actions
• per-plugin JSON view (read-only, redacted) and a confirmation dialog before any reload-triggering write

Plugins that ship their own settings page opt out with configure({ auto: false }, ctx.fiber) and are skipped; unloaded entries are not listed.

Security model

• Read responses are redacted server-side; secret values never cross the wire.
• Writes are accepted only from a loopback socket or a loopback Origin.
• The Host half uses only public DSH services (configEditor, settings, webServer); no profile files are written by hand.

Development

The client half is a bundled artifact. client.src.js is the readable source; client.js inlines CodeMirror and is what the browser loads.

npm install        # devDependencies only: CodeMirror packages + esbuild
npm run build      # regenerates client.js from client.src.js

The Client module resolves react and @deepseek-ai/dsh-client-ui-primitives from the page's module table via require; only CodeMirror is bundled.

Compatibility

Tested against DSH 0.2.2-alpha.2 (Cordis 4.0.6-alpha.1) on the Web profile.

License

MIT © 2026 Genius Alray