bradeGithub/DSH-Plugins-Marketplace
GitHub-topic-driven plugin & skill marketplace: a Settings page that browses the auto-collected registry (the whole dsh-plugin topic plus the skills index, CI-refreshed every 2 hours) with one-click install, type detection, install-script and host-shadow-dependency safety confirmations, env-key management, and the STANDARD.md recognition spec.
Install
via GitHub · GitHub source
Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/web/pnpm-workspace.yaml.
What happened when we ran it
Installed cleanly when we ran it
Every command here is run in a throwaway container against a clean profile, and the result is whatever the harness recorded — not a guess from the source. Last run yesterday.
Due diligence
What it is — The DSH-Plugins-Marketplace provides a settings page in DeepSeek Harness Web GUI for browsing and installing plugins and skills from the dsh-plugin topic.
Who it is for — When using DeepSeek Harness Web GUI for plugin management, it is suitable to browse dsh-plugin topic plugins. If not using the web GUI settings page, it may not be necessary.
Watch out — Sandbox test passed: installed in new profile and registered into harness. Requires providing API key or token. No obvious pits found.
The verdict — If I were you, I would install it from source because the sandbox test passed.
Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.
DSH-Plugins-Marketplace is a DeepSeek Harness plugin that provides a Web GUI catalogue for GitHub-hosted DSH plugins and general skills. It reads a CI-generated registry.json index, served through jsDelivr with a raw.githubusercontent.com fallback, and uses GitHub Search API only if both index sources fail. GitHub Actions refreshes the index every two hours by scanning the dsh-plugin topic; installation still clones repositories directly from GitHub.
From Settings, the marketplace identifies SKILL.md repositories, agent presets containing preset.yml and agent.cordis.yml, Cordis plugins containing package.json, and repositories with install.sh or install.ps1. It can install skills under ~/.dsh/skills/, presets under ~/.dsh/.agent-presets/, and Cordis plugins in the Web profile. It records installation state, compares versions, and requests confirmation before running third-party installers or npm lifecycle scripts. If a repository asks for API_KEY, TOKEN, or SECRET, the page pauses for input and passes the material as environment variables rather than storing it on disk. It also performs the documented host-shadow-dependency safety check.
This is intended for developers who want to discover and install community repositories from the DSH Web settings page instead of handling each repository manually. It is a poor choice for environments that do not use the DSH Web profile, cannot restart DSH after registration changes, or do not permit terminal commands and third-party installation scripts. The plugin reaches GitHub, the local DSH profile and marketplace clone directory, and may execute repository-provided scripts with the agent’s available permissions. DSH-Plugins-Marketplace does not provide a human-reviewed catalogue: topic tagging controls automatic inclusion.
The Web settings page loads the plugin catalogue from registry.json, distributed through jsDelivr and then raw.githubusercontent.com. If both fail, it paginates the GitHub Search API and caches that result for 10 minutes. The CI job scans the GitHub dsh-plugin topic every two hours, merges and deduplicates repository metadata, excludes deepseek-harness, and sorts the generated index by Star count. Installation is performed separately by cloning the selected repository into ~/.dsh/marketplace/.
The page checks installed state when the marketplace opens. Its documented checks use installed.json, directory heuristics, package-name mappings, the package’s repository field, and a cached clone. Cordis plugin versions are compared with locally cached information; npm-published plugins use npm dist-tags. An available newer version changes the action to 更新 / update.
| Detected repository | Target or action |
|---|---|
SKILL.md |
~/.dsh/skills/ |
preset.yml and agent.cordis.yml |
~/.dsh/.agent-presets/ |
package.json |
Install dependencies and register in the Web profile |
install.sh or install.ps1 |
Ask for confirmation, then execute the script |
When API_KEY, TOKEN, SECRET, or another required environment variable is detected, installation pauses for submitted material or an explicit skip. The material is supplied as environment variables and is not written to disk.
The plugin is registered in ~/.dsh/profiles/web/cordis.patch.yml with an entry containing id: dsh-plugin-marketplace and name: dsh-plugin-marketplace. The Web profile is documented with hmr disabled, so registration or code changes require restarting DSH with dsh web before refreshing the page. The official CLI installation, removal and update workflow uses the web profile; the marketplace itself also provides an in-page install and update action.
The documented setup expects the DSH Web profile. The CLI route requires dsh and pnpm; the repository also documents PowerShell for Windows and bash with curl for macOS and Linux when using its installer. Before running a third-party install.sh, install.ps1, or npm lifecycle script such as prepare, install, or postinstall, the page requests confirmation. Rejecting the prompt cancels the operation and cleans its traces. Host allowlisting and a CSRF header protect the HTTP surface, while environment-variable handling is minimised and isolated.
The index is metadata rather than a review system: automatic inclusion follows GitHub topic detection, and the community badge is not an endorsement. Installation still contacts GitHub directly. If the CDN and raw index are unavailable, the GitHub Search API fallback is subject to its cache and API availability.
Written from the project's own documentation and kept in sync with it. Where the two disagree, the source is authoritative — read the README on GitHub
Same category
dsh-market
(Recommended) The plugin market inside DSH: a Settings page to browse and search the full community catalog by category, with confirmed one-click installs and an installed-plugins view.
Installed cleanly when we ran it
Sanqi-normal
In-harness plugin market for the dsh web GUI: browse the awesome-dsh-plugin.com catalog and install/uninstall plugins into a profile from Settings → Plugins → Plugin Market.
Installed cleanly when we ran it
mishibeikejie
Visual plugin marketplace for DeepSeek Harness — browse, search and install community plugins
Installed cleanly when we ran it
ZASENJC
自动分类、收录和验证 DeepSeek-Harness 社区插件的市场。 Automatically categorize, curate, and validate the DeepSeek-Harness community plugin marketplace.
Installed cleanly when we ran it
Noob-stupid
A plugin management panel: one-click enable/disable for installed plugins plus a GitHub dsh-plugin marketplace with details and one-click installs.
Installed cleanly when we ran it
whyihaveyou
In-app plugin store for the DSH Web UI: browse, search, one-click install, compat badges.
No one-line install — this plugin lives inside a larger repository and publishes no npm package.
