bradeGithub/DSH-Plugins-Marketplace
GitHub-topic-driven plugin & skill marketplace: a Settings page that browses the auto-collected registry (the whole dsh-plugin topic plus the skills index, CI-refreshed every 2 hours) with one-click install, type detection, install-script and host-shadow-dependency safety confirmations, env-key management, and the STANDARD.md recognition spec.
Install
via GitHub · GitHub source
Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/web/pnpm-workspace.yaml.
What happened when we ran it
Installed cleanly when we ran it
Every command here is run in a throwaway container against a clean profile, and the result is whatever the harness recorded — not a guess from the source. Last run 6d ago.
Show it in your README
For maintainers: the badge serves this listing's latest sandbox verdict, so a re-run updates it on its own — and it links readers to the full result here.
Due diligence
DSH-Plugins-Marketplace is a DeepSeek Harness plugin that provides a Web GUI catalogue for GitHub-hosted DSH plugins and general skills. It reads a CI-generated registry.json index, served through jsDelivr with a raw.githubusercontent.com fallback, and uses GitHub Search API only if both index sources fail. GitHub Actions refreshes the index every two hours by scanning the dsh-plugin topic; installation still clones repositories directly from GitHub.
From Settings, the marketplace identifies SKILL.md repositories, agent presets containing preset.yml and agent.cordis.yml, Cordis plugins containing package.json, and repositories with install.sh or install.ps1. It can install skills under ~/.dsh/skills/, presets under ~/.dsh/.agent-presets/, and Cordis plugins in the Web profile. It records installation state, compares versions, and requests confirmation before running third-party installers or npm lifecycle scripts. If a repository asks for API_KEY, TOKEN, or SECRET, the page pauses for input and passes the material as environment variables rather than storing it on disk. It also performs the documented host-shadow-dependency safety check.
This is intended for developers who want to discover and install community repositories from the DSH Web settings page instead of handling each repository manually. It is a poor choice for environments that do not use the DSH Web profile, cannot restart DSH after registration changes, or do not permit terminal commands and third-party installation scripts. The plugin reaches GitHub, the local DSH profile and marketplace clone directory, and may execute repository-provided scripts with the agent’s available permissions. DSH-Plugins-Marketplace does not provide a human-reviewed catalogue: topic tagging controls automatic inclusion.
The Web settings page loads the plugin catalogue from registry.json, distributed through jsDelivr and then raw.githubusercontent.com. If both fail, it paginates the GitHub Search API and caches that result for 10 minutes. The CI job scans the GitHub dsh-plugin topic every two hours, merges and deduplicates repository metadata, excludes deepseek-harness, and sorts the generated index by Star count. Installation is performed separately by cloning the selected repository into ~/.dsh/marketplace/.
The page checks installed state when the marketplace opens. Its documented checks use installed.json, directory heuristics, package-name mappings, the package’s repository field, and a cached clone. Cordis plugin versions are compared with locally cached information; npm-published plugins use npm dist-tags. An available newer version changes the action to 更新 / update.
| Detected repository | Target or action |
|---|---|
SKILL.md |
~/.dsh/skills/ |
preset.yml and agent.cordis.yml |
~/.dsh/.agent-presets/ |
package.json |
Install dependencies and register in the Web profile |
install.sh or install.ps1 |
Ask for confirmation, then execute the script |
When API_KEY, TOKEN, SECRET, or another required environment variable is detected, installation pauses for submitted material or an explicit skip. The material is supplied as environment variables and is not written to disk.
The plugin is registered in ~/.dsh/profiles/web/cordis.patch.yml with an entry containing id: dsh-plugin-marketplace and name: dsh-plugin-marketplace. The Web profile is documented with hmr disabled, so registration or code changes require restarting DSH with dsh web before refreshing the page. The official CLI installation, removal and update workflow uses the web profile; the marketplace itself also provides an in-page install and update action.
The documented setup expects the DSH Web profile. The CLI route requires dsh and pnpm; the repository also documents PowerShell for Windows and bash with curl for macOS and Linux when using its installer. Before running a third-party install.sh, install.ps1, or npm lifecycle script such as prepare, install, or postinstall, the page requests confirmation. Rejecting the prompt cancels the operation and cleans its traces. Host allowlisting and a CSRF header protect the HTTP surface, while environment-variable handling is minimised and isolated.
The index is metadata rather than a review system: automatic inclusion follows GitHub topic detection, and the community badge is not an endorsement. Installation still contacts GitHub directly. If the CDN and raw index are unavailable, the GitHub Search API fallback is subject to its cache and API availability.
Written from the project's own documentation and kept in sync with it. Where the two disagree, the source is authoritative — read the README on GitHub
Same category
zhu1090093659
Plugin manager tab in DSH Settings → Plugins: install from npm or git with progress, enable/disable switches effective at next startup, conflict reconciliation with undo, and one-click hand-off to a fix session.
Installed cleanly when we ran it
dsh-market
Browse, search and install community plugins from inside DeepSeek Harness settings, with category filters, one-click updates, enable/disable, theme switching and configuration backup.
Installed cleanly when we ran it
awesome-dsh-plugin
Find plugins without leaving the agent: search this curated registry by keyword or category, with ready-to-run install commands.
Installed cleanly when we ran it
kingOfSoySauce
Native skin marketplace and lifecycle manager that discovers community skins, displays previews and compatibility status, and provides verified one-click or manual installation paths.
Installed cleanly when we ran it
dshplugin
DeepSeek Harness 社区内置插件市场（dsh-plugin）— 搜索插件、下载并安装 4000+ 人工精选社区插件，每日更新、完全免费。内置在 Harness「设置 → 插件中心」，无需离开应用即可浏览、搜索、安装各类 AI 插件。
Installed cleanly when we ran it
Sanqi-normal
In-harness plugin market for the dsh web GUI: browse the awesome-dsh-plugin.com catalog and install/uninstall plugins into a profile from Settings → Plugins → Plugin Market.
Installed cleanly when we ran it
