dsh-plugin-marketplace: A Verified Plugin Marketplace and Central Registry for DeepSeek Harness
yelebai/dsh-plugin-marketplace
Verified plugin marketplace and autonomous registry for DeepSeek Harness, enabling secure install, update, and diagnostics.
Provides verified plugin discovery and secure installation for DeepSeek Harness, addressing the trust issue of plugin sources.
dsh plugin --profile web add github:yelebai/dsh-plugin-marketplace- Category
- Development & Operations
- Platform
- DSH-Plugin
- Author
- yelebai
- Distribution
- Plugin
dsh-plugin-marketplace Key Features
dsh-plugin-marketplace Repository
dsh-plugin-marketplace Repo Summary
dsh-plugin-marketplace is a plugin marketplace and self-maintained central Registry plugin (DSH plugin) for DeepSeek Harness, maintained by YELEBAI under the MIT license, last updated in 2026-08. It solves the security problem of DSH plugin discovery and installation: the marketplace does not directly display all repositories under the GitHub dsh-plugin topic; only plugins that have been verified by the scanner and written into the central Registry will appear. Core capabilities include automatic scanning every two hours, Registry verification (checking manifest, bundle patch, loader entry, build artifacts, and exact installation source), one-click installation, Agent installation, manual command installation, installation management, plugin discovery (categorization, search, star sorting, and 7-day growth trends), and marketplace self-update.
What installation modes does the dsh-plugin-marketplace DSH plugin support?
The marketplace supports four installation modes: one-click installation (when an exact GitHub commit or npm version passes all checks, it is handed directly to the official DSH plugin command), manual command installation (the user provides an official DSH GitHub install command, which is parsed and locked to a commit after verification), Agent installation (when build authorization, lifecycle scripts, or further verification are needed, a DSH Agent session bound to Registry evidence is created), and view instructions (when the current profile is incompatible or identity cannot be confirmed, only the author's install instructions are opened). Automatic installation always uses Registry-verified exact commits or npm versions, never passing mutable main, latest, or Release download URLs directly to the package manager.
How do I install and start dsh-plugin-marketplace?
Use the following install command with the --profile web profile:
dsh plugin --profile web add github:YELEBAI/dsh-plugin-marketplace#v0.9.1
For local development, you can specify a path:
dsh plugin --profile web add D:/path/to/dsh_Market
After starting DSH, go to Settings → Plugins → Plugin Marketplace. The marketplace includes three sub-pages: Plugin Marketplace (search, categorize, sort, view verification info, and install), Installed Plugins (filter, check updates, update, uninstall, enable/disable), and Management & Diagnostics (manual command install, choose install location, conflict diagnostics).
How does dsh-plugin-marketplace ensure safety during Agent installation?
Agent installation pins the Registry-verified repository, package name, version, and unique commit, and loads the built-in install-dsh-plugin Skill. The Skill prioritizes the fastest safe path: if complete build artifacts exist, it uses the exact commit and disables scripts; if artifacts are missing, it builds in an isolated temporary directory; if the Release tarball lacks a trusted digest, package identity mismatches, or conflicts arise, it stops immediately. Before executing third-party code, the DSH native approval layer requests confirmation item by item; the marketplace never authorizes on the user's behalf. Updates preserve existing configuration, bundle order, and enable/disable state, and keep the old exact source for rollback.
What operations are available for managing installed plugins in dsh-plugin-marketplace?
The Installed Plugins page supports updating (checking for new versions against the Registry), enabling/disabling (modifying dsh.profile.bundles, without removing dependencies, effective after restart), uninstalling (removing plugin dependencies and bundles), and restarting DSH (waiting for running plugin tasks to finish, then restarting with the same parameters). Marketplace self-update reads the main branch version of this repository and pins the installation source to an exact commit. The npm package includes built lib/ and a Registry snapshot at publish time, so the marketplace can still use the in-package snapshot when the remote Registry is temporarily unavailable.
How does dsh-plugin-marketplace handle installation location and conflict diagnostics?
By default, plugin entities are installed directly by pnpm into the current profile's node_modules, and all pnpm tasks reuse the profile's bound store to avoid ERR_PNPM_UNEXPECTED_STORE. The Management & Diagnostics page provides an installation location panel where you can choose the Agent workspace (default $DSH_HOME/marketplace/agent-workspace) and run conflict diagnostics to ensure plugin installation does not pollute the project workspace.