ChatCode CLI Market logo
ChatCode CLI Plugin Market
English | 中文
The plugin market for ChatCode CLI. Open Settings → Plugin Market → browse, search, one-click install.
ChatCode CLI Plugin Market
One-click themes: install, switch live, no restart.
Install
chatcode-cli plugin --profile web add @chatcode/cco-market
Restart chatcode-cli web, then open Settings → Plugin Market.
The same package also provides Settings → Skill Market in Web and /skill-market in the TUI. A project install goes to the nearest Git repository's .chatcode-cli/skills/<name> directory; a user install goes to $CHATCODE_CLI_HOME/skills/<name> (or ~/.chatcode-cli/skills/<name> when CHATCODE_CLI_HOME is unset). Web defaults to the selected session's project and lets you choose another directory through the host's native chooser or in-page browser. The server resolves the final Git root, and project installation confirms the actual destination. Personal installation and management need no active session. The TUI uses its current channel workspace.
The Web Installed tab lists skills in the selected project and personal directory independently of the remote catalog, so offline or delisted skills remain manageable. Each copy shows its location, path and recorded version. Market-owned copies can be uninstalled separately after confirmation; manually installed skills are read-only in the market. Removal checks matching .skill-market.json ownership and refuses symbolic-link roots or targets. Mutations of the same skill directory are serialized within the market runtime. Uninstalling one copy retains copies elsewhere and instructions already recorded in conversation history; another same-named skill may become available to the agent. This tab does not enumerate other projects or skills supplied by other providers.
Skill archives are size-capped, reject path traversal and symbolic links, require exactly one valid SKILL.md, and never replace a same-named skill without matching .skill-market.json ownership metadata. The public catalog base URL and archive limits can be changed under config.skillMarket.
config.skillMarket.projectPickerTimeoutMs limits a native chooser request (default 120 seconds); directory browsing uses requestTimeoutMs (default 15 seconds). Closing the picker or unloading the plugin cancels pending chooser work.
Requires ChatCode CLI 0.1.0-rc.6 or newer. On an older host the market
disables itself and says so in the browser console rather than rendering
against primitives that are not there — if the Plugin Market entry never
appears, that is usually why. Worth checking when a desktop build bundles
its own host package: it may be older than the one npm would give you (#139).
What you get
-
Browse & search the full community catalog (2300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
-
Skill Market — browse and install Agent skills from Web or /skill-market without another plugin; Web includes a project chooser and an Installed tab with separate project/personal removal
-
Host-aware discovery — cards show the DSH requirement declared by engines.dsh or lockstep @deepseek-ai/dsh-* peers; an opt-in filter hides only confirmed mismatches with the running host. Undeclared, malformed, unavailable, and GitHub-only entries remain visible rather than being guessed incompatible
-
Screenshots — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
-
Comments — every card opens the plugin's discussion thread in place. It is the same thread its pages on dshmarket.com and the catalog show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. In ChatCode CLI Web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session
-
Favorites — bookmark plugins and themes from Discover or the Themes tab; a dedicated Favorites tab lists them with search, sort, and install actions. Bookmarks persist in the profile's market state (state.json); entries that leave the catalog can be cleared in one click
-
Themes — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
-
One-click install — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
-
Backup & restore — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores (plugins installed after the backup are kept), validate before writing, and roll back on failure
Speed
Installs prefer repo-verified npm packages, then author-supplied prebuilt GitHub Release tarballs, before falling back to full-repo GitHub source downloads. Prebuilt installs are typically seconds and do not need local build scripts; source-only plugins depend on your connection to GitHub.
Security
-
Installs are restricted to sources listed in the curated awesome-dsh-plugin registry — anything else is rejected
-
Build scripts stay blocked by default (pnpm ≥10); allowing one is your explicit per-package choice
-
Terminal/CLI-surface plugins are flagged before you install them into the web profile
-
The install endpoint accepts same-origin POST only; the market never phones home
-
Web skill installation, removal and directory picking require same-origin POST requests. The server validates the selected project, computes skill destinations itself, and validates downloaded ZIPs before writing a skill root
-
Backups can contain credentials from your profile config — the UI warns before export and upload; WebDAV sync is https-only, refuses private-network targets, and never stores your password in the browser
-
Authenticated Gist requests always go directly to api.github.com; bearer tokens are never sent to a public GitHub acceleration service. GitHub source archives also stay on canonical codeload URLs so pnpm's integrity policy remains in force
-
The restart endpoint additionally requires a direct loopback client (forwarded requests are rejected) and relaunches the exact ChatCode CLI entry, arguments, environment, and working directory
-
One-click restart launches a detached replacement. When this host is systemd's own service process the button is hidden automatically — the market would otherwise kill the takeover process along with the unit's cgroup and the service would not come back. The pending-change notice stays visible and says so. Detection requires both a systemd marker AND being the unit's main process, because INVOCATION_ID is inherited by every descendant of a unit (an ordinary terminal included) and hiding the button for those would be the worse bug. pm2 and launchd are not detected, so those deployments need the explicit setting below. Either flip Allow restart off in Settings → Plugins → Plugin configuration, or write it into the profile patch — where it has to sit under config:, because the loader passes only that sub-object to a plugin and a top-level allowRestart: is silently ignored (#227 by @Fantasymax):
- id: dsh-market
name: dshmarket
config:
allowRestart: false # NOT at the top level beside `name:`
GET /dsh-market/status reports "restart": false once it has taken effect.
-
For terminal-attached launches, the detached replacement keeps running after the original terminal closes
Submit your plugin
This repo is the market app, not the catalog. The plugin list comes from the curated awesome-dsh-plugin registry — to get your plugin listed in the market, open a PR there (one entry in the list; the site and this market pick it up automatically, usually within a day). Please don't PR plugin entries against this repo.
Roadmap & feedback
- Bugs go in issues — attaching the market's "Export log" makes diagnosis roughly ten times faster
- Feature ideas go on the Roadmap. Issues are kept for things that are broken, so a proposal filed as an issue gets moved there and closed; the discussion stays where you wrote it either way
- Every roadmap item welcomes community PRs — say so on the item before starting, so two people don't build it twice
Data source
Fetched live on every open from awesome-dsh-plugin.com/plugins.json — curated entries, npm mapping, and star counts refreshed daily by CI, with no stale cache behind it. A failure reports the actual reason and elapsed time, with a Retry button.
There is deliberately no bundled snapshot to fall back on: for a catalog that grows daily, a stale answer is not a degraded one but a wrong one — a plugin published this morning would read as "does not exist".
If that host is unreachable from your network, point the market at a mirror instead. Set CHATCODE_CLI_MARKET_REGISTRY_URL in the ChatCode CLI environment to anything serving the same plugins.json shape (legacy DSHM_REGISTRY_URL remains accepted):
CHATCODE_CLI_MARKET_REGISTRY_URL=https://your-mirror.example/plugins.json chatcode-cli web
Friends
DSH Desktop (dataelement)
dsh-desktop — a desktop app for DeepSeek Harness: run and manage a local Harness without installing Node.js yourself. Ships with this plugin market preset as the default. dshdesktop.com
DeepSeek Harness Desktop (hairyf)
deepseek-harness-desktop — a native desktop app for DeepSeek Harness built with Tauri (Rust + Web): one-click local install and launch with no Node.js setup required. On first run it offers to install this plugin market as a recommended preset.
DeepSeek Harness Desktop (anywhere-labs)
deepseek-harness-desktop — an Electron desktop app for DeepSeek Harness built around the idea that everything is a plugin, including the desktop itself: profile switching, a bundled Node and pnpm, and a recoverable install path that snapshots the profile before a change. dshdesktop.cn
DSH App
dsh-app — a DeepSeek Harness desktop client built on Tauri 2 rather than Electron, so it ships a much smaller binary and uses the system webview. AGPL-3.0.
Local DSH
local-dsh — a DeepSeek Harness desktop client that can run the model on your own machine: it bundles llama.cpp next to Node, pnpm and DSH, so a downloaded GGUF model answers without any external API. Built on Tauri; Apple Silicon Macs for now. localdsh.com
DSH Get
DSH Get — a searchable web directory for discovering DeepSeek Harness plugins: category filters, bilingual descriptions, install commands and per-plugin detail pages. Its normalized catalog snapshot is public at bobby-sheng/dshget-data.
modlens
modlens — the first vision plugin for DeepSeek Harness: bolts visual understanding onto text-only models like DeepSeek and GLM. Paste an image, get structured JSON evidence back — OCR, layout, semantics. Available right in this market:
chatcode-cli plugin --profile web add @liustack/modlens
License
MIT · dshmarket.com
