dshmarketplace-plugin
在 DSH 中浏览和安装 DeepSeek Harness 插件，支持英文或中文。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dshmarketplace-plugin@0.3.1Marketplace Plugin 以 dshmarketplace-plugin 发布，当前版本为 0.3.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
DSH Marketplace — install DeepSeek Harness plugins without leaving DSH
English · 简体中文
Browse and install DeepSeek Harness plugins from inside DSH, in English or Chinese. Backed by DSH Marketplace, which writes a page per plugin rather than linking straight out to GitHub.
The npm package is
dshmarketplace-plugin; this repository isdsh-plugins-store. The names differ because the shorter one was taken.
Supports DSH 0.1 and 0.2 (0.2.0-rc.2 through 0.2.2-alpha.2 checked by booting it).
dsh plugin --profile web add dshmarketplace-plugin
Then /store in any session, or Settings → Built-in plugins → Plugin marketplace.
On DSH 0.2.1-rc.2 or later the next start also puts the DSH Marketplace index
in Plugins → Discover — see below.
--profile is not optional. dsh plugin forwards to pnpm inside a profile
directory, so dsh plugin add x exits with required option '--profile
<name>' not specified and installs nothing. Swap web for your profile if
you run another one.
/store | Opens the catalogue over the session — search by capability, see what each plugin reaches, install without leaving the harness. |
| Install-tested only | Every plugin offered here already installed cleanly in a throwaway sandbox. Anything that failed, needs a manual build-script approval, or was never tested stays off the shelf — the full catalogue, verdicts included, is on dshmarketplace.dev. |
| Settings tab | The same catalogue, docked under Settings → Plugins. |
| Agent tools | dshmarketplace_search and dshmarketplace_install, so "find me a memory plugin and set it up" works in conversation. |
| Bundled skill | Teaches the agent to search rather than recall a plugin name from training data — for an ecosystem this young, a remembered name is usually wrong. |
| Bilingual | Every listing carries a hand-written English and Chinese description. The plugin follows your DSH language setting, live. |
| Discover tab | On DSH 0.2.1-rc.2+, adds our plugin index to Plugins → Discover. Every entry is a release our sandbox installed, labelled with the dsh version it installed on (and, once checked, whether the next next / alpha release accepts it), sortable by recommended, stars this week, stars and installs. |
DSH 0.2.1-rc.2 added an experimental Custom plugin indexes bundle (Plugins →
Experimental plugins) that browses third-party indexes in a Discover tab.
Once per profile, the plugin switches that bundle on and appends
https://dshmarketplace.dev/market/index.json after any sources you already
have. It never adds the source twice and never touches your other sources. If
you switch the bundle off or remove the source, it stays that way — run
/store-index to put both back. On a DSH without the bundle (0.2.0 and 0.1),
nothing happens and /store-index says why.
Plugins run with your agent's permissions, and a listing is not a security review. Three things this plugin does about that.
Install commands are validated, never interpolated. The catalogue supplies a
command already built; src/installer.js accepts only a bare npm specifier or
github:owner/repo, refuses anything containing .., and passes arguments as an
array rather than through a shell. If the catalogue were ever compromised, the
blast radius stops there. tests/installer.test.js covers that boundary
specifically — writing it found a real hole, since ../../etc/passwd is only
word characters, dots and slashes.
The browser half cannot reach the shell. It talks to two exact-path local endpoints, and the install endpoint takes a catalogue entry rather than a command, so the client cannot widen what runs.
Risk flags gate both paths. Listings carry detected install script,
terminal surface and requires credentials flags. Anything flagged stops for
an explicit confirmation, in the UI and on the agent path alike — and the
confirmation says plainly that an empty list would not have meant it was safe.
The plugin sends exactly one thing anywhere: after a successful install, the
plugin's public identifier, so install counts are real. No machine id, no
session id, no user, no query, no telemetry of any other kind. Searches go to
the public catalogue API in order to answer them and carry no identifiers.
The Discover index is fetched by DSH itself, not by this plugin; the plugin
only keeps a small marker, .dshmarketplace-plugin.json, in the profile
directory so it adds the source once.
DSHM_NO_TELEMETRY=1 # disables the install count entirely
DSHM_API=https://… # point at a different catalogue
npm install
npm test # the install-command boundary, and catalogue helpers
npm run build # esbuild → lib/index.js (node) and lib/client.js (browser)
The browser bundle may only require react and
@deepseek-ai/dsh-client-ui-primitives, and must announce itself through
window.__ModuleLoader__.load. build.mjs enforces both against the emitted
code before writing it, so an unsupported import fails here instead of inside
someone else's harness.
dshmarketplace-cli —
the same catalogue for coding agents outside DSHGET /api/v1/plugins — the public API all three readMIT. Independent project, not affiliated with DeepSeek. DeepSeek and DeepSeek Harness are marks of their respective owner, used here only to describe what this plugin is for.