@nanmicoder/dsh-plugin-market
DeepSeek Harness 的已验证插件市场：通过 Web UI 发现、检查、安装和移除 DSH 插件
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @nanmicoder/dsh-plugin-market@0.2.0Plugin Market 以 @nanmicoder/dsh-plugin-market 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English · 简体中文
dsh-plugin-market turns discovered DSH repositories into a verified catalog with safe install specs
dsh-plugin-market adds a plugin marketplace to DeepSeek Harness. Browse a continuously curated catalog inside Settings → Plugin Marketplace, inspect the evidence behind each entry, and install or remove verified plugins without leaving the Web UI.
The catalog is deliberately conservative: deterministic rules decide whether an artifact is installable; model-generated summaries and tags are display-only and never authorize an install.
Open the interactive WebUI preview to search the real catalog slice, inspect evidence, and test the responsive product flow without executing an installation.
The repository snapshot generated on 2026-08-15 contains:
| Catalog entries | One-click installable | Verified on npm | Verified from source |
|---|---|---|---|
| 3,518 | 936 | 716 | 220 |
Every one-click action executes a normalized package spec from the catalog—not a shell command copied from a repository README.
| Capability | What it changes |
|---|---|
| Verified install paths | npm manifests, DSH bundle metadata, patch files, and build readiness are checked before an entry becomes installable. |
| Long-tail discovery | Search repository names, packages, categories, author topics, and controlled catalog tags instead of relying on stars alone. |
| Explainable results | Repository description, model summary, topics, metrics, license, release data, and install evidence stay visibly separate. |
| Safe-by-construction installs | The browser sends only a catalog ID; the host resolves and validates the exact npm or GitHub spec before invoking pnpm. |
| Immediate runtime feedback | Host-only plugins hot-mount after install; plugins with a Web UI need only a page refresh. |
[!NOTE] Requires an existing DeepSeek Harness installation.
dsh plugin --profile web add @nanmicoder/dsh-plugin-market
Validate the composed profile, restart DSH, and open the Web UI:
dsh --profile web --dump-config
dsh web
Then open Settings → Plugin Marketplace.
git clone https://github.com/NanmiCoder/dsh-plugin-market.git
cd dsh-plugin-market
pnpm install
pnpm build
dsh plugin --profile web add .
Run pnpm build again after changing the source. The local plugin install remains linked to this checkout.
dsh-plugin, deepseek-harness, and dsh GitHub topics.data/v1/; the plugin refreshes them with ETag requests and keeps a local cache.pnpm add, reconciles dsh.profile.bundles, and hot-mounts the plugin row.| Tier | Required evidence | Marketplace behavior |
|---|---|---|
verified-npm | The npm registry manifest declares dsh.bundle. | One-click install from the exact published package name. |
verified-git | The repository declares dsh.bundle, has a valid cordis.patch.yml, and can build during Git installation. | One-click install from github:owner/repo, with a build-script warning. |
likely-plugin | Plugin signals exist, but unattended installation cannot be proven. | Browse and copy manual clone/build steps. |
related | Ecosystem project without a mountable DSH bundle. | Browse only. |
Each entry keeps two values separate:
| Field | Source | Executed? |
|---|---|---|
installSpec | Deterministic npm/Git classification | Yes, after the host safety gate |
installHint.command | Author README, extracted by the model | No, display-only |
This prevents hard-coded profile names, template placeholders, shell metacharacters, and stale package names in README prose from entering the execution path.
allowInstall: false.README files are fetched on demand through a catalog-ID route. The renderer builds React elements rather than using dangerouslySetInnerHTML, and links and images are limited to safe HTTP(S) URLs.
| Field | Default | Purpose |
|---|---|---|
registryUrl | '' | Catalog source. Falls back through repository data/v1/catalog.json, local cache, then the packaged seed snapshot. npm installs normally begin with the seed until a remote URL is configured. |
refreshIntervalHours | 6 | Background refresh interval. Use 0 to disable scheduled refreshes. |
allowInstall | true | Set to false to reject all install/uninstall mutations and keep browsing only. |
profileDir | inferred from ctx.baseUrl | Escape hatch for non-standard profile layouts; normally leave unset. |
- insert:
- id: plugin-hub
name: '@nanmicoder/dsh-plugin-market'
config:
registryUrl: ''
refreshIntervalHours: 6
allowInstall: true
registryUrl when deploying against a separately published catalog./plugin-hub/*. They intentionally stay outside /plugins/<package-id>, which DSH reserves for client bundles.settings.section for compatibility with DSH builds that do not expose settings.plugins.tab.cp .env.example .env # add ANTHROPIC_API_KEY for model labels
pnpm crawl:dry # full crawl into .tmp/, without changing data/
pnpm crawl:rules # deterministic classification only
pnpm crawl # crawl, classify, and label
pnpm refresh # refresh and push only when content changes
Install hints are extracted with the Anthropic SDK. The default DeepSeek-compatible endpoint and model can be overridden with LLM_BASE_URL and LLM_MODEL; classification remains rule-based regardless of the model provider.
pnpm install
pnpm typecheck
pnpm build
pnpm verify
pnpm site:dev
pnpm site:build
npm pack --dry-run --ignore-scripts
pnpm verify runs offline catalog, install-safety, request-trust, crawler, labeling, artifact, and package-contract checks.
Every pushed commit is type-checked, built, and deployed through Vercel's Git integration. main updates production; other branches receive preview deployments.
Normal commits and pushes never publish npm packages. A release tag must exactly match package.json:
pnpm version patch --no-git-tag-version
git add package.json pnpm-lock.yaml
git commit -m "chore: release v$(node -p \"require('./package.json').version\")"
git push origin main
git tag "v$(node -p \"require('./package.json').version\")"
git push origin --tags
The publish.yml workflow rebuilds from source, verifies the package and tarball, then publishes through npm Trusted Publishing (OIDC). No long-lived NPM_TOKEN is required.