dsh-plugin-market

English | 中文

An in-GUI plugin marketplace for DeepSeek Harness: categorized, searchable, sortable discovery of community plugins with provenance badges — and one-click install/uninstall straight into the running web profile.

A plugin that installs plugins. Once it is in, you never need to touch a terminal to manage plugins again.


Features

• Catalog — built from the npm registry (four paginated keyword probes + a text probe), the GitHub dsh-plugin topic (doubles as discovery for packages with no npm keywords and backfills stars), the curated awesome list, and a small built-in seed list for the known pre-release wave. Disk-cached for 6h. Discovery and verification are decoupled: the first paint takes seconds (discovery only), and the cards you actually see get their badges verified lazily in the background as you browse. 429 rate-limits get Retry-After backoff and a failed probe never sinks the build.
• Provenance (溯源) — per package: 可挂载 (declares dsh.bundle.patch, so the official plugin channel can mount it), 含界面 (declares dsh.client), license, publisher, author, maintainers, weekly downloads, npm popularity score, GitHub stars. Expanding a card lazily fetches the full packument (first publish date, version count) and the GitHub repo card (stars / forks / last push / license / open issues).
• Sort & filter — 最新更新 / 周下载量 / GitHub Stars / 名称, seven category chips (皮肤主题 / 界面增强 / 桌宠陪伴 / 模型与代理 / 工具效率 / 其他), free-text search over name, description, keywords, author, and maintainers.
• Long-tail search — npm's relevance ranking buries zero-download packages even on near-exact queries, so a name-shaped query is resolved exactly (/<name>/latest), with automatic dsh- prefix variants and hyphenation.
• Install / uninstall / update — mutations run pnpm as background jobs: the card streams pnpm's live output while it works, and closing the Settings panel never interrupts anything — a bottom-right overlay keeps the progress visible and pops a completion notification (failures stay until dismissed; a minimumReleaseAge refusal turns into a one-click 放行并重试). The host side reconciles dsh.profile.bundles exactly like dsh plugin does. pnpm 11 build-script blocks are auto-approved and retried once (reported in the log); 检查更新 compares installed registry packages against npm latest and offers one-click 更新; local link:/file: installs are never compared (a registry "latest" for a name-collided local link would be a different package, not an update).
• Restart prompt — compositions load at boot, so mutations show a banner; when a launcher script exists (default ~/.dsh/start-dsh-web.bat) a "立即重启" button restarts the host for you.

Install

Prerequisite: a working dsh web deployment (so ~/.dsh/profiles/web exists), pnpm on PATH.

dsh plugin --profile web add github:sstar16/dsh-plugin-market

or from a clone: dsh plugin --profile web add ./dsh-plugin-market

Then restart dsh web and hard-refresh the browser (Ctrl+Shift+R). The marketplace itself needs that first restart; every plugin you install afterwards is one click plus the banner's restart button.

Usage

1. Open Settings → 插件市场. 2. Browse by category chip, sort by recency / weekly downloads / stars, or search. 3. A card shows badges, metadata, and an expandable 溯源 (provenance) block with source links. 4. 安装 / 卸载 — one click; a banner reminds you to restart when the mutation lands. 5. Packages the catalog cannot know (no keywords, no topic, fresh off the press): type the exact package name and hit 在 npm 上直接搜索.

Turning it off

• Uninstall from the marketplace itself (it removes its own bundle entry), or:

``sh dsh plugin --profile web remove dsh-plugin-market `` Restart afterwards.

Security

• Routes sit behind the same Host-header trust fence as the /api gateway (loopback or the deployment's trustedHosts; cross-site browser markers refused).
• Package names and versions pass a strict allowlist regex before reaching pnpm; pnpm output is tail-echoed into the UI, failures included.
• This plugin can modify your profile and run pnpm — it is an install channel into your host process. Only expose the GUI in environments you trust.

Known limitations

• Restart required: the host composition loads at boot; no install/update takes effect without one.
• Discovery is best-effort: packages with neither npm keywords nor a GitHub topic nor a curated-list entry are only reachable through exact-name search.
• Stars come from the GitHub topic search (top ~500 by stars) plus per-card lazy provenance; unrated entries sort at the bottom.
• The restart button needs a launcher script (~/.dsh/start-dsh-web.bat on Windows); without it the banner just tells you to restart.
• Catalog entries are not vetted — 可挂载 means "mechanically mountable", not "reviewed". Check the provenance links before installing anything.
• Name collision: the npm package dsh-plugin-market belongs to another author (veloce-ailab) — this project currently installs via the github: spec; a future npm release would publish under a scoped name.

Development

pnpm install
pnpm typecheck
pnpm build      # tsc declarations + tsdown (lib/index.js host ESM, lib/client.js browser bundle)

Layout: src/index.ts host routes + catalog/installer in src/catalog.ts / src/installer.ts; browser half in src/client/. The client bundle contract (window.__ModuleLoader__ factory, CSS Modules inlining, module-table externals) mirrors dsh-better-sidebar's public build.

License

[MIT](LICENSE)