dsh-plugin-market

A DeepSeek Harness plugin that browses the deepseek-harness plugin library — every public repository tagged with the GitHub topic dsh-plugin — and shows it as a ranked list of plugin cards.

Each card carries:

• 缩略图 / thumbnail — the repository owner avatar,
• 介绍 / description — the repo description,
• 星标 / stars — stargazers_count,
• 排名 / rank — position by star count (descending),
• 更新日期 / update date — last push (pushed_at).

What it ships

dsh-plugin-market is a dual-face bundle (node + browser):

1. Web dock panel「插件技能库」 (browser half). A dock entry above the chat composer opens the manager: 已安装 (built-in / self-made / community plugins plus installed Skill packages — enable/disable hot toggles, update, uninstall), 插件库 (topic search, categories, installability precheck incl. monorepo sub-package discovery, one-click install, restart), and 技能库 (GitHub skill-topic search with SKILL.md detection for single-skill and collection repos, installed into the skills root — live, no restart). 2. Model-facing tool browse_dsh_plugins (node half, index.js). The same catalog for the agent, rendered as a card grid through a Conversation Node. 3. Settings「重启 Web」section: one-click Web restart and a deepseek-harness self-update (git pull + install + build) with a live log.

Install

Package the plugin into a tarball, then install that tarball into the profile:

cd dsh-plugin-market
pnpm pack                              # -> dsh-plugin-market-0.1.0.tgz

# from your deepseek-harness checkout
pnpm dsh plugin --profile web add ../dsh-plugin-market/dsh-plugin-market-0.1.0.tgz

> Install the tarball, not the directory. dsh plugin add ./dsh-plugin-market > (a bare directory) records a link: dependency, and Node then resolves the > plugin's @deepseek-ai/dsh-tools import from the linked directory's real path > instead of the profile's node_modules — which fails with > ERR_MODULE_NOT_FOUND. The tarball installs the files inside the profile's > node_modules, where the harness's own packages resolve normally.

pnpm prints a peer dependency warning for @deepseek-ai/dsh-tools; that is expected — the harness itself provides it (autoInstallPeers is off), and it is already present in the profile.

Verify the layer composed, then restart the Web profile:

pnpm dsh --profile web --dump-config | grep -A2 dsh-plugin-market
pnpm dsh web

> Restart the running server: a node-half (host) plugin is not hot-reloadable. > The browser half joined the dsh.client roster at compose time, so it too is > picked up on the next boot.

Usage

Ask the agent, for example:

> Use browse_dsh_plugins to list the top 20 DSH plugins.

Tool arguments:

Noise filtering

The dsh-plugin topic is noisy: many repositories tag it for exposure without being DeepSeek Harness plugins. By default (filter: "related") the tool keeps only repos whose name or description — or one of their other topics — mentions deepseek, dsh, or harness (case-insensitive). Pass filter: "all" to list every tagged repo.

GitHub rate limits & optional token

All GitHub calls work with zero setup: unauthenticated requests allow 60 requests/hour (core API: file and tree probes used by precheck and skill detection) and 10 requests/minute (search). On top of that, the plugin keeps a 1-hour persistent disk cache (~/.dsh/.cache/dsh-plugin-market.json) for skills search and SKILL.md detection results, so routine browsing rarely touches the API at all — the panel's 刷新 button bypasses the cache on demand.

Heavy users can raise the core quota to 5,000 requests/hour by setting a GitHub token of their own before boot. A token used only for public-repo reads needs no scopes at all (a classic PAT with everything unchecked, or a fine-grained PAT limited to "Public Repositories (read-only)"):

# Windows (persistent for new processes)
setx DSH_PLUGIN_MARKET_GITHUB_TOKEN ghp_xxx

# macOS / Linux (current shell; add to your profile for persistence)
export DSH_PLUGIN_MARKET_GITHUB_TOKEN=ghp_xxx

The plugin reads it at request time and sends it as a Bearer token.

> Never commit or bundle a token into the plugin package or repository. > GitHub scans public repos and auto-revokes leaked tokens, and every install > would share — and burn — one account's quota. Each user sets their own token > through the environment variable above. With > GitHub CLI installed, gh auth token prints a > ready-to-use token right after gh auth login.

How it works

• The node half registers the tool globally through ctx.tools.register(...),

so every agent (including web sessions composed from an agent preset) sees it through the tools scope chain.

• The fetch targets a fixed public API

(https://api.github.com/search/repositories?q=topic:dsh-plugin&sort=stars) with its own timeout and cancellation.

• The tool returns one canonical JSON value and projects the same list into

output.presentationMeta ({ kind: 'dsh-plugin-market', plugins, … }). That projection is persisted on the durable tool/result event.

• The browser half registers a ConversationNodeDefinition that matches those

tool/result events and renders the thumbnail grid — replay-safe, no extra durable event type required.

Notes & limits

• Only public repositories tagged dsh-plugin are listed (GitHub search scope).
• updatedAt uses pushed_at (last commit push) rather than metadata changes.
• The thumbnail is the GitHub owner avatar; repositories have no separate

per-repo thumbnail in the topic/search API.

License

MIT