Preface

DeepSeek Harness (DSH) treats model adapters, tools, sessions, Agent Loops, Hosts and Clients as plugins, with the official slogan “Everything is a plugin”. The distribution path for external plugins has also been centralized into the profile bundle: the dsh plugin command forwards parameters to pnpm, and maintains an ordered bundle layer based on the dsh.bundle.patch in the package. Currently, the web interface only provides a read-only Loader list and limited plugin configuration, but lacks a marketplace directory, community reviews, dependency visualization, and a universal installation API.

The official discovery entry is only the GitHub dsh-plugin topic. In a survey on 2026-08-14, the repository README noted that GitHub returned 417 candidate repositories at the time, mixed with real bundles, regular Cordis packages, Skills, MCPs, awesome lists, and outdated protocols that no longer work. Being able to search for a repository via a topic does not mean it can be installed, is compatible, or can be rolled back.

DSH_Creative_Workshop aims to fill this gap. Inspired by the interaction model of the Steam Workshop, it builds a directory, structure verification, graph retrieval, collection and installation planning outside the DSH runtime. The browser workshop, standalone account page and management console have been deployed. Below is an explanation of what it is, what it can do now, and how to use it, verified against the community directory page, GitHub README, CHANGELOG.md and docs/11-implementation.md.

What It Is

DSH_Creative_Workshop is a community open-source project maintained by OBdangshang07, hosted at OBdangshang07/DSH_Creative_Workshop, licensed under MIT, and primarily written in TypeScript. The community directory categorizes it under “Tools and Capabilities”. As of 2026-08-17, it has 59 GitHub stars. The current stable version is v1.1.4 (2026-08-15), with the release theme “Media Reliability and Directory Quality”.

It is not intended to just skin the existing plugin list, nor is it a new DSH runtime. The README defines it as an independent Marketplace Control Plane: responsible for directories, standardization, provenance, community, graph retrieval and installation orchestration; the local runtime facts still follow the DSH Loader, profile manifest, lockfile and patch. The project clearly defines several boundaries:
- Do not fork or replace the Cordis Loader
- Do not redefine the DSH plugin format, nor restore the upstream deprecated .dsh-plugin repository protocol
- The cloud website does not directly read or write $DSH_HOME, nor execute third-party bundle code on the server
- Do not package GitHub stars, download counts or a one-time static scan into “security certification”

The project explicitly states that it has no affiliation with or endorsement from DeepSeek. The “STEAM Workshop” only describes the interaction paradigm, and does not use Valve/Steam trademarks or page designs. The DeepSeek Harness Plugin Library that hosts it is also an independent community site with no official affiliation to DeepSeek / HyperGryph.

Core Features

v1.1.4 has delivered the planned high-value closed-loop features as a TypeScript monorepo: the browser store, Marketplace API, local Companion, standalone login page and management console. Production data is stored using Node.js built-in SQLite (WAL) for users, sessions, directories, audits, community relationships and audit logs.

Cards on the store homepage only render bundles that have passed structural verification and administrator approval. Clicking a card takes you to the refreshable and shareable in-site details page /plugin/?id=..., which displays standard fields, fixed commit provenance, declared dependencies, dynamic community data, and uses GitHub as a clear external button rather than part of the detail page itself.

The public directory supports searching by name, description, package name, as well as faceted filtering, sorting and pagination by kind, surface, topic, author, language and license. v1.1.4 also updated the plugin cover art to use workshop-native output: when remote GitHub images fail, are rate-limited, or have incorrect types, the card will still display a recognizable deterministic SVG cover. Project media is only allowed to be fixed to GitHub Social Previews or image files from verified repositories and commits, with MIME type, size, timeout and redirect checks in place. The detail page can show related plugin recommendations, and users can report media issues.

Discovery, Structural Verification and Trust Boundaries

The GitHub dsh-plugin topic is only a candidate discovery source, and the topic itself does not qualify a repository for inclusion. Synchronization cross-references recently updated and high-star repositories; without a dedicated configured token, batches are processed according to core API quotas, with a maximum of 15 repositories per batch in anonymous mode. Delayed or failed repositories can be resumed from the original task without overwriting the public directory repeatedly.

The verification chain is fixed: lock the repository commit, scan the package.json in the monorepo, check the dsh.bundle.patch, Cordis entry structure and DSH/Cordis dependency provenance. The crawler will exclude private packages, scripts/templates paths, and deduplicate duplicate packageName entries in the same repository. New revisions default to waiting for manual review before entering the public directory. Logged-in users can also submit their own GitHub repositories for the admin panel to accept or reject.

This layer is called structural verification, not security audit, let alone DeepSeek official certification. The workshop page also clearly states “Structural Verification Passed · Not Security Audited”. Reviews are bound to the current public revision, and the same user can only leave one latest review per revision, so experience from old versions will not be mixed into new releases.

Collections, Discussions and Account Relationships

After logging in, users can manage actual bookmarks, subscriptions, collections, revision-bound reviews and device sessions. Subscriptions are account-based relationships and do not simulate local installations. Collections are private by default, and will only appear in the collection square if explicitly made public and not hidden by administrators; other users can duplicate public collections. Guests can read discussions, replies, public collections, site-wide reviews and update feeds; logged-in users can post, reply and report. Discussion content is rendered as plain text.

The online user count on the homepage is defined as browsers with foreground activity in the last 90 seconds: multiple tabs under the same cookie are counted once, and automated clients are excluded. Original identifiers are only stored in process memory, and SQLite only retains 5-minute aggregate buckets for the admin panel to view 24-hour peaks.

The standalone /login/ page provides login, registration, password rule prompts and secure in-site redirects. Users can change their account name, save favorite searches, control notification categories and follow discussions. After a name change, historical community content will display the current account name, while the original attribution is retained for audit purposes.

Local Companion: Plan First, Dry-Run Only

The Companion listens on 127.0.0.1:4101 by default, responsible for detecting the local environment, generating installation plans, and performing auditable operations. The current implementation permanently marks the execution mode as dry-run: the response explicitly states rollbackAvailable: false, because no writes have been made to the local DSH profile. The pre-flight checks, locking, real dsh plugin adapter and rollback features outlined in the planning documentation have not yet been announced as completed features.

The security boundaries are clearly laid out in docs/11-implementation.md:
- Reject non-loopback hosts, with an explicit allowlist for Origins
- All changes require a local Bearer token
- Only accept structured fields such as pluginVersionId, profile, plan id and confirmation token
- Explicitly reject argv, command, script and path
- Environment detection only runs the hardcoded dsh --version and corepack pnpm --version commands in the codebase
- Plans will fix the catalog revision, profile digest, package spec, source commit and artifact digest
- Confirmation tokens are invalidated after one use

That is, you can currently review “what would happen if you installed”, but you cannot let the website or Companion directly modify your profile.

Management Console

The standalone /admin/ page provides an overview, online peaks, plugin revision review, changelog collection/editing, asynchronous GitHub synchronization, user and session management, community governance, media health, repository submission review and audit logs. Administrator actions are logged with request context. The Marketplace API defaults to listening on 127.0.0.1:4100.

Installation and Activation

The installation command given on the community directory page is as follows, run in the DeepSeek Harness terminal:

dsh plugin add github:OBdangshang07/DSH_Creative_Workshop

For a reproducible installation, replace commit with the actual commit hash from the repository:

dsh plugin add github:OBdangshang07/DSH_Creative_Workshop#commit

The directory page also notes that the plugin runs with the permissions of the current DSH process, and may execute code during installation. You should inspect the source code repository and license before installing.

It is important to separate this command from the project’s own nature. The root package.json of the repository does not have a dsh.bundle.patch, so per official DSH semantics, a package without a declared bundle will only be a regular dependency after being packaged into the profile, and will not automatically be mounted as a Cordis layer. The project itself positions itself as a control plane outside the runtime, not a web UI plugin in the sidebar. A more appropriate way to use it is to open the already deployed browser workshop, or start the API and Companion locally using the repository scripts.

The current deployment configuration and online pages point to https://xxnmkk.xyz/, with the standalone account page at /login/ and the management console at /admin/. The local scripts are defined in the root package.json:

pnpm start:api
pnpm start:companion
pnpm preview:web

The engines field requires Node.js ^22.19.0 || >=24.0.0, and the package manager is locked to pnpm 11. The planning baseline is aligned with the upstream deepseek-ai/deepseek-harness 0.1.0-rc.5 (Developer Preview, no compatibility guaranteed) from 2026-08-14, and future upgrades will require re-verification per commit.

Typical Usage

The following workflows come from the README and implementation documentation, and can be followed directly on the deployed workshop:

  1. Browse the reviewed directory. Open the workshop homepage, where the cards correspond to bundles that have passed structural verification and review. You can search by name, description, package name, then filter by type, runtime surface, topic, author, language and license.
  2. Open plugin details. Go to /plugin/?id=... and verify the fixed commit, declared dependencies, community statistics and GitHub external link provided on the page. Covers and project media are served natively by the workshop; when viewing screenshots, use verified project media instead of directly pulling original GitHub images.
  3. Create an account relationship after logging in. Register or log in at /login/. Bookmarks, subscriptions, collections and reviews can only target currently public plugins. Reviews are written as “how well did this revision work for me”, not a permanent star rating for the plugin. Collections will only appear in the square if made public.
  4. Look at community signals, not installation results. You can read discussions, site-wide reviews and activity feeds; subscribing to a plugin will send you notifications when new revisions are approved. None of this means the plugin is already installed locally.
  5. Use the Companion for installation planning. Use the local Companion to detect the environment, generate a plan and perform a dry-run. The current response will not modify the profile, and there is no real rollback functionality. The planned one-click installation transaction flow (pre-flight → confirmation → application → verification → commit / rollback) is still the target model, not a delivered executor in v1.1.4.
  6. Submit repositories as an author. After logging in, you can submit GitHub repositories, and the admin panel will decide whether to include them in the public directory based on structural verification and manual review. Changelogs are collected in the following order: structured plugin declarations, GitHub Releases, repository CHANGELOGs, commit summaries; if no trusted content is available, it will explicitly show “Author has not provided a changelog”.

The repository also provides a JSON Schema (spec/workshop-manifest.schema.json) and example (examples/workshop-manifest.example.json) for workshop extension metadata. Authors who want to formalize permissions, compatibility ranges, dependencies and acceptance steps into standard fields can supplement them using this draft v0.1 checklist, instead of relying only on README text.

Applicable Scenarios and Notes

It is suitable for the following groups:
- Users who want to browse DSH bundles beyond GitHub topics, based on structural verification and review results
- Advanced users who need to compare versions, view declared dependencies, and bind reviews to specific revisions
- People who maintain shareable collections and want to treat a set of plugins as a replicable list
- Plugin authors: submit repositories, supplement metadata, view reviews and community feedback
- Directory maintainers: use the admin panel for synchronization, revision review, media governance and report handling

It is not intended to be understood as an “official app store” or “install it to one-click modify your local DSH”. The parts that v1.1.4 has not yet completed include: the real dsh plugin adapter, profile file transactions/locks/snapshots/rollbacks, isolated code-level security analysis and dynamic sandboxes, OAuth/email verification/password recovery, production-grade Companion pairing and cross-platform installation matrices. Before the real executor is enabled, the documentation requires completion of file transactions, profile drift checks, restricted lifecycle scripts, crash recovery and cross-platform testing, rather than just replacing the dry-run adapter with exec.

Before installing or running any relevant code, please note the following:
- The plugin runs with the permissions of the current DSH process, and may execute code during installation. First inspect the source code and MIT license before deciding whether to run the dsh plugin add command from the directory page.
- Structural verification only confirms that the package/bundle patch/Cordis entry match, and does not mean a security audit has been performed, nor does it mean DeepSeek official endorsement.
- The Companion should only be bound to loopback addresses. Do not expose the change interface to the public internet, and do not allow remote pages to pass arbitrary commands.
- “Subscribed” in the cloud directory does not represent local installation status; whether the plugin is active locally still depends on the profile and Loader.
- DSH is still in Developer Preview, compatibility conclusions need to be tied to DSH version/commit, plugin commit and environment, and cannot assume that the next RC version will remain compatible.

Summary

DSH already has a plugin runtime, but lacks a discoverable, interpretable, reviewable discovery layer. DSH_Creative_Workshop has turned this into an independent control plane: using GitHub topics to discover candidates, using fixed commits for structural verification, using reviewed directories, collections, revision reviews and graph relationships to reduce selection costs, and using the local Companion to provide installation plans that currently stop at dry-run. The browser workshop, account and admin pages have been launched; transactional installation that actually modifies the profile has not yet been delivered.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh_creative_workshop/

GitHub: https://github.com/OBdangshang07/DSH_Creative_Workshop

Deployed workshop: https://xxnmkk.xyz/