Preface¶
DeepSeek Harness (dsh) splits its runtime into stackable plugin layers: tools, sessions, sandboxes, and UI can all be packaged as bundles and loaded into a Profile, then composed into the full runtime on next startup. The official repository summarizes this as “everything is a plugin”. For end users, adding new capabilities often does not require modifying Harness source code, but rather selecting, replacing, or installing a layer of configuration.
When actually getting hands-on, however, installing community plugins remains relatively fragmented. The official recommendation is to add the GitHub Topic dsh-plugin to your repository for easier discovery; installation uses dsh plugin add, with the CLI forwarding the request to pnpm in the Profile directory. The command itself is not complex, but the subsequent steps are troublesome: does this repository declare dsh.bundle.patch, should it be pinned to a specific commit, are there pre-built Release packages available, do you need to restart after installation, and which Web Profile should it be installed into? There are already independent plugin directory sites in the community, and some people have built command-line marketplaces; they can reduce discovery costs, but most still require users to return to the terminal.
The dsh-plugin-installer maintained by Toukaiteio takes a different approach: it adds a “Plugin Marketplace” tab to the official Web UI’s Settings → Plugins page, keeping discovery, verification, installation, updates, and Profile switching within the same interface. Below is an explanation of what it is, what it can do, how to install it, and how to use it, verified against the community directory, GitHub README / package.json, and DeepSeek Harness official documentation.
What It Is¶
dsh-plugin-installer is a UI enhancement plugin for DeepSeek Harness, maintained by Toukaiteio, licensed under MIT, and primarily written in JavaScript. The community directory page positions it as “Marketplace Plugin: Quickly connect DeepSeek Harness to the GitHub plugin ecosystem”; the repository README is more specific: it is a plugin marketplace built into the Web UI, and also a Web Profile switching tool.
It does not solve the problem of “writing another plugin”, but rather addresses these daily operations:
- Browse candidate repositories from GitHub with the dsh-plugin and dsh Topics
- Confirm that the root package.json declares dsh.bundle.patch before installation
- Prioritize using pre-built .tgz packages from GitHub Releases, and perform SHA-256 verification when digests are available
- Install plugins into a selected Profile, and update or remove them directly from the page
- Open or create other Web Profiles without leaving the current interface
As of the writing of this article (2026-08-18), both the community directory and GitHub repository show 6 stars. The latest stable version is v0.2.0 (released on 2026-08-16), which matches the version number in package.json. It is important to note: the community plugin directory is an independent site with no official affiliation to DeepSeek / FunPlus, and should not be mistaken for an official app store; this installer itself is also a community plugin, not a built-in feature of Harness.
Core Features¶
Discover via GitHub Topics, No Private Index Maintenance Required¶
The plugin marketplace searches GitHub repositories tagged with the dsh-plugin and dsh Topics automatically, and excludes the DeepSeek Harness main repository to avoid listing the host program as a plugin. The list supports two official GitHub-supported sorting methods: by update time and by star count. It pre-fetches the next page when approaching the bottom of the list, creating infinite scrolling.
The README clearly states the meaning of the Topics: they are only discovery signals, not representative of security audits or official endorsements. A repository appearing in the list only means it has the corresponding tags, not that its code has been reviewed.
To reduce GitHub API pressure, search results are cached for 12 minutes on both the server and client sides based on “search term + sorting method + page number”. When the anonymous quota is exhausted, you can paste a GitHub Token in the “GitHub Request Settings” section of the same tab; for unattended scenarios, you can also use the server environment variable GITHUB_TOKEN as a fallback.
Verify It Is a DSH Bundle Before Installation¶
After the user clicks Install, the host side processes in the order documented in the README:
1. Fetch repository metadata and the latest GitHub Release
2. Read the root package.json
3. Require a valid dsh.bundle.patch declaration to exist
4. Prioritize using the <package-name>-<version>.tgz matching the version from the Release; verify the content when GitHub provides a digest, save the archive to DSH_HOME/plugin-archives/ before installation
5. When no suitable Release exists, only allow pinned-commit source code installation after confirming that the declared JavaScript entry file exists in that commit
This aligns with the official DeepSeek Harness release documentation: packages without a dsh.bundle declaration can be installed as regular dependencies, but will not become a layer of the Profile; installations from Git source code will get unbuilt source, and TypeScript packages that do not commit the lib/ directory will fail to load. This installer chooses to “install built packages when Releases are available; source code fallback requires a verifiable entry file”, and if the source path requires running a prepare script, you must confirm again for that plugin. When there are no available Releases and no verifiable entry, the marketplace will refuse to install and explain the reason.
Update, Remove, or Manage After Installation¶
The “Installed Plugins” section corresponds to the currently selected Web Profile. When the page opens, it first compares the marketplace-installed plugins with the latest GitHub Release; when there is no Release, it compares the source code commits instead. The statuses on the page include:
- Update Available: Download and install the verified latest Release package
- Up to Date: The installed package version matches the latest Release version
- Cannot Check Updates for Now: A conservative prompt when neither the Release nor source code status can be verified, and it will not claim “there is an update” when comparison fails
- Delete: Call DSH’s own plugin remove after confirmation, to keep the Profile’s bundle list and actual package state consistent
Starting from v0.2.0, opening the plugin marketplace will also check if there is a new stable Release for the installer itself. One-click updates only apply to the current Profile and take effect after restarting; the old build will continue to serve before restarting, and other Profiles will not be affected.
The copy and date format follow DSH’s Settings → General → Language. After installing to the current Web Profile, the page will prompt for a restart and provide “Restart DSH Now”: it first launches a new process, confirms the new address is available before redirecting, then closes the old process.
Switch Web Profiles on the Same Page¶
In addition to installing plugins, this interface provides Profile-related operations:
- Open Profile: Launch the selected Web Profile on a new local port, then redirect to the new address; the current process is temporarily retained, and the current session will not be lost if switching fails
- Create and Open: Initialize a new Profile containing the official Web bundle and this plugin, then open it
The README also documents an upstream limitation: in the current DSH preview version, the npm package @deepseek-ai/dsh-web-app may depend on @deepseek-ai/dsh-frontend which does not exist in the repository. When this happens, creating a new Web Profile will be blocked by the upstream package, and already working Web Profiles will not be affected. This is a packaging issue in the Harness preview version, not something the installer can work around.
Installation and Activation¶
The environment requirements are based on the repository README and package.json:
- Node.js >=22.19.0
- pnpm >=10
- DeepSeek Harness 0.1.0-rc.6 or compatible version
- An already working DSH Web Profile (the in-app interface is mounted on the Web UI)
The installation command provided on the community directory page can be run directly in the DeepSeek Harness terminal:
dsh plugin add github:Toukaiteio/dsh-plugin-installer
For reproducible installations, the directory page recommends pinning to a commit:
dsh plugin add github:Toukaiteio/dsh-plugin-installer#commit
Replace commit with the actual 40-character hash. The repository README more explicitly requires installing it into the active Web Profile, and when installing from a specified GitHub commit, the repository must already contain the built lib/ directory:
dsh plugin --profile web add github:Toukaiteio/dsh-plugin-installer#<commit>
dsh web
If you want to use the pre-built installation package directly, you can download the latest stable .tgz from GitHub Releases (currently dsh-plugin-installer-0.2.0.tgz), then add it to the Web Profile:
dsh plugin --profile web add ./dsh-plugin-installer-0.2.0.tgz
dsh web
Windows users can also use the one-click PowerShell script provided by the repository: it downloads the latest stable Release, verifies the SHA-256 digest when provided by GitHub, saves the archive to DSH_HOME/plugin-archives/dsh-plugin-installer/, installs it to the web Profile, and starts the DSH Web UI:
irm https://raw.githubusercontent.com/Toukaiteio/dsh-plugin-installer/main/scripts/Install-DshPluginInstaller.ps1 | iex
To specify a different Profile or disable automatic Web UI startup, first download the script and pass parameters:
$script = "$env:TEMP\Install-DshPluginInstaller.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/Toukaiteio/dsh-plugin-installer/main/scripts/Install-DshPluginInstaller.ps1 -OutFile $script
& $script -Profile work -NoStart
The equivalent Bash script for macOS and Linux follows the same process, additionally requiring bash, curl, and Node.js:
curl --fail --location --remote-name https://raw.githubusercontent.com/Toukaiteio/dsh-plugin-installer/main/scripts/install-dsh-plugin-installer.sh
bash ./install-dsh-plugin-installer.sh
To specify a Profile or only install without starting the UI:
bash ./install-dsh-plugin-installer.sh --profile work --no-start
After the Web UI starts, open Settings → Plugins → Plugin Marketplace.
Typical Usage¶
The steps below come from the SKILL.md and Chinese README in the repository, and can be followed directly via the interface:
1. Confirm you are running a Web Profile, then navigate to Settings → Plugins → Plugin Marketplace.
2. Browse the online list by update time or star count, or enter search terms to filter results.
3. After selecting a repository, first check the verification result to confirm it is recognized as a DSH bundle, then proceed with installation. Select the target Profile before installing.
4. If the verification prompt mentions a prepare script, it means third-party code will be executed during installation. Do not grant build permissions without explicit confirmation.
5. After installing to the current Web Profile, use Restart DSH Now to apply the new bundle overlay.
6. Afterwards, you can check the update status in “Installed Plugins” and update or remove plugins as needed.
When GitHub anonymous requests are rate-limited, expand the GitHub Request Settings section in the same tab, paste your Token, and save it. The Token will not be echoed back to the browser after saving; the plugin writes it to:
$DSH_HOME/config/dsh-plugin-installer.json
Use the DSH default directory if DSH_HOME is not set. Saving an empty value will clear the Token stored by this plugin. The Token is only read server-side, and can come from the above configuration file or the GITHUB_TOKEN environment variable; the README recommends granting only the minimum permissions required to access public repository metadata.
On Windows, if you are using local HTTPS acceleration or proxy tools like FastGitHub or steamcommunity_302, the marketplace may fail to connect to GitHub and prompt a TLS certificate verification error. This is documented in Issue #1: the proxy root certificate has been trusted by Windows, but Node.js does not use the system certificate store by default. The fix is to fully exit DSH first, then enable Node.js to use the system CA in the same CMD window before starting DSH:
set "NODE_OPTIONS=%NODE_OPTIONS% --use-system-ca"
dsh web
This option requires Node.js 22 or newer, and the accelerator root certificate must still be installed and trusted by Windows. Do not use NODE_TLS_REJECT_UNAUTHORIZED=0 to disable certificate verification entirely.
If you want to publish your own plugin that can be discovered by this marketplace, the SKILL.md in the repository lists the minimum requirements: declare dsh.bundle.patch in the root package.json, insert a host module via cordis.patch.yml, export an apply(ctx) function from the host module, and add the dsh-plugin Topic (and optionally the dsh Topic) to your GitHub repository. Repositories installed from Git should commit the built lib/ directory to avoid running build scripts during installation. Skill describes workflows, while Plugins modify the runtime or UI—they are not the same thing.
Applicable Scenarios and Notes¶
This tool is particularly suitable for these situations:
- You are already using the DSH official Web UI and want to browse and install community plugins directly from the settings page, instead of returning to the terminal to copy commands every time
- You need to switch between multiple Web Profiles, or occasionally create a new Profile with the official Web bundle
- You have tagged your own DSH plugin with dsh-plugin and want to confirm how the marketplace will discover and verify it
There are several boundary conditions to review before use:
Plugins run with the permissions of the current dsh process, and code may be executed during installation. The community directory and repository README both require: check the source code repository and license before installing. GitHub Topics are not a security review. What the installer can do is verify the bundle structure, pin commits, and prioritize using verified Release packages; it cannot replace you from reading third-party source code, especially repositories with installation or build scripts.
The command dsh plugin add github:Toukaiteio/dsh-plugin-installer on the directory page does not hardcode the Profile. The in-app interface depends on the Web Profile, so in actual use, add --profile web (or the name of the Profile you are using) as documented in the README, and pin the commit only when a reproducible installation is needed. DeepSeek Harness is still in developer preview as of now, and the official README notes that there will be breaking changes; this plugin declares compatibility with 0.1.0-rc.6, so you should re-verify after upgrading Harness.
Creating a brand new Web Profile is still affected by the upstream @deepseek-ai/dsh-frontend packaging issue. When you already have a working Web Profile, you can continue installing plugins into the existing Profile instead of forcing a new one for a “clean environment”.
Summary¶
dsh-plugin-installer brings GitHub DSH plugin discovery and installation into the official Web UI’s Settings → Plugins page: it uses Topics for search, filters with dsh.bundle.patch, prioritizes installing verified Release packages, and includes update, delete, and Profile switching functions. It reduces the number of steps required, but does not change the fact that “plugins run with the permissions of the current process”.
Community Directory: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-plugin-installer/
GitHub Repository: https://github.com/Toukaiteio/dsh-plugin-installer
DeepSeek Harness: https://github.com/deepseek-ai/deepseek-harness