Foreword

DeepSeek Harness (DSH) breaks capabilities into composable plugins, but installing plugins often involves checking community directories, copying installation commands, specifying profiles in the terminal, and restarting web services. The community directory is independently maintained at awesome-dsh-plugin.com and has no official affiliation with DeepSeek /幻方; the official implementation can be referenced at dsh-market.

Below, we introduce the @sanqi-normal/dsh-webui-market-plugin, maintained by Sanqi-normal: it integrates directory browsing, installation, updates, and uninstallation into the Settings → Plugins → Plugin Market section of the DSH web GUI. The interface follows the harness’s light/dark theme and switches between Chinese and English based on system language.

What is This

@sanqi-normal/dsh-webui-market-plugin is a community plugin market client within the DSH web profile. It reads the plugin directory from awesome-dsh-plugin.com (via JSON API plugins.json, which includes Star counts and inclusion dates), displays categories, search, and sorting in the settings panel, and uses the backend to call the dsh plugin CLI to write plugins into the bundle layer of the specified profile.

The plugin’s current version is 0.5.5, licensed under MIT, with approximately 100 stars on GitHub. It falls under the category of network tools: directory data comes from the network, and installation can be done via npm registry or GitHub source.

Core Features

Directory Browsing and Sorting

After opening Settings → Plugins → Plugin Market:

  • The directory is grouped by categories, supporting search and “Installed” filtering.
  • Cards display GitHub Stars (hidden if no data is available).
  • Sorting options include Hot (Stars descending, no Stars last), New (inclusion date), or restoring the default order from the official site.
  • Large directories are rendered incrementally in batches to avoid lag from inserting hundreds of cards at once.
  • The top displays the directory source link, which can directly navigate to awesome-dsh-plugin.com.

Clicking Details reveals the official installation command for that plugin (including the target profile).

Installation, Updates, Uninstallation, and Task Queue

Installation, updates, and uninstallation form a FIFO task queue. Multiple plugins can be queued consecutively; the task panel is fixed in the bottom-right corner, showing real-time statuses: “Queued / Validating / Executing / Completed / Failed / Aborted / Timed Out”. You can cancel queued items, abort executing items, and view pnpm logs for each task.

  • The default task timeout is 120 seconds, which can be increased via the environment variable DSH_MARKET_OP_TIMEOUT_MS (e.g., 300000).
  • If pnpm encounters temporary network errors (e.g., GET ... error, ETIMEDOUT, ECONNRESET), it will automatically retry once.
  • Update All queues all updatable plugins sequentially.
  • The queue supports one-click clearing of completed/failed records; clearing syncs to the server, so they won’t reappear after refresh.

Installed plugin cards show real-time status (synced with the profile’s package.json), identified by “Author + Repository” (owner/repo) to avoid mislabeling plugins with the same name. Dependencies installed outside the directory or market also appear in the Local Plugins list, marked as in/out of directory, disabled, or source type, and support disabling, enabling, or uninstalling (built-in bundles and local link/file sources do not offer deletion).

Cross-Profile Installation and Sync

The official directory publishes --profile web commands by default; the desktop (desktop shell) uses a separate profile (e.g., desktop), so plugins installed only for web won’t automatically appear in the desktop app.

The panel top provides Installation Settings and Cross-Profile Sync:

  • Auto-sync to other profiles is enabled by default: plugins are automatically installed to all initialized profiles on the local machine; when disabled, they are installed only to the selected profile during installation.
  • The installation confirmation dialog allows selecting the target profile (default: web).
  • Cross-Profile Sync installs plugins already installed in web to the target profile with one click (only adds missing items).
  • Syncing is local copying: the source profile must have the plugin installed (syncFrom validation); plugins outside the directory (e.g., aegis) can also be synced. After installing to profiles like desktop, the corresponding application needs to be restarted.

Security Mechanisms and Trial Verification

  • Source Whitelist: Installation only accepts github: sources from the curated directory (consistent with dsh-market’s policy); directory fetch failures or registry/link sources bypass this restriction. The whitelist applies to all target profiles and can be bypassed by checking “Skip Security Check”.
  • npm Priority: When directory entries include npm mappings, npm is used for installation/updates first; only GitHub-only plugins use the GitHub source. You can set domestic mirrors in npm/pnpm configuration (e.g., registry=https://registry.npmmirror.com).
  • Trial Boot: After passing whitelist checks, if the plugin does not declare a web client half, it is trial-installed in a temporary DSH_HOME and actually started once; only if a dsh web: readiness line appears is it considered installable. Verification failures provide real startup errors and reject installation without writing to the real profile. Trial boot only runs for the web profile.
  • Same-Origin Validation: Write operations only accept same-origin POST; cross-origin requests return 403.
  • Pre-Installation Snapshot: Before writing, package.json is backed up as .mkts-snapshot-<timestamp>.json, which can be used with dsh plugin --profile <name> remove <package> for manual rollback.

Disabling, Enabling, and Hot Mounting

  • Disable / Enable: Disabling preserves dependencies and disk files but removes the plugin from the active bundle layer; the state is written to dsh.market.disabled and persists after restart.
  • Hot Mounting: After successful installation, if cordis.patch.yml contains only simple id/name insertions, the plugin can be mounted into the running composition and automatically refresh the page; complex patches or unsupported environments fall back to “Restart Required”. Hot mounting only applies to the running web profile.

Failure Troubleshooting

After installation/update/uninstallation failures (including timeouts, aborts, rejections), the failure popup and task queue display an Ask DSH button: the frontend creates a new conversation and sends the operation target, environment information, and complete error logs as a prompt to the AI for easier troubleshooting.

For pnpm ≥11, if ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION occurs, the market automatically merges the violating name@version into the profile’s pnpm-workspace.yaml under minimumReleaseAgeExclude and retries once.

Installation and Enabling

This plugin runs within the DSH web profile, with peer dependencies provided by the host; users do not need to manually install @deepseek-ai/cordis, @deepseek-ai/dsh-client-runtime, or @deepseek-ai/dsh-client-ui-slots. The current version targets DSH 0.0.1-rc.2+ (excluding 0.0.1-rc.1) and 0.1.0-rc.2+. Node requires ^22.19.0 || >=24.0.0.

Method 1: Install from npm registry (recommended):

dsh plugin --profile web add @sanqi-normal/dsh-webui-market-plugin

Method 2: Install from GitHub source:

dsh plugin --profile web add github:Sanqi-normal/dsh-webui-market-plugin

After installation, restart the web service to take effect:

pnpm dsh web

GitHub source installation executes the package’s prepare script. If intercepted by pnpm, add the prompted package name to the profile’s pnpm-workspace.yaml under allowBuilds and retry. Starting with pnpm 11, build scripts not explicitly allowed in allowBuilds cause ERR_PNPM_IGNORED_BUILDS; if the package does not require build scripts, you can set it to false to explicitly reject.

Typical Usage

After completing the installation steps above, open the DSH web interface in a browser and navigate to Settings → Plugins → Plugin Market.

  1. Locate the target plugin in the search box or categories, and narrow the range using “Hot / New” sorting.
  2. Click Details to verify the official installation command and target profile.
  3. Click Install on the card; if you need profiles like desktop, confirm “Auto-sync to other profiles” in Installation Settings, or add via the Cross-Profile Sync section.
  4. Observe progress in the bottom-right task panel; on failure, check pnpm logs or click Ask DSH.
  5. After successful installation, if hot mounting is not effective, execute pnpm dsh web to restart the web service.

Maintainers can refresh the offline directory snapshot from the official JSON API using the following command (fails if the official site is unreachable, without copying old data):

pnpm run snapshot

The snapshot is written to data/catalog-snapshot.json, providing fallback when the official directory fetch fails.

Applicable Scenarios and Notes

Who is this for: Developers who frequently try community plugins in the DSH web GUI; local users needing consistent plugins across multiple profiles like web and desktop; environments seeking to reduce the risk of “breaking the composition” with whitelists, trial verification, and task queues.

Important notes:

  • This plugin runs with the permissions of the current dsh process; check the target plugin’s source code and license before installation.
  • Installation/uninstallation usually requires restarting the web service; hot mounting may avoid restarts when successful.
  • Manually executing dsh plugin add/remove/update in the command line may temporarily restore disabled items; restart or the next market operation will reapply the disable state.
  • Cross-profile sync only adds, not deletes; it will not remove existing content in the target profile.
  • Directory data and plugin counts are based on awesome-dsh-plugin.com; this is a community ecosystem directory, not an official app store.

Conclusion

@sanqi-normal/dsh-webui-market-plugin brings the awesome-dsh-plugin.com directory into the DSH settings panel, using queued installation, whitelists, trial verification, and cross-profile sync to streamline the process of “checking directories → entering commands → restarting” into an observable workflow. If you primarily extend harness capabilities in the web GUI, this is one of the more complete market frontends in the network tools category.