Preface¶

DeepSeek Harness (DSH) adopts an “everything is a plugin” architecture, with many repositories carrying the dsh-plugin topic in the community. However, the list on GitHub doesn’t mean they are directly installable: whether the manifest is complete, whether the bundle patch matches, and whether the installation source can be locked to a precise commit all need to be checked individually. Manually reading READMEs, assembling installation commands, and then handling build scripts and profile conflicts incur a non-trivial cost.

This introduction presents dsh-plugin-marketplace, maintained by YELEBAI. It serves as both the plugin marketplace UI within the DSH Web Profile and a self-maintained central Registry: scanners regularly verify candidate plugins, and only entries that pass validation are opened for one-click installation; otherwise, manual commands or Agent-guided paths are taken. The SkillHub directory page classifies it as a “workflow” tool, and its current version is v0.9.2 (MIT License).

What Is This¶

dsh-plugin-marketplace is a plugin marketplace plugin for DeepSeek Harness, offering:

• Discovery and installation of plugins verified by the Registry;
• Updates, start/stop, uninstallation, and batch management of installed plugins;
• For plugins requiring builds or manual judgment, guided installation via constrained Agent sessions.

Maintainer: YELEBAI. GitHub repository: YELEBAI/dsh-plugin-marketplace. SkillHub directory page: skillhub.cn/plugins/YELEBAI/dsh-plugin-marketplace.

The marketplace does not directly display all repositories under the GitHub dsh-plugin topic; only plugins written into the central Registry are shown. This differs from simply browsing topic lists, as the installation source is locked to a precise commit or exact npm version, avoiding handing over mutable main or latest directly to package managers.

Core Features¶

Registry Scanning and Validation¶

The scanner performs incremental scans every two hours on topic:dsh-plugin archived:false, locks the 40-character commit SHA of the default branch, and then statically validates the manifest, bundle patch, loader entry, runtime artifacts, and installation source. Items that pass validation are written to registry/plugins.json; those with insufficient evidence but valid structure enter guided installation audits; invalid structures are logged in registry/rejected.json.

The scanner does not install dependencies or execute third-party code. When the remote Registry is temporarily unavailable, the Registry snapshot bundled within the npm package can still support the marketplace’s basic functionality.

Four Installation Modes¶

Marketplace UI: Three Subpages¶

After installation and startup, navigate to Settings → Plugins → Plugin Marketplace:

• Plugin Marketplace: Search, categorize, sort by Stars, view validation information, and install plugins; supports the Star growth trend over the last 7 days.
• Installed Plugins: Filter by update/start/stop status, update, uninstall, enable, or disable individually or in batches; can safely restart DSH.
• Management & Diagnostics: Manual command installation, select plugin installation location, configure Agent workspace, and run conflict diagnostics.

Agent-Guided Installation¶

For plugins that still require builds or lifecycle scripts, the marketplace displays Agent Install (for installed plugins, guided updates show Agent Update). The first step of each guided task loads the built-in install-dsh-plugin Skill, performs read-only checks in a dedicated workspace, and then requests confirmation item-by-item via DSH’s native approval layer. By default, the Agent is bound to $DSH_HOME/marketplace/agent-workspace, which can be switched to an existing directory in Management & Diagnostics → Agent Install & Update Workspace.

Installation Management and Conflict Diagnostics¶

Installed plugins support batch updates, enable, disable, and uninstallation, with a maximum of 50 per batch. Update determination isn’t just based on version numbers: even if the version number hasn’t changed for a GitHub source, if the Registry-verified commit differs from the currently installed commit, a prompt for an available update is shown.

The conflict panel performs heuristic static diagnostics on enabled plugins, checking for duplicate Bundle IDs and common Cordis service registration patterns. Diagnostics do not execute JavaScript and may produce false positives, but they block newly introduced conflicts before installation, updates, or enabling.

Installation and Enabling¶

First, use the official command to install the marketplace plugin into the Web Profile. The installation command from the README is as follows:

dsh plugin --profile web add github:YELEBAI/dsh-plugin-marketplace#v0.9.2

For local development, you can point to a local directory:

dsh plugin --profile web add D:/path/to/dsh_Market

After installation, start DSH:

dsh --profile web

After startup, navigate to Settings → Plugins → Plugin Marketplace to use it. The marketplace plugin runs with the current DSH process privileges; please inspect the source code and MIT license terms yourself before installation.

Typical Usage¶

One-Click Install from Marketplace¶

On the marketplace homepage, find the target plugin by category or search, view the Registry validation information, and click install. Plugins that meet the automatic installation conditions will complete the installation using the precise source locked by the Registry, without the need to manually write commands.

Manual Command Installation¶

In Management & Diagnostics → Manual Command Installation, paste the official installation command, for example:

dsh plugin --profile web add github:owner/repo#ref

You can also just enter github:owner/repo#ref. The input is not passed to the shell; the marketplace only accepts a single GitHub installation command for the current profile, rejecting extra arguments, pipes, multiple commands, and dangerous refs. Tags or branches are first resolved to a precise commit, then package.json, bundle patch, and conflicts are validated; lifecycle scripts are disabled during installation.

Managing Installed Plugins¶

On the Installed Plugins page, you can check for updates, batch start/stop, or uninstall. To immediately sync with the remote Registry, clicking Check for Updates bypasses the cache. If a plugin requires a restart after the operation, you can use the Restart DSH function provided on the page, which restarts with the same parameters and profile.

Using a Custom Registry¶

The default central Registry address is:

https://raw.githubusercontent.com/YELEBAI/dsh-plugin-marketplace/main/registry/plugins.json

You can override it with an environment variable before starting:

$env:DSH_PLUGIN_REGISTRY_URL = 'https://raw.githubusercontent.com/OWNER/REPOSITORY/main/registry/plugins.json'
dsh --profile web

Alternatively, set registryUrl in the plugin configuration. Remote content is cached by default for 15 minutes and supports ETag; if a refresh fails, it falls back to the in-package snapshot.

Suitable Scenarios and Notes¶

Who is it for:

• Developers using the DSH Web Profile who wish to discover, install, and manage community plugins in a single interface;
• Teams requiring Registry pre-validation, precise commit locking, and batch operation capabilities;
• Organizations maintaining their own plugin lists and wanting to reuse the same scanning and validation processes.

Notes when using:

• Plugins run with the current DSH process privileges; please read the source code and license terms before installing third-party plugins.
• Agent installation involves untrusted inputs like README, Issues, scripts, and dependencies; manual approval is still required before executing builds or postinstall operations.
• Community directories like SkillHub are independent sites and have no official affiliation with DeepSeek / High-Flyer; this marketplace is also not an official app store.
• The marketplace’s self-update reads the version from this repository’s main branch and pins the installation source to the resolved precise commit.

Conclusion¶

dsh-plugin-marketplace combines “discover plugins” and “install securely” into a single workflow: Registry scanning and validation provide trusted sources, the marketplace UI covers search, installation, updates, and conflict diagnostics, and complex scenarios are handed over to constrained Agent sessions. If you are already using the DSH Web Profile to extend capabilities, you can install v0.9.2 using the above command and then access the plugin marketplace from the settings panel to try it out.

• SkillHub directory page: https://www.skillhub.cn/plugins/YELEBAI/dsh-plugin-marketplace
• GitHub repository: https://github.com/YELEBAI/dsh-plugin-marketplace