Preface¶
DeepSeek Harness (DSH) adopts an “everything is a plugin” architecture: capabilities are extended through plugins, rather than modifying the main repository source code. In practice, community plugins are scattered across various GitHub repositories. While there are quite a few projects with the dsh-plugin topic, the lack of a unified entry point means users must manually sift through README files and repository structures to find plugins, verify installation methods, or determine if a specific commit can actually be installed.
The DSH Plugin Marketplace is a standalone, installable DSH bundle that embeds the plugin marketplace directly into DSH’s built-in Settings UI. This article explains what it is, what it can do, and how to install and use it.
What It Is¶
The DSH Plugin Marketplace (npm package name @w2112515/dsh-plugin-marketplace, current version 0.2.4) is maintained by w2112515 and licensed under MIT. It is not part of the official DSH repository, nor is it a standalone web product. After installation into the web profile, the Host Loader mounts the Marketplace Host plugin, and the browser-side entry point is registered under Settings → Plugins → Marketplace. The interface automatically switches languages (Chinese / English) based on DSH’s display language setting.
SkillHub Community Directory Page: https://www.skillhub.cn/plugins/w2112515/dsh-plugin-marketplace
GitHub Repository: https://github.com/w2112515/dsh-plugin-marketplace (12 stars, category: client)
Core Features¶
Plugin Directory and Search¶
The marketplace builds its directory by scanning GitHub repositories with the dsh-plugin topic daily. According to the README, it can discover over 2,200 plugins. The directory is hosted as static JSON on the repository’s GitHub Pages, and browsing does not require a GitHub account or token. Within Settings, plugins can be searched by category and their freshness information can be viewed.
Evidence-Based Installation Eligibility¶
The scanner proves the existence of installation targets at each plugin’s pinned commit. Installation behavior is categorized into three types:
| Directory Entry | What the Scanner Proves | What Happens During Installation |
|---|---|---|
| Automatic install | The pinned commit’s git tree contains all installation targets (entry files, patches, etc.) | pnpm add --ignore-scripts, third-party lifecycle scripts are not executed |
| Needs script review | Targets are missing, but the package declares lifecycle scripts | The script is displayed as-is during the review step; after you explicitly agree, the Host installs it once with --allow-build=<name>, and the agreement is not persisted |
| Manual install | Neither of the above is satisfied | Only provides a repository link; the marketplace takes no action |
Automatic installation pins an immutable 40-character commit, following a capability preflight → short-term review plan → confirm execution workflow. On failure, it rolls back the profile manifest, lockfile, and workspace configuration.
Solution Packs¶
Repositories with both dsh-plugin and dsh-plugin-pack topics and containing a dsh.pack.json manifest can become solution packs. Manifest example:
{
"schemaVersion": 1,
"name": "My Essentials",
"description": "A curated starter set",
"items": ["owner/plugin-a", "owner/plugin-b"]
}
items consists of 1–50 owner/repo strings. The marketplace displays the explicit status of each entry (will auto-install, needs script review, manual install, not in catalog, already installed), along with an honest install N of M count. When installing a solution pack, the process executes serially via the single-plugin plan→execute path. It stops at the first failure and does not perform a full rollback.
Community Ratings¶
Ratings leverage GitHub’s native reactions: each cataloged plugin has a ballot comment under the ratings issue. 👍/👎 represents one vote, with one vote per GitHub account. The details page shows the overall window and the window for the last 90 days; no conclusion is displayed for plugins with fewer than 10 votes. The client is read-only; voting is done on GitHub, and the marketplace does not store credentials.
Agent Tools¶
The Host plugin registers four tools with the DSH agent: marketplace_search, marketplace_detail, marketplace_install, and marketplace_manual_guide. Search and detail tools are read-only. Installation uses the same plan→execute pipeline as the WebUI, requiring manual approval for each invocation. Script-review entries are designed to be rejected for installation via the agent (they must be reviewed in Settings → Plugins → Marketplace). Manual-install entries only fetch repository instructions via the guide tool. You can disable the agent interface by setting agentTools: false in the bundle configuration.
Privacy and Telemetry¶
The README explicitly states: no telemetry, no installation counts, no server; the directory is static JSON hosted on GitHub Pages.
Installation and Enablement¶
Regular users install via npm:
dsh plugin --profile web add @w2112515/dsh-plugin-marketplace
You can also pin an immutable commit (the repository includes build artifacts in lib/, and prepare is not run locally):
dsh plugin --profile web add github:w2112515/dsh-plugin-marketplace#<40-char-commit>
Automatic installation requires the Host to run pnpm 11 (the plugin will also try corepack pnpm). Installations requiring script review need pnpm ≥ 11.7. Even without a package manager, the WebUI can still be browsed, displaying a recovery prompt instead of a false success.
Uninstallation:
dsh plugin --profile web remove @w2112515/dsh-plugin-marketplace
After installation, start the Web UI:
dsh web
The plugin activates after restarting dsh web. During development, you can override the catalog URL:
$env:DSH_PLUGIN_MARKETPLACE_CATALOG_URL = 'https://w2112515.github.io/dsh-plugin-marketplace/plugin-marketplace/catalog-v1.json'
dsh plugin --profile web add D:\Work\dsh-plugin-marketplace
dsh --profile web --dump-config
dsh web
Typical Usage¶
Browsing and One-Click Installation in Settings¶
- Install the marketplace bundle using the commands above and start
dsh web. - Open Settings → Plugins → Marketplace.
- Search or browse by category; click a plugin to view details, including freshness, activity evidence, and community rating links.
- For plugins marked as automatic, confirm the installation plan and execute; for entries needing script review, read the full script before agreeing; for manual entries, follow the repository link to handle it yourself.
Search and Installation in Agent Sessions¶
The agent can call marketplace_search to find plugins and marketplace_detail to view details. Installation via marketplace_install requires manual approval each time; script-review entries must be handled in the Settings UI. The agent can also install the marketplace using standard shell tools:
dsh plugin --profile web add github:w2112515/dsh-plugin-marketplace#<40-char-commit>
dsh --profile web --dump-config
dsh web
Installing Solution Packs¶
Select a solution pack in the Marketplace’s Solution packs view, review the upfront disclosure of the installation composition (e.g., 7 one-click · 1 script-review · 1 manual), confirm, and install; script entries still require individual review and agreement.
Applicable Scenarios and Considerations¶
Suitable for: Developers already using DSH’s web profile who wish to discover, review, and install community plugins from within DSH; teams needing curated solution packs to align capability baselines in one go; scenarios where agents retrieve plugins during sessions but installations still require manual gating.
Considerations:
- This plugin and the SkillHub community directory are independent ecosystem sites, with no official affiliation to DeepSeek / High-Flyer. They are not official app stores.
- Plugins run with the current DSH process permissions; third-party plugins installed via the marketplace also operate under these permissions. Before installation, you should review the target repository’s source code and license. For entries needing script review, be sure to read the entire script before agreeing.
- Automatic installation pins a commit and ignores third-party lifecycle scripts, but it cannot replace your trust judgment of the plugin author and repository content.
package.jsonrequires Node^22.19.0 || >=24.0.0, and the package manager ispnpm@11.7.0.
Conclusion¶
The DSH Plugin Marketplace consolidates the fragmented dsh-plugin ecosystem on GitHub into DSH Settings: the directory is browsable, installation eligibility is backed by commit-level evidence, script installations require per-instance consent, solution packs honestly disclose their composition, and there is no telemetry. If you are already extending capabilities on the DSH web side, you can install it using the official command and try it out under Settings → Plugins → Marketplace.
- Community Directory: https://www.skillhub.cn/plugins/w2112515/dsh-plugin-marketplace
- GitHub: https://github.com/w2112515/dsh-plugin-marketplace
- Chinese README: https://github.com/w2112515/dsh-plugin-marketplace/blob/main/README.zh-CN.md