Preface

The DSH ecosystem emphasizes “everything is a plugin.” Many capabilities can be integrated into the DSH Web UI as plugins, but community plugins themselves are typically scattered across different repositories or directories. When developers install plugins locally, they often face several specific issues: plugin entry points are hard to find, installation sources are inconsistent, GitHub access is unstable, and third-party plugins may affect web startup.

dsh-workshop is a Steam Workshop-style plugin store for the DeepSeek Harness Web UI: browse, search, and install community plugins with one click, with automatic mirror acceleration and security validation. It integrates the community plugin directory into the DSH Web UI sidebar, centralizing installation, uninstallation, and updates in a single local panel.

It should be noted upfront: the DSH community directory is an independent site with no official affiliation to DeepSeek / High-Flyer; dsh-workshop is also not an official app store and does not constitute a security endorsement of plugins.

Core Features

The main capabilities provided by dsh-workshop are as follows:

  • Independent sidebar entry: Adds a “Workshop” button to the DSH Web UI sidebar. Clicking it opens the workshop panel without occupying the settings page.
  • Browse and search: Supports a card-based grid of 850+ plugins, filterable by category, including UI Enhancement / Tools / Workflow / Notifications / Development / Entertainment, with 5 sorting options and pagination.
  • Chinese descriptions: 122 curated plugins are connected to the official bilingual description library, with side-by-side Chinese-English content visible on the detail page.
  • One-click installation: npm is prioritized, with automatic fallback to GitHub sources; the installation process displays stages and real-time logs.
  • GitHub mirror acceleration: Built-in 7 mirrors with automatic speed testing to select the fastest path; mirrors can also be manually re-tested from the panel, such as ghfast.top / gh-proxy.com / ghproxy.net, etc.
  • Security mechanisms: Blacklist for TUI/standalone distribution plugins, patch pre-check before installation, post-installation artifact validation + automatic rollback, automatic unlock and reinstall when build scripts are blocked by pnpm, and same-origin validation for all write operation interfaces.
  • Installed plugins management: Provides an installed view, supporting uninstallation, reinstallation / updates.

Installation and Activation

dsh-workshop declares in its package.json an engines requirement of node >=18.17. After meeting the Node.js version requirement, you can add this plugin to your DSH profile:

dsh plugin --profile web add dsh-workshop

After installation, you need to restart dsh web for the web-side sidebar entry and panel to take effect:

dsh web

Once started, a “Workshop” entry will appear in the sidebar. Click this button to open the plugin store panel.

Typical Usage

Here is a common local usage workflow.

  1. Click the “Workshop” button in the sidebar. This button is typically a store icon used to open the workshop panel.

  2. Browse, search, or filter plugins by category within the panel. Categories can help quickly narrow down results, such as UI enhancement, Tools, Workflow, Notifications, Development, and Entertainment.

  3. Click a plugin card to view details. The detail page will display the plugin description; if it matches the Chinese description library, side-by-side Chinese-English content will be visible.

  4. Click “One-click install (auto-select source)” or “Install from GitHub”. The installation process will display progress and real-time logs at the bottom of the panel.

  5. After installation completes, restart dsh web for the bundle plugin to take effect.

If a TUI or standalone distribution plugin conflicts with web startup, causing the sidebar entry to disappear, you can execute the uninstall command to restore:

npx -y @deepseek-ai/dsh plugin --profile web remove <package-name>

Security Boundaries

Before installing third-party plugins, you should evaluate their permissions and code impact scope as if running code natively on your machine. dsh-workshop itself provides several layers of restriction, but these restrictions do not equate to plugin quality review.

  • Inclusion is not an endorsement of security: Directory data comes from third-party community indices, and plugins are maintained by their respective authors. Installing any third-party plugin is equivalent to running third-party code on your local machine.
  • Plugin runtime permissions: Plugins run with the permissions of the current dsh process. It is recommended to review the source code, dependencies, licenses, and build scripts before installation.
  • Local same-origin restriction: The workshop API only accepts same-origin requests from local loopback addresses 127.0.0.1 / localhost.
  • Avoid public exposure: Do not expose the dsh web port to the public internet. If exposed via a tunnel, write operation interfaces such as install/uninstall will be rejected by same-origin validation.
  • Compatibility risks: TUI / standalone distribution plugins may conflict with web, causing startup anomalies or the sidebar entry to disappear.

Applicable Scenarios

dsh-workshop is suitable for the following usage patterns:

  • Centrally browsing community plugins within the local DSH Web UI.
  • Needing to install DSH plugins from npm or GitHub sources and wanting to see installation progress.
  • Requiring GitHub mirror acceleration when in Mainland China or under network-restricted environments.
  • Wanting to view installed plugins in a unified manner and perform uninstallation, reinstallation / updates.

It is not suitable for scenarios where the DSH Web UI is directly exposed as a public internet service, nor is it suitable for interpreting “can be installed” as “safe to run.” You should still review plugin source code and licenses yourself before installation.

Conclusion

The value of dsh-workshop lies in bringing the browsing, searching, installation, mirror acceleration, and basic security validation of DSH community plugins into the same Web UI panel. It addresses the fragmented issues of “finding plugins, installing plugins, and managing plugins” during local development, but the security responsibility for the plugins themselves remains with the user.

GitHub repository:

https://github.com/loguhan/dsh-workshop