Preface

DSH’s extension model is plugin-based, and community projects typically need to address several specific types of issues: where extensions are discovered, how Profiles are generated, how recovery works after installation, how the settings interface is presented, and how the installation process remains rollback-capable.

OMDSH Hub is a community project in the omdsh-dev/dsh-hub repository, positioned as the community extension catalog and Profile generation manager for DeepSeek Harness. It is not an official app store and has no official affiliation with DeepSeek / 幻方.

What This Is

OMDSH Hub provides a community extension catalog and Profile generation management, reusing existing Harness capabilities.

Verified information is as follows:

  • GitHub repository: omdsh-dev/dsh-hub
  • Package name: @omdsh/dsh-hub
  • License: MIT
  • package.json is marked private: true to prevent npm publishing; the public GitHub repository does not require removing this protection
  • Current package version: 0.1.0-rc.1

Core Capabilities

OMDSH Hub’s capabilities center around the extension catalog, Profile generation, and Harness integration.

Verified capabilities include:

  1. Provides a community extension catalog and Profile generation manager.
  2. Supports transactional installation, recovery, catalog browsing, and settings UI.
  3. Reuses Harness Profiles, Bundles, Repository Plugins, Agent Presets, layered Skill registries, Cordis lifecycle, and configuration contracts.
  4. Provides an extension manager, Workshop bridge, and agent ecosystem services.
  5. Registers a loopback-only admin API at the endpoint /omdsh/extensions/v1.
  6. Installs the official-v2 ready-to-run adapter.
  7. The client contributes an Extensions settings section, supporting Installed, Discover, collections, recipes, updates, and history views.

Integration with Harness

The Host-side entry point is dist/index.mjs. It provides an extension manager, Workshop bridge, and agent ecosystem services, registers a loopback-only admin API, and installs the official-v2 ready-to-run adapter.

The admin endpoints are:

/omdsh/extensions/v1

Mutation requests are restricted to the loopback Host, cross-site Fetch Metadata is rejected, and an Origin header, when present, must be matched against the HTTP Origin.

The pre-built client entry point is dist/client.js. It contributes the Extensions settings section via the standard client manifest and supports the following views:

  • Installed
  • Discover
  • collections
  • recipes
  • updates
  • history

Security and Transaction Model

OMDSH Hub’s installation and update flows use a generation management approach.

The verified security model includes:

  1. Installation and update operations are staged into a new physical Profile generation.
  2. Package manager lifecycle scripts are disabled by default.
  3. Registry documents are strictly parsed, and remote replacements require configured Ed25519 signatures.
  4. A candidate generation takes effect only after configuration validation and readiness confirmation at runtime.
  5. Failed candidates are discarded, and the previous generation remains recoverable.

Local Verification

Local verification requires Node.js 22 or higher.

Run the following commands:

npm ci --ignore-scripts
npm run validate
npm run pack:check

validate checks exact npm package versions, contract declarations, JavaScript syntax, vendored Registries, and the full Node test suite.

pack:check inspects the package manifest without publishing and rejects local npm configurations.

@deepseek-ai packages require registry read access. A short-lived NPM_TOKEN must be provided via process environment variables, following the local npm configuration described by the package owners. Do not place specific tokens into the repository.

Dependencies and Registry Status

This release candidate was verified against npm next channel packages queried on 2026-08-13:

  • Cordis 4.0.1-rc.4
  • DSH client and Host contracts 0.0.1-rc.5

Verified materials also state that when @deepseek-ai/dsh-repository-plugin is not available on the npm registry, Git-source catalog entries remain guided integrations, and OMDSH does not declare these entries as installable via an npm-provided Repository Plugin.

Installation and Enablement

Verified materials do not provide official installation commands, so this article does not construct installation commands.

If you plan to verify the repository locally, first run the local verification commands from the previous section. If you plan to enable it, review the source code, license, registry access permissions, and local npm configuration before installation. Since this plugin runs with the current dsh process permissions, it is recommended to confirm that the admin endpoints, Profile generation, remote replacement signatures, and lifecycle script policies align with your environment requirements before enabling.

Applicable Scenarios and Considerations

Suitable for the following scenarios:

  1. Managing a community extension catalog for DSH environments.
  2. Managing generation, installation, updates, and recovery of Harness Profiles.
  3. Requiring the Extensions settings section and Installed, Discover, collections, recipes, updates, and history views.
  4. Requiring a transactional installation flow with rollback capability for failed candidates.

Points to note:

  1. This project is a community project, not an official app store.
  2. package.json is marked private: true to prevent npm publishing.
  3. The admin API is restricted to the loopback Host.
  4. Remote replacements require configured Ed25519 signatures.
  5. Package manager lifecycle scripts are disabled by default.
  6. Do not commit NPM_TOKEN to the repository.

Links

  • Catalog page: https://www.skillhub.cn/plugins/omdsh-dev/dsh-hub
  • GitHub: https://github.com/omdsh-dev/dsh-hub