Introduction

For DSH plugin users, third-party repositories, package names, versions, and installation commands often need to be confirmed separately. DSH Marketplace is an unofficial community plugin maintained by ouyangyipeng that puts GitHub topic:dsh-plugin real-time community repositories into DeepSeek Harness’s Settings → Plugins → Marketplace, supporting plugin discovery, search, check, install, update, and uninstall. The following sections introduce installation, interfaces, caching, security boundaries, and configuration.

Core Capabilities

  • Puts GitHub topic:dsh-plugin real-time community repositories into DeepSeek Harness’s Settings → Plugins → Marketplace
  • Supports plugin discovery, search, check, install, update, and uninstall
  • DS-Harness Desktop has an offline built-in fixed version Marketplace starting from desktop-v0.2.0
  • Supports standard DSH Web profile install, update, uninstall
  • Uses directory cache, ETag revalidation, visible rate-limit status, and stale-on-error fallback
  • Uses pnpm add --ignore-scripts for staging and installation, requiring pre-built entry, bundle patch, and path checks
  • Provides /dsh-marketplace/v1/bootstrap, /dsh-marketplace/v1/catalog, /dsh-marketplace/v1/install, /dsh-marketplace/v1/remove HTTP APIs
  • Only allows same-origin loopback + process nonce calls for write interfaces

Installation and Setup

DS-Harness Desktop

DS-Harness Desktop has an offline built-in fixed version Marketplace starting from desktop-v0.2.0. After opening the application, go to Settings → Plugins → Marketplace; there is no need to install this plugin first.

The built-in version displays “Desktop Built-in” and cannot be updated or uninstalled within the Marketplace; it updates with verified Desktop releases.

Standard DSH Web Profile

Standard DSH Web profile installation requires the current DeepSeek Harness, Node.js ^22.19.0 || >=24.0.0, and pnpm located in PATH.

First, install the specified version:

dsh plugin --profile web add "github:ouyangyipeng/dsh-marketplace#v0.1.1"

Then restart dsh web, and open Settings → Plugins → Marketplace.

After the above steps, to update or uninstall a separately installed DSH Marketplace, use:

dsh plugin --profile web update dsh-marketplace

dsh plugin --profile web remove dsh-marketplace

Typical Usage

After installation, go to Settings → Plugins → Marketplace to browse topic:dsh-plugin community repositories and perform search, check, install, update, or uninstall.

For local development, you can clone the repository and run checks:

git clone https://github.com/ouyangyipeng/dsh-marketplace.git
cd dsh-marketplace
pnpm install
pnpm test
pnpm run typecheck
pnpm run build
pnpm site:check
pnpm pack --dry-run

If the current directory is a checked-out local repository, you can connect to the standard DSH Web profile:

dsh plugin --profile web add "link:$(pwd)"
dsh web

HTTP API

DSH Marketplace provides the following interfaces:

  • GET /dsh-marketplace/v1/bootstrap
  • GET /dsh-marketplace/v1/catalog
  • POST /dsh-marketplace/v1/install
  • POST /dsh-marketplace/v1/remove

Write interfaces only allow same-origin loopback + process nonce calls. It requires the TCP peer, Host, and optional Origin to be loopback, and the process nonce returned by the same-origin bootstrap must be submitted simultaneously. LAN clients, remote Origin, invalid nonce, non-JSON content, body exceeding 16 KiB, and host-bundled repository mutations are rejected; bundled conflicts return HTTP 409.

Directory and Caching

  • GitHub Search returns a maximum of 1,000 results per query
  • The Search API has lower rate limits for unauthenticated users
  • Marketplace does not collect or persist GitHub tokens
  • Standalone install defaults to profile: web, cacheTtlMs: 600000

Security Boundaries

DSH Marketplace can check package format and tighten the installation process, but it cannot prove third-party plugins are trustworthy. Plugins run inside the DSH process after restart; you should still read the source code before enabling them.

It always uses pnpm add --ignore-scripts for staging and installation. Only TypeScript source code, dependencies with prepare/postinstall, actual standalone applications, or repositories without standard DSH bundle declarations still appear in the directory, but installation will explicitly fail.

Configuration

Standalone install uses the following default configuration:

- insert:
    - id: dsh-marketplace
      name: dsh-marketplace
      config:
        profile: web
        cacheTtlMs: 600000

Optional configuration:

  • home: Override DSH Home; empty values sequentially use DSH_HOME and ~/.dsh
  • bundledRepositories: Immutable list of owner/repository owned by the host; default []. Coordinates are normalized on load; illegal values and case-normalized duplicates will cause the plugin to fail to start

Use Cases and Considerations

DSH Marketplace is suitable for DSH plugin developers using the DeepSeek Harness standard Web profile or DS-Harness Desktop to centrally view, install, and update DSH community plugins.

Please note: Marketplace can check package format, but cannot prove third-party plugin trustworthiness. Plugins run inside the DSH process; you should check source code, dependencies, and licenses before enabling them. DSH Marketplace itself is an MIT licensed community-maintained unofficial plugin; DeepSeek Harness, DeepSeek name, and community plugins retain their respective licenses and trademarks.

Links

  • GitHub Repository: https://github.com/ouyangyipeng/dsh-marketplace