Introduction¶

DSH’s extensibility can be broken down into plugins, but community plugins are scattered across GitHub. A repository tagged with topic:dsh-plugin does not necessarily mean it is usable or trustworthy. If done manually, the steps include searching, verifying the bundle, reviewing lifecycle scripts, pinning versions, modifying the profile, and confirming loading, which can be quite a few steps.

find-plugin addresses this workflow: it registers tools in DSH, searches for community plugins first, performs static checks and risk disclosure, fixes the commit for installation after DSH approval, and verifies the installation result.

What is this¶

find-plugin is a DSH plugin maintained by graceen2331-prog under the MIT license. It registers two DSH tools: find_plugin and install_plugin.

V1 depends directly on GitHub and the official DSH plugin manager, without introducing a registry, embedding, database, or Web UI.

Core Features¶

find_plugin¶

find_plugin receives:

{ query: string }

It only searches for topic:dsh-plugin on GitHub, sorts by local keywords, and returns at most 5 items. Returned fields include repository name, description, stars, update time, GitHub URL, package name, and bundle patch.

It checks the root package.json, dsh.bundle.patch, and the build entry points referenced by the patch, lists install, prepare, postinstall, and obvious risks, and filters out invalid candidates such as archived or disabled repositories, mixed bundle/profile usage, dangerous paths, empty patches, and missing build artifacts.

GitHub’s unauthenticated search rate limit is low. You can optionally provide a token via DSH_FIND_PLUGIN_GITHUB_TOKEN, GITHUB_TOKEN, or GH_TOKEN, and the token is only sent to api.github.com.

install_plugin¶

install_plugin receives:

{
  owner: string
  repo: string
  profile?: string
}

profile defaults to web. When executed, it fetches the full commit SHA of the default branch and re-verifies the bundle at that SHA; it displays the repository, package, target profile, fixed SHA, lifecycle scripts, and risks in the DSH approval; and continues only if allowed-once.

During installation, it installs github:<owner>/<repo>#<40-char-sha> via the official DSH plugin manager using --ignore-scripts. Afterwards, it verifies profile dependencies, SHA pinning, dsh.profile.bundles, bundle patch, and the official --dump-config.

After successful installation, it returns restartRequired: true; V1 defaults to not hot-loading new bundles in the current runtime.

Installation and Activation¶

Prerequisites:

Node.js 20 or higher.
pnpm must be available in PATH, because the current official DSH plugin manager calls pnpm within the profile directory.

Installing to the web profile:

npx @deepseek-ai/dsh plugin --profile web add github:graceen2331-prog/find-plugin

Then start or restart the Web surface:

npx @deepseek-ai/dsh web

After the steps above, the plugin registers two DSH tools: find_plugin and install_plugin. This repository has committed the lib/ build artifacts; installation and execution do not depend on the package’s own prepare, install, or postinstall scripts.

Typical Usage¶

Call find_plugin in DSH passing { query: string }. After obtaining candidate repositories, you can use install_plugin to install one of them, passing { owner: string, repo: string, profile?: string }; if profile is not passed, it defaults to web.

For development or verification, the repository provides the following commands:

pnpm install --ignore-scripts
pnpm test
pnpm pack

Before publishing, execute the previous GitHub installation command in an empty DSH_HOME, restart the Web surface, and confirm that the two tools have been registered from the DSH tool registry.

Use Cases and Notes¶

Suitable for finding community plugins in DSH and completing checks, approval, and commit pinning before installation. Please note: The GitHub topic is not a trust signal; static checks can only filter obvious issues and cannot replace a full source code audit.

DSH plugins ultimately run within the Harness process and have the permissions of that process; they are not a secure sandbox.

V1 never executes lifecycle scripts of dependencies; plugins that rely on prepare to generate runtime files and do not have committed build artifacts will be filtered out or fail to load. Pinning the top-level repository commit can prevent branch movement between checking and installation, but it does not equal complete supply chain assurance. Approval is a one-time authorization; it will not install if rejected, cancelled, or if there is no available approval channel.

It is recommended to check the source code, license, and repository status before installation. find_plugin has a low unauthenticated search rate limit; if needed, you can use a token; the token is only sent to api.github.com.

Conclusion¶

The value of find-plugin lies in putting the community plugin installation action into a workflow that is checkable, approval-capable, and commit-pin-able. It is not a substitute for source code auditing, nor does it isolate DSH plugins into a sandbox; rather, it reduces common errors caused by manual verification and version drift.

GitHub Repository:

https://github.com/graceen2331-prog/find-plugin

Directory Page (Plugin Trace):

https://www.skillhub.cn/plugins/graceen2331-prog/find-plugin

find-plugin: Search and controlled installation of community plugins in DSH