dsh-marketplace

Community plugins for DeepSeek Harness are scattered across GitHub repositories, and the manual loop of searching, verifying bundle format, and hand-writing profile dependencies is both tedious and error-prone. dsh-marketplace consolidates plugin discovery, search, inspection, installation, update, and removal into a single Marketplace tab under Settings, keeping the entire lifecycle within the Harness interface and eliminating the need to bounce between terminals.

The install pipeline enforces multiple security gates: a candidate package is first staged in an isolated temporary project, then must pass pre-built entry validation, bundle patch declaration checks, and real-path escape detection before it is atomically written into the profile dependency. A failed install simply does not activate, and a failed uninstall restores the previous manifest. Staging always uses the --ignore-scripts flag so unknown scripts are never executed, write endpoints require loopback pairing plus a process nonce, and GitHub data is rendered as plain text only, drawing a clear security boundary around third-party repositories.

It is well suited for developers who frequently extend their Harness workflow through third-party plugins, and for teams that want a single controlled surface for the full plugin lifecycle while keeping supply-chain security boundaries explicit and auditable.