dsh-whale-market

Thousands of community plugins and ten-plus thousand agent skills are scattered across GitHub, and hunting, vetoing, and tracking them one by one is slow and risky. dsh-whale-market collapses that entire pipeline into the native DSH web settings page: a live GitHub Search API feed over the dsh-plugin and agent-skills topics, backed by a four-level fallback chain (disk snapshot, a static index of 4,260 plugins and 2,000 skills, and a built-in seed) so browsing and keyword search keep working even on a flaky connection or behind a restrictive network.

Before anything touches your disk, the plugin runs type detection (cordis plugin / skill / preset / install script / manual), a compatibility score with manifest checks, and a dangerous-pattern scan for download-and-exec, auto-start writes, credential reads, and rc tampering. Script-type and unknown-type repositories must pass an explicit confirmation dialog. The install pipeline is fully asynchronous with live progress, cancellation, credential scrubbing, automatic pnpm retry, and an automatic fallback to codeload tarballs when direct git fails behind proxy rewrites. After installation, favorites surface update notifications, history can be exported as JSON or backed up over WebDAV, the audit log supports sanitized export, and the marketplace itself can self-update with one click.

Four Agent tools (market_search, market_install, market_installed, market_update) let conversations drive the whole workflow, while plugin authors get a compliance scaffold and a pre-publish checklist that covers package.json, patch files, and host templates. It is built for DSH power users who want a single native surface to discover, audit, install, and maintain community plugins, and for tech leads who need a unified, auditable entry point for plugin lifecycle management across a team.