dsh-plugin-marketplace

The community plugins for DeepSeek Harness are scattered across GitHub repositories. Installing one typically means searching manually, verifying the package.json structure by hand, and chaining a series of terminal commands, which is a fragmented and error-prone workflow. dsh-plugin-marketplace folds discovery, verification, and installation into a single visual panel under Settings and Plugins, so you can go from browsing to running a new plugin without leaving the browser.

The workflow revolves around three actions: browse, search, and install. Leave the query blank to list popular repositories under the dsh-plugin topic; type a capability keyword such as balance, memory, or tools to narrow results; or paste an exact owner/repo slug or GitHub URL to inspect a project that is not yet trending. Each result card shows the package name, default branch, license, last-update date, and source URL, and expands to reveal full metadata before you commit to an install. The install step reuses the running dsh launcher plugin command internally, so no profile-mutation logic is duplicated on the client side. On the security front, both the search and install routes accept only same-origin loopback requests by default, the installer strips any environment variable whose name contains KEY, SECRET, TOKEN, or PASSWORD before a third-party lifecycle script runs, and GitHub credentials never reach the browser.

It is designed for two audiences: users running a DeepSeek Harness web profile who want to explore and install community plugins without leaving the settings page, and developers publishing dsh plugins who benefit from discoverability under the dsh-plugin topic.