DSH-plugin-market

DSH does not ship with a built-in plugin marketplace, so administrators who want to distribute plugins or let users install third-party extensions are stuck with manual downloads and command-line scripts. DSH-plugin-market fills that gap by embedding a web settings page directly into DSH, where users can add HTTPS plugin repositories, refresh the catalog, and install or remove plugins with a few clicks, consolidating what used to be a terminal-only workflow into a single visual interface.

Security and controllability are at the core of every design decision. Repositories must be served over HTTPS, manifests are validated for field types, path traversal, and SHA-256 checksums, and downloads are written to a temporary directory first, then atomically swapped into the install path only after verification succeeds. Downloaded code is never auto-executed. Static plugins are disabled by default after install, with enable or disable states persisted to a patch file that takes effect on the next DSH restart. Dynamic plugins only expose manual start and stop controls when the manifest declares controllable: true and the Host explicitly injects a lifecycle controller.

This plugin is best suited for team administrators building a private DSH plugin distribution pipeline, and for DSH operators who need to manage multiple HTTPS plugin repositories from a unified interface while enforcing strict security boundaries. Note that the plugin depends on host-mounting logic not yet merged into the DSH core, so the corresponding integration patch must be applied before first use.