DSH-Plugins-Marketplace

129Stars7Forks17Issues0Watchers

Third-party plugins and general Skills marketplace within DSH Web GUI: automatically indexes all GitHub repositories tagged with dsh-plugin, agent-skills, or claude-skills. The settings page provides browsing, one-click installation, version detection, and installed status identification.

Categories🖥️ UI Enhancements🛠️ Developer Tools
bradeGithubbradeGithub
·bradeGithub/DSH-Plugins-Marketplace.git
Language
JavaScript
License
MIT
Branch
main
agentai-agentscordisdeepseek-harnessdshdsh-pluginjavascriptllm

Install

$ dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace

Run the command above in your terminal to install this plugin via the dsh CLI. You can switch Profile in the top-right corner. New to dsh? Read the beginner tutorial

One-Line Description

DSH Plugin Marketplace is an "app store" embedded in the DeepSeek Harness Web GUI settings page: automatically pulls all third-party plugins tagged with dsh-plugin and general Skills from agent-skills / claude-skills from GitHub, provides browsing, searching, one-click installation, version checking, auto-update, and installed status recognition—moving the command-line installation process to a visual interface.

Core Features

  • Auto-browse all third-party plugins with dsh-plugin topic on GitHub (~3900+), sorted by Star count, installed items pinned to top
  • Auto-browse general Skills from agent-skills and claude-skills topics (~14000+), search + infinite scroll pagination + one-click install to local Skills directory
  • Intelligent recognition of four repository types (cordis plugin / Skill / agent preset / install script), follows corresponding installation path based on type
  • Five-level "installed" status detection: installation manifest + directory heuristic + package name mapping + repository ownership check + self-identification, auto-compares when opening marketplace
  • Version detection and one-click update: compares installed version with latest repo version; button turns orange "Update" when mismatched; npm-published types compare via dist-tags from source
  • Installed plugins' environment variables can be re-edited (API Keys, etc.), takes effect after DSH restart; installation backups can be exported/imported and support push to WebDAV
  • Installation feedback loop: popup confirms "Working / Not Working" after installation, results auto-sync to GitHub issue (requires Token config); this plugin also has a banner for one-click self-update
  • Bilingual UI (Chinese/English) and installation logs, auto-switches following DSH language setting; cards support category chips filtering + badges like Community Curated / Verified / Manual Install Only

Technical Implementation

  • Language: JavaScript (ES Modules, distributed with .js extension, runs on Node.js)
  • Key Dependencies: All use Node built-in modules—node:child_process (git / npm / pnpm / dsh CLI calls), node:fs/promises (clone cache and config read/write), node:crypto (session token + timing-safe comparison), node:zlib (gzip decode index), node:os / node:path / node:url / node:util
  • Architecture Pattern: Single repo, dual-sided—lib/index.js is the server side, after injecting webServer it registers 14 HTTP endpoints under /api/marketplace/* (list / skills / install / uninstall / self-update / check-update / feedback / env-edit / backup / restore, etc.), mounted via cordis.patch.yml bundle mechanism into web profile; lib/client.js is the browser bundle (window.__ModuleLoader__.load form), injects slots + locale, registers "DSH Plugin Marketplace" section in "Settings"
  • Entry Files: lib/index.js (server entry and apply(ctx) hook), lib/client.js (client UI and apply(ctx) hook), cordis.patch.yml (bundle injection declaration)

Use Cases

Used when DSH users want to extend their toolset without typing commands in the terminal: aggregating scattered third-party plugins and general Skills from GitHub into a searchable, filterable, one-click installable page, with automatic version tracking. Suitable for DSH users who frequently install plugins, prefer visual operations, or need to sync plugin lists across multiple machines; less helpful for users who only use a few built-in tools or prefer directly editing cordis.patch.yml in their IDE.

Prerequisites & Compatibility

DependencyMin VersionDescription
DeepSeek HarnessNot declaredMust use web profile; this plugin injects into webServer service via cordis.patch.yml, depends on host providing webServer, slots, locale, and webServer.tapIndex (older versions without tapIndex will auto fail-closed for LAN write operations)
Node.jsNot declaredHeavily relies on Node built-in modules (node:child_process, node:fs/promises, node:crypto, node:zlib), recommends using DSH host's required Node version (22.19+ or 24+)
Git / pnpm / dsh CLISource requiredinstall.sh / install.ps1 header requires git and pnpm on machine; official installation path uses dsh plugin --profile web install; without dsh CLI, script automatically falls back to direct clone + patch registration
PlatformCross-platformTested on macOS / Windows / Linux; Windows uses PowerShell for install script, macOS / Linux use bash
Native ModulesNoneAll depends on Node built-in APIs, no native modules introduced

Installation

dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace

After installation, DSH must be restarted (run dsh web again) before refreshing the page; if using install.sh / install.ps1 script, the installation process will auto-detect dsh CLI and prefer the official installation method.

Configuration Options

ConfigTypeDescriptionDefault
DSH_HOME (env var)PathDSH home directory root path; marketplace stores clone cache, installed manifest, env edits under $DSH_HOME/marketplace/~/.dsh
DSH_MARKETPLACE_ALLOWED_HOSTS (env var)Comma-separated hostnames / IPsAdditional trusted Host whitelist—localhost and LAN private subnets are allowed by default; this variable adds public domain names or custom IPs to whitelist (only use when you can confirm safety)Not set
GITHUB_TOKEN / GH_TOKEN (env var)GitHub TokenAdds Bearer header when directly connecting to GitHub for indexing, raises rate limit from unauthenticated 60/hour to authenticated 5000/hour; normal users don't need config, list uses CDN index which doesn't call API anywayNot set
lanWrite in ~/.dsh/marketplace/config.jsonBooleanWhether to allow LAN clients to perform write operations like install / uninstall / feedback; when set to true, must also carry session token injected in page (x-dsh-marketplace-token header); read operations unaffected by this configfalse (only localhost loopback can write)
token in ~/.dsh/marketplace/feedback.jsonStringPersonal Access Token used when syncing installation feedback to GitHub issue; can be left empty, feedback will open pre-filled page for manual submission instead; if filled, writes to local fileNot set
Feedback toggle (page top-right)UI switchAfter closing, "Is it working?" popup no longer appears for successful installations, but server's pending queue is retained, re-opening restores prompts; preference saved in browser localStorageEnabled
Language (DSH global)EnumAuto-switches Chinese / English following DSH host "Settings → General → Language"; this plugin has no separate settingFollows DSH

FAQ

Q: After installation, DSH page has no changes. Must I restart?

A: Restart is required. DSH's Web profile has config hot-reloading disabled (HMR disabled), cordis.patch.yml registration entries or plugin code changes require re-running dsh web to take effect; this is host behavior, not this plugin's limitation.

Q: Does the list itself consume my GitHub API quota?

A: No. The list is built by the repository's GitHub Actions every 2 hours as a static index (registry.json), users read via jsDelivr CDN, zero API calls throughout; only when manually clicking "Refresh" AND both CDN and raw.githubusercontent sources are unavailable does it fall back to search API, in which case unauthenticated rate limit is 10/minute.

Q: What forms can a repository be recognized as?

A: Four types total: cordis plugin (with package.json, installed to web profile), Skill (with SKILL.md, installed to ~/.dsh/skills/), agent preset (with preset.yml + agent.cordis.yml, installed to ~/.dsh/.agent-presets/), install script (install.sh / install.ps1, copied then executed). Plugin authors must write corresponding markers per STANDARD.md for correct recognition and updates.

Q: How are plugins requiring API Keys handled?

A: During step 3, it scans README, .env examples, and install scripts; environment variables matching patterns like API_KEY / TOKEN / SECRET / PASSWORD will auto-pause, popup asking you to fill in or skip; filled values only pass as environment variables to the subprocess for this installation, not written to any persistent file (except third-party install script's own behavior).

Q: What if I filled the wrong API Key for an installed plugin?

A: Installed cards have an "Edit" button, listing environment variable keys scanned for that plugin (value not shown back, configured items are marked), you can add, modify, or manually add new keys; after saving, writes to ~/.dsh/.env and merges into envs.json, takes effect after DSH restart.

Q: Why do some installed plugins not have an "Uninstall" button?

A: Uninstall relies on installed.json installation records maintained by this marketplace. Only plugins "installed via this marketplace" get the uninstall button, which deletes installation directory, cordis.patch.yml registration entry, and installation record together; pre-installed manually, installed via third-party CLI, or placed via non-marketplace channels are only recognized as "Installed", requiring manual directory deletion.

Q: How does this plugin marketplace update itself?

A: After detecting a new version in settings, a "vOld → vNew" banner and "Update Now" button appear; clicking triggers the server to clone the latest repository, verify staging integrity, atomically replace the body directory (auto-rollback on failure),完成后重启 DSH 生效；与安装共用全局互斥锁，进行中重复点击会返回 409。

Q: Can other computers on the LAN use this marketplace?

A: LAN can browse (read endpoints open to all trusted Hosts), but write operations like install/uninstall are only allowed for localhost loopback by default; to perform write operations on LAN, need to set {"lanWrite": true} in ~/.dsh/marketplace/config.json and carry the session token injected in page (x-dsh-marketplace-token header) in requests.

Learning Curve

Beginner — install with single dsh plugin command and find entry in settings page to use; most operations don't require reading documentation; if just using default features, restart DSH after installation and it's ready to use. Advanced operations needed only when dealing with LAN writes, feedback Token, WebDAV backup, or self-hosted index sources.

Known Issues & Limitations

  • Security Model: Installation endpoints have no user authentication; protection relies on "local network isolation + CSRF headers + Host whitelist (localhost loopback / LAN private subnet / env var additions) + Origin verification". Do not expose DSH web port to untrusted networks; installation means executing third-party code on your machine (npm dependencies and install scripts), only install repositories you trust and have verified
  • Installation task is synchronously hung on a single POST request overall (clone + npm install + build + material confirmation multiple rounds), if there's a reverse proxy with short timeout in front of DSH (default 60s), connection may be cut—backend task will continue executing, frontend needs to refresh status to confirm result
  • Version detection only works for cordis plugins with package.json; Skill / preset / script types have no version concept; when authors release without bumping version, no update prompt; CLI type (npm published) compares via npm dist-tags, requires clicking "Check Update" manual button to query npm registry in real-time
  • Plugin list defaults to static index (CDN), only falls back to GitHub search API when both sources unavailable, in which case unauthenticated rate limit is 10/minute, frequent "Refresh" clicks may trigger rate limit
  • Skills index is full volume (14000+), but single repository's SKILL.md detection is batch-completed by Core API quota (CI incrementally continues every 2 hours), undetected repository cards show "Unverified" badge
  • Install script type plugin's "installed" detection is based on cache directory existence, after uninstall (deleting cache) it will show as installable again
  • "Community Curated" badge comes from third-party awesome aggregation page (default awesome-dsh-plugin/awesome-dsh-plugin), when aggregation page fetch fails, this round's build won't update badge (incremental build keeps old badge, next build recovers), inclusion does not represent this marketplace's quality endorsement of the plugin
  • Plugin code modifications require DSH restart to take effect (Web profile's HMR is disabled)
← Back to plugin directory