# DSH-Plugins-Marketplace

> Third-party plugins and general Skills marketplace within DSH Web GUI: automatically indexes all GitHub repositories tagged with dsh-plugin, agent-skills, or claude-skills. The settings page provides browsing, one-click installation, version detection, and installed status identification.

## Metadata

- Author: [@bradeGithub](https://github.com/bradeGithub)
- Repo: <https://github.com/bradeGithub/DSH-Plugins-Marketplace.git>
- GitHub: [bradeGithub/DSH-Plugins-Marketplace](https://github.com/bradeGithub/DSH-Plugins-Marketplace)
- Stars: 129
- Language: JavaScript
- License: [MIT](https://spdx.org/licenses/MIT.html)
- Topics: `agent`, `ai-agents`, `cordis`, `deepseek-harness`, `dsh`, `dsh-plugin`, `javascript`, `llm`, `marketplace`, `nodejs`, `plugin`, `plugin-marketplace`
- Forks: 7
- Open Issues: 17
- Last push: 2026-08-20T21:12:08.000Z
- Added: 2026-08-20T00:00:00.000Z

## Install

```bash
dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace
```

## Wiki

## One-Line Description
DSH Plugin Marketplace is an "app store" embedded in the DeepSeek Harness Web GUI settings page: automatically pulls all third-party plugins tagged with `dsh-plugin` and general Skills from `agent-skills` / `claude-skills` from GitHub, provides browsing, searching, one-click installation, version checking, auto-update, and installed status recognition—moving the command-line installation process to a visual interface.

## Core Features
- Auto-browse all third-party plugins with `dsh-plugin` topic on GitHub (~3900+), sorted by Star count, installed items pinned to top
- Auto-browse general Skills from `agent-skills` and `claude-skills` topics (~14000+), search + infinite scroll pagination + one-click install to local Skills directory
- Intelligent recognition of four repository types (cordis plugin / Skill / agent preset / install script), follows corresponding installation path based on type
- Five-level "installed" status detection: installation manifest + directory heuristic + package name mapping + repository ownership check + self-identification, auto-compares when opening marketplace
- Version detection and one-click update: compares installed version with latest repo version; button turns orange "Update" when mismatched; npm-published types compare via dist-tags from source
- Installed plugins' environment variables can be re-edited (API Keys, etc.), takes effect after DSH restart; installation backups can be exported/imported and support push to WebDAV
- Installation feedback loop: popup confirms "Working / Not Working" after installation, results auto-sync to GitHub issue (requires Token config); this plugin also has a banner for one-click self-update
- Bilingual UI (Chinese/English) and installation logs, auto-switches following DSH language setting; cards support category chips filtering + badges like Community Curated / Verified / Manual Install Only

## Technical Implementation
- **Language**: JavaScript (ES Modules, distributed with `.js` extension, runs on Node.js)
- **Key Dependencies**: All use Node built-in modules—`node:child_process` (git / npm / pnpm / dsh CLI calls), `node:fs/promises` (clone cache and config read/write), `node:crypto` (session token + timing-safe comparison), `node:zlib` (gzip decode index), `node:os` / `node:path` / `node:url` / `node:util`
- **Architecture Pattern**: Single repo, dual-sided—`lib/index.js` is the server side, after injecting `webServer` it registers 14 HTTP endpoints under `/api/marketplace/*` (list / skills / install / uninstall / self-update / check-update / feedback / env-edit / backup / restore, etc.), mounted via `cordis.patch.yml` bundle mechanism into web profile; `lib/client.js` is the browser bundle (`window.__ModuleLoader__.load` form), injects `slots` + `locale`, registers "DSH Plugin Marketplace" section in "Settings"
- **Entry Files**: `lib/index.js` (server entry and `apply(ctx)` hook), `lib/client.js` (client UI and `apply(ctx)` hook), `cordis.patch.yml` (bundle injection declaration)

## Use Cases
Used when DSH users want to extend their toolset without typing commands in the terminal: aggregating scattered third-party plugins and general Skills from GitHub into a searchable, filterable, one-click installable page, with automatic version tracking. Suitable for DSH users who frequently install plugins, prefer visual operations, or need to sync plugin lists across multiple machines; less helpful for users who only use a few built-in tools or prefer directly editing `cordis.patch.yml` in their IDE.

## Prerequisites & Compatibility
| Dependency | Min Version | Description |
|---|---|---|
| DeepSeek Harness | Not declared | Must use web profile; this plugin injects into `webServer` service via `cordis.patch.yml`, depends on host providing `webServer`, `slots`, `locale`, and `webServer.tapIndex` (older versions without tapIndex will auto fail-closed for LAN write operations) |
| Node.js | Not declared | Heavily relies on Node built-in modules (`node:child_process`, `node:fs/promises`, `node:crypto`, `node:zlib`), recommends using DSH host's required Node version (22.19+ or 24+) |
| Git / pnpm / dsh CLI | Source required | `install.sh` / `install.ps1` header requires `git` and `pnpm` on machine; official installation path uses `dsh plugin --profile web install`; without dsh CLI, script automatically falls back to direct clone + patch registration |
| Platform | Cross-platform | Tested on macOS / Windows / Linux; Windows uses PowerShell for install script, macOS / Linux use bash |
| Native Modules | None | All depends on Node built-in APIs, no native modules introduced |

## Installation
```bash
dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace
```

After installation, DSH must be restarted (run `dsh web` again) before refreshing the page; if using `install.sh` / `install.ps1` script, the installation process will auto-detect `dsh` CLI and prefer the official installation method.

## Configuration Options
| Config | Type | Description | Default |
|---|---|---|---|
| `DSH_HOME` (env var) | Path | DSH home directory root path; marketplace stores clone cache, installed manifest, env edits under `$DSH_HOME/marketplace/` | `~/.dsh` |
| `DSH_MARKETPLACE_ALLOWED_HOSTS` (env var) | Comma-separated hostnames / IPs | Additional trusted Host whitelist—localhost and LAN private subnets are allowed by default; this variable adds public domain names or custom IPs to whitelist (only use when you can confirm safety) | Not set |
| `GITHUB_TOKEN` / `GH_TOKEN` (env var) | GitHub Token | Adds Bearer header when directly connecting to GitHub for indexing, raises rate limit from unauthenticated 60/hour to authenticated 5000/hour; normal users don't need config, list uses CDN index which doesn't call API anyway | Not set |
| `lanWrite` in `~/.dsh/marketplace/config.json` | Boolean | Whether to allow LAN clients to perform write operations like install / uninstall / feedback; when set to `true`, must also carry session token injected in page (`x-dsh-marketplace-token` header); read operations unaffected by this config | `false` (only localhost loopback can write) |
| `token` in `~/.dsh/marketplace/feedback.json` | String | Personal Access Token used when syncing installation feedback to GitHub issue; can be left empty, feedback will open pre-filled page for manual submission instead; if filled, writes to local file | Not set |
| Feedback toggle (page top-right) | UI switch | After closing, "Is it working?" popup no longer appears for successful installations, but server's pending queue is retained, re-opening restores prompts; preference saved in browser localStorage | Enabled |
| Language (DSH global) | Enum | Auto-switches Chinese / English following DSH host "Settings → General → Language"; this plugin has no separate setting | Follows DSH |

## FAQ

**Q: After installation, DSH page has no changes. Must I restart?**

A: Restart is required. DSH's Web profile has config hot-reloading disabled (HMR disabled), `cordis.patch.yml` registration entries or plugin code changes require re-running `dsh web` to take effect; this is host behavior, not this plugin's limitation.

**Q: Does the list itself consume my GitHub API quota?**

A: No. The list is built by the repository's GitHub Actions every 2 hours as a static index (registry.json), users read via jsDelivr CDN, zero API calls throughout; only when manually clicking "Refresh" AND both CDN and raw.githubusercontent sources are unavailable does it fall back to search API, in which case unauthenticated rate limit is 10/minute.

**Q: What forms can a repository be recognized as?**

A: Four types total: cordis plugin (with `package.json`, installed to web profile), Skill (with `SKILL.md`, installed to `~/.dsh/skills/`), agent preset (with `preset.yml` + `agent.cordis.yml`, installed to `~/.dsh/.agent-presets/`), install script (`install.sh` / `install.ps1`, copied then executed). Plugin authors must write corresponding markers per `STANDARD.md` for correct recognition and updates.

**Q: How are plugins requiring API Keys handled?**

A: During step 3, it scans README, `.env` examples, and install scripts; environment variables matching patterns like `API_KEY` / `TOKEN` / `SECRET` / `PASSWORD` will auto-pause, popup asking you to fill in or skip; filled values only pass as environment variables to the subprocess for this installation, not written to any persistent file (except third-party install script's own behavior).

**Q: What if I filled the wrong API Key for an installed plugin?**

A: Installed cards have an "Edit" button, listing environment variable keys scanned for that plugin (value not shown back, configured items are marked), you can add, modify, or manually add new keys; after saving, writes to `~/.dsh/.env` and merges into `envs.json`, takes effect after DSH restart.

**Q: Why do some installed plugins not have an "Uninstall" button?**

A: Uninstall relies on `installed.json` installation records maintained by this marketplace. Only plugins "installed via this marketplace" get the uninstall button, which deletes installation directory, `cordis.patch.yml` registration entry, and installation record together; pre-installed manually, installed via third-party CLI, or placed via non-marketplace channels are only recognized as "Installed", requiring manual directory deletion.

**Q: How does this plugin marketplace update itself?**

A: After detecting a new version in settings, a "vOld → vNew" banner and "Update Now" button appear; clicking triggers the server to clone the latest repository, verify staging integrity, atomically replace the body directory (auto-rollback on failure),完成后重启 DSH 生效；与安装共用全局互斥锁，进行中重复点击会返回 409。

**Q: Can other computers on the LAN use this marketplace?**

A: LAN can browse (read endpoints open to all trusted Hosts), but write operations like install/uninstall are only allowed for localhost loopback by default; to perform write operations on LAN, need to set `{"lanWrite": true}` in `~/.dsh/marketplace/config.json` and carry the session token injected in page (`x-dsh-marketplace-token` header) in requests.

## Learning Curve
Beginner — install with single `dsh plugin` command and find entry in settings page to use; most operations don't require reading documentation; if just using default features, restart DSH after installation and it's ready to use. Advanced operations needed only when dealing with LAN writes, feedback Token, WebDAV backup, or self-hosted index sources.

## Known Issues & Limitations
- **Security Model**: Installation endpoints have no user authentication; protection relies on "local network isolation + CSRF headers + Host whitelist (localhost loopback / LAN private subnet / env var additions) + Origin verification". Do not expose DSH web port to untrusted networks; installation means executing third-party code on your machine (npm dependencies and install scripts), only install repositories you trust and have verified
- Installation task is synchronously hung on a single POST request overall (clone + npm install + build + material confirmation multiple rounds), if there's a reverse proxy with short timeout in front of DSH (default 60s), connection may be cut—backend task will continue executing, frontend needs to refresh status to confirm result
- Version detection only works for cordis plugins with `package.json`; Skill / preset / script types have no version concept; when authors release without bumping version, no update prompt; CLI type (npm published) compares via npm dist-tags, requires clicking "Check Update" manual button to query npm registry in real-time
- Plugin list defaults to static index (CDN), only falls back to GitHub search API when both sources unavailable, in which case unauthenticated rate limit is 10/minute, frequent "Refresh" clicks may trigger rate limit
- Skills index is full volume (14000+), but single repository's SKILL.md detection is batch-completed by Core API quota (CI incrementally continues every 2 hours), undetected repository cards show "Unverified" badge
- Install script type plugin's "installed" detection is based on cache directory existence, after uninstall (deleting cache) it will show as installable again
- "Community Curated" badge comes from third-party awesome aggregation page (default `awesome-dsh-plugin/awesome-dsh-plugin`), when aggregation page fetch fails, this round's build won't update badge (incremental build keeps old badge, next build recovers), inclusion does not represent this marketplace's quality endorsement of the plugin
- Plugin code modifications require DSH restart to take effect (Web profile's HMR is disabled)

---

This document is auto-generated by [deepseek-plugin.org](https://deepseek-plugin.org). HTML page: [DSH-Plugins-Marketplace](https://deepseek-plugin.org/plugins/bradeGithub/DSH-Plugins-Marketplace)
Wiki generated by AI (model: `MiniMax-M2.5`)