Preface¶

In DSH (DeepSeek Harness), the common practice for the plugin ecosystem is to search GitHub for dsh-plugin, manually execute the installation command after finding a repository, and then open the README to understand its usage. dsh-plugin-market brings this entire workflow into the DSH Web interface: browse community plugins, translate searches, favorite, install, update, uninstall, and view READMEs.

Additionally, it introduces a static security audit gate before installation and updates: it first checks the artifact about to be installed, then decides whether to auto-install. It is maintained by nanshan1995 and licensed under MIT. It is presented here as a DSH community plugin, not as an official app store from DeepSeek / Hangfang; DSH’s extension ecosystem emphasizes “everything is a plugin,” and the community catalog is also an independent plugin source separate from the official store.

What This Is¶

dsh-plugin-market is a plugin marketplace running inside DeepSeek Harness: you can browse community plugins under the GitHub dsh-plugin topic, perform Chinese-English translated searches, install, update, and uninstall with one click, and run static audits on specific release artifacts before installation.

It primarily solves three types of problems:

• Plugin discovery, installation, inspection, updating, and README viewing are scattered across different interfaces.
• There is no unified static inspection entry point before installation.
• Chinese users lack translation assistance when searching for English plugins.

Core Capabilities¶

Community Browsing and Favorites¶

• Browse plugins under the GitHub dsh-plugin topic, sortable by stars or latest update.
• Paginated list loading using the “Load more” button.
• GitHub returns a maximum of 1000 results; the interface displays the actual total, and search can cover results beyond the browsed list.
• The favorite button on community cards can save plugins to a personal “My Favorites” section. Favorite information is stored in the profile and persists across restarts.

Chinese-English Translated Search¶

• Supports real-time keyword search.
• Built-in Chinese/English synonym tables, with real-time LLM translation applied to queries.
• Chinese queries can find English plugins, and English queries can find Chinese plugins.
• The interface displays Translated as: ... to confirm the actual search terms used.

Static Audit Before Installation¶

Before installation or update, dsh-plugin-market downloads the exact artifact to be installed and performs a static audit.

Verified hard-block rules include:

• Dynamic execution capabilities.
• Credential paths or sensitive environment variables.
• Install scripts: preinstall, install, postinstall; for git installs, this also includes prepare.
• Patches that override other plugins.

If the audit blocks, the interface presents two choices: Install anyway and Cancel. Install anyway forces the download, with risk borne by the user; Cancel aborts the installation.

Installation, Update, and Uninstall¶

• Installation flow: download source, static audit, auto-install if passed.
• Ongoing installations, updates, uninstalls, and operations awaiting audit-block decisions are pinned to the top of the list, with real-time progress displayed.
• Installed plugins support sorting by installation time.
• Hot enable/disable is supported without restarting.
• Disabled plugins remain disabled after restart.
• Update checks and one-click updates are supported; updates also pass through the audit.
• Uninstall uses a two-step confirmation on the same button: click uninstall first, the button enters a confirmation state, then click again to execute; clicking elsewhere reverts it.
• Log export and pnpm self-service installation are supported.

README Viewing¶

• Open plugin READMEs within the marketplace.
• HTML tables and image rendering are supported.
• Language links within READMEs can switch language files.
• Cache TTL is 30 minutes.
• Fixes garbled READMEs caused by double encoding, and displays a corresponding marker after repair.

Git Repository Links¶

For installed plugins, repository links are resolved with the following priority:

• The repository field in package.json or GitHub homepage.
• github: installation spec text.
• Scanning the plugin’s own README.

Once resolved, the spec text or the Source button can open the repository.

Cross-Platform and Networking¶

• Supports macOS, Windows, and Linux.
• README and audit downloads support network adaptation: proxy detection, direct connection fallback.

Installation and Activation¶

Prerequisites¶

• DeepSeek Harness’s dsh web is running.
• pnpm is available; the marketplace can detect and provide installation instructions.
• Windows requires version 10 1803 or later, because the audit step uses bundled bsdtar.

Installation Command¶

Install from the GitHub source:

dsh plugin --profile web add github:nanshan1995/DSH-Plugin-Market

After installation, restart DeepSeek Harness, then open:

Settings → Plugin Market

Typical Usage¶

Finding Plugins¶

1. Go to Settings → Plugin Market.
2. Browse the dsh-plugin topic list, click “Load more” for pagination.
3. For more precise searches, enter keywords and check the actual search terms in Translated as: ....

Favoriting Plugins¶

Click the favorite button on any community plugin card, and the plugin will be saved to your personal “My Favorites.” Favorited plugins support the same install, update, uninstall, and README viewing operations as the community list.

Installing Plugins¶

1. Click Install.
2. The system downloads the corresponding source and performs a static audit.
3. If the audit passes, the plugin auto-installs.
4. If the audit blocks, choose Install anyway or Cancel.

Managing Installed Plugins¶

In the “Installed” section:

• Sort by installation time.
• Hot enable or disable plugins.
• Perform update checks and one-click updates.
• Uninstall via a two-step confirmation button.
• Click the repository link or Source to open the source repository.

Viewing READMEs¶

Click the README entry for a plugin to open its usage instructions within the marketplace. Language links in the README can switch languages; when a double-encoding fix is applied, the interface provides a repair notice.

Missing dsh.bundle Declaration¶

If a plugin does not have a dsh.bundle declaration, a yellow alert appears after installation, along with a Let the Agent handle it button to let the Agent complete the follow-up wiring.

Configuration Options¶

The following environment variables are from verified sources.

Applicable Scenarios and Notes¶

Suitable for the following scenarios:

• Managing multiple plugins in DSH Web and wanting a unified entry point.
• Needing to browse GitHub dsh-plugin community plugins instead of opening repositories one by one.
• Chinese users searching for English plugins, or English users searching for Chinese plugins.
• Wanting static checks on plugin artifacts before installation.

Points to note:

• This is a DSH community plugin, not an official DeepSeek / Hangfang app store.
• Plugins run with the current dsh process permissions at runtime. Before installation, check the source code, license, and author provenance.
• dsh-plugin-market itself is MIT-licensed; community plugins may have different licenses.
• The audit is a pre-install static check, not a runtime sandbox. When choosing Install anyway to force installation, the risk is borne by the user.
• GitHub search is subject to API rate limits; a token can be configured if necessary, but tokens should only be sent to api.github.com.

Conclusion¶

dsh-plugin-market consolidates DSH plugin discovery, search, installation, updates, README viewing, and pre-install auditing into a single web entry point. If you maintain DSH plugins or need a more secure way to install community plugins, you can install it using the GitHub command above and try it out.

Verified links:

• GitHub repository: https://github.com/nanshan1995/DSH-Plugin-Market
• License: MIT

The currently verified sources do not provide the catalog page URL, so this article does not include a catalog link.