dsh-plugins-store

English · 简体中文

Browse and install DeepSeek Harness plugins from inside DSH, in English or
Chinese. Backed by DSH Marketplace, which writes a
page per plugin rather than linking straight out to GitHub.

The npm package is dshmarketplace-plugin; this repository is
dsh-plugins-store. The names differ because the shorter one was taken.

Install

dsh plugin --profile web add dshmarketplace-plugin

Then /store in any session, or Settings → Plugins → Plugin store.

--profile is not optional. dsh plugin forwards to pnpm inside a profile
directory, so dsh plugin add x exits with required option '--profile
<name>' not specified and installs nothing. Swap web for your profile if
you run another one.

What it does

Safety

Plugins run with your agent's permissions, and a listing is not a security
review. Three things this plugin does about that.

Install commands are validated, never interpolated. The catalogue supplies a
command already built; src/installer.js accepts only a bare npm specifier or
github:owner/repo, refuses anything containing .., and passes arguments as an
array rather than through a shell. If the catalogue were ever compromised, the
blast radius stops there. tests/installer.test.js covers that boundary
specifically — writing it found a real hole, since ../../etc/passwd is only
word characters, dots and slashes.

The browser half cannot reach the shell. It talks to two exact-path local
endpoints, and the install endpoint takes a catalogue entry rather than a
command, so the client cannot widen what runs.

Risk flags gate both paths. Listings carry detected install script,
terminal surface and requires credentials flags. Anything flagged stops for
an explicit confirmation, in the UI and on the agent path alike — and the
confirmation says plainly that an empty list would not have meant it was safe.

Privacy

The plugin sends exactly one thing anywhere: after a successful install, the
plugin's public identifier, so install counts are real. No machine id, no
session id, no user, no query, no telemetry of any other kind. Searches go to
the public catalogue API in order to answer them and carry no identifiers.

DSHM_NO_TELEMETRY=1    # disables the install count entirely
DSHM_API=https://…     # point at a different catalogue

Development

npm install
npm test         # the install-command boundary, and catalogue helpers
npm run build    # esbuild → lib/index.js (node) and lib/client.js (browser)

The browser bundle may only require react and
@deepseek-ai/dsh-client-ui-primitives, and must announce itself through
window.__ModuleLoader__.load. build.mjs enforces both against the emitted
code before writing it, so an unsupported import fails here instead of inside
someone else's harness.

Related

• dshmarketplace.dev — the catalogue, with a
  written page per plugin
• dshmarketplace-cli —
  the same catalogue for coding agents outside DSH
• GET /api/v1/plugins — the public API all three read

Contact

• Community — LINUX DO
• Issues — GitHub Issues

Acknowledgements

• LINUX DO — where the DSH ecosystem is actually being
  discussed, and where this project is published and takes its feedback.
  Plugins whose authors posted them there carry a verified badge in the
  catalogue.
• awesome-dsh-plugin
  (CC0-1.0) — the community registry the catalogue is seeded from.
• ZASENJC/dsh-plugins-store
  (MIT) — reading its source is how the DSH client plugin API was worked out.
  No code was copied; the manifest shape, the two entry points and the slot
  names are public interface, and having them written down saved a lot of
  guessing.

License

MIT. Independent project, not affiliated with DeepSeek. DeepSeek and DeepSeek
Harness are marks of their respective owner, used here only to describe what
this plugin is for.