DSH Plugin Marketplace

The DeepSeek Harness action layer for DSH Index discovery, user-confirmed installs, issue tracking, and labelled community knowledge.

Status: release foundation implemented; not published to npm yet. The package, dsh-index CLI, DSH manifest, consent gates, provider adapters, release workflow, Marketplace API contract, and supported Web entry points are in this repository. The DSH Index Marketplace API is live with production D1, rate-limit bindings, and an inaccessible Worker secret; the npm package still awaits its first public release. This release is verified against the local DeepSeek Harness 0.1.0-rc.5 checkout.

Search a source, then select Install. Marketplace adds an editable Install plugin prompt to the current Harness message box; it never installs a discovered repository silently.

DSH Index and Marketplace are complementary:

Product	Responsibility	It does not do
DSH Index	Public discovery, daily snapshots, observed movement, and moderated community reference	Certify a repository, audit security, or recommend an installation
Marketplace	DeepSeek Harness action layer: search, inspect, user-confirmed install, issue drafts/status, and contributions	Silently install packages, silently file issues, or publish raw user data

Intended one-command install

The release package will be @dshindex/dsh-plugin-marketplace and will declare both a DSH bundle patch and a Web client bundle. Once the first npm release is published, the complete Marketplace installation will be:

dsh plugin --profile web add @dshindex/dsh-plugin-marketplace

Then restart dsh web. This is the official DSH profile-plugin flow: dsh plugin forwards to pnpm in the selected profile, detects the package's dsh.bundle.patch, and mounts the patch on the next boot. The Marketplace package will include its host plugin, client plugin, and dsh-index CLI in that one package.

Until publication, there is no supported install command. The package is built and unit-tested in CI, but the final temporary-profile smoke test requires the npm scope and first release; users must not install an unbuilt Git checkout.

What the plugin will provide

Human users in DSH Web

1. Marketplace discovery — search and inspect DSH Index sources, see the current indexed total, and add Install plugin to the active message box for the Agent to resolve. This is an editable prompt, never a background installation.
2. Issue widget — turn a failure into a previewed GitHub or Gitee Issue draft; the user reviews and explicitly submits it. Submitted issues are watched for state changes.
3. Star / feedback widget — after an attributable plugin use, invite the user to give a score, FAQ answer, or pitfall report. They can submit, defer, or permanently stop prompts. Public display happens only after DSH Index moderation.

Agents and CLI

The same typed Marketplace client will power both the DSH tools and the dsh-index CLI, rather than maintaining two incompatible APIs:

dsh-index doctor
dsh-index plugins list --query "git" --tag workflow --cursor 
dsh-index plugins summary
dsh-index plugins show owner/repo
dsh-index install prepare owner/repo
dsh-index issue draft github owner/repo --title "…" --body "…"
dsh-index issue submit github owner/repo --title "…" --body "…" --confirm
dsh-index issue watch github owner/repo 42 --etag 
dsh-index report score owner/repo --score 4 --share
dsh-index report faq owner/repo --text "…" --share
dsh-index report pitfall owner/repo --text "…" --share

The CLI is an interface to the same policy-enforced library, not a route around consent. In Harness, the equivalent abilities are model-callable tools whose side-effecting calls must go through the normal user-approval policy.

Design boundaries

• A GitHub dsh-plugin topic match is a discovery candidate, never an installable, compatible, or safe-plugin claim.
• Marketplace offers an Install handoff for every displayed source: it writes Install plugin into the active message box so the user can edit or submit it to the Agent. Only a separately verified install descriptor may lead to an actual package-install command.
• Installation displays the exact package specification and profile, and needs user confirmation. There is no background install.
• The Issue flow submits only after showing a redacted preview. Tokens, secrets, source files, and raw conversation transcripts are excluded by default.
• A score or report is private until the author opts in and DSH Index approves it. Unmoderated data never changes a public leaderboard.
• Issue polling is local and conservative; it uses conditional reads and backoff. Webhooks are only an optimisation for repositories where a Marketplace GitHub App is explicitly installed.

Why this package shape

The topic page is not a quality bar: it currently contains thousands of repositories, including projects merely advertising DSH support. We inspected the projects below for concrete, reusable implementation lessons.

Project	What is useful	Marketplace decision
dsh-web-ui	An npm-published aggregate package uses dsh.bundle.patch and dsh.client; users install it with one dsh plugin --profile web add … command. It also demonstrates that bundles must declare their child dependencies.	Use one published bundle package for Marketplace rather than asking users to patch cordis.yml manually.
ModLens	A single package combines a host plugin, Web client bundle, package manifest, CLI, and conservative host routes. Its code treats uncertain UI/host capabilities as fail-closed.	Keep one canonical core library with host, client, and CLI adapters; make network and side-effect failures visible rather than pretending success.
dsh-task-board	It has to inject a sidebar row with DOM selectors because the current DSH sidebar has no public list slot for third-party navigation.	Do not use DOM scraping. Marketplace contributes a supported sidebar.footer.action Marketplace entry and a Settings tab; it does not claim a new top-level sidebar navigation section.

See the implementation plan for the delivery order, API contracts, trust model, and acceptance tests.

Repository plan

src/
  core/          # schemas, policy gates, typed DSH Index client
  host/          # Cordis plugin, tools, local issue-watch state
  client/        # supported DSH Web slot contributions and widgets
  cli/           # dsh-index command, same core/policy client
  providers/     # GitHub and Gitee adapters
tests/
cordis.patch.yml # bundle entry inserted by dsh plugin
package.json     # exports ., ./client and bin dsh-index

Maintainer release checklist

No credential is stored in this repository. Before the first release, the npm scope owner needs to:

1. Create or confirm ownership of the public @dshindex npm scope.
2. Create an npm granular automation token limited to publishing packages in that scope.
3. Add it in GitHub under Settings → Secrets and variables → Actions as NPM_TOKEN; optionally protect the npm-publish environment with required reviewers.
4. Push a signed/tagged v0.1.0 release. The release workflow runs checks and publishes with npm provenance.

The workflow contains only the secret reference, never the token value. Local credentials use ignored .env files or the host credential store.

Sources checked

• DeepSeek Harness: first plugin tutorial and “Into the harness”
• DSH client-module contract
• GitHub dsh-plugin topic
• GitHub Issues API and Issues webhooks

License

MIT. See LICENSE.