dsh-plugin-market turns discovered DSH repositories into a verified catalog with safe install specs

Find the real plugins. Install the safe ones.

dsh-plugin-market adds a plugin marketplace to DeepSeek Harness. Browse a continuously curated catalog inside Settings → Plugin Marketplace, inspect the evidence behind each entry, and install or remove verified plugins without leaving the Web UI.

The catalog is deliberately conservative: deterministic rules decide whether an artifact is installable; model-generated summaries and tags are display-only and never authorize an install.

Current catalog proof

The repository snapshot generated on 2026-08-15 contains:

Catalog entries	One-click installable	Verified on npm	Verified from source
3,518	936	716	220

Every one-click action executes a normalized package spec from the catalog—not a shell command copied from a repository README.

Why Plugin Market?

Capability	What it changes
Verified install paths	npm manifests, DSH bundle metadata, patch files, and build readiness are checked before an entry becomes installable.

Tier	Required evidence	Marketplace behavior
`verified-npm`	The npm registry manifest declares `dsh.bundle`.	One-click install from the exact published package name.
`verified-git`	The repository declares `dsh.bundle`, has a valid `cordis.patch.yml`, and can build during Git installation.	One-click install from `github:owner/repo`, with a build-script warning.
`likely-plugin`	Plugin signals exist, but unattended installation cannot be proven.	Browse and copy manual clone/build steps.
`related`	Ecosystem project without a mountable DSH bundle.	Browse only.

Field	Source	Executed?
`installSpec`	Deterministic npm/Git classification	Yes, after the host safety gate
`installHint.command`	Author README, extracted by the model	No, display-only

Field	Default	Purpose
`registryUrl`	`''`	Catalog source. Falls back through repository `data/v1/catalog.json`, local cache, then the packaged seed snapshot. npm installs normally begin with the seed until a remote URL is configured.
`refreshIntervalHours`	`6`	Background refresh interval. Use `0` to disable scheduled refreshes.
`allowInstall`	`true`	Set to `false` to reject all install/uninstall mutations and keep browsing only.
`profileDir`	inferred from `ctx.baseUrl`	Escape hatch for non-standard profile layouts; normally leave unset.

@nanmicoder/dsh-plugin-market

安装

说明文档

Find the real plugins. Install the safe ones.

Current catalog proof

Why Plugin Market?

Install

npm

Build from source

How it works

Trust model

README hints are evidence, not commands

Marketplace experience

Configuration

Boundaries

Catalog development

Development

Releasing

License