dsh-plugin-marketplace

简体中文

A standard DeepSeek Harness profile bundle that adds a GitHub plugin market to Settings → Plugins. It searches public repositories carrying the dsh-plugin topic, verifies that the root package.json declares dsh.bundle.patch, renders result cards with expandable details, and installs a selected repository into the current profile through dsh plugin.

Install

dsh plugin --profile web add github:mengxingGG/dsh-plugin-marketplace --allow-build=dsh-plugin-marketplace
dsh --profile web

Open Settings → Plugins → Plugin market after restarting the profile.

Search and install

• Leave the query blank to list popular repositories from the dsh-plugin GitHub topic.
• Search for a capability such as balance, memory, or tools.
• Paste an exact owner/repository slug or GitHub repository URL to inspect an unlisted repository.
• Expand a card to review its package name, default branch, license, update date, and source URL.
• Choose Install only after reviewing the source. The confirmation explains that third-party package lifecycle scripts and plugins execute with the local account's privileges.

An installation writes the selected dependency and bundle membership to the configured profile. Restart that dsh profile to activate the new Host and Client plugin entries.

Architecture

The package is an ordinary external DSH bundle:

• dsh.bundle.patch points to cordis.patch.yml, which inserts the Host row.
• dsh.client publishes lib/client.js through the Web client module loader.
• The Host registers two same-origin JSON routes on ctx.webServer: search and add.
• The Client contributes one settings.plugins.tab entry and communicates only with those same-origin routes.
• Installation reuses the running dsh launcher's plugin command; no profile mutation logic is duplicated in the browser.

The add route accepts only same-origin POST requests and loopback authorities by default. GitHub credentials are never sent to the browser. Before running a third-party package lifecycle script, the installer removes environment variables whose names contain KEY, SECRET, TOKEN, or PASSWORD.

Configuration

Every field is optional in cordis.patch.yml:

Field	Default	Meaning
topic	dsh-plugin	GitHub repository topic used for discovery
searchMaxResults	8	Maximum repositories inspected per search, 1–30
requestTimeoutMs	15000	Timeout for each GitHub request
installTimeoutMs	300000	Timeout for one package installation
profile	web	Profile mutated by the add route
tokenEnv	GITHUB_TOKEN	Optional environment variable for a GitHub token
allowRemote	false	Permit same-origin non-loopback clients

Anonymous GitHub access has restrictive rate limits. Set the configured token environment variable when repeated discovery exhausts the anonymous allowance.

Development

pnpm install
pnpm run check

pnpm run check runs strict type checking, four focused test files, both Host and Client builds, and verifies the client module-loader registration.

License

MIT