DSH Marketplace

DSH Marketplace is an external DeepSeek Harness bundle. It adds a Marketplace surface and an Installed view without modifying DSH upstream.

Install

Install Marketplace into the DSH Web profile. This also works when the dsh CLI is not installed globally:

npx -y --package @deepseek-ai/dsh dsh plugin --profile web add untr-dsh-marketplace@latest

Restart DSH, then click Marketplace in the lower-left sidebar. Marketplace deliberately does not restart or hot-unload DSH.

Registry URL

The host fetches Registry Schema v1 from the public default:

https://untr.github.io/dsh-plugin-marketplace/registry/v1

Development environments and mirrors can override it before starting DSH:

export DSH_MARKETPLACE_REGISTRY_URL=https://mirror.example/registry/v1

The URL must serve meta.json, index.json, and plugins/<github-database-id>.json. The browser never calls GitHub and never needs a GitHub token.

Security model

• The browser sends only a registry plugin ID or an installed package name.
• The host validates the request and derives exact install arguments from the validated registry.
• Commands run through the official DSH CLI with an argument array and shell: false.
• Mutation requests are same-origin JSON, limited to 64 KiB, and serialized by one mutex.
• Third-party plugins are executable code. Registry inclusion is not a security review or endorsement.
• Packages that require build scripts are not installed automatically on DSH 0.1.0-rc.6. Follow pnpm's exact allowBuilds diagnostic in the current profile's pnpm-workspace.yaml, preserving all existing YAML.

Develop and verify

From the workspace root:

pnpm --filter untr-dsh-marketplace typecheck
pnpm --filter untr-dsh-marketplace test
pnpm --filter untr-dsh-marketplace build
pnpm --filter untr-dsh-marketplace pack

Compatibility details are recorded in COMPATIBILITY.md.