dsh-plugin-market

A DeepSeek Harness plugin that browses the deepseek-harness plugin library — every public repository tagged with the GitHub topic dsh-plugin — and shows it as a ranked list of plugin cards.

Each card carries:

• 缩略图 / thumbnail — the repository owner avatar,
• 介绍 / description — the repo description,
• 星标 / stars — stargazers_count,
• 排名 / rank — position by star count (descending),
• 更新日期 / update date — last push (pushed_at).

What it ships

dsh-plugin-market is a dual-face bundle (node + browser):

1. Web dock panel「插件技能库」 (browser half). A dock entry above the chat composer opens the manager: 已安装 (built-in / self-made / community plugins plus installed Skill packages — enable/disable hot toggles, update, uninstall), 插件库 (topic search, categories, installability precheck incl. monorepo sub-package discovery, one-click install, restart), and 技能库 (GitHub skill-topic search with SKILL.md detection for single-skill and collection repos, installed into the skills root — live, no restart).
2. Model-facing tool browse_dsh_plugins (node half, index.js). The same catalog for the agent, rendered as a card grid through a Conversation Node.
3. Settings「重启 Web」section: one-click Web restart and a deepseek-harness self-update (git pull + install + build) with a live log.

Install

Package the plugin into a tarball, then install that tarball into the profile:

cd dsh-plugin-market
pnpm pack                              # -> dsh-plugin-market-0.1.0.tgz

# from your deepseek-harness checkout
pnpm dsh plugin --profile web add ../dsh-plugin-market/dsh-plugin-market-0.1.0.tgz

Install the tarball, not the directory. dsh plugin add ./dsh-plugin-market (a bare directory) records a link: dependency, and Node then resolves the plugin's @deepseek-ai/dsh-tools import from the linked directory's real path instead of the profile's node_modules — which fails with ERR_MODULE_NOT_FOUND. The tarball installs the files inside the profile's node_modules, where the harness's own packages resolve normally.

pnpm prints a peer dependency warning for @deepseek-ai/dsh-tools; that is expected — the harness itself provides it (autoInstallPeers is off), and it is already present in the profile.

Verify the layer composed, then restart the Web profile:

pnpm dsh --profile web --dump-config | grep -A2 dsh-plugin-market
pnpm dsh web

Restart the running server: a node-half (host) plugin is not hot-reloadable. The browser half joined the dsh.client roster at compose time, so it too is picked up on the next boot.

Usage

Ask the agent, for example:

Use browse_dsh_plugins to list the top 20 DSH plugins.

Tool arguments:

Argument	Type	Default	Meaning
limit	number	25	How many plugins to return (clamped to 1–100).
sort	string	stars	stars (rank by star count) or updated (last push).
filter	string	related	related (default) or all. See the filtering note below.

Noise filtering

The dsh-plugin topic is noisy: many repositories tag it for exposure without being DeepSeek Harness plugins. By default (filter: "related") the tool keeps only repos whose name or description — or one of their other topics — mentions deepseek, dsh, or harness (case-insensitive). Pass filter: "all" to list every tagged repo.

GitHub rate limits & optional token

All GitHub calls work with zero setup: unauthenticated requests allow 60 requests/hour (core API: file and tree probes used by precheck and skill detection) and 10 requests/minute (search). On top of that, the plugin keeps a 1-hour persistent disk cache (~/.dsh/.cache/dsh-plugin-market.json) for skills search and SKILL.md detection results, so routine browsing rarely touches the API at all — the panel's 刷新 button bypasses the cache on demand.

Heavy users can raise the core quota to 5,000 requests/hour by setting a GitHub token of their own before boot. A token used only for public-repo reads needs no scopes at all (a classic PAT with everything unchecked, or a fine-grained PAT limited to "Public Repositories (read-only)"):

# Windows (persistent for new processes)
setx DSH_PLUGIN_MARKET_GITHUB_TOKEN ghp_xxx

# macOS / Linux (current shell; add to your profile for persistence)
export DSH_PLUGIN_MARKET_GITHUB_TOKEN=ghp_xxx

The plugin reads it at request time and sends it as a Bearer token.

Never commit or bundle a token into the plugin package or repository. GitHub scans public repos and auto-revokes leaked tokens, and every install would share — and burn — one account's quota. Each user sets their own token through the environment variable above. With GitHub CLI installed, gh auth token prints a ready-to-use token right after gh auth login.

How it works

• The node half registers the tool globally through ctx.tools.register(...), so every agent (including web sessions composed from an agent preset) sees it through the tools scope chain.
• The fetch targets a fixed public API (https://api.github.com/search/repositories?q=topic:dsh-plugin&sort=stars) with its own timeout and cancellation.
• The tool returns one canonical JSON value and projects the same list into output.presentationMeta ({ kind: 'dsh-plugin-market', plugins, … }). That projection is persisted on the durable tool/result event.
• The browser half registers a ConversationNodeDefinition that matches those tool/result events and renders the thumbnail grid — replay-safe, no extra durable event type required.

Notes & limits

• Only public repositories tagged dsh-plugin are listed (GitHub search scope).
• updatedAt uses pushed_at (last commit push) rather than metadata changes.
• The thumbnail is the GitHub owner avatar; repositories have no separate per-repo thumbnail in the topic/search API.

License

MIT