dsh-plugin-hub

DSH Plugin Hub plugin

English | 中文

Find plugins, explore rankings, and manage installations without leaving DeepSeek Harness. Settings → Plugin Hub has four tabs: Plugin marketplace, Installed, Rankings, and Tasks. Discover a plugin, review its installation plan, then follow the result. You can also ask your Agent to search the catalog or check local plugins and task status in a conversation.

The plugin connects to the public, read-only DSH Plugin Hub catalog API for published and verified community plugins, install commands, compatibility data, community metrics, and source links. The Settings page and conversation tools coexist; opening the marketplace website is not required to search. Installs, updates, and removals run locally after you review and confirm them.

Install · Browse in Settings · Search in a conversation · Tool inputs · Response fields · Configuration

Capabilities

• Read Chinese or English descriptions; the conversation search tool also supports category, runtime type, installation source, ordering, and page filters.
• Return concise actionable text in Native mode and the complete structured result in PTC mode (called Code Mode in earlier releases).
• Validate every public API response field and expose pagination, data freshness, and anonymous quota metadata.
• Honor Harness cancellation, configurable timeouts, 429 retry information, and stable error categories.

Public catalog access only calls GET /api/v1/plugins/search and GET /api/v1/plugins/{owner}/{repo} and requires no API key. The Installed tab reads the configured profile locally. When a dependency exposes a public GitHub repository, only that owner/repo is sent to look up the catalog version; package specs, profile contents, and filesystem paths are not uploaded. The local task queue invokes the official dsh plugin --profile ... CLI only after the user reviews and confirms a structured plan in Settings.

Install and run

Requires an installed DeepSeek Harness and Node.js ^22.19.0 || >=24.0.0. The Settings page requires Web-profile client extension support; it does not appear in an environment without the Web client. Plugin searches need no additional API key; conversation use still requires a working model configured in Harness.

Install the npm package into the Web profile:

dsh plugin --profile web add @czj-git/dsh-plugin-hub

Inspect the composed configuration and start Harness:

dsh --profile web --dump-config
dsh --profile web

Open Settings → Plugin Hub, or try a conversation prompt below. If Harness is already running, restart it after installing or updating the plugin, then refresh the page.

Harness versions and authentication

Development dependencies target the 0.1.2-rc.1 SDK. The client uses Cordis Context and the independent UI renderer, not the removed dsh-client-runtime. Peer ranges explicitly include prereleases starting with 0.1.0-rc.7, 0.1.1-rc.2, and 0.1.2-alpha.5. npm test dispatches search and ranking calls through the actual Harness tool registry, covering safety metadata, compatibility ranges, nullable values, and absent fields from older API responses.

When the Web profile requires browser authentication, open the startup URL printed by dsh web. Never share its token with the website or another person. Opening a bare local URL may return 401. The website handoff flow is described below.

Plugin Hub in Settings

After the Web profile starts, open Harness Settings and select Plugin Hub in the left sidebar. The page uses the native Settings layout and Harness theme variables, follows the active Chinese or English locale, and never embeds an external page. Switching languages refetches the marketplace and rankings in the active locale and updates descriptions, detail links, and date formatting without a page reload; unfinished requests for the previous locale are cancelled.

Plugin marketplace · Installed · Rankings · Task center

Plugin marketplace

See what is already installed while browsing the catalog. The amber Review install action means compatibility needs review, not that an installation failed.

• Published and verified plugins default to GitHub Stars ordering; entering a keyword switches to relevance ordering.
• Nine marketplace categories and pagination are available. Category filters wrap so every option stays visible. The compact two-column desktop grid becomes one column in a narrow window.
• Each card shows the plugin name, owner, description, verification, category, Stars, views, package source, and primary language.
• The primary action reflects local state and compatibility: Install, Update, Installed, or Incompatible. Unknown compatibility shows an amber Review install or Review update action. A known-incompatible plugin cannot be installed from its card.
• Install and update actions open a plan with the source, version, compatibility, and risk notices. Only explicit confirmation creates a task; clicking a card does not immediately change the profile.
• The plugin name and detail arrow open its public DSH Plugin Hub detail page in the browser.

Installed

Check what is actually installed in the selected profile. Local and catalog versions are shown separately. The LOCAL badge here reflects a development installation; use the npm command above for a regular installation.

The Installed tab reads the current profile's package.json, resolved package versions, and dsh.profile.bundles instead of guessing local state from the website:

• It separates declared dependencies, actual installed versions, and activation in the profile bundle layer.
• It labels npm, GitHub, local, and unknown sources, plus missing and inactive packages.
• Catalog matches use semantic-version ordering for Matches catalog or an available update. Versions that cannot be compared safely are not mislabeled as upgrades.
• Only an explicit catalog 404 becomes Not listed. Network failures become Catalog unavailable without hiding local state.
• An uninitialized or empty profile gets an explicit empty state, and local inventory works offline.
• Local routes expose no CORS headers or filesystem paths. When newer versions exist, the Installed tab shows a count and can review one update or all available updates.
• Batch review refetches every catalog detail independently, then summarizes pinned source, target version, normalized operation, compatibility, and build-approval notices in one confirmation dialog. One confirmation queues the plans serially.
• Every declared dependency can enter removal confirmation. If batch queueing stops partway through, the UI reports how many tasks were already queued instead of encouraging a blind retry.

Rankings

The Top stars view shows GitHub Star totals alongside each plugin. Switch ranking modes or filter by category to explore the catalog from another angle.

• Daily growth uses GitHub Star change between the latest two successful metric snapshots and shows “Pending” without a baseline.
• Top Stars orders by total GitHub Stars.
• Newly listed orders by first listing time in DSH Plugin Hub.
• Recently active orders by the latest GitHub push time.
• A compact single-column list retains rank, avatar, owner, description, category, verification, and the selected ranking metric, with category filtering and pagination.

Task center

Succeeded means the CLI completed and the on-disk profile was reconciled, not that the running process has loaded the new plugin. The amber notice asks you to restart Harness to activate the change; it is not an installation error. Expand View redacted log to inspect the execution record.

Install, update, and removal are two-step operations: preview a plan, then confirm task creation. The confirmation panel shows the profile, package, pinned source and version, normalized CLI arguments, compatibility, build approval, permissions, external services, telemetry, risk flags, and restart behavior.

• The browser submits structured operation, profile, owner/repo, and packageName fields, plus an exact version or ref for advanced installation. It cannot submit shell text; the Host refetches catalog or source metadata and local state, then reconstructs fixed argv.
• Confirmation re-resolves catalog data and checks the fingerprint of the reviewed plan. If metadata changed, task creation is rejected until the new plan is reviewed.
• One profile executes tasks serially, and the same package cannot have duplicate active work. States are queued, validating, running, reconciling, succeeded, failed, cancelled, or interrupted.
• Safe POSIX process-group cancellation is available for running work. Failed and interrupted tasks can be retried. Logs redact ANSI controls, credentials, tokens, and private home paths.
• Success requires both a successful CLI result and a fresh local inventory reconciliation. Disk changes require a Harness restart before the new plugin instance is loaded.
• Failed tasks link to the matching Chinese or English build-approval or troubleshooting guide on DSH Plugin Hub.

Plugin counts, positions, versions, and task history in screenshots reflect capture time only. Chinese and English screenshots were taken separately, so local dependency counts may differ too.

Advanced installation

The Installed tab offers advanced installation from an exact npm package version or a public GitHub repository and branch, tag, or commit ref. The Host reads source metadata and resolves GitHub refs to immutable commit SHAs before showing a plan for confirmation. Sources outside the catalog are explicitly unverified; a package.json is not proof of compatibility. Private sources and arbitrary shell commands are not supported.

Continue from the website to Harness

Plugin detail pages and installation guides use Open in Harness to visit the local landing page at http://127.0.0.1:3080/api/dsh-plugin-hub/open. Click Continue in Harness there to enter Plugin Hub. A detail-page link carries only owner/repo and an optional display language; a general guide requests the Plugin Hub Settings page. Neither carries a command, version, package source, or login token. The landing route requires this plugin version 0.4.0 or later; update older installations and restart Harness first.

If the landing page requests sign-in, open the startup URL printed by dsh web in another tab in the same browser, then return to the landing page and continue. Do not append the startup token to a website link. The selection stays in the landing tab and survives authentication redirects that clear query parameters. The landing page never sets authentication cookies, reads credentials, or changes Harness authentication settings.

• The plugin accepts only a strict repository identity or the fixed Settings-page identifier. Duplicate parameters, extra path segments, whitespace, and command-like values are rejected before any preview request.
• A deep link is consumed once and removed from the address bar while unrelated query parameters and the URL fragment are preserved.
• For a valid repository, the local Host refetches catalog detail and verifies the exact package, source, target version, and Harness compatibility before showing the existing structured confirmation dialog.
• Opening a link never installs automatically and never bypasses build-script approval or lifecycle confirmation. Work enters the local queue only after explicit confirmation inside Harness.

Search in a conversation

The Settings page is not the only entry point. When the plugin is enabled, the Agent can still call dsh_plugin_search and dsh_plugin_rankings without opening Settings or asking you to write JSON. Send any one of these prompts in a Harness conversation:

Find a feature:

Use DSH Plugin Hub to search for memory plugins. Return up to 5 results, explain their purpose in English, and include install commands and detail links. Do not install anything.

Browse a ranking:

Use DSH Plugin Hub to show the top 10 plugins by GitHub Stars. Describe them in English and include detail links.

Discover new plugins:

Use DSH Plugin Hub to show the 5 most recently listed plugins. Explain their purpose and provide install commands.

Check local state:

Use DSH Plugin Hub to check installed plugins and recent tasks in the current profile. Tell me which plugins are active, which changes need a restart, and why any tasks failed. Do not change configuration or install anything.

Local queries use dsh_plugin_installed and dsh_plugin_task_status. Both read state without creating installation tasks.

Conversation example: the Agent calls dsh_plugin_rankings and presents Top Stars with descriptions, install commands, and source links.

The model decides whether to call a tool and how to compose its answer. If it does not call one, explicitly ask: “Call dsh_plugin_search with memory as the query and en as the locale.” Search uses keyword matching; if no results appear, try a shorter Chinese or English keyword or remove a filter.

Returned install commands are text, not profile changes. Installing a plugin requires a separate request and remains subject to Harness permissions and approvals. Native mode's compact result omits some compatibility and timestamp fields; use PTC mode (called Code Mode in earlier releases) to read the complete structured result when you need those details.

How it works

flowchart TD
    website["Website: detail / install guide"] --> deeplink["Repository identity or Settings identifier only"]
    deeplink --> settings
    settings["Settings: marketplace / rankings"] --> proxy["Host same-origin search route"]
    installed["Settings: installed"] --> inventory["Host local inventory route"]
    inventory --> profile["Selected Harness profile"]
    installed --> batch["Individual / batch pinned update plans"]
    batch --> manage["Settings: confirmation / tasks"]
    manage --> tasks["Host serial lifecycle queue"]
    tasks --> catalog["Refetch and validate catalog detail"]
    tasks --> cli["Fixed argv to dsh plugin"]
    cli --> profile
    chat["Conversation: search / ranking tools"] --> client["Shared PluginHubClient"]
    proxy --> client
    client --> api["DSH Plugin Hub public read-only catalog API"]
    catalog --> api

The browser does not call the cross-origin public API directly. /api/dsh-plugin-hub/search proxies and validates searches, while /api/dsh-plugin-hub/installed only reads the configured local profile. /api/dsh-plugin-hub/tasks is a private same-origin API without CORS: every mutation must carry an Origin matching the current Host, inputs use strict schemas, and history is stored under Harness home in a 0700 directory and 0600 file.

Configuration

The bundle supplies these defaults:

- id: dsh-plugin-hub
  name: '@czj-git/dsh-plugin-hub'
  config:
    baseUrl: https://dshpluginhub.dev
    locale: en
    timeoutMs: 15000
    maxResults: 10
    profile: web
    taskTimeoutMs: 600000
    taskKillGraceMs: 5000
    taskHistoryLimit: 50
    taskLogBytes: 65536
    npmRegistryUrl: https://registry.npmjs.org
    githubApiUrl: https://api.github.com

Later profile patch layers must restate the complete config object because Cordis patching replaces the row value instead of deep-merging it.

Tool inputs

dsh_plugin_search

Searches published and verified plugins. The tool trims query and collapses consecutive whitespace to one space. An empty normalized query fails before any network request.

Example input:

{
  "query": "vision",
  "locale": "en",
  "category": "multimodal-creative",
  "type": "hybrid",
  "source": "npm",
  "sort": "relevance",
  "page": 1,
  "limit": 5
}

Natural-language example:

Find a DeepSeek Harness plugin that lets a text-only agent analyze screenshots. Prefer npm packages and include the install command.

dsh_plugin_rankings

Lists rankings through the ordering modes of the same public search endpoint. This tool has no keyword, type, or source parameter.

Ranking definitions:

Example input:

{
  "ranking": "stars",
  "locale": "en",
  "category": "coding-tools",
  "page": 1,
  "limit": 10
}

Enumerations

category values:

sort values:

• relevance: exact and prefix matches on names, repositories, and authors lead, followed by contains matches and descriptions; Stars and plugin ID keep ties stable.
• growth, stars, newest, and active: use the same definitions as the ranking tool.

Tool output

The search and ranking tools return the same structured value. PTC mode can consume every field. Native mode uses the text projection below to avoid placing a large JSON object in the model context.

Complete field reference