中文 · English

---

Two Forms

The DSH ecosystem is growing fast, with plugins and skills scattered across GitHub — you never know which are useful, how to install them, or how to combine them into a working setup. DSH Market collects them all on one platform and offers two consumption entry points:

	Web (Live)	DSH Plugin (Dev Complete)
Location	Browser · GitHub Pages static site	DSH sidebar · cordis plugin
Focus	Discovery & evaluation	Installation & management
Content	Plugins (cordis/skill) + bundle sections (ecosystem marketplace)	5-Tab panel · one-click install · beginner recs · personalized recs · scenario recs · AI agent install (see DSH Plugin) + bundle tab
Install	No install, open in browser	npx @deepseek-ai/dsh plugin --profile web add @dsh-market/plugin
Resources	—	Zero-token passive, no daily conversation involvement

Relationship: they only share the same plugins.json data (auto-refreshed daily at 06:00 for stars and descriptions). No other coupling — Web is a standalone site, plugin is a standalone cordis plugin; use them independently: no plugin needed for Web, and installing the plugin doesn't affect the Web site.

Demos

Web	DSH Plugin

Requirements

• DSH ≥ 0.1.5 (latest release 0.1.5-rc.1 tested)
• Node.js ≥ 20

Panel entry auto-adapts: 0.1.5+ uses the standard icon in the left nav; earlier versions fall back to a sidebar button + overlay (maintenance mode, removed in 0.5.0).

Quick Start

Web

No install needed:

https://dsh.market/

Install Plugin

npx @deepseek-ai/dsh plugin --profile web add @dsh-market/plugin

After install, restart harness; a "Plugin Market" entry appears at the sidebar bottom.

Since v0.4.0: AI agent install upgraded to routing mode — first tries zero-LLM direct install (already-installed check → recipe cache → README-parsed commands + smoke test); only when needed does it hand off to a minimal-protocol sub-agent; after a successful one-click install, the recipe is auto-learned for zero-token reinstalls/migrations.

Since v0.4.5: when confirming install you can check 🛡 Security Mode — for unknown or sensitive plugins, this skips zero-LLM direct install and forces the AI sub-agent to run a pre-install security scan: checks for dangerous commands (curl|sh pipe execution / download-and-execute / base64 obfuscation), sensitive-data exfiltration (reading API Key / Token and sending it out), config tampering (overwriting sandbox / approval / permission settings), network exposure & trust-boundary bypass (binding 0.0.0.0, cloud-server deploy / reverse-proxy tunnel exposing local ports to the public internet, relaxed Host validation), and questionable provenance (newly created low-activity repos), etc.; if risk is found, the install is aborted and no commands are executed. Security Mode consumes tokens; for trusted plugins you can leave it off for fast install. Background: DSH once disclosed critical vulnerability QVD-2026-57410 (CVSS 9.8 — spoofing the Host header bypasses the trust boundary, allowing keyless machine control) — exposing a local port to the public internet is equivalent to handing over control; use tunnel reverse-connect for remote access, never expose service ports publicly.

DSH Plugin

A plugin marketplace in the DSH sidebar: beginners up in 3 minutes, gets smarter with use.

Beginner-friendly · Zero barrier

• First open shows a cold-start questionnaire: pick your common scenarios and plugin types, instantly get curated + "for you" picks
• No commands to memorize — one-click install on cards (skill / cordis auto-routed, auto-retry on failure, rollback available)
• Zero-token passive: no resources consumed unless the panel is open, no involvement in daily chats

Personalized recs · Learns as you use it

• Profile built from questionnaire / favorites / GitHub stars / installed plugins, all stored locally
• "For You" updates dynamically with usage (EMA decay); each rec includes a one-line "why"

Scenario recs · Reads current session

• Manually triggered; reads current session title and messages (zero-token) → recommends "what to install for this scenario right now"

AI Semantic Search · Coming Soon

• Local recall of 60 candidates → LLM reranks to 20 with reasoning; candidate pool is fixed regardless of plugin count, off by default to save tokens

AI Agent Install (Routing Mode)

• Not sure whether to install? Leave it to the plugin marketplace: T0 zero-LLM direct install (already installed / recipe cache / README-parsed commands + smoke test) → only when needed, dispatch a minimal-protocol sub-agent (fixed steps + JSON output, no full README reading); on success the recipe is auto-learned; when config is needed, asks you first

Features

• Continuous indexing — daily auto-scan of GitHub topics like dsh-plugin / dsh and community curated lists, full inclusion (currently 7,487 plugins + bundle channel)
• Practical 5-dimension scoring — maintenance activity / practicality / ecosystem heat / convenience / signal quality, weighted geometric-mean fusion; each plugin includes a "why recommended" note
• Chinese experience — auto-generated Chinese summaries and feature tags for all plugins; Chinese search and filtering
• One-click install — plugin version uses deterministic script routing: skill type git clone, cordis type dsh plugin add; retry and rollback on failure
• AI install (routing mode) — zero-LLM direct install first (recipe cache / parsed commands + smoke test; 75%+ of plugins need no AI); when needed, minimal-protocol sub-agent (JSON verdict auto-saved as recipe); install metrics recorded locally (T0 hit rate / AI involvement / success rate)
• 🛡 Security Mode — optional at install confirmation: forces a pre-install AI security scan (dangerous commands curl|sh / obfuscated execution / sensitive-data exfiltration / config tampering / network exposure & trust boundary / questionable provenance); aborts on risk found; addresses DSH plugin supply-chain and network-exposure risks (e.g. QVD-2026-57410 CVSS 9.8); recommended for unknown-origin plugins (consumes tokens)
• Recommendation system — cold-start questionnaire / beginner-friendly / "for you" (personalized profile) / scenario recs (reads session context, see DSH Plugin)
• Bundle ecosystem — Web "Bundle" section + plugin-side bundle tab (browse / entry resolution check / install entry); companion dsh.pack.json bundle protocol (see dsh-bundler)
• Zero-token resident — plugin version is purely passive; no resources consumed unless the panel is open

Usage

Web

Scenario	How to use
Find plugins	Search box (Chinese keywords / tag multi-select / type & score filters)
Check quality	Card radar chart + 5-dimension breakdown + recommendation reason
Install plugins	Copy the real install command from the detail page, or copy the "AI install prompt"

Plugin (5-Tab Panel)

Tab	What it does
Recs	"For you" / curated / scenario recs (manual trigger, reads session context)
Search	Local Fuse search · trending tags · 200+ results paginated
Favorites	Starred plugins to install later
Installed	Detects locally installed (skill dir + profile), one-click uninstall
Settings	GitHub binding (PAT star / device-flow read-only) · rec mode · target profile

Scoring

Practical 5-dim scoring (weighted geometric mean, StarRadar-inspired, "practical, convenient" focus):

Dimension	Weight	Meaning
Maintenance activity	30%	Commits in last 90 days + issue health (DSH iterates fast; easily broken plugins weighted highest)
Practicality	25%	README / docs / examples completeness
Ecosystem heat	20%	Log-normalized stars (p99 dynamic baseline) + fork participation rate (Wilson small-sample robust)
Convenience	15%	Clear install steps + no extra config needed
Signal quality	10%	License / topics / description / README completeness

Each plugin has an explanation (one-line reason for the score). See Scoring docs.

Indexing

Scope: DSH Market is a plugin indexing & discovery platform for the DeepSeek Harness ecosystem — only DSH-specific ecosystem plugins; no general project indexing.

Daily 06:00 auto pipeline scans these sources:

GitHub Actions（每日 06:00 自动收录 + 部署）
  └─ collector（Node，并发 10，24h 缓存）
       ├─ 扫描数据源：
       │    ├─ topic 扫描：dsh-plugin / dsh / deepseek-harness-plugin / dsh-bundle / dsh-skill
       │    │    └─ 多路排序并集（stars + updated + created 各取前 1000，去重合并）
       │    │    └─ GitHub Search API 单查询硬上限 1000 条，多路并集覆盖长尾（~72%+）
       │    │    └─ 限流：Search API 30 次/分钟 → 每页间隔 2.3s，防 403
       │    ├─ awesome 列表 ×2（人工策展社区列表）
       │    ├─ dsh-external 组织
       │    └─ 本仓库提交插件 issue（label: submission / 标题「[提交插件]」）
       ├─ 收录条件（全部满足才收录）：
       │    1. 不是 fork / archived / 官方本体（deepseek-ai/deepseek-harness）
       │    2. 特征检测通过：根目录有 SKILL.md（skill 型）
       │       或 skills/ 目录含 SKILL.md（技能集合）
       │       或 dsh.profile / cordis.patch.yml 等 cordis 标记
       │       或 package.json 依赖含 cordis 关键字（二次确认）
       │    3. 无 stars / 评分门槛——检测通过即收录
       ├─ 元数据 + README：GitHub API（stars / 描述 / 安装命令解析）
       ├─ 实用五维评分 + 解释层
       └─ DeepSeek 增量中文化（只翻译新插件，省 API 费用）
            → data/plugins.json
                 ├─ 同步到 web/public/plugins.json（Web 站 + 插件版共用）
                 └─ 提交 → 构建 → 部署 GitHub Pages

Note: the dsh-plugin topic is just a ticket into the candidate pool — inclusion also requires the repo to actually be a DSH plugin (has SKILL.md or cordis marker). Of 2,000+ repos with the topic, many are not DSH plugins (casual tags / forks); heuristic detection filters them out.

Structure

├─ collector/   # 数据管道（Node + tsx）：扫描 → 检测 → 评分 → 中文化
├─ web/         # Web 站（Vite + React + TS + Fuse.js）
├─ plugin/
│  ├─ core/     # 插件核心层（纯 Node，零 DSH 依赖，可独立测试）
│  └─ ui/       # 插件 UI 层（cordis Host RPC + 浏览器 Client 面板）
├─ schema/      # 共享类型（DshPlugin / MarketData / PracticalScore）
└─ scripts/     # 工具脚本（截图 / 数据注入 / 视觉评审）

Local Dev

# 克隆与安装
git clone https://github.com/2BingLing/dsh-market.git
cd dsh-market
npm install
cp .env.example .env        # 填入 GITHUB_TOKEN（必需）、DEEPSEEK_API_KEY（可选）

# 数据管道（扫描 → 检测 → 评分 → 中文化 → data/plugins.json）
npm run collect

# Web 站
npm run dev -w web          # http://localhost:5173
npm run build -w web        # 生产构建

# 插件端
npm run build -w @dsh-market/core    # 核心层
npm run build -w @dsh-market/plugin  # 插件包（lib/index.js + lib/client.js）

Contribute

Submit a Plugin (Either Method)

1. Add the dsh-plugin topic to your repo — fastest; picked up directly by the daily pipeline
2. Submit via the submit-plugin issue template — fill in repo URL / plugin type / one-line summary

What happens after submission:

提交 issue → 次日 06:00 自动管道提取仓库 → 特征检测
  ├─ 通过（是 DSH 插件）→ 收录进市场 → 自动回复 issue：
  │     ✅ 已收录确认 + 次日更新说明 + 徽章指引 → 自动关闭 issue
  └─ 未通过（非插件）→ 不收录（可重新打开 issue 询问原因）

• Fix data: wrong score / description / install command — file an issue or PR

• Author bio: attach an "author-written intro" at submission; shown in the "Author Bio" section on the marketplace detail page (with author badge) — introduce your plugin in your own words, warmer than auto-generated text. Already-listed plugins can submit a [数据修正] issue to add or correct (supports author bio / summary / install command; applied next day; to clear an existing bio write 作者自述：无; for complex fixes like type changes, file a new submit-plugin issue instead)

• Show the listing badge: included plugin authors can add the DSH Market badge at the top of their README so users recognize it at a glance:

  

  Usage: PLUGIN-BADGE.md (top-rated requires practical score ≥ 80)

License

MIT