DSH Plugin Marketplace (dsh-plugin-marketplace)

Manual: clone this repository into ~/.dsh/profiles/web/node_modules/dsh-plugin-marketplace and register it in ~/.dsh/profiles/web/cordis.patch.yml:

- insert:
    - id: dsh-plugin-marketplace
      name: dsh-plugin-marketplace

One-liner to hand to an AI (command execution capability required):

Install the DSH Plugin Marketplace plugin (dsh-plugin-marketplace): run dsh plugin --profile web install bradeGithub/DSH-Plugins-Marketplace; if the dsh CLI is not available, clone https://github.com/bradeGithub/DSH-Plugins-Marketplace into ~/.dsh/profiles/web/node_modules/dsh-plugin-marketplace and register it in ~/.dsh/profiles/web/cordis.patch.yml (id: plugin-marketplace, name: dsh-plugin-marketplace). After completion, restart dsh web.

flowchart LR
  CI["GitHub Actions<br/>每 2 小时增量扫描 topic:dsh-plugin"] -->|提交回 main| REG["registry.json / skills.json<br/>静态索引"]
  REG -->|"① Contents API .gz"| UI["市场列表页"]
  REG -->|"② jsDelivr → raw（.gz 优先）"| UI
  REG -.->|"③ 内置索引 → 磁盘缓存"| UI
  UI -.->|"全失败才兜底"| API["GitHub Search API<br/>10 次/分 · TTL 10 分钟"]
  UI --> CMP{"与 installed.json 比对<br/>六段已安装判定"}
  CMP -->|"未安装 / 需更新"| INS["克隆 → 类型识别 → 环境变量扫描"]
  INS --> GATE{"含安装脚本或<br/>npm 生命周期脚本？"}
  GATE -->|是| OK["弹窗确认后执行"]
  GATE -->|否| DONE["写入 cordis.patch.yml<br/>与 installed.json"]
  OK --> DONE
  CMP -->|"已装版本更低"| UPD["显示「更新」按钮"]

• The index contains only repository metadata (name / description / Star / update time / tags / license); installation still clones directly from github.com.
• Installed-detection pipeline: install manifest → host-directory heuristic (dirOwners) → artifact identification → profile mapping hit (bidirectional slug/repository-name/pkg_name/repository check) → script cache → cached package-name mapping re-looked-up in the profile; @deepseek-ai/* official plugins are automatically excluded.
• Marketplace self-update only accepts release tags SSH-signed by the maintainers (local signature verification + tag↔version↔commit SHA binding; fails closed and rejects update on failure).

For layered architecture, index building algorithms, version-detection source tables, and detection details, see docs/ARCHITECTURE.md; for the security model, see docs/SECURITY.md.

~/.dsh/
├── profiles/web/
│   ├── node_modules/dsh-plugin-marketplace/   ← 插件本体
│   └── cordis.patch.yml                       ← 注册条目
└── marketplace/
    ├── cache/<owner>__<name>/                 ← 克隆缓存（安装与版本比对数据源）
    └── installed.json                         ← 已安装清单

Write-operation auth is consistent: loopback requests are passed through directly; LAN requests require the lanWrite: true config plus the x-dsh-marketplace-token session header. Uninstall relies on the installed.json record — only plugins "installed via this marketplace" can be fully uninstalled. See docs/HTTP-API.md for the full API contract (body fields / return values / state machine).

Harness Desktop: a third-party maintained Windows desktop edition that ships this marketplace built into its stable release (that entry was submitted by the desktop author, who also maintains the marketplace branch used by the desktop client); awesome-dsh-plugin: a community-curated list that serves as the data source for the "Community Featured" badge, cross-listed with this marketplace. Neither is affiliated with DeepSeek official.

Code contributors: lgnorant-lu (core contributions including write-endpoint auth, security/robustness fixes in PR #63, and the mechanized test system in PR #66), baiyuscc13724-max (Harness Desktop integration and install-flow simplification #1/#2), anupamme (OrbisAI Security, verify-installability SSRF whitelist protection #213); any / bubble / tatakaria — early contributions. Ecosystem collaborators: qing3a (dsh-plugin-verify, drives the "✓ Verified" badge), wwumit (skills-catalog, drives the "Disclosure ✓" badge), ylwl1997 (dshbase mutual recognition of listings), awesome-dsh-plugin maintainers (cross-listing PR #994).

Thanks to every user who reports issues via marketplace feedback and issue reports — your reports directly drive the pace of fixes. To contribute, see docs/CONTRIBUTING.md and STANDARD.md §7 Self-Test Checklist.