springbrand-lab/dsh-plugin-market

@springbrand/dsh-plugin-marketplace

The visual plugin marketplace built into DeepSeek Harness Web settings and bundled with SpringBrand Desktop. Open Settings → Plugin Marketplace to browse and search the catalog, then install, update, or remove plugins.

Install from scratch

You do not need DSH preinstalled.

1. Install the LTS version of Node.js, then close and reopen your terminal.

2. Install DSH and pnpm:

   npm install --global pnpm @deepseek-ai/dsh
   

3. Confirm that DSH is available:

   dsh --version
   

4. Install the marketplace:

   dsh plugin --profile web add @springbrand/dsh-plugin-marketplace
   

5. Start DSH Web:

   dsh web
   

Keep the terminal open. Your browser normally opens automatically; otherwise, open the http://127.0.0.1:... address printed in the terminal. Then go to Settings → Plugin Marketplace.

If dsh is still not found after reopening the terminal, use:

npx @deepseek-ai/dsh plugin --profile web add @springbrand/dsh-plugin-marketplace
npx @deepseek-ai/dsh web

Already have DSH?

dsh plugin --profile web add @springbrand/dsh-plugin-marketplace
dsh web

What you get

• Browse and search by name, author, description, or npm package, with visible plugin categories, repository avatars, and compact GitHub Star counts.
• Profile management across web, headless, and other local profiles under ordinary DSH; SpringBrand Desktop limits operations to its active profile.
• Install, update, and remove in one place, with exact installed versions, visible update badges and counts, and one-click updates to the latest published version.
• Installed view covering both catalog entries and profile dependencies that are not listed in the catalog.
• Marketplace self-updates in SpringBrand Desktop by installing the latest release into the active profile; removing that profile override falls back to the version bundled with the app.
• Clear activation timing: changes to the current profile restart DSH automatically; changes to other profiles apply on their next launch.

Security

• Installation is limited to catalog entries marked bundle, installable, and npm.
• The server resolves the npm package name from the catalog again instead of accepting an arbitrary source from the browser.
• Updates and removals accept only valid npm package names already installed in the selected profile.
• Mutation endpoints accept same-origin JSON POST requests only, with an 8 KiB body limit.
• Ordinary DSH commands are launched with argument arrays, never through a shell. SpringBrand Desktop delegates to its managed package-operation service. Only one plugin operation runs at a time.

Plugins are third-party code. Catalog inclusion is not a security endorsement; install only sources you trust.

How it works

[Web settings]
      |
      v
[Local HTTP API from this plugin]
      |
      +--> [dshplugin.market/api/catalog]
      |
      +--> ordinary DSH: dsh plugin --profile <profile> add|update|remove <package>
      |
      +--> SpringBrand Desktop plugins: desktopPnpm.runPlugin()
      |
      +--> SpringBrand Desktop marketplace override: desktopPnpm.run()

Under ordinary DSH, the marketplace targets the running profile by default and can select another profile in the UI. SpringBrand Desktop exposes only its active profile, runs package operations through desktopPnpm, and requests an orderly application restart through desktopProfiles. Third-party plugins use runPlugin() so DSH reconciles their bundle layers. The marketplace’s own profile override uses direct run() because its row already belongs to Desktop; reconciling it as another bundle would duplicate that row. The plugin does not provide arbitrary hot-mounting or seamless port handoff.

Which profiles appear as targets

Under ordinary DSH the profile list is web, headless, the profile this process was launched with, and every directory under <DSH home>/profiles, sorted by name. The DSH home is DSH_HOME when set, otherwise ~/.dsh. profiles/node_modules is never offered as a target.

A profile appears in the list before it has been initialized, so a plugin can be installed into headless from a web session without creating the profile first. What the Installed view reports for each profile is that profile’s own package.json dependency map — which is why it also lists packages that were installed outside this marketplace and are absent from the catalog. SpringBrand Desktop also reports the marketplace version bundled with the app; its first self-update creates a profile dependency that takes precedence after restart.

Configuration

Override these fields in the profile’s Cordis configuration:

config:
  profile: web
  catalogUrl: https://dshplugin.market/api/catalog
  restartDelayMs: 1500

• profile: the profile used by an ordinary DSH process; read from the launch arguments by default. SpringBrand Desktop always uses its active profile.
• catalogUrl: the plugin catalog JSON URL; HTTP and HTTPS are supported.
• restartDelayMs: delay before restarting an ordinary DSH process, from 500 to 30000 milliseconds. SpringBrand Desktop owns its restart timing.

Uninstall

Remove the package from the marketplace’s Installed tab, or run:

dsh plugin --profile web remove @springbrand/dsh-plugin-marketplace

Development

npm install
npm run check

License

MIT