# dsh-market: A Plugin Market That Lives Inside DeepSeek Harness

> dsh-market is a TypeScript plugin that turns DeepSeek Harness's settings into a browsable, searchable, and one-click installable plugin store. It handles themes, updates, backups, and diagnostics, but its real value is how it constrains installs to a curated registry and manages hot reloads without restarting the host.

**dsh-market/dsh-market** — The plugin market inside DeepSeek Harness: browse, search and one-click install.

- Repository: https://github.com/dsh-market/dsh-market
- Website: https://dshmarket.com
- Stars: 8,235 · Forks: 322
- Language: TypeScript
- License: MIT
- Published: 2026-08-22 · Updated: 2026-08-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/dsh-market-dsh-market

## What dsh-market Actually Fixes

DeepSeek Harness (dsh) is a harness that runs plugins, but before dsh-market, installing a plugin meant knowing the package manager commands and editing configuration files by hand. dsh-market replaces that with a visual interface inside the harness's own Settings page. It is for people who run dsh web and want to browse a catalog, click install, and see progress without leaving the app. The README is explicit about the target: it is the plugin market inside DeepSeek Harness. The problem it solves is not discovery alone, it is the whole lifecycle: install, switch themes live, update, uninstall, backup, and diagnose conflicts. For a user who is not comfortable with pnpm or YAML patches, this removes a real barrier. For an operator who manages many profiles, the backup and merge restore feature is the bigger draw.

## How the Install Flow Works

The install command is `dsh plugin --profile web add dshmarket`, followed by a restart of `dsh web`. After that, the market appears under Settings → Plugin Market. The market is itself a plugin, so it can update itself through the same mechanism it offers for other plugins. The README notes that on hosts older than dsh web 0.1.0-rc.6, the market disables itself and writes a message to the browser console instead of rendering. That is a deliberate fallback: it refuses to render against primitives that are not there. The install speed depends on the source: the market prefers repo-verified npm packages, then author-supplied prebuilt GitHub Release tarballs, and only falls back to full-repo GitHub source downloads. Prebuilt installs are typically seconds and do not need local build scripts. Source-only plugins depend on your connection to GitHub. The one-click install shows live progress, and most plugins go live after a page refresh, not a full restart.

## Themes, Hot Disable, and the Patch Layer

Themes get a dedicated tab. Installing a theme makes it active immediately, switching is one click, and themes are mutually exclusive. Your choice survives restarts. The hot disable and enable mechanism is more interesting. It writes `- id: …` and `disabled: true|false` into the profile's `cordis.patch.yml`, which is the official patch layer for the harness. This mechanism is ported from another project, dsh-plugin-hub. The harness's HMR re-composes within about one second, so no restart is needed. The loader re-applies the choice on every boot. The README warns that hand-edited patch rows show as badges, host-infrastructure plugins are protected from toggling, and a malformed patch file is never made worse. That last point is a meaningful safety property: the market does not corrupt an already broken patch file. If a change cannot hot-load, the market shows a one-click restart button beside a pending-change banner, and that restart is restricted to same-origin loopback requests.

## Security Model: Curated Registry and Restricted Endpoints

The security model is the strongest part of the design. Installs are restricted to sources listed in the curated awesome-dsh-plugin registry; anything else is rejected. Build scripts stay blocked by default, because pnpm 10 or newer blocks them, and allowing one is an explicit per-package choice. Terminal or CLI-surface plugins are flagged before you install them into the web profile. The install endpoint accepts same-origin POST only, and the market never phones home. The restart endpoint requires a direct loopback client, rejecting forwarded requests, and relaunches the exact DSH entry, arguments, environment, and working directory. Backups can contain credentials from your profile config, so the UI warns before export and upload. WebDAV sync is https-only, refuses private-network targets, and never stores your password in the browser. These are concrete constraints, not vague promises. The trade-off is that you cannot install a plugin that is not in the curated registry, which is a real limitation for anyone with a private or experimental plugin.

## Backup, Restore, and the Merge Behavior

The backup and restore feature exports your profile's plugin list and configuration as readable JSON. You can import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist. The restore operation merges rather than replaces: plugins installed after the backup are kept. It validates before writing and rolls back on failure. That merge behavior is a deliberate choice, and it is the right one for most cases, because a full overwrite would lose plugins you installed later. But it also means that a restore does not give you a clean snapshot. If you want to return to an exact known state, you would need to uninstall plugins manually first. The README does not mention a way to do a non-merge restore. The backup also contains credentials, so the warning before export is not optional. The sanitized log export masks home paths and credential shapes, and nothing is sent anywhere.

## Diagnostics, Load Order, and the AI Fix Prompt

The diagnostics page shows the plugin load order and conflict surface in one place. It includes the bundle stack with official and community badges, duplicate loader entries, dependency version mismatches, multi-version core packages, overrides, and invalid config entries. Everything is collapsible, and problem blocks are highlighted. The load order panel lets you drag community bundles into the order you want, or take a suggested order derived from the plugins' own before and after rules. Nothing is written until a trial composition passes, and the panel tells you what the new order would change before you apply it. The AI fix feature copies a diagnostics-driven fix prompt to the clipboard. The prompt first asks the agent to detect whether it is itself the harness running the profile. If so, it hard-forbids mutating the live composition, upgrading or restarting the harness, or reinstalling dependencies. Instead, it has the agent write an idempotent apply script plus a rollback script, and asks you to run them in an external terminal. That is a cautious design: it keeps an AI agent from doing irreversible damage to a running harness.

## Limitations and the Wrong Tool Cases

The most obvious limitation is the version requirement. If your dsh web is older than 0.1.0-rc.6, the market disables itself silently, and the README points to issue #139 as the reason: a desktop build may bundle its own dsh that is older than the npm one. That is a real failure mode to check before adopting. Another limitation is the curated registry: you cannot install anything outside awesome-dsh-plugin, which is fine for community plugins but useless for proprietary or internal ones. Build scripts are blocked by default, so a plugin that needs a build step will fail unless you explicitly allow it per package. The market also depends on GitHub for images and discussions, so it will not work in an air-gapped environment. The README does not mention an offline mode. For a user who wants to install a plugin from a private git URL, dsh-market is the wrong tool. For a user who wants to avoid GitHub entirely, the comments feature (which loads giscus and contacts giscus.app and GitHub) is a dealbreaker.

## Maintenance, Upgrades, and License

The market updates itself through the same per-plugin update mechanism it offers to others. You can pick a release channel: stable or beta. The beta channel lets you try builds still being verified, and it applies only to the market, never to your other plugins. A third dev channel appears once developer mode is switched on, and it carries builds published straight off a branch. That gives you a way to test the market itself before it hits stable. The market's version sits next to the page heading, so a screenshot of a problem carries the version. The settings card, available on dsh 0.1.0-rc.7 and newer, lets you manage the market from Settings → Plugins → Plugin configuration, including an opt-in cleanup that removes the disable rows it wrote, so plugins it switched off start running again. The license is MIT, which means you can modify and redistribute it, but you should check the license of any plugin you install through it, because the market does not enforce license compatibility. The README does not describe a migration path from an older market version, but the self-update mechanism likely handles it.

## Conclusion

Adopt dsh-market if you run DeepSeek Harness (dsh web 0.1.0-rc.6 or newer) and want a visual, curated way to install community plugins without touching the command line. Skip it if your host is older than rc.6, if you need to install plugins from outside the awesome-dsh-plugin registry (it rejects them), or if you want full control over build scripts (they stay blocked by default). Before adopting, verify your dsh web version, confirm that your profile's cordis.patch.yml is valid, and test the backup/restore flow on a non-production profile. The market's own release channel (stable vs beta) lets you control updates, but you must check that the host's bundled dsh is not older than the npm version, as noted in issue #139.

## FAQ

### How do I install the dsh-market plugin in DeepSeek Harness?

Run `dsh plugin --profile web add dshmarket`, restart `dsh web`, then open Settings and Plugin Market. The host must be dsh web 0.1.0-rc.6 or newer, and on an older host the market disables itself and says so in the browser console.

### Why does the Plugin Market entry not appear in dsh web?

The market needs dsh web 0.1.0-rc.6 or newer and disables itself on an older host instead of rendering. A desktop build that bundles its own dsh can be older than the version npm would install, which is tracked as issue 139.

### How does dsh-market decide whether a plugin fits my host?

Cards show the requirement declared by `engines.dsh` or by lockstep `@deepseek-ai/dsh-*` peers, and an opt-in filter hides only confirmed mismatches. Undeclared, malformed, unavailable and GitHub-only entries stay visible rather than being guessed incompatible.

### Where does dsh-market keep my favorites, groups and notes?

In the profile's market state in `state.json`, beside groups and notes, and the notes are never sent anywhere. Groups are purely organisational: a plugin lives in one group, ungrouped is the default, and nothing about enable state changes.

### Can I update a dsh-market plugin that I installed from an archive link?

Only through its own source. A catalog entry that merely shares the plugin name is never offered as its update, so an update cannot silently replace an archive install with a different plugin. Other plugins check npm version or a pinned commit against HEAD and can be updated one at a time or all at once.

## Sources

- [Official documentation](https://dshmarket.com)
- [Official README](https://github.com/dsh-market/dsh-market#readme)
- [Project repository](https://github.com/dsh-market/dsh-market)
- [Release notes](https://github.com/dsh-market/dsh-market/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/dsh-market-dsh-market