DSH Market

What it does

DSH Market puts plugin discovery inside the harness. You open a settings page, browse a catalogue with categories, star counts and screenshots, and install from a card instead of copying a package name into a terminal. It is the shortest path from wondering whether a plugin exists to having it loaded.

One distinction matters more than any feature: this repository is the market app, not the catalogue. The list it shows comes from a separate curated registry, awesome-dsh-plugin, and the market fetches that list live from awesome-dsh-plugin.com/plugins.json every time you open it — there is deliberately no bundled snapshot to fall back on. So the market’s own README is careful about what a listing means: listing ≠ endorsement, and plugins remain third-party code.

What you can do in it

• Browse and search a catalogue the README describes as “2300+ plugins, growing daily”, with category filters, star counts, top and new sorting, and bilingual descriptions.
• One-click install, with terminal- and CLI-surface plugins flagged before you confirm.
• Hot disable and enable — toggling writes a disabled flag into the profile’s cordis.patch.yml, and the README says the harness recomposes it within about a second, so most changes do not need a restart. A restart button exists for the cases that do.
• Back up and restore your profile as JSON, including daily automatic WebDAV backup or a private GitHub Gist. Restores merge rather than replace.
• Updates, triggered by you — one plugin, or everything at once.
• Diagnostics: log export that masks home paths and credential shapes, a load-order view, and an “AI fix” path for a broken profile.

Requirements

The harness must be running a web profile at 0.1.0-rc.6 or newer; on an older host the market disables itself and says so in the browser console. pnpm is required and is auto-detected, with a one-click setup offered if it is missing. The README states no minimum Node version, operating system, or account requirement — the package’s package.json declares no engines field either.

What it does not promise

The install surface is the part to read before using it, because the market installs and runs other people’s code:

• Installs are restricted to sources listed in the curated registry — anything else is rejected, so this is not a general URL installer.
• Build scripts stay blocked by default under pnpm 10 and later.
• The README states no moderation, review, malware-scanning or audit process, and no permissions field exists in the package. “Curated” describes the registry’s editorial list, not a security guarantee.
• Backups can contain credentials from your profile configuration. The UI warns before export or upload; WebDAV is HTTPS-only, refuses private-network targets, and never stores your password in the browser.
• The market’s README says it “never phones home”, but it also fetches the catalogue live on every open and contacts GitHub and giscus for screenshots and comments. Read that as “no first-party telemetry”, not as “no outbound network access”. Telemetry is not stated either way.

When to use it — and when not to

Use it if you want to discover plugins without leaving the harness, or if you would rather toggle a plugin off than reason about profile files by hand. The hot disable path and the backup/restore tools are genuinely useful even if you install everything by hand.

Be cautious if you are using it as a trust signal. It is a browser over a third-party registry, and the thing you are installing still deserves the source review you would give it otherwise. Also note that it manages its own dependencies through the harness’s settings API, so the self-management behaviour needs a newer harness than the plain catalogue browsing does.

Compatibility notes

The package is published as dshmarket while the repository and its patch file use the dsh-market id — worth knowing when you are matching a profile entry to a package. Settings, pnpm setup and the restart control assume a standard --profile web layout with state.json and cordis.patch.yml in the profile directory. Service-manager integration is uneven: the README hides the systemd restart button and does not detect pm2 or launchd, so a restart under those setups is manual.

FAQ

Does DSH Market review or vouch for the plugins it lists?

No. Its README states plainly that listing is not endorsement, and that plugins are third-party code. The catalogue is curated as an editorial list by a separate registry project; this repository does not run a security review, a malware scan, or an audit, and it publishes no moderation policy.

Where does the plugin list actually come from?

From a separate curated registry, fetched live on every open. The market repository holds the browsing interface, not the catalogue, and the README says a bundled snapshot was deliberately left out. If that registry is unreachable, there is no bundled snapshot to fall back on — but the README documents an escape hatch: set DSHM_REGISTRY_URL in the environment dsh runs in to any host serving the same plugins.json shape.

Does it install plugins automatically?

No. Installs and updates are user-triggered. The market also refuses sources outside the curated registry and keeps package build scripts blocked by default.

Can its backups leak my credentials?

The backup file can contain credentials from your profile configuration, and the README says the interface warns before you export or upload one. WebDAV backup is HTTPS-only, refuses private-network targets, and does not keep your password in the browser.