A plugin shop that scrapes npm, gates hard, and admits zero reviews

What it does

dsh-plugin-shop is a plugin marketplace for DeepSeek Harness. It automatically scrapes npm and GitHub for packages tagged with dsh-plugin or deepseek-harness, runs them through a mechanical gate with seventeen possible rejection reasons, and serves the survivors as a browsable catalog inside the harness settings. The daily build is committed to git, so every addition or removal shows up as a diff.

The interesting bit

Instead of treating a plugin store like an opaque database, the project treats it like a reproducible build pipeline: content-addressed JSON, SHA-256 verification, and a dependency check that resolves peer names against your local profile rather than storing version ranges in the catalog. It is also refreshingly honest about trust—today, no listing has been human-reviewed, and the UI makes you acknowledge that before installing anything.

Key highlights

• Auto-discovers plugins from npm keywords and GitHub topics; no manual submission queue.
• Mechanical gating with 17 recorded rejection reasons, published with each daily build.
• Git-auditable daily catalog commits; every change is a reviewable diff.
• Local peer-dependency resolution: “Incompatible” means missing in your profile, not a global verdict.
• Content-addressed JSON with SHA-256 verification; races npm, npmmirror, and GitHub Pages for the fastest mirror.

Caveats

• registry/verified.yml is currently empty: no human has reviewed any listing, so every install requires an explicit trust acknowledgement.
• This is not a sandbox. Once mounted, a plugin holds full access to your filesystem, shell, and model requests.
• The mechanical filter is not a security audit; it checks structural validity, not malicious intent.

Verdict

Worth a look if you use DeepSeek Harness and want a centralized, auto-updating plugin browser with honest trust boundaries. Skip it if you expect a curated app store or sandboxed extensions—this one tells you up front that installing a plugin is an act of complete trust.