dsh-desktop-safe-market 0.2.13

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 bruc3van
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,168 @@
+# dsh-desktop-safe-market
+
+**深度扫描 5 分钟，放心使用每一天。**
+
+中文 | [English](./README_EN.md)
+
+一个**先审查、再安装**的 DeepSeek Harness 插件市场。它与「点一下就装」的普通市场刻意保持距离，差异集中在两件事：
+
+- **精选来源**：市场列表不是 GitHub topic 的原始抓取，而是 [awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin) 每日快照管线的**人工精选**产物——蹭 topic 的非插件、归档/停用仓库在上游就被剔除，席位再按类目逐轮均衡发牌——你浏览的是一份经过编辑把关的短名单，而不是热度堆场。
+- **先审查再安装**：点「安全安装」不会装任何东西。它打开一个新会话、把一段**安全审查提示词**放进输入框，由 Agent 实际读仓库代码，确认干净后才执行官方安装命令。插件自身没有任何能执行安装的接口——审查与安装因此在结构上不可分割、绕不过去。
+
+使用上，它在设置里多一个**安全市场**导航项（挂市场自己的店面图标），分两页：
+
+- **插件**：上方是**已安装面板**——列出当前 profile 通过包安装的插件及其运行状态，支持停用/启用和卸载；桌面客户端自动装进来的市场插件也列在这里，因为别处都移除不了它。DSH 自带的插件、以及没有归属标记的 in-box 接入不在此列。下方是精选市场，「全部插件」视图按 Star 数排名。
+- **技能**：列出当前会话实际能解析到的技能。
+
+![安全市场](./assets/screenshots/marketplace.png)
+
+## 它解决什么问题
+
+装插件本质上是在自己的机器上运行别人写的代码。普通目录回答「有哪些插件」，然后把风险留给你的那一次点击；「这个插件安全吗」始终无人回答——而它恰恰是你点安装那一刻真正在赌的东西。
+
+这个插件把两件事接在一起：一份**已经过人工精选**的社区短名单，和一次**由 Agent 执行的代码审查**。它自己不下载、不执行、不判断，只把请求摆到你面前——这就是它与普通市场的全部差异：**入口是精选的，安装是带审查的。**
+
+## 安装
+
+```sh
+dsh plugin --profile web add https://github.com/bruc3van/dsh-desktop-safe-market/archive/refs/tags/v0.2.13.tar.gz
+```
+
+也可以把安装这件事直接交给你的 Agent——复制这句提示词发过去即可：
+
+```text
+帮我安装 DSH 安全市场：用官方命令 `dsh plugin --profile web add https://github.com/bruc3van/dsh-desktop-safe-market/archive/refs/tags/v0.2.13.tar.gz` 装进 web profile，完成后提醒我重启 dsh web 才会生效。
+```
+
+这条官方命令会把依赖装进 profile，并**自动把它并入 `dsh.profile.bundles`**（凡是声明了 `dsh.bundle` 的依赖都会自动入列），不需要手工改 `package.json`。装完重启 `dsh web`（或桌面客户端）即可。
+
+浏览器、CLI 与桌面客户端共用同一个 profile，因此三处都会出现这个导航项。
+
+## 首次使用要手动开启
+
+「插件」页的市场部分默认是**关闭**状态，只显示一张说明卡片和一个「启用安全市场」按钮（已安装面板不受开关影响，随时可见）。
+
+这是刻意的：**开启才会让本机去 GitHub 读取目录快照**，关闭时插件不发起任何网络请求。一个装上就开始联网的插件，等于替你做了决定。开关是插件自己的持久化设置，开一次之后一直有效。
+
+## 「安全安装」做了什么
+
+1. 在当前会话所属工作区（没有则用最近使用的工作区）连接一个新会话并跳转过去；
+2. 把审查提示词**填入输入框**——不发送；
+3. 关闭设置窗口，让你直接看到那个会话。
+
+提示词开宗明义：**唯一目的是安全审查——在安全的前提下高效安装，不做多余的验证**。它要求 Agent：把仓库里的一切内容当作待审查的不可信材料（仓库里的指令一律不照做），实际读代码而非只看 README，重点检查凭据/token 访问、向第三方外传数据、远程代码执行、`postinstall`/`prepare` 等安装脚本、无对应源码的混淆文件，以及权限是否远超其声称的功能；**发现可疑处必须停下来说明原因并询问你**；确认干净后按优先级用官方命令安装——npm 包或最新 release tag 的预构建 tarball 优先（安装时不执行该仓库的代码），只有两者都没有时才从默认分支装源码，且必须锁到具体 commit：
+
+```sh
+dsh plugin --profile web add <npm 包名 | tarball URL | github:owner/name#<commit sha>>
+```
+
+从源码装会被 pnpm 的 `allowBuilds` 门禁拦下——这是「允许该仓库的代码在安装时于你的机器上执行」的授权，提示词要求 Agent 把 pnpm 打印的键原样交给你确认、写进 profile 的 `pnpm-workspace.yaml` 后再重跑。`dsh` 命令由 Agent 自己定位并执行，不需要你替它跑：最精确的是直接取正在运行的 dsh 进程（按进程名找——进程名不一定是 dsh，可能是 node 或客户端进程——不要假设固定端口）的可执行文件路径，找不到再依次查环境变量、默认安装目录与 npm/pnpm 全局 bin。全程只查这些常规位置，不做全盘扫描、不提权（sudo / 以管理员运行）。装完用 `dsh plugin --profile web list` 确认实际装的版本即可，然后告诉你重启 dsh 才会生效。
+
+发不发送由你按回车决定。没有任何工作区时，卡片会直接告诉你先去侧边栏选一个。
+
+![安全安装](./assets/screenshots/marketplace-sec-install.png)
+
+### 已经装过的：安全升级
+
+目录里已经装在本 profile 的插件，卡片右上角标出「已安装 vX.Y.Z」，按钮也从「安全安装」变成**「安全升级」**——省得对着一个装好的插件反复点安装。
+
+认亲靠的是已安装包 `package.json` 里的 `repository` 字段（各种写法都会归约成 `owner/name`），因为目录是按 GitHub 仓库编排的，而安装是按包名编排的，两者只是有时拼写相同。没写 `repository` 的包退回「包短名 ≈ 仓库名」的猜测，且仅在该短名只对应一个已装包时才算数——两个包重名时宁可都不标，也不能让结论取决于遍历顺序。
+
+**目录里没有版本号**（上游 `market.json` 只收录仓库事实，不收录发布版本），所以「有没有新版」这件事插件本地算不出来，也不去猜：升级提示词的第一步就是让 Agent 去确认上游最新版本——release tag，或该仓库发布到 npm 的版本——**不比当前新就直接回「已是最新」、不做任何改动**；确有新版才继续完整审查新版产物——与全新安装同一套扫描标准，不做两版 diff 的定向审查。升级的安装方式与全新安装是同一套优先级（npm / release tarball / 锁 commit 的源码）与 `allowBuilds` 规则。和安装一样，插件自己不执行任何命令。
+
+## 已安装面板
+
+「插件」页顶部的**已安装面板**列出当前 profile 通过 `dsh plugin add` 装进来的插件包（同时写在 `dependencies` 与 `dsh.profile.bundles` 里的那些：版本、简介、每个 loader 条目的运行状态），**以及桌面客户端自动装进来的市场插件**。DSH 模板自带的层不在此列。提供两个动作：
+
+- **停用/启用**：往 profile 自己的 `cordis.patch.yml`（用户补丁层）写入/移除一行 `- id: <条目> / disabled: true`，同时直接推动 loader 条目——**立即生效，无需重启**，重启后依旧有效。market 自己那行不提供停用按钮：停用市场会连带停掉唯一能再启用它的界面。
+- **卸载**：用户插件会先在本会话停用，再于 profile 目录执行 `pnpm remove`（与官方 `dsh plugin remove` 同一原语），依赖、锁文件、`node_modules` 和 `dsh.profile.bundles` 一并去掉，并清掉该包在 `pnpm-workspace.yaml` 里的 `allowBuilds` / `minimumReleaseAgeExclude` 条目。内置座位没有 pnpm 树，卸载会撤 `bundles` 并删除带归属标记的副本。若 `pnpm remove` 失败，清单仍会改掉（下次启动不再加载），面板会说明磁盘未修剪。同一会话内重装刚卸载的插件会被残留停用行按住，卡片会提示「点启用即可恢复」。
+
+已安装列表也会列出「写在 `dependencies` 里、但没进 `dsh.profile.bundles`」的插件（装上了却不会加载），避免只能靠下次 `pnpm add` 才发现。这类包不能点启用，只能卸载。
+
+### 桌面客户端装进来的市场插件
+
+桌面客户端不是用 `dsh plugin add` 安装市场的，而是把插件**复制**进 `<DSH_HOME>/profiles/node_modules`、再往 `dsh.profile.bundles` 写一个条目——不写依赖。这样装进来的插件标着「由桌面客户端接入」，并且**面板是它唯一的移除入口**：官方 `dsh plugin` 明确不碰非依赖项的 bundle，而当初装它的客户端可能已经被卸载了。
+
+它没有写进依赖，**目录本身就是安装**，所以卸载会同时删掉 `bundles` 条目和那份复制的目录——只摘条目会留下一棵没人列出、没人加载、也再无法移除的插件树（面板正是靠 `bundles` 列表找到它的）。
+
+如果客户端还装着、且没有关掉它连接设置里的「接入内置安全市场」，那么它下次启动会把插件重新装回。卡片上写明了这一点：要彻底不再出现，请在客户端那边关掉开关。没有归属标记的 in-box bundle 属于部署自身，面板不列出、也不提供卸载。
+
+设计上与「安全安装」一致：**停用、列表和内置座位仍是本地文件编辑 + loader 调用**。用户插件的卸载是唯一会启动进程的动词：在本 profile 目录跑 `pnpm remove`，不联网安装任何东西。市场关掉时这一页只剩开关本身：你关掉的是这个市场，它不该继续在你的设置里开着一个插件管理器。
+
+![已安装面板](./assets/screenshots/marketplace-installed.png)
+
+## 技能页
+
+列出**当前会话**能解析到的技能，含名称、说明、来源 provider 与调用策略（模型可调用 / 用户 `/名称` 可调用），可搜索。
+
+按会话寻址不是偷懒，是必须：技能注册表是「宿主 + 每作用域」分层的，而 web 部署**特意禁用了宿主平面的 `skill-filesystem`**——本地发现归各个 Agent 预设所有。从插件根上下文读只能看到全局层，会对着一堆技能报告「没有技能」。没有打开的会话时，页面直说没有可读的那一层。
+
+![技能页](./assets/screenshots/marketplace-skills.png)
+
+## 数据来源
+
+市场只读 [awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin) 每日快照管线发布的一个精选文件 [`market.json`](https://github.com/bruc3van/awesome-dsh-plugin/blob/main/data/market.json)，全部编辑决策都在上游（爬取与人工名单所在处）完成：
+
+- 上游对带 `dsh-plugin` 标签的爬取（`repositories.json`）做过滤：要求有简介、剔除归档/停用仓库、应用 `curated.json` 人工排除名单；
+- 分类与**均衡发牌**也在上游——不是纯按 star 排序（那样两三个分类就会吃掉几乎所有席位），而是每类先出最强、再出次强，至多 300 席；
+- 本插件按该顺序截断到 `marketSize`（默认 1000），并在 Host 侧重校验每一行后才发给浏览器；
+- **网络韧性（自动切换）**：默认从 GitHub raw 读取。当默认地址不可达或请求出错（超时、DNS/连接失败、HTTP 错误）时，自动改用同一文件在 Gitee 的镜像（[bruc3van/awesome-dsh-plugin](https://gitee.com/bruc3van/awesome-dsh-plugin) 的 `raw/main/data/market.json`）；回答过的那一侧会被记住（粘性），下次读取直接走它，镜像失败再回到 GitHub，无需任何配置。自己配置过 `catalogBase` 的部署不受影响——只读它指定的那一个来源。
+
+接口协议——字段形状、截断上限、分支名白名单、顺序不变量与版本规则——见 [docs/market-json-spec.md](docs/market-json-spec.md)。
+
+## 配置
+
+在 `~/.dsh/profiles/web/cordis.patch.yml` 里覆盖：
+
+| 字段 | 默认值 | 说明 |
+| --- | --- | --- |
+| `catalogBase` | awesome-dsh-plugin 的 `data/` 目录 | 指向该文件的镜像 |
+| `marketSize` | `1000` | 市场展示多少个插件 |
+
+## 安全边界
+
+- **插件自身不执行任何安装命令**，也没有能执行它的接口——审查与安装因此不可分割；
+- **市场文件在 Host 侧读取并重新校验**后才发给浏览器（精选后的至多 300 行，而不是 2.4 MB 爬取快照），并持久化在 `$DSH_HOME/storages/safe_market.json`，重启后走 ETag 条件请求（一次 304；默认地址连不上时自动改用 Gitee 镜像，两边都连不上才用上次的目录）；
+- **仓库链接由 `owner/name` 重新拼装**，不采信文件里的地址，因此被投毒的文件无法塞进自己的 URL scheme——wire codec 也会强制校验这个形状，而不只是靠注释；
+- **默认分支名进提示词前经过模式校验**（`[A-Za-z0-9][A-Za-z0-9._/-]*` 加 git ref 规则，不合格一律回落 `main`），提示词同时声明 URL 与分支为市场提供的不透明字面量——被投毒的分支名无法向审查提示词注入指令；
+- 卡片全部以纯文本渲染；
+- 关闭状态下 Remote 接口直接拒绝，无法绕过开关读取目录；
+- 安装交接全程走官方公开服务（workspaces / sessions / conversation），不读 DOM、不发送消息；
+- 已安装面板的动词只接受**经 wire codec 校验且实际在 profile 清单里的包名**；停用与内置座位卸载落地为本机文件编辑与 loader 调用。用户插件卸载会在 profile 目录运行 `pnpm remove`（包名再经同一套形状校验，不走 shell 拼接），失败时仍改清单并在面板说明；写入用户补丁层时保留原有注释与手工行。
+
+**收录不代表安全背书。** Agent 的审查是一次有依据的辅助判断，不是结论——请自己看过再决定。
+
+## 已知限制
+
+- **只读技能，还不能装技能**：技能页目前只回答「我有什么」。技能的分发形态与插件不同（文件系统目录而非 npm 包），装技能是下一步。
+- **不体检已安装插件**：已安装面板能查看、停用、卸载，但不重新审计已经装上的代码——「装之前」的审查仍然不可省。
+- **市场自己不执行安装**：命令写在提示词里由 Agent 执行，所以审查与安装绑在一起、绕不过去；代价是市场里看不到安装进度。
+- **导航图标是皮肤级的替换**：设置壳按 section id 硬编码导航图标（未知 id 一律齿轮），slot 契约没有图标位。本插件按自己的导航文案找到对应行并替换图标，壳结构变化时最坏退回齿轮，不影响功能。
+
+## 开发
+
+```sh
+pnpm install --ignore-workspace
+pnpm run typecheck
+pnpm test          # node --test，目录归约与读取器的回归测试
+pnpm run build     # lib/index.js（Host，ESM）、lib/client.js（浏览器，ModuleLoader 包裹）、lib/types
+```
+
+发版时版本号有几处要一起动：`package.json`、`dsh.plugin.json`，以及两份 README 里的 tarball 地址（安装命令与 Agent 提示词各一处）。`pnpm test` 里的版本门禁（`test/version.test.ts`）会逐一核对，CI（`.github/workflows/check.yml`）在每次推送与 PR 上跑同一套检查。
+
+`devDependencies` 固定在与运行时一致的 `@deepseek-ai/*` 已发布版本上；`peerDependencies` 全部可选，实际由 profile 的 node_modules 提供。
+
+## 相关项目
+
+**作者维护**
+
+- **[dsh-desktop](https://github.com/bruc3van/dsh-desktop)**——让 Agent 安全常驻桌面的独立 DeepSeek Harness 客户端：官方 Web UI 原封不动，长任务常驻托盘，精选插件先审查、再安装。（本市场在桌面端即以 in-box 方式内置。）
+- **[awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin)**——用 30 秒为你的 DeepSeek Harness 找到合适的插件。这不是又一个仓库清单：GitHub 上所有打着 `dsh-plugin` 标签的仓库由脚本每天自动抓取，再经人工逐个核实——真插件进目录，蹭热度的进黑名单，每条剔除理由公开可查；并告诉你每个插件适合谁、从哪里开始。（也是本市场的数据来源。）
+
+**官方仓库**
+
+- **[deepseek-harness](https://github.com/deepseek-ai/deepseek-harness)**——DeepSeek Harness: Everything is a Plugin. 官方 `dsh` 与 Web UI 的上游项目——本插件是其插件体系上的第三方市场，市场里的每个插件最终都装进它的 profile、跑在它之上。
+
+## 许可证
+
+MIT

package/README_EN.md

@@ -0,0 +1,168 @@
+# dsh-desktop-safe-market
+
+**A deep scan in 5 minutes — use with confidence every day.**
+
+[中文](./README.md) | English
+
+A **review-before-install** extension marketplace for the DeepSeek Harness web GUI. It deliberately differs from click-to-install marketplaces on two counts:
+
+- **A curated source.** The list is not a raw crawl of the `dsh-plugin` topic. It is the daily, human-curated output of the [awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin) snapshot pipeline — topic riders, archived and disabled repositories are removed upstream, and entries are dealt round by round across categories — so what you browse is an editorially filtered shortlist, never a popularity dump.
+- **Review before install.** The install button installs nothing. It opens a new session and stages a **security-review prompt**; an agent reads the repository's actual code, and only a clean reading proceeds to the official install command. The plugin itself has no interface that could run an install — review and install are inseparable by construction.
+
+In use, it adds a **Safe Market** entry to the Settings navigation (wearing the market's own storefront icon), with two pages:
+
+- **Plugins** — an **installed panel** on top: the plugin packages installed into this profile as dependencies, with their live state, each disableable/enableable and uninstallable; the marketplace plugin the desktop client placed is listed here too, because nowhere else can remove it. Layers shipped with DSH, and in-box bundles carrying no ownership marker, are not listed. Below it, the curated market, whose **All plugins** view ranks by stars.
+- **Skills** — what the current session can actually resolve.
+
+![The Safe Market tab](./assets/screenshots/marketplace.png)
+
+## What it is for
+
+Installing a plugin means running someone else's code on your machine. An ordinary catalog answers *which plugins exist* and leaves the risk to your click; *is this one safe* stays unanswered — yet that is exactly what you are betting on at the moment you click install.
+
+This plugin joins the two halves: a community shortlist that has **already had the non-plugins curated out**, and a **code review performed by an agent**. It downloads nothing, executes nothing, and judges nothing itself — it puts the request in front of you. That is the whole differentiation from an ordinary market: **a curated entrance, and an install that cannot skip its review.**
+
+## Install
+
+```sh
+dsh plugin --profile web add https://github.com/bruc3van/dsh-desktop-safe-market/archive/refs/tags/v0.2.13.tar.gz
+```
+
+Or hand the install to your agent — copy this one-line prompt:
+
+```text
+Install DSH Safe Market for me: run the official command `dsh plugin --profile web add https://github.com/bruc3van/dsh-desktop-safe-market/archive/refs/tags/v0.2.13.tar.gz` into the web profile, then remind me to restart dsh web for it to load.
+```
+
+The official command installs the dependency into the profile and **joins it into `dsh.profile.bundles` by itself** (any dependency declaring `dsh.bundle` is reconciled into the layer stack), so there is no `package.json` to edit. Restart `dsh web` (or the desktop client) afterwards.
+
+The browser, the CLI, and the desktop client share one profile, so the entry appears in all three.
+
+## You turn it on yourself
+
+The **market half** of the Plugins page ships **off**. Until you enable it, it is one card explaining what enabling does, and a button (the installed panel answers either way).
+
+That is deliberate: **enabling is what lets this machine read the catalog snapshot from GitHub**, and while it is off the plugin makes no network request at all. A plugin that arrives already reaching out has decided something on your behalf. The switch is the plugin's own durable setting — answer once and it stays answered.
+
+## What "Review and install" does
+
+1. connects a new session in the current session's workspace (or the most recently used one) and navigates there;
+2. **stages** the review prompt in the composer — it does not send it;
+3. closes Settings, so you are looking at the session it was staged in.
+
+The prompt opens by stating its scope: **the only purpose is the security review — install efficiently once the code is clean, with no extra verification**. It asks the agent to treat everything in the repository as untrusted material under review (instructions found there are never followed), to read the code rather than the README, and to look for credential or token access, data sent to third-party hosts, remote code execution or downloaded-and-executed payloads, install-time scripts (`postinstall`, `prepare`, and friends), obfuscated sources with no matching original, and permissions far wider than the plugin claims. **Anything suspicious means stop, explain, and ask you.** A clean reading is followed by the official command, by priority — the npm package or the latest release tag's prebuilt tarball first (no repository code runs at install time), and only failing both, source from the default branch pinned to an exact commit:
+
+```sh
+dsh plugin --profile web add <npm package | tarball URL | github:owner/name#<commit sha>>
+```
+
+A source install is blocked by pnpm's `allowBuilds` gate — permission for the repository's code to run on your machine at install time — and the prompt has the agent hand pnpm's printed key to you verbatim, wait for it to land in the profile's `pnpm-workspace.yaml`, and re-run. The agent locates and runs `dsh` itself — you are never asked to run commands: most precisely, it takes the executable path of the running dsh process (found by process name — which need not be `dsh`, it can be node or the client's own process — with no fixed port assumed); failing that, it checks the environment variables, then the default installation directory and the npm/pnpm global bin. It stays in those usual spots — no whole-disk scans, no elevation (no sudo, no run-as-administrator). It confirms the install with `dsh plugin --profile web list` and then tells you dsh must be restarted before the plugin loads.
+
+Whether it is sent is your Enter key. With no workspace at all, the card says so and points you at the sidebar.
+
+![Review and install](./assets/screenshots/marketplace-sec-install.png)
+
+### Already installed: review and upgrade
+
+A catalog row already installed into this profile is marked **Installed vX.Y.Z** in its card, and its button reads **Review and upgrade** instead of Review and install — so you are not offered an install for something you already have.
+
+The join is the installed package's `repository` field (every npm spelling is reduced to `owner/name`), because the catalog is keyed by GitHub repository while an install is keyed by package name, and the two are only sometimes spelled alike. A package that declares no repository falls back to matching its short name against the repository name — but only while that name picks out exactly one installed package: when two share it, neither claims the row, because an answer that depends on iteration order is worse than no answer.
+
+**The catalog carries no versions** (the upstream `market.json` records repository facts, not releases), so whether a newer version exists is something this plugin cannot compute locally — and does not guess. The upgrade prompt's first step is to have the agent establish the newest upstream version — the latest release tag, or the version the repository publishes to npm — and, **if it is not newer, say so and change nothing**; only a real update leads on to a full review of the new artifact — the same scan standard as a fresh install, not a diff-oriented review of what changed between versions. Upgrades install through the same ladder as fresh installs (npm / release tarball / commit-pinned source) and the same `allowBuilds` rules. As with install, the plugin runs no command itself.
+
+## The installed panel
+
+The **installed panel** at the top of the Plugins page lists the packages this profile gained through `dsh plugin add` (names that sit in both `dependencies` and `dsh.profile.bundles`) — version, description, the live state of each loader entry — **and the marketplace plugin the desktop client placed**. Layers shipped with the DSH profile template are not listed. Two actions:
+
+- **Disable/enable** writes (or removes) a `- id: <entry>` / `disabled: true` row in the profile's own `cordis.patch.yml` (the user patch layer) and nudges the loader entry directly — **effective immediately, no restart**, and durable across restarts. The market's own row has no disable button: disabling the market would take down the only surface that could re-enable it.
+- **Uninstall** stops a user plugin for this session, then runs `pnpm remove` in the profile directory (the same primitive official `dsh plugin remove` forwards to), so the dependency, lockfile, `node_modules`, and `dsh.profile.bundles` entry go together, along with that package's leftover `allowBuilds` / `minimumReleaseAgeExclude` rows in `pnpm-workspace.yaml`. An in-box seat has no pnpm tree: uninstall drops the `bundles` entry and deletes the marked copy. If `pnpm remove` fails, the manifest is still edited (the next boot will not compose it) and the panel names the prune fault. A plugin uninstalled and reinstalled within one session is held down by leftover stop rows, and its card explains that Enable will clear them.
+
+The list also shows plugins that sit in `dependencies` but never joined `dsh.profile.bundles` (installed, not loaded), so they can be uninstalled from here. Enable is not offered for those rows.
+
+### The marketplace plugin placed by the desktop client
+
+The desktop client does not install this market with `dsh plugin add`. It **copies** the plugin into `<DSH_HOME>/profiles/node_modules` and adds one entry to `dsh.profile.bundles` — no dependency. Such a copy is labelled *seated by the desktop client*, and **this panel is the only place it can be removed**: official `dsh plugin` deliberately never touches a bundle that is not a profile dependency, and the client that placed it may have been uninstalled since.
+
+The copy is never written as a dependency — the directory itself IS the install — so uninstalling removes the `bundles` entry *and* the copied directory. Taking only the entry would strand a plugin tree that nothing lists, nothing loads, and nothing can ever offer to remove again; the panel finds this plugin through the bundle list.
+
+If the client is still installed and still set to seat the built-in Safe Market, it will put the plugin back the next time it starts; the card says so. To stop it coming back, turn the switch off in the client's connection settings. An in-box bundle with no ownership marker belongs to the deployment itself: it is neither listed nor removable here.
+
+By design it matches "review and install": **disable, listing, and in-box uninstall stay local file edits plus loader calls**. Uninstall of a user plugin is the one verb that spawns: `pnpm remove` in this profile directory, never an install over the network. With the market switched off, though, the page is the switch and nothing else: what you turned off is this marketplace, and it should not keep a plugin manager running in your settings.
+
+![The installed panel](./assets/screenshots/marketplace-installed.png)
+
+## The Skills page
+
+Lists the skills the **current session** resolves — name, description, owning provider, and invocation policy (model-invocable, user-invocable via `/name`) — with search.
+
+Addressing it by session is required, not lazy: the skill registry is host+per-scope layered, and the web deployment **deliberately disables the host-plane `skill-filesystem` row** — local discovery belongs to each agent preset. A read from the plugin's root context sees the global layer alone and would report "no skills" to a user with plenty. With no session open, the page says there is no layer to read.
+
+![The Skills page](./assets/screenshots/marketplace-skills.png)
+
+## Where the data comes from
+
+The market reads a single published file, [`market.json`](https://github.com/bruc3van/awesome-dsh-plugin/blob/main/data/market.json), from [awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin)'s daily snapshot pipeline. Every editorial decision happens upstream, where the crawl and the human curation live:
+
+- the crawl of repositories tagged `dsh-plugin` (`repositories.json`) is filtered there — a description is required, archived/disabled repositories are dropped, and the exclusions in `curated.json` are applied;
+- rows are categorized and **balanced** there — not a straight star ranking (that would hand almost every slot to two or three categories), but entries dealt round by round so every category places its best entry before any places its second, up to 300;
+- this plugin truncates that order to `marketSize` (default 1000) and re-validates every row on the Host before the browser sees it;
+- **network resilience (automatic failover)**: the default read comes from GitHub raw. When the default address cannot answer (timeout, DNS/connection failure, or an HTTP error), the read automatically falls over to the Gitee mirror of the same published file ([bruc3van/awesome-dsh-plugin](https://gitee.com/bruc3van/awesome-dsh-plugin)'s `raw/main/data/market.json`). The side that answered is remembered (sticky) and tried first next time, falling back the other way if it later fails — no configuration needed. A deployment with its own `catalogBase` keeps exactly that one source.
+
+The wire protocol — field shapes, truncation limits, the branch-name whitelist, the ordering invariant, and the versioning rules — is documented in [docs/market-json-spec.md](docs/market-json-spec.md).
+
+## Configuration
+
+Override in `~/.dsh/profiles/web/cordis.patch.yml`:
+
+| Field | Default | Meaning |
+| --- | --- | --- |
+| `catalogBase` | awesome-dsh-plugin's `data/` directory | Point the market at a mirror of the same file |
+| `marketSize` | `1000` | How many plugins the market shows |
+
+## Security boundary
+
+- **The plugin runs no install command and exposes no interface that could** — review and install are therefore inseparable;
+- **the market file is fetched and re-validated on the Host** before the browser sees it — a curated list of at most 300 rows, not the 2.4 MB crawl — and persisted at `$DSH_HOME/storages/safe_market.json` so a restart asks conditionally (one 304, or the Gitee mirror when the default address is unreachable, or the last catalog when both are);
+- **repository links are rebuilt from `owner/name`** rather than trusted from the file, so a poisoned file cannot contribute a URL scheme of its own — the wire codec enforces the rebuilt shape, not just a comment;
+- **the default branch is pattern-checked before it reaches the prompt** (`[A-Za-z0-9][A-Za-z0-9._/-]*` plus the git ref rules; anything else falls back to `main`), and the prompt declares both the URL and the branch as opaque marketplace literals — a poisoned branch name cannot inject instructions into the review;
+- every card renders as plain text;
+- while disabled, the Remote refuses — the catalog cannot be read around the switch;
+- the install hand-off runs entirely through published services (workspaces / sessions / conversation): it reads no DOM and sends no message;
+- the installed-panel verbs accept only **wire-codec-checked package names that are actually in the profile manifest**; disable and in-box uninstall land as local file edits plus loader calls. Uninstall of a user plugin runs `pnpm remove` in the profile directory (the name is shape-checked again, never interpolated into a shell); a failed prune still edits the manifest and the panel says so; edits to your patch layer preserve existing comments and hand-written rows.
+
+**Being listed is not a safety endorsement.** The agent's review is an informed second opinion, not a verdict — read it yourself before deciding.
+
+## Known limitations
+
+- **Skills are read-only for now.** The Skills page answers "what do I have". Skills are distributed as filesystem directories rather than npm packages, so installing them is the next step.
+- **It does not audit what you already installed.** The installed panel views, disables, and uninstalls, but it does not re-review code that is already running — the before-install review is still the gate.
+- **The market does not run the install itself.** The command lives in the prompt and the agent runs it, which is what makes the review impossible to skip — at the cost of no progress display inside the market.
+- **The nav icon is a skin-level swap.** The settings shell hardcodes section nav icons by id (unknown ids get the gear) and the slot contract has no icon option; this plugin finds its own labeled row and re-skins the icon. If the shell restructures, the worst case is the gear returning — nothing functional breaks.
+
+## Development
+
+```sh
+pnpm install --ignore-workspace
+pnpm run typecheck
+pnpm test          # node --test, the catalog reduction and reader regressions
+pnpm run build     # lib/index.js (Host ESM), lib/client.js (browser, ModuleLoader-wrapped), lib/types
+```
+
+A version bump has places that must move together: `package.json`, `dsh.plugin.json`, and the tarball URLs in both READMEs (the install command and the agent prompt each carry one). The version gate in `pnpm test` (`test/version.test.ts`) checks each one, and CI (`.github/workflows/check.yml`) runs the same check on every push and PR.
+
+`devDependencies` are pinned to the published `@deepseek-ai/*` versions the runtime actually loads; every `peerDependency` is optional and supplied by the profile's node_modules.
+
+## Related projects
+
+**Maintained by the author**
+
+- **[dsh-desktop](https://github.com/bruc3van/dsh-desktop)** — a standalone DeepSeek Harness client that keeps an agent safely resident on your desktop: the official Web UI untouched, long-running tasks resident in the tray, curated plugins reviewed before they install. (This market ships in-box with the desktop client.)
+- **[awesome-dsh-plugin](https://github.com/bruc3van/awesome-dsh-plugin)** — find the right plugin for your DeepSeek Harness in 30 seconds. Not another repo list: every repository on GitHub tagged `dsh-plugin` is crawled daily by script and then verified one by one by a human — genuine plugins enter the catalog, topic riders land on the blacklist, and every exclusion reason is public to check. It also tells you who each plugin is for and where to start. (Also the data source this market reads.)
+
+**Official repositories**
+
+- **[deepseek-harness](https://github.com/deepseek-ai/deepseek-harness)** — DeepSeek Harness: Everything is a Plugin. The upstream project behind the official `dsh` and Web UI — this plugin is a third-party marketplace on its plugin system, and everything the market installs lands in its profiles and runs on it.
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-desktop-safe-market
+      name: dsh-desktop-safe-market

package/dsh.plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "dsh-desktop-safe-market",
+  "description": "A safety-first plugin marketplace for the DeepSeek Harness web GUI",
+  "version": "0.2.13",
+  "entry": {
+    "name": "dsh-desktop-safe-market",
+    "inject": [
+      "typert",
+      "settings",
+      "skills",
+      "storageDomain",
+      "loader"
+    ]
+  },
+  "client": {
+    "platform": "web"
+  },
+  "bundle": {
+    "patch": "./cordis.patch.yml"
+  }
+}