Prerequisites

Node.js ^22.19.0 or >=24.0.0 — DSH plugins and the harness itself require a current Node. Check with node -v.
DeepSeek Harness installed and running (npx @deepseek-ai/dsh web for the web profile). Most plugin tooling assumes dsh web 0.1.0-rc.6 or newer — on older hosts, market plugins disable themselves rather than render against missing primitives.
pnpm for source installs (the ecosystem standardizes on it; build scripts stay blocked by default on pnpm ≥10, which is a safety feature, not a bug).

The basic install command

Plugins install into a profile. For the web UI that's the web profile:

dsh plugin --profile web add <npm-package-name>

For example, the community in-app market:

dsh plugin --profile web add dshmarket

Then restart dsh web and open Settings — installed plugins surface there. You can sanity-check the final composition before booting:

dsh --profile web --dump-config
dsh --profile web

npm vs GitHub sources

Prefer plugins published to npm — you get a versioned, pinnable artifact. GitHub-source installs (github:owner/repo) track whatever the repo contains right now. Our catalog shows which form each plugin ships in on its detail page.

Troubleshooting

"The plugin entry never appeared in Settings"

Almost always a host version mismatch. Upgrade DSH to the latest release candidate and retry. If you run a desktop build, check whether it bundles its own (older) dsh — the bundled one wins over the npm one.

"Downloads are slow or fail" (GitHub connectivity)

Plugin installs pull from npm and GitHub. In regions with poor GitHub connectivity, community tooling (e.g. dsh-market) maintains fallback routes for Git refs, README content and avatars, and accepts a persistent custom HTTPS proxy prefix in Settings → Plugins → Plugin configuration. The environment variable DSHM_GITHUB_PROXY remains the operator-level override.

"Install hangs on build scripts"

pnpm ≥10 blocks dependency build scripts by default. Only allow a build script for a package you trust — it is arbitrary code execution on your machine.

"I installed something broken and want out"

Plugins are controlled through the profile's patch layer (cordis.patch.yml). Community markets expose two-step uninstall and hot disable/enable (DSH's HMR re-composes in about a second, no restart). Before a batch install, export your plugin list as JSON so rollback is one import away.

One warning that matters more than any step above

A DSH plugin runs with the harness's permissions — which are your permissions. Listing sites (including this one) can check provenance and maintenance signals, but only you can decide what code you trust. Skim our plugin safety checklist before your first install.

How to Install DSH Plugins (and Fix Failed or Slow Downloads)