Discover and Add a DeepSeek Harness Plugin

What this article is (and is not)

The plugin guide is the full how-to (Cordis families, authoring, safety). The security checklist is the permissions mindset. This post is the happy-path operator journey: discover → copy → add → reload → prove it worked — without pretending this site is a live store.

Upstream still owns exact CLI flags. If README and this page disagree, the README wins.

Step 0 — Have a working DSH first

Do not start plugin shopping while npx @deepseek-ai/dsh web is still broken. Fix the environment with install or the npx / 3080 ladder. Pick a mode (often Standard for daily work, Creative when you are deliberately testing a skin). Use a disposable workspace.

Step 1 — Discover without drowning

Two discovery layers:

1. Curated navigator — Community plugins on this portal: rewritten summaries + copy-ready dsh plugin add lines. Not a full mirror; not a certification.
2. Public topic — GitHub topic dsh-plugin and other community catalogs when you outgrow the subset.

Star counts are popularity, not a security review. Prefer packages whose README documents tools, secrets, filesystem scope, and network calls.

Step 2 — Copy the exact install line

Typical form:

dsh plugin add github:owner/repo

Some packages use dsh plugin add @scope/name when the README says so. Typos in the owner or scope install strangers. Prefer copying from the card or the upstream README — not from a screenshot in chat.

Step 3 — Add, then fix the usual install snags

1. Run the command from a shell where DSH / dsh is available (npx path or source pnpm dsh — see install docs).
2. Plugin management often shells out to pnpm. If add fails with “pnpm not found”, install pnpm globally and retry.
3. Registry timeouts: retry with the official npm registry.
4. Reload or restart the profile the plugin patches.

Step 4 — Prove it in Trajectory

1. Send one low-risk prompt in the throwaway folder.
2. Open session / Trajectory logs (observability intro).
3. Look for new tool names you did not expect.
4. If anything looks wrong, unload the last plugin before adding another — see the security checklist.

Step 5 — Record what you pinned

Write down: DSH preview version, plugin SHA or tag, workspace root, preset name. Without that, next week’s “it broke after upgrade” bug report is noise.

Anti-patterns

• Adding three community packages before the first successful Standard loop.
• Treating a curated card as “verified safe”.
• Pointing a new plugin at payroll or home directory on day one.
• Skipping Trajectory because “the chat answered fine”.

Where to go next

• Full operator/author docs: plugin guide
• Cards to copy: directory
• UI-only experiments: skins
• Send discovery fixes upstream: contribute