Plugin Market Index (format 1)

This is not a feed for humans — it is the index DSH reads when a user adds it as a custom plugin market. One document lists every install-verified plugin with an exact version, a real publish time and a commit-pinned install source, so dsh can show, compare and install without scraping the site.

Endpoint

URL	Description	Update
`/market/index.json`	DSH plugin market index (format 1). Only bundles that passed install verification on the current dsh version; ecosystem apps, regressed repositories and high-risk (critical or medium) entries are excluded.	rebuilt on each deploy (data inputs refresh on their own schedules; `Cache-Control: public, max-age=300`)

Serve it as a direct 200 response — dsh fetches with redirect: "error", so a trailing-slash or www redirect fails. Cross-origin reads are allowed (Access-Control-Allow-Origin: *); no API key.

Use it in DSH

Enable the optional custom plugin market bundle (dsh → Plugins → Experimental → Custom plugin market).
Open Plugins → Discover → Manage index sources.
Add https://www.dsh.so/market/index.json. Discover then lists, searches and installs these plugins; installed entries are matched by package name.

The same file can be referenced from a profile's cordis.patch.yml:

- id: plugin-market
  config:
    indexes:
      - https://www.dsh.so/market/index.json

Document structure (format 1)

Field	Required	Semantics
`format`	yes	Always `1`.
`title`	yes	Localized text (string, or object keyed by lowercase language ids) that must include `en`.
`description`	no	Localized text shown by the market.
`metadata.categories` / `labels` / `sortKeys`	no	Declarations; plugin metadata may only reference ids declared here.
`plugins[]`	yes	Installable bundles; `name` is unique and must be a valid npm package name.
`plugins[].title` / `description` / `icon` / `author`	no	Display fields. Icons are absolute https URLs; `repository` is display-only and never an install source.
`plugins[].metadata`	no	`category`, `keywords[]`, `labels[]`, `sortKeys` — ids must be declared.
`plugins[].versions[]`	yes	Non-empty, one entry per exact version, sorted by SemVer precedence descending.
`versions[].version`	yes	Exact SemVer (no ranges).
`versions[].publishTimestamp`	yes	Unix seconds, integer in `[0, 10^11)`. For npm sources this is the real registry publish time.
`versions[].source`	yes	`{ "type": "npm" }` → install `name@version`; `{ "type": "git", "url", "commit" }` → install `git+<url>#<commit>`.
`versions[].engines.dsh`	no	SemVer range of compatible DSH versions; dsh evaluates it before offering the version.

Format 1 is strict: a single invalid member makes DSH reject the whole document. This index is validated with the official @deepseek-ai/dsh-plugin-market-index parser at build time, so a broken document fails the build rather than reaching users.

What the entries mean

The index is filtered, not just annotated. A plugin is listed only when its install verification passed on the current dsh version (L4 sandbox install / L5 run), and entries whose fused security verdict is critical or medium are excluded entirely — only low-risk and audit-pending entries are listed. Ecosystem apps (not installable via dsh plugin add), regressed repositories and bundles without a resolvable exact version never appear.

Every listed plugin carries trust labels in metadata.labels, declared once in the document header:

Label	Meaning
`install-verified`	The current dsh version installed and ran the plugin successfully.
`risk-low`	Site security verdict (static scan + vet + model-driven audit, raise-only) is low.
`risk-pending`	No audit verdict yet — keep an eye on it.
`risk-medium` / `risk-critical`	Declared only in the audit scope (`scope=all`); these entries are never published in the market index.

Versions come from the published npm package or a GitHub release tag; publishTimestamp is the npm registry's own publish time, and git entries pin the commit the release tag points at (not the default-branch HEAD).

Known limits: git entries without a release fall back to the latest commit time as publishTimestamp; display icons are the author's GitHub avatar because the registry has no plugin logo. The index is a selection layer — the full registry, security verdicts and per-version verification records live on each plugin page.

Fetch

curl https://www.dsh.so/market/index.json

Free to reuse with attribution to dsh.so (CC BY 4.0). The document is a build-time derivation of the public registry; field additions are announced in the changelog. The full plugin data API catalogue is at /data/.