By zoahdev · 2026-08-15 · Based on a real submission (ydhrdh/dsh-marketplace PR #1) and real installs
dsh-marketplace (discussion #1752) is an open-source plugin marketplace: one JSON manifest per plugin, PR-based review, git history as the audit log, zero-cost static hosting.
npm), git (github:owner/repo), or local (local).npm run validate.install.command uses the {profile} placeholder.dsh-plugin topic.Required: id (matches the directory), name, version, description, author{name,url}, license, category, install{target,spec,command}, repository. Set verified: false on first submission; maintainers flip it after review.
{
"id": "dsh-plugin-doctor",
"name": "Plugin Doctor",
"version": "1.3.0",
"category": "tools",
"install": {
"target": "git",
"spec": "github:zoahdev/dsh-plugin-doctor",
"command": "dsh plugin --profile {profile} add github:zoahdev/dsh-plugin-doctor"
},
"repository": "https://github.com/zoahdev/dsh-plugin-doctor"
}
git clone https://github.com/ydhrdh/dsh-marketplace
mkdir -p registry/plugins/<your-plugin-id>
npm install
npm run validate
npm run build
# open a PR; CI must be green
Installing a git-hosted plugin triggers pnpm 11's build-script gate:
[ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED] ... not in the "allowBuilds" allowlist
Add the exact key the CLI prints to the profile's pnpm-workspace.yaml, then re-run dsh plugin add. It succeeds and --dump-config shows the plugin row.
Tip: include your real install output (both the failure and the success) in the PR description — it makes maintainer review much faster. That's exactly how our PR #1 is written.