dsh-plugin-registry

Public-safe, first-party registry for Harzva-maintained DeepSeek Harness (DSH) plugins.

This repository is the source of truth for Harzva first-party public plugin metadata, immutable source and Release references, DSH compatibility, declared capabilities, permissions, review evidence, and reversible withdrawal state. It is designed to be consumed by tooling and a future read-only dsh-plugin-store UI.

It is intentionally not an official DeepSeek marketplace, a general community directory, a credentials service, or an implicit-trust installer. A registry record describes what was reviewed; it does not certify third-party code as safe. Installation remains an explicit user action through a DSH-aware path.

Current status

The first public record is harzva.dsh-control-plane. More first-party records require their own public Release, source pin, checks, and review pack; third-party discovery is intentionally outside this registry's authority.

Repository layout

• registry/schema/plugin.schema.json — public record contract.
• registry/plugins/*.json — one record per plugin.
• registry/index.json — deterministic generated index.
• scripts/generate-index.mjs — deterministic index generator/checker.
• scripts/validate-registry.mjs — schema-shaped and public-safe validation.

Local checks

npm run check

The checks require no dependency installation and do not execute plugin code. They reject malformed records, mutable source references, broken public URLs, credential-shaped values, local paths, and generated-index drift.

Public-safe boundary

Do not add API keys, cookies, .env values, raw chats, real Sessions, private knowledge, absolute local paths, real DSH_HOME values, or private source archives. Records contain public metadata and links to public releases only.

Relationship to dsh-control-plane

dsh-control-plane manages Runtime, Profile, Preset, Session, plan, and knowledge-reference projections. This registry owns first-party plugin publication metadata. A future control plane integration must consume this registry read-only and must not copy private runtime state.