dsh-plugin-registry

Public-safe, first-party registry for Harzva-maintained DeepSeek Harness (DSH)
plugins.

This repository is the source of truth for Harzva first-party public plugin metadata, immutable
source and Release references, DSH compatibility, declared capabilities,
permissions, review evidence, and reversible withdrawal state. It is designed
to be consumed by tooling and a future read-only dsh-plugin-store UI.

It is intentionally not an official DeepSeek marketplace, a general community
directory, a credentials service, or an implicit-trust installer. A registry
record describes what was reviewed; it does not certify third-party code as
safe. Installation remains an explicit user action through a DSH-aware path.

Current status

The first public record is harzva.dsh-control-plane. More first-party
records require their own public Release, source pin, checks, and review pack;
third-party discovery is intentionally outside this registry's authority.

Repository layout

• registry/schema/plugin.schema.json — public record contract.
• registry/plugins/*.json — one record per plugin.
• registry/index.json — deterministic generated index.
• scripts/generate-index.mjs — deterministic index generator/checker.
• scripts/validate-registry.mjs — schema-shaped and public-safe validation.

Local checks

npm run check

The checks require no dependency installation and do not execute plugin code.
They reject malformed records, mutable source references, broken public URLs,
credential-shaped values, local paths, and generated-index drift.

Public-safe boundary

Do not add API keys, cookies, .env values, raw chats, real Sessions, private
knowledge, absolute local paths, real DSH_HOME values, or private source
archives. Records contain public metadata and links to public releases only.

Relationship to dsh-control-plane

dsh-control-plane manages
Runtime, Profile, Preset, Session, plan, and knowledge-reference projections.
This registry owns first-party plugin publication metadata. A future control
plane integration must consume this registry read-only and must not copy private
runtime state.