majiayu000/dsh-plugin-registry
Harness Registry is a searchable DeepSeek Harness plugin registry for DSH users and plugin authors. It combines a community-curated catalog with GitHub discovery, verifies the installable dsh.bundle manifest contract, and exposes comparable plugin metadata and copy-ready install commands.
catalog 简介 / catalog descriptioncatalog description：Searchable DeepSeek Harness plugin registry with curated listings and manifest-verified GitHub discovery.
安装Install
dsh plugin --profile web add github:majiayu000/dsh-plugin-registry把 majiayu000/dsh-plugin-registry 加入你的 DSH 配置（web profile）即可启用。
READMEREADME
Harness Registry — DeepSeek Harness Plugin Registry
Harness Registry is a searchable DeepSeek Harness plugin registry for DSH users and plugin authors. It combines a community-curated catalog with GitHub discovery, verifies the installable dsh.bundle manifest contract, and exposes comparable plugin metadata and copy-ready install commands.
Status: pre-release. The registry is available at plugin.dshdesk.com and the source is released under the MIT License. See launch readiness.
Quickstart
Requirements: Node.js 22 and npm.
git clone https://github.com/majiayu000/dsh-plugin-registry.git
cd dsh-plugin-registry
npm ci
npm run dev
Open http://localhost:5173 to browse, search, filter, and inspect the registry.
What it provides
- A searchable web directory with categories, trust labels, Stars, Forks, and install commands.
- Curated entries vendored from the community catalog into
sources/curated.json. - Automatic discovery from the GitHub
dsh-plugintopic. - Manifest verification: discovered repositories must declare a valid
dsh.bundleobject inpackage.json, and its referenced patch file must exist. - Supply-chain pinning: each verified plugin records the exact
verifiedCommitHEAD its manifest was checked against. - A public JSON snapshot with schema validation, health gates, and a separate audit queue.
- Snapshot freshness on every page, with a stale warning past 24 hours and an automatic GitHub issue when a scheduled sync fails.
- Strict per-page Content-Security-Policy with icons restricted to GitHub-hosted domains.
- A repository checker that explains whether a plugin is eligible for automatic discovery.
- An optional on-site review form that creates an assigned, public GitHub Issue through a protected Cloudflare Pages Function.
Query the registry data
The generated snapshot lives at public/data/plugins.json and follows schema/registry.schema.json.
jq '.stats | {published, curated, automaticallyDiscovered, pendingReview}' public/data/plugins.json
Inspect one plugin:
jq '.plugins[] | select(.id == "omdsh-dev/dsh-at-file") | {id, trustLevel, install}' public/data/plugins.json
Validate the snapshot and run the governance tests:
npm run validate:registry
npm test
Backfill GitHub primary-language metadata without rerunning full discovery:
GH_TOKEN=... npm run backfill:languages
How discovery works
Vendored curated catalog (sources/curated.json) ─┐
├─ normalize ─ verify ─ governance ─ public registry
GitHub topic ────────────────────────────────────┘ └──── audit queue
Curated repositories receive the curated trust level. Automatically discovered repositories are installable only when their root package.json contains a valid dsh.bundle; these receive manifest_verified. Pending repositories remain visible as GitHub candidates without an install command, while blocked and quarantined repositories stay hidden. The full policy is documented in registry governance.
The scheduled GitHub Actions workflow refreshes the snapshot every two hours. When the registry changes, the same workflow commits the snapshot and deploys its verified build artifact to Cloudflare Pages, so sync commits created with GITHUB_TOKEN do not depend on a second push event. A health gate prevents an unauthenticated partial discovery run, an unexpectedly smaller complete snapshot, or a partially answered GitHub GraphQL batch from replacing healthy data. If a scheduled sync fails, the workflow opens a titled tracking issue and closes it once the next run is healthy again.
Add a plugin
For automatic discovery:
- Publish a real, public, non-fork GitHub repository.
- Declare an installable
dsh.bundleobject in the pluginpackage.json(root or a path listed indsh.bundles). - Make sure the referenced patch file exists and is a top-level YAML array (empty
[]is valid). - Add the
dsh-pluginGitHub topic. - Wait for the next registry sync.
Check a local checkout before publishing:
npm run check:plugin -- ./hello-plugin
Use the repository checker at http://localhost:5173/publish.html. When the Cloudflare submission channel is configured, authors can submit a trackable review request without leaving the page; GitHub remains available as a fallback. See submission review setup.
Known limitations
- Manifest and patch-file verification confirm the bundle overlay exists and is a top-level YAML array; they are not an installation test, security audit, or endorsement of plugin code.
- GitHub install commands are pinned to
verifiedCommitwhen that SHA was recorded. npm-style specs are not commit-pinned. - Stars, Forks, descriptions, Topics, and primary languages are point-in-time GitHub metadata and can lag until the next sync.
- A complete discovery refresh requires a GitHub token; unauthenticated runs inspect only recent candidates and cannot overwrite a complete snapshot.
- The browser-based repository checker uses the unauthenticated GitHub API and may encounter rate limits.
- The Cloudflare Pages site tracks
main; formal versioned releases are not yet available.
Development
npm ci
npm test
npm run validate:registry
npm run build
To refresh registry data, provide a GitHub token with public repository read access:
GITHUB_TOKEN=... npm run sync:plugins
To regenerate the vendored curated catalog from the current snapshot:
npm run export:curated
Do not commit tokens or generated credentials. See CONTRIBUTING.md for the change workflow.
Project structure
assets/contains the registry UI modules, styles, and translations.public/data/plugins.jsonis the generated public registry snapshot.scripts/contains discovery, normalization, and validation tooling.functions/contains Cloudflare Pages server-side routes for review submissions.schema/registry.schema.jsondefines the published snapshot contract.tests/covers registry governance and browser-facing behavior.
Support and security
- Bugs, data corrections, and feature requests: GitHub Issues
- Sensitive vulnerabilities: private vulnerability report
- Security policy: SECURITY.md
License
Harness Registry is available under the MIT License.
相关推荐Related
-
nexu-io/open-design
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your…
-
esengine/DeepSeek-Reasonix
DeepSeek-native AI coding agent for your terminal. Engineered around prefix-cache stability — leave it running.
-
Molunerfinn/PicGo
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosti…
-
titanwings/colleague-skill
将冰冷的离别化为温暖的 Skill，欢迎加入数字生命1.0！Transforming cold farewells into warm skills? It's giving rebirth era. Welcome to Digital …
-
tt-a1i/archify
Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams—self-contained…
-
freestylefly/awesome-gpt-image-2
Prompt as Code | GPT-Image2 工业级提示词引擎与模板库，470+ 个案例逆向工程，20+ 套工业级模板，并提炼出Skills，持续更新中
-
awesome-dsh-plugin/awesome-dsh-plugin
A curated list of plugins for DeepSeek Harness (dsh) · DeepSeek Harness 插件精选列表
-
YaoApp/yao
✨ All your agents and workspaces in one place, on every device you own. Track tasks on a board, accessible from desktop,…