Building the DeepSeek Harness plugin ecosystem: 42 open-source plugins in a 46-repo family (45 PerryLink-owned plus pan17's dsh-wechat, Apache-2.0) — security, workflows, research, messaging bridges, developer experience — plus the DSH Desktop Market catalog, a plugin-certification registry and the dsh-plugin-doctor CI checker. All 42 ship CI and a Gitee mirror, five-language docs held to the same section count, install command and configuration keys by a gate in each repo's own CI, and the dsh.bundle contract; 137,423 npm downloads over the trailing 30 days. I also contribute upstream to Cordis — the plugin-core framework DeepSeek Harness is built on — and to deepseek-ai projects, including a merged FlashMLA fix.

DeepSeek Harness turned "everything is a plugin" into an ecosystem. I build the plugins I wish existed — engineering-discipline guardrails, runtime panels, cross-session memory, and verifiable research engines — and publish them the way production software deserves.

• The research this family rests on is now a published paper with a DOI — and it is, in large part, a measurement of two things on this profile: laya-mcp — the installable sidecar and MCP server that serves Laya's typed decisions — and jevcore. When a Judgment Layer's Self-Reported Fields Lie: Cost, Latency and the Failure Boundary of Three Judgment Layers on the Same Items — three judgment layers measured on one item set: Laya (local, non-autoregressive), TypeSafe Jev (remote, typed decisions) and DeepSeek-V4.1-Flash. Four claims; three hold and one the data refutes. A complete Chinese translation is archived separately, and the artifact — code and every results/ JSON — is a third record.

• What it found, in one line each. Cost is not the binding constraint: the real axes are latency and the usable state window, and "an order of magnitude cheaper" stops holding once state grows. The judges' self-reported access-layer fields are not trustworthy, and their failures cluster in one place — the concrete ones being a truncation flag that reports passed while silently dropping input, a probability field that inverts an item's conclusion, and two verdict words that are unreachable under real input. The shape behind them: the judge is near-perfect (0.9909, n=220) where the answer is explicitly stated and collapses (0.3091, n=220) where it must notice an absence — while its self-reported confidence stays high in both cases.

• The negative result is reported as one. A dissimilar judge does not supply incremental coverage in any of the three regimes: when the generator errs the judge is less accurate than its own marginal, and the failure correlation is positive in 3/3 draws. The paper also reports four instances of the error class it names — a specification-level defect masquerading as a finding about the model — each caught by a control and not by review, which is where its 23 mandatory protocol clauses come from.

• Both language versions say they are one work, in their own pages. Zenodo has no is translation of relation, so the fact is carried in each PDF's front matter and in the record descriptions instead. 10.5281/zenodo.22901853 · 10.5281/zenodo.22902025 — cite one, not both; where they differ, the English text governs.

• Twelve pull requests of mine are now in laya's default branch — eleven of them merged today, eight of those within 84 seconds (13:22:52Z–13:24:16Z): #237, #236, #232, #231, #230, #228, #227 and #212. The earlier four are #94, #169, #210 and #211. Two stay open (#234, #222) and not one was closed unmerged — every pull request I opened there either landed or is still waiting.
• The batch is a spread, not one theme, which is the part worth keeping: the project's first Windows CI lane (#212 — 15 of the 16 Linux suites now run on windows-latest, the sixteenth skipped with its reason recorded in the workflow rather than quietly dropped, and the required tests (pyX.Y) check names untouched), a suite for the load-time and budget errors no test reached (#237), three assertions that could not fail (#231), an ECE that binned differently from its own siblings (#232), inference moved off the event loop (#230), non-ASCII characters surviving non-string instructions (#228), and a disclaimer heuristic that read the word "confidential" as one (#227). #169 and #210 came out of my own issues #93 and #35, both closed by the maintainer as fixed by merged work; the maintainer's note on #210 is the one worth keeping — "it is better for having been written by someone outside the project."
• And a fifth elsewhere: a process that could not start at all now starts, in a repo governed by the same org as one already on this page. claude-agent-acp #1146 fixes issue #1124 — src/index.ts awaited resolveSettings at module scope with nothing around it, so a transient EINTR/EMFILE/EAGAIN while reading the managed-policy tier rejected a top-level await in an ESM entry point, aborted module evaluation, and exited the process before it served a single ACP message; the client saw only exit 1 and silence. The two neighbours that make it the only call able to do this are both still true on main: SettingsManager.loadAllSettings wraps the same SDK call in try/catch, and the unhandledRejection handler is registered after the await, so it never covers it. The fix extracts the tier read into src/managed-policy.ts — for one reason, that an ESM entry point with top-level side effects cannot be imported by a test — and adds four regression tests, the decisive one asserting the promise resolves with the target env untouched. tests went from 17 failed | 1366 passed to 17 failed | 1370 passed. The 17 pre-existing failures are recorded as untouched and explicitly not claimed either way.

The six most-starred family plugins (★ measured 2026-09-22); every other family repo is listed in full further down, and the research four-piece set is under Research.

One-command starter pack: dsh-kit — installs the core family in one command.

Counting note: the family's own READMEs say "42 plugins" because they count every repo that declares dsh.bundle.patch. Measured against all 46 repos this page names: 39 of the 41 plugin rows declare the contract, and 3 of the 5 support repos do — dsh-plugin-kit (a review-rule meta package), dsh-cert-mcp (a certification MCP server) and dsh-plugin-doctor (the CI health checker); dsh-catalog and dsh-kit ship none. 39 + 3 = the family's 42. The two plugin rows outside that arithmetic are the sibling project line jevcore (no dsh.bundle; only its jevcore-dsh workspace member is a plugin) and the third-party pan17/dsh-wechat. Both counts therefore describe the same 45 PerryLink-owned repos.

Support repos: dsh-plugin-kit (review-rule meta package) · dsh-catalog (DSH Desktop Market catalog source) · dsh-cert-mcp (certification MCP server) · dsh-kit (one-command installer) · dsh-plugin-doctor (plugin health checker). Five repos publish under a @perrylink/ npm name rather than their repo name — the support repos @perrylink/dsh-plugin-kit and @perrylink/dsh-plugin-doctor, and the plugins @perrylink/dsh-github, @perrylink/dsh-ticktick and @perrylink/dsh-skill-pack-security-provider — so the perrylink npm account holds 53 names while the family has 41 plugin repos.

Every repo below is external to PerryLink/*; every number is measured, merged work only, and open proposals are deliberately not listed. The third column names the project's owner — the account alone does not say whether that is a company, a standards body or one person.

★ 1,000+ — named individually, as the rule requires, each carrying the party that owns the project. Fifteen external repos above a thousand stars carry merged work. Five of those rows belong to a major company or a well-known organization — Tencent, DeepSeek, cordiverse, and the ACP project that Zed and JetBrains jointly govern, which now accounts for two of the fifteen; the other ten are catalog repos, small community orgs and one-person projects, and the column says so rather than letting the account name imply a company:

Cordis is the upstream plugin-core framework that powers DeepSeek Harness — vendored into that repo and renamed @deepseek-ai/cordis; FlashMLA #224 is the only merged pull request in the whole deepseek-ai org.

The rest of the contributor set is the community catalog layer rather than upstream projects: 21 further repositories, DSH plugin directories and small community projects (dsh-handbook among them) — the catalogs ingest the family and carry no company owner, so they are named here only in aggregate. 36 external repositories have carried a merged pull request of ours, and 297 merges outside PerryLink/* were counted across them — re-derived 2026-09-23 from every merged pull request of this account, so 297 is exact rather than a floor over a probed subset. Ten of those 36 merged the work under the maintainer's own authorship, so they carry no commit attributed to this account on their default branch; by the rule above they do not size the set, which is 26. SihanTeng's list is the largest of the ten at 32 merges, and is the case that rule was written about.

Security — published advisory GHSA-j922-p6h6-p255 for dsh-permission-rules (medium, patched in 0.6.16).

Official harness repo — it does not accept external pull requests, so that line runs through issues, Discussions (the Show Your Plugins! post #6104) and the plugin ecosystem instead — while the wider deepseek-ai org is open to fixes (FlashMLA #224 merged).

• GitHub (this profile), Gitee and npm — source, CI and releases here; 104 owned repos mirrored to Gitee by a daily job (default branch + all tags); the perrylink account holds 55 npm names and 827 versions, 48 of them active and 44 carrying a provenance attestation
• npm downloads — 137,423 over the trailing 30 days (npm window 08-22..09-20, the last day its daily series covers); dshfind independently tracks 22k+ across the 8 family plugins it has a download figure for — dshfind reports rounded tiers, so that is a floor rather than a total
• DSH Desktop Market — add the catalog source https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json under Market → Sources to browse the family in-app; MCP Registry — three servers, all published from their release workflows over GitHub OIDC: dsh-cert-mcp, jevcore-mcp and laya-mcp
• GitHub Actions — dsh-github and dsh-test-drive also ship composite actions, so they install as uses: PerryLink/dsh-test-drive@vX

Published to a dozen-plus third-party DSH directories and curated lists — awesome-dsh-plugin, DSH Directory, Awesome DeepSeek Harness, walkinglabs' list, Zhiyuan-Fan's list, the AdamPlatin123 radar, dsh-suite, dshfind.com, deepseek1024.com and Glama among them — and scored on OpenSSF Scorecard; the GitHub dsh-plugin topic is what most of them ingest from.

我在 DeepSeek Harness 上把自己希望存在的插件做了出来:检查点回退、声明式权限、输出风格、跨会话记忆、MCP 面板、模型档位路由、微信/TickTick 桥接,以及可验证研究报告 / 基金研究 / 行业研究 / 数据质量「研究四件套」——共 42 个插件(Apache-2.0):全部带 CI 与 Gitee 镜像,42 个插件仓全部带五语文档(五份文件的一致性由每个仓自己的 CI 闸门守着:段落数、安装命令、配置键),且全部声明 dsh.bundle 契约。perrylink 这个 npm 账号下共有 55 个名称、827 个版本:其中 48 个在用(本账号 42 个非 scoped + 5 个 @perrylink/ scoped + pan17 的 dsh-wechat),7 个已弃用(折进 dsh-plugin-upgrade 2.0.0 的三条走廊腿、作者撤回的 dsh-personal-directive、改名前的 scoped @perrylink/dsh-cert-mcp,以及上面三个已归档的 layacore 名字);55 个里有 44 个当前 latest 版本带 provenance 证明(11 个没有:@perrylink/dsh-plugin-doctor、jevcore 三包(jevcore/jevcore-dsh/jevcore-mcp)、dsh-laya、laya-mcp、dsh-wechat、dsh-ticktick、dsh-kit、dsh-catalog、dsh-plugin-kit)。下载量近 30 天 137,423(窗口 08-22..09-20):8 月 69,059 + 9 月截至 20 日 97,843;按名称拆开是 42 个非 scoped 60.0k/84.7k/120.0k、5 个 scoped 4.0k/8.3k/10.5k、7 个弃用名 2.7k/3.7k/6.3k、pan17 的 dsh-wechat 5.1k/2.8k/4.8k。一键全家桶:dsh-kit。同时我是 DeepSeek Harness 上游核心框架 Cordis(cordiverse/cordis,cordiverse 出品、已被 DeepSeek 收编为其 Harness 的 vendored 内核)的贡献者,也是 deepseek-ai 官方仓贡献者:FlashMLA 的修复已合并(#224),这是该组织下唯一一条已合并的外部 PR;此外还有 13 个「千星以上」外部仓的已合并贡献,逐仓的项目归属方与星数见上方 Upstream 一节的表格——其中归属大公司或知名组织的包括 腾讯 Tencent 的 teamai-cli、DeepSeek 的 FlashMLA、Zed 与 JetBrains 共同治理的 agent-client-protocol,其余为个人维护者与社区目录。

2026-09-23 轮:这一家子所依赖的那项研究,现在是一篇有 DOI 的论文 —— 而且它测的很大一部分,正是这份主页上的两个项目:laya-mcp(把 Laya 的定型决策做成可安装 sidecar 与 MCP server 的那条线)与 jevcore。《当判定层的自报字段说谎时:三类判断层的成本、延迟与失效边界实测》在一套相同条目上实测了三类判定层:Laya(本地、非自回归)、TypeSafe Jev(远程、定型决策)与 DeepSeek-V4.1-Flash。四条主张,三条成立,一条被自己的数据否定。

① 成本不是约束。 真正分离三者的是延迟与可用状态窗口;「便宜一个数量级」在状态变大后就不成立了。 ② 判定器的接入层自报字段不可信,且失效集中在同一个位置:截断标志一边报「通过」一边静默丢弃输入、概率字段把条目结论反号、两个判定词在真实输入下根本不可达。这些现象收敛成一条形态 —— 答案被明确陈述时近乎完美(0.9909,n=220),必须注意到「缺席」时塌缩(0.3091,n=220),而两种情形下自报置信度都不低。 ③ 负结果照负结果报。 异种判定器在三个区制上都没有提供增量覆盖:生成器出错时,判定器比它自己的边际准确率还低,失败相关在 3/3 次抽样中为正。论文还如实报告了它自己命名的那类错误的四个实例 ——规格级缺陷伪装成关于模型的发现 —— 每一个都是被对照抓出来的,不是被审阅抓出来的;那 23 条强制协议条款就来自这里。 ④ 两个语言版本各自说明它们是同一项工作。 Zenodo 没有 is translation of 这个关系(CORAR 词表里就没有),所以这件事写在两份 PDF 的扉页和记录描述里:英文原文 · 中文译本;制品(代码与全部 results/ 产物)是第三条记录 10.5281/zenodo.22901248。引其一即可,不要当两篇引;两者有出入以英文为准。

laya 上现在有我 12 条已合并的 PR —— 其中 11 条是今天合的,8 条集中在 84 秒之内(13:22:52Z–13:24:16Z):#237、#236、#232、#231、#230、#228、#227、#212;更早的四条是 #94、#169、#210、#211。另有两条仍在审(#234、#222),没有一条是被关闭而未合并的 —— 我在那里提的每一条,要么已进主干,要么还在等。

这批不是一个主题,而是一片,这一点更值得记:那个项目的第一条 Windows CI 车道(#212 —— Linux 那 16 个 suite 里 15 个现在在 windows-latest 上跑,第 16 个被跳过但把原因写进了 workflow 而不是悄悄丢掉,必需的 tests (pyX.Y) 检查名一个没动)、没有任何测试覆盖到的 load-time 与 budget 错误(#237)、三个不可能失败的断言(#231)、一个与它自家兄弟分箱不同的 ECE(#232)、把推理移出事件循环(#230)、让非 ASCII 字符在非字符串指令里存活(#228),以及一个把「confidential」这个词当成免责声明的启发式(#227)。#169 与 #210 出自我自己提的 issue #93、#35,维护者都以「已由合并的工作修好」关闭;维护者对 #210 的那句评语值得留着 —— 「it is better for having been written by someone outside the project.」 第五个在别处:一个根本起不来的进程现在能起来了 —— 仓库归属的 org,正是本页已列出的另一个仓所属的那家。 claude-agent-acp #1146 修的是 issue #1124:src/index.ts 在模块作用域直接 await resolveSettings(...) 而外面没有任何保护,于是读取 managed-policy 那一层时一个瞬时的 EINTR/EMFILE/EAGAIN 就让 ESM 入口的顶层 await 变成 reject,模块求值中断,进程在发出任何一条 ACP 消息之前就退出 —— 客户端只看到 exit 1 和一片沉默。能让它成为唯一会这样的一处调用,靠的是两个邻居,而两个在 main 上至今仍然成立:SettingsManager.loadAllSettings 把同一次 SDK 调用包在 try/catch 里,而 unhandledRejection 处理器注册在这个 await 之后,所以根本盖不到它。修法是把这一层的读取抽成 src/managed-policy.ts(理由只有一条:带顶层副作用的 ESM 入口没法被测试 import),并补四个回归测试,其中决定性的那个断言 promise resolve 且目标 env 一字未动。测试从 17 failed | 1366 passed 变成 17 failed | 1370 passed;那 17 个既有失败如实记为未触碰,并且明确不对其下任何结论。

待业中。近期考虑给自己安排一次体检。因此最近将减少熬夜，后续的更新迭代节奏会适当放缓。当然，问题和缺陷修复不会停，只是发布频率会降低一些，还请大家谅解。