Contributing a plugin

Create plugins/<plugin-name>/plugin.json and validate it against schemas/plugin-v1.schema.json. The folder name and descriptor name must be identical, lowercase, and kebab-cased.

The descriptor records:

• identity, version, display copy, publisher, authors, and license;
• repository, homepage, and an immutable npm or Git distribution;
• compatible DSH/OpenHarness versions, profiles, and platforms;
• controlled categories and capabilities;
• declared network, filesystem, environment, and command permissions;
• optional localized display copy.

Every distribution declares its actual package identifier in distribution.package; OpenHarness uses it as a strong local identity signal. For Git distributions, distribution.ref must be the exact 40-character commit SHA to install. Branch names and tags are intentionally rejected. For npm distributions, version is combined with distribution.package to form the exact package version.

Git distributions must commit their package entry point and other runtime artifacts. Catalog CI verifies the descriptor package name, DSH metadata, and entry file at the pinned SHA, and rejects install-time lifecycle scripts. A user's plugin profile should not have to authorize repository build scripts.

Before opening a pull request, run:

pnpm install
pnpm validate
pnpm test
pnpm build

Changes to existing plugin versions should update both version and the pinned distribution. Reviewers should verify that declared permissions match the code at that immutable source revision.