Contributing

Contributions should keep the plugin small, inspectable, and safe to install in a DSH host process.

Requirements

• Node.js 22.19+ or 24+
• npm
• A supported DeepSeek Harness profile for integration testing

Setup

npm ci
npm run check

The check runs unit tests, validates every installable entry in the embedded catalog, and verifies the npm package contents.

Development rules

• Add focused tests for behavior changes.
• Keep dshget_search and dshget_plugin_info read-only.
• Keep third-party installation behind the explicit /dshget install command.
• Never pass catalog strings through a shell. Spawn dsh with a fixed argument array.
• Validate remote data before replacing the local cache.
• Do not add credentials, private repository metadata, or user telemetry.

Pull requests

Explain the user-visible change, the trust-boundary impact, and the commands used to verify it. Small, single-purpose pull requests are easier to review.

The embedded snapshot is sourced from the public dshget-data catalog. Changes to the catalog pipeline belong in that project; this repository contains only the release snapshot consumed offline.