xlings-res/dsh-plugins

Mirrored tarballs of DeepSeek Harness plugins, consumed by Sunrisepeak/dsh-index.

Nothing here is original work. Every release is a pnpm pack of an upstream plugin at a pinned commit, republished so that xlings install dsh:<plugin>

• resolves through a CN mirror as well as GitHub,
• verifies a sha256 before it installs,
• still works if the upstream repository disappears,
• and needs no build authorisation on the user's machine — the package's own prepare script ran here, in CI, once.

Layout

tag     <plugin>-<version>
assets  <plugin>-<version>.tgz
        <plugin>-<version>.tgz.sha256

Each release body records the upstream repo, the exact commit it was built from, its license, and the digest.

What gets mirrored, and what does not

Mirroring is redistribution, so the license decides — not usefulness or popularity. A plugin is mirrored only if its upstream repository carries a license that grants redistribution (MIT, BSD-3-Clause, Apache-2.0, GPL-3.0), and the LICENSE file must be present in the tree at the pinned commit, not merely claimed in repository metadata. The upstream license ships inside every tarball.

A plugin with no LICENSE grants no rights at all, so it is not mirrored. Those install straight from GitHub instead, and dsh-index labels them as such rather than implying a guarantee it cannot make.

The license is re-checked at every publish: a project can relicense, so a decision made when the plugin was first indexed is not valid forever.

Takedown

If you author a plugin here and want it removed, open an issue on dsh-index or contact the maintainers. The release is deleted and the package reverts to installing directly from your repository — no fork of your code is kept.

Publishing

Releases are produced by tools/mirror.py in dsh-index. It refuses rather than degrades: any failed gate means no release and no mirror block, so a mirror entry that does not resolve cannot exist.