Open-source developer in Beijing. I build the DeepSeek Harness plugin ecosystem: 42 Apache-2.0 plugins in a 48-repo family — security, workflows, research, messaging bridges and developer experience — plus the DSH Desktop Market catalog, a plugin-certification registry and the dsh-plugin-doctor CI checker. Every plugin ships CI, a Gitee mirror and five-language docs held to the same section count by a gate in its own CI.

One command installs the core family — dsh-kit:

./install-all.sh web              # Linux / macOS
.\install-all.ps1 -Profile web   # Windows PowerShell

Every repo below is external to PerryLink/*; every number is measured, merged work only, and open proposals are deliberately not listed. The third column names the project's owner — the account alone does not say whether that is a company, a standards body or one person.

★ 1,000+ — named individually, as the rule requires, each carrying the party that owns the project. Twenty-three external repos above a thousand stars carry merged work (★ measured 2026-10-06), and the newest of them is not a row that merely drifted over the line: Tencent/BrowserSkill merged 2026-10-06T13:45:15Z — the most recent of the three, as of that measurement; awslabs/mcp had held the position for the fifteen hours before it and docker/docker-agent for the ten before that; ruvnet/ruflo and walkinglabs/learn-harness-engineering entered the ten days before those, and punkpeye/fastmcp has carried its merge since 2026-09-24 and was missing from the round before. Nine of those rows belong to a company or a well-known project organization — Amazon Web Services, Docker, Reactive Resume, DeepSeek, cordiverse, Tencent, and the ACP project that Zed and JetBrains jointly govern, the last two of which take two rows each; the other fourteen are catalog repos, small community orgs and one-person projects, and the column says so rather than letting the account name imply a company:

The rest of the contributor set is the community catalog layer rather than upstream projects: 23 further repositories, DSH plugin directories and small community projects (dsh-handbook and imsai-sh's list, which alone took 41 merges, among them) — the catalogs ingest the family and carry no company owner, so they are named here only in aggregate. 46 external repositories carry at least one merged pull request of ours together with a commit attributed to this account, and 320 merges were counted inside them — re-derived 2026-10-06 from this account's own merged pull requests, so 320 is exact rather than a floor over a probed subset. Two further repositories took 33 more of our merged pull requests without crediting a commit to this account on their default branches — SihanTeng's list, 32 of them, which is the case the rule at the top of this section was written about, and dsh-better-sidebar, one, which merged 2026-10-04 and carries no commit of ours on main — so neither sizes the contributor set. 320 + 33 = the 353 merged pull requests this account has outside PerryLink/*, concentrated in 48 repositories; a further 92 are open across 54 repositories and are deliberately not counted here.

The ten days since the last round moved the merged count by 30 (2026-09-25 → 2026-10-05, the window this round re-measured), and 22 of those 30 are laya alone — the last of them #924, which merged 2026-10-04T17:50:19Z and is the most recent merge this account has anywhere. Six more landed one apiece in six repositories that were not part of this set at all before — ruflo, learn-harness-engineering, koishi-plugin-booru, dsh-plugin-manager, dsh-plugin-market and dsh-annotation — which is what puts the largest row in the table above, ruflo at 73,901★, in a set it was not part of ten days ago. The twenty-ninth is dsh-better-sidebar, merged 2026-10-04T17:26:07Z, and it is the one merge in the window that credits this account no commit — which is why it is named in the paragraph above instead of being counted with the other 29. The thirtieth, and the most recent of all, is docker-agent#4372 — a two-file documentation fix merged 2026-10-05T12:14:03Z by Docker maintainer aheritier, which is both the +1 in the total above and the row that puts a seventh company in the table.

laya — NandhaKishorM/laya — 46 merged pull requests of the 50 this account has opened there and second among merged-PR authors, behind aashish254 (126) and ahead of Bruce-Yii (27); the maintainer NandhaKishorM holds one merged PR of his own because he commits to main directly rather than through pull requests, and none of the three leaders is a collaborator. As of 2026-10-05 it reads 1 open and 3 closed unmerged — the open one is #943, opened 2026-10-05, where Router.predictBatch dropped the per-call onPredictStart/onPredictEnd/hooksRaise arguments; 45 of the 46 merged inside a nine-day run (2026-09-21 → 2026-09-29), and the maintainer merges in batches — fifteen of them share two timestamps, seven at 19:29:05 on 09-27 and eight at 17:40:36 on 09-29. The complete list is one query away:

laya pull requests by this account — the same 49, always current, in any language.

Security — published advisory GHSA-j922-p6h6-p255 for dsh-permission-rules (medium, patched in 0.6.16).

Official harness repo — it does not accept external pull requests, so that line runs through issues, Discussions (the Show Your Plugins! post #6104) and the plugin ecosystem instead — while the wider deepseek-ai org is open to fixes, and the account now proposes them at the systems layer rather than only in its catalogs: of the 20 pull requests it has opened across that org, FlashMLA #224 remains the only one merged, and 16 are open, 14 of them code fixes carrying a reproduction across ten repositories — DeepEP three, FlashMLA and deepseek-recipe two each, and one apiece in DeepGEMM, 3FS, TileKernels, DeepSeek-MoE, DeepSeek-Prover-V1.5, DeepJIT and DeepSelect — the other two are catalog additions.

The other 36 plugins and the five support repos are one line each below. The roster's source of truth is dsh-kit — its plugins.txt and a parity script hold the family to that file; the machine-readable catalogue is dsh-catalog, which is also the DSH Desktop Market source; and each plugin's own README carries the detail this page only summarises.

A maintainer review of the whole family against the official harness and the wider plugin ecosystem concluded that three of these plugins duplicate capabilities the official harness now implements natively, and one was reclassified as internal tooling. Retirement here has a precise meaning: compatibility updates stop because the capability is now official, or because a better-adopted alternative exists — these are not abandoned or broken, and they keep working for existing installs.

Reclassified, not retired: dsh-catalog is now treated as family-internal tooling rather than a product. It is live infrastructure feeding the DSH Desktop Community Market, and its job is to inventory this family — so it does not compete with third-party catalogs and needs no retirement.

Frozen because better-adopted alternatives now exist for that capability. Each repo's README records the measured comparison. Weekly npm downloads, measured 2026-10-05:

dsh-defend is the one frozen package that is still the broader detector — an Aho-Corasick engine over the prompt-injection / jailbreak / secret-leaker asset sets, with three-way allow/ask/block interception on user messages, tool arguments and tool results. It is frozen because the field moved, not because the plugin is weaker.

• GitHub (this profile), Gitee and npm — source, CI and releases here; 46 family repos mirrored to Gitee by a daily job (default branch + all tags), plus this profile repo; the perrylink account holds 52 npm names and 951 versions, 47 of them with a non-deprecated latest and 39 of those carrying a SLSA provenance attestation on that version (44 names carry it on at least one version; the eight with none anywhere are jevcore, jevcore-dsh, jevcore-mcp, dsh-laya, laya-mcp, dsh-personal-directive and the three archived layacore names — measured 2026-10-05 against each name's own packument, and the registry search endpoint is not authoritative here, since it returns only 47 names and omits the deprecated ones)
• npm downloads — 152,643 over the trailing 30 days (npm window 09-05..10-04, summed per name from the downloads point endpoint; dshfind independently tracks 22.5k+ across the 8 family plugins it currently has a download figure for — dshfind reports rounded tiers, so that is a floor rather than a total
• DSH Desktop Market — add the catalog source https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json under Market → Sources to browse the family in-app; MCP Registry — three servers, all published from their release workflows over GitHub OIDC: dsh-cert-mcp, jevcore-mcp and laya-mcp
• GitHub Actions — dsh-github and dsh-test-drive also ship composite actions, so they install as uses: PerryLink/dsh-test-drive@vX

Published to a dozen-plus third-party DSH directories and curated lists — awesome-dsh-plugin, DSH Directory, Awesome DeepSeek Harness, walkinglabs' list, Zhiyuan-Fan's list, the AdamPlatin123 radar, dsh-suite, dshfind.com, deepseek1024.com and Glama among them — and scored on OpenSSF Scorecard; the GitHub dsh-plugin topic is what most of them ingest from.

This page is re-measured, not remembered. Every figure carries the date it was measured, and the round log records what each re-measurement corrected — including three claims of this page's own that did not survive. Round log · How every figure was measured.