# Reference plugin and distribution research

This report records the 2026-10-06 reference-plugin and distribution research for DSH `0.2.0-rc.2`. Source observations, design implications, and dated external rules are evidence for that baseline; this source-only research does not establish product runtime compatibility. Implementation status belongs to [README](../../README.md), and executed checks to the [verification reports](../verification/client-interface.md).

## Evidence and scope

- **Verified installed baseline:** the local Desktop manifest reports DSH `0.2.0-rc.2`, Node `24.18.1`, pnpm `11.7.0`, macOS ARM64, and host protocol `4`. The Desktop package identifies clean build commit `5e9e301dd9dc8923b2762f76dacfc5751f6ca851`. [Runtime descriptor](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/desktop-runtime.json#L1); [Desktop package](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/package.json#L24).
- **Local source provenance:** the installed path supplied for inspection is inside the packed Electron archive `/Applications/DeepSeek Harness.app/Contents/Resources/app.asar`, rather than a normal filesystem directory. An inspection snapshot was extracted from that archive under `.local/dsh-runtime/` in the workspace. Local citations below point to that snapshot; it should remain ignored inspection material, not vendored project code. [Installed archive](</Applications/DeepSeek Harness.app/Contents/Resources/app.asar>); [extracted DSH manifest](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/package.json#L1).
- **Verified reference baseline:** GitHub main and npm metadata agree on `dsh-session-recycle-bin@0.4.3`, commit `c9f08e801cf46a917a49d785dc32e9e769e6d2a9`. The repository still has the name `Seetraum/harness-session-delete`. Reference implementation links use that commit. [GitHub tree](https://api.github.com/repos/Seetraum/harness-session-delete/git/trees/main?recursive=1); [npm metadata](https://registry.npmjs.org/dsh-session-recycle-bin/latest).
- **Currency limitation:** public DSH `master` documentation can be newer than the installed runtime. For behavior on this machine, local `0.2.0-rc.2` code takes precedence. Fetching the newer publish tutorial at the installed build commit returned 404; the accessible tutorial is therefore cited as upstream documentation, not proof that every sentence was present in this installed release. [Current publish tutorial](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md).
- Research consisted of source/document reads and a tarball file listing. No remote source scripts were executed, no local sessions were deleted, and the installed archive was not modified.

## Verified reference-plugin findings

### License and attribution

The reference is **MIT licensed**, copyright **2026 Seetraum**. The license permits use, modification, distribution, sublicensing, and sale, conditional on including the original copyright and permission notice in copies or substantial portions. A reuse or adaptation should preserve that notice in the distributed package and document the upstream relationship. An independent implementation can cite it as inspiration without implying an upstream endorsement. The license text is evidence for reuse conditions; it is not a compatibility guarantee. [Pinned license](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/LICENSE).

### Product behavior and useful precedents

The README describes sidebar and conversation-header actions that archive sessions, a Settings recycle-bin panel, restore, permanent deletion, batch actions, and running-agent protection. The browser source also implements workspace grouping, search, preview, metadata, confirmation dialogs for permanent deletion, and a toast undo for moving a session to the bin. These establish an existing product baseline; a new project needs a clear functional distinction beyond a refreshed visual treatment. [README](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/README.md); [browser source](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/client.js).

Its host mounts through one bundle patch row and serves its own `/api/session-trash/*` routes. The browser is a hand-written `window.__ModuleLoader__.load({ id, factory })` closure that requests React from the DSH module table. Sidebar actions are injected with a document-wide `MutationObserver`, matching DOM rows and localized accessibility labels; duplicate titles can require position/recency heuristics. The Settings and header contributions use slots, but the sidebar injection is coupled to the host's DOM. [Pinned bundle patch](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/cordis.patch.yml); [browser source](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/client.js).

### Implementation risks relevant to current DSH

The following are **verified source observations**, followed by **design inferences**. They are not a reproduced exploit assessment.

| Verified observation | Implication for a new plugin |
|---|---|
| The reference overwrites `WorkspaceRegistry.archiveSession` and `unarchiveSession`, directly reading and writing registry state. Its HTTP archive route only checks the agent registry for `status !== 'idle'`. | Do not copy these patches into the current host. Native archive admission now includes more activity families and preserves invariants this patch bypasses. |
| Its archive state is the host's `archivedSessionIds`, not a separately owned trash collection. | Calling every archived session “deleted” conflates the host's archive feature with plugin trash. Native archived sessions could unexpectedly appear in a bin or become purge targets. |
| `permanentlyDeleteSession` calls `rm(dirname(logPath), { recursive: true, force: true })`, then cleans cache/live/workspace state through several separate steps. | This removes the entire session directory, including retained generations and any colocated artifacts. The cleanup is not one transaction and can leave partial state if a later step fails. |
| Path resolution first probes old/internal persistence methods, then scans `HOME/.dsh/sessions`; it does not use DSH's configured data-root helper in that fallback. | Avoid guessed roots. Custom `DSH_HOME`, configurable JSONL roots, alternate providers, or future layouts require an explicit supported adapter. |
| Purge routes accept any non-empty string IDs and do not require membership in the archive set. The workspace-purge route also accepts caller-supplied IDs. | A new host endpoint should validate identifiers and each target's membership, capabilities, and current state. UI confirmation alone does not constrain what the backend will delete. |
| The recursive removal path is derived from persistence lookup or a `join(root, project, sessionId)` fallback without an explicit realpath containment assertion in the plugin. | Treat filesystem authorization and containment as required implementation work. Do not infer that a string session ID authorizes any path it happens to resolve to. |
| One delete wrapper suppresses original-delete and physical-delete failures, while cache removal is fail-soft; batch routes collect per-session errors but `emptyArchivedSessions` returns counts without its collected error details when any deletion succeeds. | Report actual per-target outcomes and retain failed items visibly. A “success” counter must correspond to verified completion. |
| The reference snapshots only active-agent status before filesystem work; it does not acquire the current persistence writer lease. | An idle loaded session can still own a write handle, and another process can be writing. Current safety needs persistence ownership coordination, not an agent-status check alone. |
| The host shim deliberately avoids a default export to preserve named `inject`; it content-hashes only the implementation entry on dynamic import. It also tags service patches and attaches cleanup through `ctx.effect`. | Lifecycle cleanup and reinstall behavior are material requirements. The shim is a workaround tied to its build shape; copying it is not proof that transitive imports or every host version reload safely. |
| The mutation-route guard checks a fixed `x-dsh-plugin` header. The reference describes this as a minimal CSRF defense. | This is a custom-header mechanism, not a secret or a complete statement of current DSH authentication. Validate integration with the installed host's transport and origin policy before exposing new mutation routes. |

All reference implementation observations in this table come from the [pinned host source](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/packages/session-trash-host/lib/index.js), [host shim](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/index.js), and [security policy](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/SECURITY.md).

### Current-host cross-checks

**Verified:** native `archiveSession(sessionId, options)` in `0.2.0-rc.2` checks whether the session exists, asks the `workspace/session-activity` waterfall, rejects activity unless `stopActivity: true`, clears the pin in the same durable state write, and can dispatch `workspace/session-stop` after archival. Shipped activity providers cover the running agent turn, owned jobs, running descendants, and active reminders. Native `unarchiveSession` already exists and removes only the archive marker. Replacing these methods with the reference's archive implementation would bypass current admission and pin handling. [Installed workspace implementation](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-workspace/lib/index.js#L507); [installed workspace contract](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-workspace/README.md#L99).

**Verified:** current persistence offers create/open/stat/list/flush and handle-based reading/writing. `open(id, 'read')` observes without ownership; omitting or confusing access is unsafe. Closing a write handle drains pending durability and releases ownership. The JSONL backend explicitly says “Nothing deletes session files” and “the seam has no deletion API”; it uses kernel-backed writer exclusion across instances/processes. Removing the POSIX lock file forfeits that exclusion. Permanent deletion therefore needs its own carefully scoped storage integration; it cannot simply call a public generic delete API that does not exist. [Installed persistence contract](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-session-persistence/README.md#L34); [JSONL limitations](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-session-persistence-jsonl/README.md#L163).

**Verified:** the JSONL root is deployment-controlled and required, with no backend default; logs may be compressed and retain historical generations. The shared home helper resolves explicit configuration, then `DSH_HOME`, then `~/.dsh`. The reference's filesystem fallback is narrower than these current contracts. [JSONL configuration](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-session-persistence-jsonl/README.md#L28); [home-path helper](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-home-paths/README.md#L12).

## Verified DSH package and browser contracts

### Bundle versus profile

An installable plugin is an npm **bundle** declaring `dsh.bundle.patch`; a runnable composition is a **profile** declaring `dsh.profile.bundles`. The plugin should ship a patch YAML array that mounts a package-named loader row. A package without `dsh.bundle` can install as a library dependency, but no bundle layer is activated. `patch` can be one relative file path or an ordered list of paths. [Official publication tutorial](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md); [installed manifest reference](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-package-manifest/README.md#L46).

`dsh plugin --profile <name> ...` forwards package-manager arguments to pnpm in that profile and maintains its installed bundle list. Patch layers compose in bundle order, followed by the profile patch, the home patch, and CLI overlays. Later row configuration replaces the complete `config` value rather than deeply merging it. A new package should insert its own stable row and avoid overriding core rows unnecessarily. [Official publication tutorial](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md).

### Manifest fields and public display metadata

| Field | Verified contract |
|---|---|
| `name`, `version` | Required in the public `DshPackageManifest` type and for npm publication. |
| `dsh.manifestVersion` | Optional author declaration; currently `1`. Independent of npm version and session format version. |
| `engines.dsh` | Optional compatible-host SemVer range beside `engines.node`; declarative, not enforced by the installed loader/installer. |
| `dsh.bundle.patch` | Required for bundle activation; one file path or ordered list relative to package root. |
| `dsh.client.platform` | Required client-platform string; the Web consumer selects `web`. |
| `dsh.client.inject` | Optional string array of informational package-name edges. It is **not** Cordis service injection or an activation-order guarantee. |
| `dsh.client.external` | Optional exact non-baseline module-table requests. Feature plugins should collaborate via Cordis services/slots rather than runtime imports of another feature plugin. |
| `dsh.client.immediately` | Optional boolean for the early registration barrier; ordinary feature UI belongs in the application batch. |
| `exports["./client"]` | Required when the Web loader discovers a `dsh.client` declaration. The installed consumer accepts a string, or one conditional level containing a string `default`. |
| `exports["./package.json"]` | Enables official metadata readers to access package-field fallback and the top-level icon declaration. |
| `exports["./locale/*.json"]` | Enables localized metadata discovery from `locale/en.json` and sibling locale files. |
| top-level `icon` | Installed metadata reader accepts a relative SVG/PNG/JPEG/WebP file ≤256 KiB, contained under the manifest directory after realpath resolution. |

Sources: [installed manifest reference](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-package-manifest/README.md#L28); [official public types](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/util/package-manifest/src/types.ts); [installed client declaration validator](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-client-modules/lib/index.js#L61); [installed client export resolver](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-client-modules/lib/index.js#L170); [client authoring rules](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/AGENTS.md).

**Verified installed metadata behavior:** the title comes from exported locale `meta.title`, then accessible package `name`; description comes from locale `meta.description`, then package `description`. The installed reader does not consult the reference's custom `dsh.displayName`, `dsh.description`, `dsh.homepage`, or `dsh.repository` fields in this path. Use official exported locales for native Plugin Manager/Settings presentation, and top-level npm metadata for discovery. [Installed metadata reader](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js#L1969); [official metadata cookbook](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/cookbook/adding-a-package.md#plugin-display-metadata).

**Version distinction:** current upstream cookbook also describes a `./icon` export fallback and subpath metadata. The installed reader inspected here only uses manifest `icon`. A top-level `icon` plus exported manifest is the verified path for this baseline; do not assume the newer fallback exists locally. [Installed reader](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js#L1982); [upstream cookbook](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/cookbook/adding-a-package.md#plugin-display-metadata).

### Browser artifact and native UI requirements

The host serves the **built** client export, not TypeScript sources. Dynamic browser bundles register lazy CommonJS factories through `window.__ModuleLoader__.load({ id, factory })`; arbitrary ESM browser output is not that protocol. React, Cordis, and static UI modules are supplied by the platform module table. The official tsdown preset supplies the wrapper and CSS lifecycle tagging, but that preset depends on DSH monorepo paths and internal helpers, so a standalone plugin cannot assume it is an importable npm build SDK. A standalone build must reproduce the supported artifact boundary and prove its emitted requests resolve. [Installed module-system reference](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-client-modules/README.md#L32); [official build preset](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/tsdown.client.ts).

For a polished native UI, official authoring guidance favors slots, framework-derived props/hooks, host localization, CSS Modules, `clsx`, existing UI primitives, and `--dsw-alias-*` semantic tokens. Menus use `Menu`/`MenuSurface`; theme branches belong to the theme owner; preserve focus visibility and reduced motion. This is a better basis than DOM title matching and a second global palette. These are upstream authoring conventions, not a new mandatory checklist invented for this project. [Official client rules](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/AGENTS.md); [official styling reference](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/web-styling.md).

## Verified market distribution contract

`dshmarket` is the npm package for the community market application; its repository is `dsh-market/dsh-market`. It consumes the separate curated `awesome-dsh-plugin` catalog. Submission belongs in **awesome-dsh-plugin/awesome-dsh-plugin**, not in the market application's repository. Its catalog currently already lists the reference under `category: session`. [Market README](https://github.com/dsh-market/dsh-market/blob/main/README.md#submit-your-plugin); [reference catalog entry](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/data/plugins/Seetraum__harness-session-delete.yml).

The current catalog submission is **one YAML file** named `data/plugins/<owner>__<repo>.yml`. The READMEs are generated and should not be edited by hand for a submission. Required data includes matching GitHub URL/name, a valid category, and an accurate English description ending in a period; Chinese is optional. `session` is the natural proposed category for this product. [Catalog contributing guide](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/contributing.md#adding-a-plugin--收录插件).

Verified eligibility requirements are a real working and maintained project, a `dsh.bundle` declaration, repository age of at least **one day**, the `dsh-plugin` GitHub topic, accurate non-marketing descriptions, and a category matching actual behavior. No commit-count minimum is stated. CI checks are a prerequisite; a maintainer also reviews source and claimed behavior. A fork or overlapping plugin can qualify when it adds meaningful behavior or is better maintained; a same-functionality duplicate has no guaranteed listing. [Catalog eligibility and review](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/contributing.md#how-submissions-are-reviewed--收录如何评审).

Npm publication is optional for catalog eligibility, but recommended for prebuilt installation. The published npm package's **top-level `repository` must identify the listed GitHub repository** for automatic npm mapping. There is no manually supplied package mapping field: a handwritten `npm:` entry is rejected. The market prefers repository-verified npm packages, then catalog-declared prebuilt GitHub Release tarballs, then source. [Catalog npm mapping](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/contributing.md#npm-package--npm-包optional--可选); [market install source priority](https://github.com/dsh-market/dsh-market/blob/main/README.md#speed).

An optional catalog `tarball:` must be an HTTPS `.tgz` on GitHub Release hosting. Use a stable filename for `releases/latest/download/` or pin a release tag when the asset filename includes a version. Curated screenshots live in the plugin's own `screenshots.json`, next to its manifest, with 1–8 relative image paths or accepted GitHub-hosted HTTPS URLs. Relative paths must not escape the plugin directory. [Catalog tarball and screenshot guidance](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/contributing.md).

The market reads `engines.dsh` or lockstep DSH peers for host-aware compatibility display/filtering; undeclared or malformed metadata remains visible rather than being guessed incompatible. That UI signal is distinct from actual runtime refusal. Declare a tested range and implement any required runtime capability check. [Market host-aware discovery](https://github.com/dsh-market/dsh-market/blob/main/README.md#what-you-get); [installed metadata enforcement limitation](/Users/jam/Documents/codespace/personal-projects/dsh-session-bin/.local/dsh-runtime/dsh/node_modules/@deepseek-ai/dsh-package-manifest/README.md#L92).

## Verified npm publication and packed payload

Npm requires valid package name and version; the normalized `repository` object should use `type: git` and a public VCS URL, with `directory` for monorepo packages. `exports` determines public entry points; `files` determines packed payload. These fields solve different problems, so listing an export does not prove its target is packed. The default payload is broad if `files` is omitted. Npm always includes the manifest, README/license files, and main/bin entries; root `.npmignore` does not override an explicit `files` allowlist, while nested ignore files can. [Npm package metadata specification](https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-json.md#files).

**Observed reference tarball:** read-only listing of [dsh-session-recycle-bin-0.4.3.tgz](https://registry.npmjs.org/dsh-session-recycle-bin/-/dsh-session-recycle-bin-0.4.3.tgz) found the following 11 regular files, agreeing with npm `dist.fileCount`:

```text
LICENSE
client.css
client.js
index.js
packages/session-trash-host/lib/index.js
package.json
packages/session-trash-host/package.json
README.md
README.zh.md
packages/session-trash-host/lib/types/index.d.ts
cordis.patch.yml
```

This is a real published example of one package containing host/browser/CSS/patch artifacts and a nested host implementation. It has `exports` for `.`, `./client`, and `./package.json`; its main browser/host artifacts are already JavaScript. Its license is present in the payload. This inspection did not run its scripts or establish that deletion is safe on current DSH. [Pinned manifest](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/package.json); [npm metadata](https://registry.npmjs.org/dsh-session-recycle-bin/latest).

Git/source installation is a different delivery contract: the official DSH tutorial says a TypeScript source package needs a self-contained `prepare` step and user package-specific build authorization under pnpm ≥10. Publishing already built output to npm or shipping a packed tarball avoids that source-build requirement. Therefore npm and a release tarball should be the primary proposed distribution artifacts. [Official source-versus-prebuilt guidance](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md#installing-from-github-the-build-script-catch).

A release should verify the exact packed view: every relative runtime import, generated browser chunk, stylesheet, patch, locale resource, and icon must be present, and each public export must resolve from a clean extracted tarball. Official DSH package rules explicitly require closed publication payloads, and npm's `pack` command emits the tarball and its filenames. This source inspection does not verify those properties for a new plugin; runtime and packed-artifact evidence is recorded separately in the verification reports. [Official client dependency/payload rules](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/AGENTS.md#dependency-declaration); [npm pack specification](https://github.com/npm/cli/blob/latest/docs/lib/content/commands/npm-pack.md).

**Name observation, not reservation:** the registry query for `dsh-session-bin/latest` returned 404 during research. This does not reserve the name or guarantee that a future publication will be accepted. Npm scope/owner and the final public GitHub URL remain decisions for the project owner. [Registry lookup](https://registry.npmjs.org/dsh-session-bin/latest); [npm naming rules](https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-json.md#name).

## Use of these findings

Design implications and capability acceptance conditions belong to the [design proposal](../design-proposal.md), selected architecture to the [ADRs](../decisions/0001-host-lifecycle.md), contribution rules to [CONTRIBUTING](../../CONTRIBUTING.md), and distribution requirements to the [release contract](../release.md). Runtime compatibility requires the separately recorded [executed verification](../verification/client-interface.md); the source observations above do not substitute for it.

## Primary-source index

- Reference: [repository](https://github.com/Seetraum/harness-session-delete), [pinned README](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/README.md), [pinned license](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/LICENSE), [pinned host implementation](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/packages/session-trash-host/lib/index.js), [pinned browser implementation](https://github.com/Seetraum/harness-session-delete/blob/c9f08e801cf46a917a49d785dc32e9e769e6d2a9/client.js), [published npm metadata](https://registry.npmjs.org/dsh-session-recycle-bin/latest).
- DSH: [publication tutorial](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md), [public package types](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/util/package-manifest/src/types.ts), [client authoring](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/AGENTS.md), [browser build preset](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/client/tsdown.client.ts), [metadata cookbook](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/cookbook/adding-a-package.md), [styling](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/web-styling.md).
- Market/catalog: [market README](https://github.com/dsh-market/dsh-market/blob/main/README.md), [market npm metadata](https://registry.npmjs.org/dshmarket/latest), [catalog contribution contract](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/contributing.md), [existing reference listing](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/data/plugins/Seetraum__harness-session-delete.yml).
- Distribution/tooling: [npm package schema](https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-json.md), [npm pack](https://github.com/npm/cli/blob/latest/docs/lib/content/commands/npm-pack.md), [GitHub Node package publication](https://github.com/github/docs/blob/main/content/actions/tutorials/publish-packages/publish-nodejs-packages.md), [mise configuration](https://github.com/jdx/mise/blob/main/docs/configuration.md).