PerryLink DSH 插件门户 — a zero-dependency static portal that renders the @perrylink DeepSeek Harness plugin ecosystem as grouped cards, one page, no build step, no runtime framework.
English · 这是一个零依赖的静态门户：单页、无构建步骤、无运行时框架，按分组渲染 @perrylink DeepSeek Harness 插件生态的卡片。
The portal renders the complete registry tracked by dsh-plugin-kit/data/repos.json: every roster entry, plugins plus the dsh-plugin-kit infra repo. Every card shows the repo name, a one-line description, its ★ count, two shields.io badges (live GitHub stars + a static rating badge), and the GitHub link. The authoritative counts are printed by node scripts/verify-portal.mjs (the README deliberately carries no frozen number).
本门户渲染 dsh-plugin-kit/data/repos.json 记录的完整清单（全部插件仓库 + dsh-plugin-kit 基建仓库）。每张卡片展示仓库名称、一句话简介、★ 数、两个 shields.io 徽章（实时 GitHub stars + 静态评分徽章）与 GitHub 链接。权威计数由 node scripts/verify-portal.mjs 打印，README 刻意不写死数字。
Cards are grouped by the roster's group field (group → English label):
| 分组 Group | 内容 Contents |
|---|---|
| 基建 Infra | dsh-plugin-kit |
| 会话 Session | dsh-memento, dsh-checkpoint-rewind, dsh-composer-history, dsh-background-agents, dsh-session-pin, dsh-session-sync |
| 安全 Security | dsh-auto-review, dsh-permission-rules, dsh-defend, dsh-mask, dsh-skill-pack-security |
| 质量 Quality | dsh-doublecheck, dsh-data-quality, dsh-test-drive, dsh-score |
| 研究 Research | dsh-industry-research, dsh-fund-research, dsh-research-report, dsh-library |
| 集成 Integration | dsh-mcp-panel, dsh-claude-move, dsh-lsp-actions, dsh-local-ai, dsh-github, dsh-translate |
| 桌面 Desktop | dsh-click, dsh-talk, dsh-draw |
| 观测 Observability | dsh-budget, dsh-observe, dsh-fast |
| UX | dsh-output-styles |
| 生态 Ecosystem | dsh-plugin-guide |
Per-group counts are printed by the gate (node scripts/verify-portal.mjs) instead of being frozen here.
P0 — the foundational must-haves for the portal — are done for v1:
- 静态门户 v1 ✅ —
index.htmlis a single file with inline CSS/JS; zero external runtime dependencies. - 数据源同步 ✅ —
data/repos.jsonis a verbatim copy ofdsh-plugin-kit/data/repos.json(plus a_sourcesync note). - 分组渲染 ✅ — one card per roster entry, grouped by
group. - 质量徽章 ✅ — live
img.shields.io/github/stars/…+ a static rating badge per card; no self-hosting.
P1/P2 (landed in this revision): read-only adoption-level chips, the mirrored attestation index, and the verify.html lookup. Still out of scope: star/rating auto-refresh pipeline, search/filter, per-plugin detail pages, and a self-hosted badge service.
Each card surfaces two quality signals: the ★ count from the roster (synced snapshot) and a live stars badge from GitHub via shields.io. The static rating badge reflects the synced star value (n/a for dsh-plugin-kit, which ships no star count). These signals are display-only — the portal does no scoring of its own; scoring lives in dsh-plugin-kit.
The portal only displays adoption levels and attestations: it does not compute a level, does not issue, validate or revoke an attestation, and is not an official site, not a certification body, and not a security audit. 本门户只读展示：不计算 level、不做认证、不做安全审计，也不代表 DeepSeek；没有证据的层显示为 not-run / not-measured，不显示为通过。
data/levels.json— a read-only projection of the three adoption depths (entry/flow/boost) for every roster repo. An axis without an evidence record is displayed asnot-run/not-measured, never as a pass; cards keep the roster order and are never sorted or weighted by level.data/attestations.json— a mirror of the standard repository'spublish/attestations/index.json.sourcepoints at the upstream path/URL andrecordscopies the attestation files referenced byfile, so the verify page needs no network call. Attestation grades A–D are orthogonal to the levels and are never converted.verify.html— look up anattestationIdand read its subject, grade, claimLevel, status, dates, scope, excluded list, disclaimer and evidence links. An expired record renders asstaleand a withdrawn one aswithdrawn; neither is ever shown as valid. The page carries the same-view disclaimer 非官方 · 非认证 · 非安全审计.
dsh-plugin-portal/
├── index.html # 单文件门户（内联 CSS/JS，无外部运行时依赖）
├── verify.html # attestationId 只读查验（零依赖、静态、无构建）
├── data/repos.json # 从 dsh-plugin-kit/data/repos.json 复制的清单（见 _source 注释）
├── data/levels.json # 三层采用深度的只读投影（不计算 level）
├── data/attestations.json # 标准仓 publish/attestations/index.json 的镜像
├── scripts/verify-portal.mjs # 零依赖门禁（roster + levels + attestations + pages）
├── package.json # npm test 别名；无依赖、无安装步骤
└── README.md # 本文件
data/repos.json is not the source of truth: dsh-plugin-kit/data/repos.json owns the roster and star counts. To refresh this portal, re-copy that file over data/repos.json.
Open over HTTP (the pages fetch data/repos.json, data/levels.json and data/attestations.json, which file:// blocks):
python -m http.server 8080
# then open http://localhost:8080/ and http://localhost:8080/verify.htmlNo browser and no install step: the gate is zero-dependency and asserts that about itself, so the portal stays runnable from a bare checkout.
node scripts/verify-portal.mjs # the gate itself
npm test # same gate, no install step (package.json has no dependencies)It prints the authoritative counts (entries, groups, per-group) and checks:
- the gate imports nothing but
node:builtins; data/repos.jsonsatisfies the roster contract —name/group/role/star, anhttps://github.com/<owner>/<repo>URL whose repo segment matchesname, and no duplicate names;- the inline script in
index.htmlparses (new vm.Script) and runs under a DOM stub; - every roster entry has a blurb in
DESCRIPTIONSand every group aGROUP_ENlabel — an entry whose blurb has not landed yet must be registered inPENDING_DESCRIPTION(the deliberate allowlist), otherwise the gate fails; - star badges derive their owner from
repo.github, third-party owners included (pan17/dsh-wechat) — no hardcoded owner; data/repos.jsonis a verbatim copy of the upstreamdsh-plugin-kit/data/repos.jsonexcept for_source, and the sha256 recorded in_sourcestill matches that file. On a runner without the sibling kit checkout (CI) this check reportsskiprather than failing, so the gate is never red for a reason the runner cannot fix;- the README does not freeze a count;
data/levels.jsononly references roster repos, covers every one of them, uses the per-level status enum, and everyruntime/measured/manualstatus carries anhttpsevidence.url—not-runis never upgraded to a pass;data/attestations.jsonmirrors the standard-repository index with uniqueattestationIds, realexpiresAtdates, detail for every record, and nolevelfield anywhere (a grade is orthogonal to an adoption level);verify.htmlparses, shows 非官方 · 非认证 · 非安全审计 in the same view, and classifies an expired or withdrawn record asstale/withdrawn— nevervalid;index.htmlrenders the optional level row fromdata/levels.json, showsnot-run/not-measuredrather than an empty badge, and links evidence when a record has one.
Two behaviors worth knowing when reading a card: the star badge owner comes from the roster entry's own github URL, and a roster entry with no blurb renders the visible description not synced marker (accent, italic) plus one console.warn instead of silently showing placeholder copy.
This project is part of the DeepSeek Harness plugin family from PerryLink. The roster stays collapsed below so every README keeps a short first screen; expand it to see every row and its status.
Expand all plugins
The ecosystem is moving to three adoption depths, not grades: DSH-ENTRY (compatibility baseline — can it be installed and booted?), DSH-FLOW (recommended usability — can a user install, configure, recover, upgrade and uninstall it?) and DSH-BOOST (Cordis practice — is it measurably cheaper?). They are not certification, not a ranking, and not endorsed by DeepSeek.
- Public teaching copy: dsh-plugin-guide/guide/standards.md
dsh-plugin-doctorexposes an ENTRY projection in its JSON report;dsh-plugin-certificationexplains why its A–D grades are orthogonal to the levels.- The machine-readable
spec/levels.jsonand the audit tool live in the privatedsh-standardsproject (draft; ask the maintainer). This portal does not ship or reimplement that spec: it only renders the labels mirrored indata/levels.json, andverify.htmlreads the mirrored attestation index. 本门户只读展示，不计算 level、不做认证。