Submit a Plugin

Getting your plugin into the registry validates dsh.so's whole purpose: the moment a developer actively submits their plugin, dsh.so becomes an ecosystem hub rather than a content site. Paste a repository URL or an npm package below — the channel is detected automatically. The checker pulls it, validates the format, runs a security scan, and prepares a schema-valid registry entry for you.

Acceptance criteria

✔ DSH compatibility signal (at least one):
- •a dsh field in package.json
- •a cordis / agent.cordis manifest
- •a dsh.plugin.* manifest
- •a DSH topic: dsh-plugin or dsh-pack
✔ README with install instructions
✔ Open-source license with a recognizable SPDX identifier
✔ Valid plugin id — the repository name (or the npm package name for npm-only entries) must slug to ^[a-z0-9]+(-[a-z0-9]+)*$
✔ Scannable source — the repo contains source files (JS/TS, scripts, …) the security scanner can analyze; docs-only or empty repos cannot be scanned
✔ Security scan passes — no blocking findings (hardcoded secrets, exfiltration endpoints, destructive operations, mining); warning-level findings need manual review before submitting

Scan coverage: vet runs AST analysis on JS/TS (plus shell/PowerShell download-and-exec patterns); other languages are covered by the dsh heuristic scanner.

Check your repository

Repository URL or npm package

Paste either one — the channel is detected automatically. Repository (GitHub · Gitee · GitLab): github.com/owner/repo · gitee.com/owner/repo · owner/repo. npm: dsh-foo · @scope/dsh-foo · npmjs.com/package/dsh-foo. npm packages work with or without a Git repository: when the package declares one the entry links to it, otherwise it is stored as an npm-only plugin. Checks always run against the published tarball.

Entry type

dsh plugin (installable via dsh plugin add) Desktop / standalone app (bundles dsh, distributed via releases)

Desktop shells and other standalone applications that bundle the dsh runtime are listed as ecosystem apps (shown as L5 · ecosystem app): they get a GitHub repository link instead of an install command and are exempt from the install-verification ladder (the security scan still applies).

Security scan powered by

What happens next

When the checks pass, click Submit to dsh.so — the registry entry and scan report are filed as an issue in the dsh.so backend for review. Maintainers merge schema-valid entries into the registry.
Every submission is re-fetched and re-scanned server-side at submit time — the source is analyzed fresh, never from cache. Submissions are rate-limited per address and per repository (a few per 10 minutes) to prevent abuse.
Your plugin is listed with Declared compatibility only — never Verified until independently tested.
Metadata (stars, forks, last commit) syncs automatically from the hosting platform.
Tip: adding the dsh-plugin or dsh-pack topic lets the registry auto-index your repository. Packages that declare a repository keep pulling stars, forks and license from it; npm-only entries are listed from the npm registry alone (metadata, license and the install command all come from the package).

Report a compatibility check

You ran a plugin on a specific dsh version and it worked (or didn't)? That is exactly the data the ecosystem needs — and dsh.so is honest about it: no plugin is Verified yet, and the only way to change that is real reports. Copy the template below, paste it into the official Discussions, and dsh.so will fold the result into the version compatibility matrix.

Template · copy & post

Plugin compatibility report
---------------------------
Plugin: <name or repo URL>
dsh version: <e.g. 0.1.0-rc.6>
Install method: <bundle add / --patch / source>
Result: <pass / fail / partial>
Notes: <what worked, what broke, screenshots or logs>

Open a new Discussions post

Questions?

Ask in the official DSH Discussions or open a regular issue in the dsh.so repository.