Add Social Research, Media Kit and BeatBrowser plugins for DeepSeek Harness

.github/workflows/harness.yml

@@ -0,0 +1,24 @@
+name: Harness packages
+on:
+  push:
+    paths: ['packages/dsh-*/**', 'harness/**', 'scripts/sync-harness.mjs', '.github/workflows/harness.yml']
+  pull_request:
+    paths: ['packages/dsh-*/**', 'harness/**', 'scripts/sync-harness.mjs', '.github/workflows/harness.yml']
+permissions:
+  contents: read
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        dsh: ['0.1.0-rc.6', '0.2.1-rc.2']
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 22
+      - run: npm run harness:check
+      - run: npm install --global pnpm@10.32.1
+      - run: node harness/scripts/install-host.mjs ${{ matrix.dsh }} /tmp/beatapi-dsh-host
+      - run: node harness/scripts/host-smoke.mjs /tmp/beatapi-dsh-host/node_modules/@deepseek-ai/dsh

README.md

@@ -18,6 +18,10 @@ and Workspace capabilities. This plugin connects Codex, Cursor, Grok Bot, and
 Grok Build to BeatAPI through a bundled Skill, local MCP server, typed client,
 and locked public contract.
 
+**DeepSeek Harness:** three independently installable bundles provide
+[Social Research](packages/dsh-social), [Media Kit](packages/dsh-media), and
+[BeatBrowser](packages/dsh-browser). See [setup and validation](harness/README.md).
+
 For host-independent onboarding, give an Agent this instruction:
 
 ```text

harness/README.md

@@ -0,0 +1,17 @@
+# BeatAPI plugins for DeepSeek Harness
+
+Three independently installable bundles with distinct tools and tasks:
+
+| Bundle | Task | Tools | Install |
+|---|---|---|---|
+| [Social Research](../packages/dsh-social) | Social discovery, approved reads, stored results and source tables | 5 native | `dsh plugin --profile web add @beatapi/dsh-social@0.1.0` |
+| [Media Kit](../packages/dsh-media) | Image/video discovery, pricing previews, approved starts and task status | 4 native | `dsh plugin --profile web add @beatapi/dsh-media@0.1.0` |
+| [BeatBrowser](../packages/dsh-browser) | Existing Chrome logins and owned background TaskSpaces | 24 namespaced MCP tools | `dsh plugin --profile web add @beatapi/dsh-browser@0.1.0` |
+
+Tested hosts: `0.1.0-rc.6` and `0.2.1-rc.2`, Node.js 22.12+. Community integrations by BeatAPI, not official DeepSeek products. Each bundle supplies a Skill and coexists with the others. Prebuilt JavaScript needs no install-time build script. Each package README documents GitHub installation too.
+
+`harness/shared/` is synchronized into self-contained Social and Media packages by `npm run harness:sync`; `npm run harness:check` checks drift and offline behavior. To verify a host, run `node harness/scripts/host-smoke.mjs /absolute/path/to/@deepseek-ai/dsh`. It installs all three tarballs into a temporary profile, checks 33 tool registrations and three Skills, calls the report tool, then stops the host and removes temporary data. It never creates paid tasks or mutates existing profiles.
+
+See [validation](VALIDATION.md) and [security](SECURITY.md) for evidence and limits.
+
+For a reproducible test runtime, first run `node harness/scripts/install-host.mjs <version> /tmp/beatapi-dsh-host`. Its recorded official package versions avoid older prerelease caret ranges resolving a mixture of later RC packages. These pins affect the test host only, not the distributed plugins or the user's installation.

harness/SECURITY.md

@@ -0,0 +1,15 @@
+# Harness package privacy and security
+
+These packages run as trusted local host code. Search and Inspect contact `https://api.beatapi.io` without credentials. Authenticated Data reads, generation and result/status calls send the key only in the Authorization header to that fixed origin; redirects are refused. There is no added telemetry service. Tool responses reach the user's chosen model and host.
+
+Keys are resolved per operation through Harness credentials. Settings contain reference names, not secrets. Errors do not return raw gateway messages, supplier diagnostics or keys. Failed paid requests are never automatically retried.
+
+Pricing acknowledgements bind the reference, schema hash, pricing and normalized input. Human approval is required before confirm_paid. This is a workflow check, not cryptographic proof of consent or a gateway spending cap. Host approval policies remain authoritative.
+
+Social tools reject model/workflow/web references and account-mutation verbs. Retrieved content is untrusted. CSV output neutralizes formula prefixes; report rows separate observed evidence from analysis. Reports return contents and do not write arbitrary files.
+
+Media starts require a stable idempotency key. Remote tasks can continue after local cancellation; resume the original task ID. The plugin does not silently resubmit failed tasks, upload local files or download arbitrary URLs.
+
+The Browser connector starts the published `@beatapi/beat-browser@1.4.1` through the in-box MCP client. Extension installation, pairing and website login remain separate user steps. Real signed-in browser control retains TaskSpace ownership, interruption and manual-resume rules. Optional FAST is not enabled by this connector.
+
+Harness records, model-provider processing and BeatBrowser records follow their respective policies. Use private vulnerability reporting for security issues; never attach real keys, cookies, customer data or private media to public issues.

harness/VALIDATION.md

@@ -0,0 +1,28 @@
+# Harness validation — 2026-10-28
+
+Status: implementation and package acceptance complete. Marketplace submission and package publication are separate states; see their actual links and receipts rather than treating tests as marketplace approval.
+
+## Reproduced checks
+
+| Check | Result |
+|---|---|
+| Offline DSH behavior tests | 14 passed; scope restrictions, missing credentials, safe errors, redaction, price previews, changed specifications, idempotency, result retrieval, task resume, CSV safety and compact discovery |
+| Existing plugin validation | Standalone `npm run verify` passed, including contract/Skill/runtime checks, 20 existing tests, typecheck, generated MCP bundle and artifact builders |
+| Harness `0.1.0-rc.6` | Three actual tarballs installed together in an isolated profile; 9 native tools, 24 browser MCP tools and 3 Skills registered; report execution passed |
+| Harness `0.2.1-rc.2` | Same installation, registration, Skill and report checks passed |
+| Live capability discovery | Actual X Social Data and image-model discovery plus contract inspection succeeded; these were free requests |
+| Real browser through Harness | Both host versions created an owned background TaskSpace, read the Example Domain page through the namespaced snapshot tool and finished the space; Chrome extension 1.4.1 |
+| Packaged browser dependency | Uses the published `@beatapi/beat-browser@1.4.1`, not unpublished FAST settings source |
+
+`node harness/scripts/host-smoke.mjs /absolute/path/to/@deepseek-ai/dsh` reproduces isolated installation, 33 tools, three Skills and an offline report call. The dedicated GitHub workflow runs this against both declared host versions. It does not require website login or a connected Chrome extension and does not create browser pages or paid requests.
+
+## Boundaries
+
+- Real paid Social Data reads and image/video generation were not executed during this acceptance because no BeatAPI credential was configured in the isolated environment. Do not interpret discovery, `ready` or mocked paid responses as a successful real data read or generated asset.
+- The payment workflow, transport and task resumption have offline regression coverage. A user with a key must approve actual inputs and current pricing before a real paid start. The acknowledgement is not a gateway-enforced spending cap.
+- Platform/action coverage varies. Not every platform, data action, model, reference-media input, operating system or future Harness version has been tested.
+- Browser acceptance read a public page. It did not certify authenticated account actions, posting, payments, CAPTCHA handling or unattended operation. Foreground interruption and explicit-resume requirements are retained.
+- Report formatting uses clearly labeled fixture rows in offline tests. It does not claim that those rows are fetched social evidence.
+- Media status returns remote task results. File upload, local file download and full timeline editing are not provided by this package.
+
+The plugin readmes and proposed marketplace descriptions deliberately stay within these boundaries.