Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-the-rc-plugin-manager-defaults-to-public-npmmirror-fallback
The rc Plugin Manager defaults to public npmmirror fallback. The newly rc-reachable Plugin Manager may ask registry.npmmirror.com when the preceding configured public registry cannot supply a package/version. It is ordered fallback, not fastest-mirror selection. An outside/private registry is queried alone; this is not indiscriminate public leakage of private package lookups.
Channel: preview-or-beta; default at rc.1 and both current heads. Half: both. Date: 2026-09-23 (first rc containing the manager).
Operator consequence: Set fallbackRegistries explicitly, including an empty list if only one approved registry may supply plugins. Include the mirror in package-origin and egress review for live Web installs. This behavior is separate from the CLI’s initial npm installation.
Receipt
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/boot/plugin-manager/src/index.ts#L184-L186
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/boot/plugin-manager/src/registry.ts#L40-L79
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/boot/plugin-manager/README.md#L50
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-the-rc-plugin-manager-defaults-to-public-npmmirror-fallback
Profile citations
- deepseek-harness / claim / plugin-public-registry-fallback
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-10-13-deepseek-harness-the-rc-plugin-manager-defaults-to-public-npmmirror-fallbackdeepseek-ai/deepseek-harness / packages/boot/plugin-manager/src/index.ts#L184-L186tagged commit file2026-10-13-deepseek-harness-the-rc-plugin-manager-defaults-to-public-npmmirror-fallbackdeepseek-ai/deepseek-harness / packages/boot/plugin-manager/src/registry.ts#L40-L79tagged commit file2026-10-13-deepseek-harness-the-rc-plugin-manager-defaults-to-public-npmmirror-fallbackdeepseek-ai/deepseek-harness / packages/boot/plugin-manager/README.md#L50
Versioned source: run artifact