Add DeepSeek Harness Parallel Search plugin

[georgeatparallel]

Summary

• add @parallel-web/dsh-web-search as a first-class workspace package
• register Parallel Search as the native DeepSeek Harness web_search provider through cordis.patch.yml
• add deterministic provider, redirect-isolation, manifest, package-content, and profile-lifecycle checks
• add a Node 22.19/24/26 DSH compatibility matrix with a package-filtered install
• harden release detection and make interrupted npm releases safe to retry by verifying the exact packed artifact
• document installation, verification, contribution, security, bootstrap publishing, and release recovery
• route vulnerability disclosures to security@parallel.ai while keeping ordinary support at support@parallel.ai

Why

DeepSeek Harness supports provider-neutral web search, but it does not include a Parallel provider. This package lets Harness users route the existing built-in web_search tool through Parallel without adding a second model-facing tool or expanding the package into fetch/extract behavior.

User impact

After the release candidate is published, users can install the plugin into the Harness web profile, export PARALLEL_API_KEY, and keep using the normal Harness web_search experience. The README includes a start-to-finish setup path and direct request-verification guidance.

Validation

• frozen workspace install
• whole-workspace lint, format check, typecheck, tests, and build
• 48 credentialless plugin tests
• one credentialed live Parallel Search request returning three citeable sources
• clean-room package-filtered install with no preinstalled dependencies or prebuilt plugin output
• two independently packed tarballs with identical SHA-512 hashes
• packed-artifact allowlist and disposable DSH add/activate/remove lifecycle
• 18 release tests covering detection, cleanup, first publish, exact-integrity recovery, mismatches, and registry failures
• live no-op recovery check against an existing npm tarball
• actionlint v1.7.7 on both workflows
• staged-diff disclosure and secret review
• production audit path review: no advisory path traverses the DSH package

Release follow-up

Merging this PR intentionally does not publish the newly added package. An npm organization owner must manually bootstrap 0.1.0-rc.0 under the rc dist-tag, configure npm trusted publishing for this repository and workflow, and then use the normal version-bump PR flow for later releases.

[sergei1152]

looks good, couple things of note

[georgeatparallel]

looks good, couple things of note

cool - addressed those issues in the latest commit