dsh-plugin-health

dsh-plugin-health

⚠️ 已归档 / Archived:本工具的体检能力已并入 dsh-insights-kit 的 selfcheck 与「体检」页(npm 发布,一键安装)。本仓库不再维护,历史参考保留。 Archived: the health-check capability now lives in dsh-insights-kit (selfcheck + the Audit page). This repo is no longer maintained.

Zero-dependency health-check CLI for DeepSeek Harness (dsh) plugins · 零依赖的 dsh 插件体检工具 ｜ MIT ｜ Node ≥ 20 ｜ 简体中文

Runs a battery of checks against a dsh plugin and prints a scored report (✅/⚠️/❌ + A–D), as Markdown and/or JSON. It answers the questions a plugin user or list maintainer would ask before installing:

• Manifest completeness — dsh.bundle.patch declared, cordis.patch.yml committed, exports["./client"] present, lib/index.js + lib/client.js shipped, files whitelist sane, license & repository metadata.
• npm consistency — is it published? is latest in sync with the repo version? (a stale or name-squatted package shows up here)
• Repo signals — age (awesome-dsh-plugin's ≥1-day gate), recency, stars, dsh-plugin topic, archived/fork flags.
• Docs & i18n — README / Chinese README / LICENSE presence.
• Read-only surface (local --dir mode) — greps the sources for filesystem writes, subprocess spawns and HTTP write verbs, and checks whether HTML/Markdown rendering has sanitizers (DOMPurify / marked / escape). Honest "only-read" claims get verified instead of taken on faith.

No dependencies; works against public GitHub + npm APIs (set GITHUB_TOKEN to raise the API rate limit).

Usage

# check a GitHub repo (defaults to an npm publish check too)
dsh-plugin-health ice5kysl/dsh-workspace-kit
dsh-plugin-health ice5kysl/dsh-file-explorer-kit

# check a local plugin directory (adds the read-only-surface security scan)
dsh-plugin-health --dir /path/to/plugin

# write a Markdown report / print JSON
dsh-plugin-health ice5kysl/dsh-workspace-kit -o report.md
dsh-plugin-health --dir /path/to/plugin --json

Run without installing:

npx --yes github:ice5kysl/dsh-plugin-health ice5kysl/dsh-workspace-kit

Sample reports

• dsh-workspace-kit
• dsh-file-explorer-kit

Scoring

Start at 100; warn −5, fail −20, info/pass 0. Grade: A ≥ 90 · B ≥ 75 · C ≥ 60 · D < 60. The scan is a heuristic first pass, not a security audit — read the explanations before trusting an "only-read" claim.

Dev

node index.mjs <owner/repo>    # or --dir …