dsh-quality-score

Quality scorecard for DeepSeek Harness (dsh) plugins: 0-100 score + grade + per-component breakdown, with issues and fix suggestions.

Built on the same methodology as the ecosystem supply-chain health scan: manifest completeness, peer resolvability, dist-tag health (the #2763 class), dead ranges, freshness, and dsh-tools peer compatibility. Zero runtime dependencies, read-only.

Install

dsh plugin add dsh-quality-score

Or run standalone:

npx dsh-quality-score dsh-dep-audit

CLI

dsh-quality-score <npm-name> [--json]
dsh-quality-score --batch <names-file> [--json]
dsh-quality-score --batch-registry <registry.json> [--category <name>] [--json]

Prints the score, grade, component breakdown, issues and suggestions. --batch scores every package name in a file (one per line, # comments ignored) and prints a ranked leaderboard — the building block for a registry-wide quality table.

npx dsh-quality-score dsh-dep-audit
npx dsh-quality-score dsh-vault --json
npx dsh-quality-score --batch registry-names.txt

In-harness usage (agent-callable)

Ask your dsh agent:

给这个插件打个质量分：quality_score，包名 dsh-dep-audit。

Score this plugin: quality_score with name set to the npm package.

Returns a dsh-quality-score/v1 report:

{
  "schema": "dsh-quality-score/v1",
  "name": "dsh-dep-audit",
  "ok": false,
  "score": 65,
  "grade": "C",
  "components": [
    { "id": "manifest", "name": "Manifest completeness", "max": 20, "earned": 20, "note": "version 0.1.1" },
    { "id": "peer-resolvable", "name": "Peer resolvability", "max": 20, "earned": 20, "note": "1 peer range(s)" },
    { "id": "dist-tag", "name": "Dist-tag health", "max": 15, "earned": 15, "note": "latest=0.1.1" },
    { "id": "dead-ranges", "name": "Dead ranges", "max": 15, "earned": 15, "note": "none" },
    { "id": "freshness", "name": "Freshness", "max": 10, "earned": 10, "note": "2026-08-18" },
    { "id": "dsh-tools-peer", "name": "dsh-tools peer compat", "max": 10, "earned": 0, "note": "declared ^0.1.0-rc.6; dsh-tools latest=0.0.1-rc.1" }
  ],
  "issues": ["declared @deepseek-ai/dsh-tools peer range is contradicted by the broken latest dist-tag (#2763 class)"],
  "suggestions": ["Install with @deepseek-ai/[email protected] (or the matching rc) until the official latest is fixed"],
  "error": null
}

Components

Component	Max	What it measures
`manifest`	20	name / version / description / license present in the latest version
`peer-resolvable`	20	every peer range has a published match
`dist-tag`	15	latest vs next mismatch (#2763 class)
`dead-ranges`	15	peer ranges referencing unpublished package names
`freshness`	10	latest release within 365 days
`dsh-tools-peer`	10	declared dsh-tools peer satisfied by the current latest dist-tag

Grade: A ≥ 95 · B ≥ 85 · C ≥ 70 · D ≥ 55 · F below.

Why it exists

The registry has 900+ plugins; quality signals exist (dsh-ecosystem, dsh-recommend) but nothing gives a per-plugin actionable score with fix suggestions from npm metadata alone.
Same evidence basis as the supply-chain health scan — one dist-tag fix on the official side would raise scores across the ecosystem.
Zero runtime dependencies, read-only; degrades gracefully offline.

Development

pnpm install
pnpm typecheck
pnpm build
pnpm test
pnpm test:integration

CI runs the dsh-plugin-doctor preflight, unit tests (mock registry), packed-artifact integration, and a fresh-profile dsh web boot smoke on Windows.

License