New:Introducing Socket Scanning for VS Code Marketplace Extensions.Learn more →
Get Started

dsh-code-index

Package Overview
Dependencies
Maintainers
1
Versions
12
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

dsh-code-index

Edit-ready Context Packs for DSH agents: bounded source excerpts, changes, related tests, and inclusion evidence — local-first.

latest
Source
npmnpm
Version
0.10.0
Version published
Weekly downloads
0
Maintainers
1
Weekly downloads
 
Created
Source

dsh-code-index

npm version CI

English | 中文

v0.10.0 stable candidate — ArkTS & Reliable Code Context

Give your DeepSeek Harness agent the bounded source context it needs to start a code task. One code_context call selects primary declarations, strong callers/callees, imports, current changes, and likely tests, with exact source ranges and reasons for inclusion. When evidence is missing, the pack says so.

  • Source within budget: complete declarations, then whole-line windows, then explicit signature-only fallback. Overlapping source lines are deduplicated; current and baseline excerpts stay separate.
  • One selected pack: text and opt-in structured output consume the same final ContextPack. Both stay within the default 5000-character cap.
  • Evidence you can inspect: inclusion reasons are separate from exact / import-scoped / name-only relationship provenance. No probability or confidence estimate is invented.
  • Local and current: isolated repo/worktree indexes, external add/change/delete freshness, no external indexing API key. Existing full/compact surfaces and v0.8 configuration remain supported.

v0.9.1 is published on npm and fixes Gitignore directory whitelist rules that silently omitted source trees. The packaged candidate passed real Agent verification in DSH Desktop 0.2.0-rc.2. See release evidence.

This branch prepares the unpublished 0.10.0 stable candidate; npm latest remains v0.9.1. ArkTS .ets files now use a pinned, bundled MIT grammar rather than the TS parser. See ArkTS PoC and v0.10 evidence.

On this page

Quick start

Requires Node 22/24 and a matching DSH 0.2.0-rc.2 host group. Install the published version into a Web profile:

npx @deepseek-ai/dsh@0.2.0-rc.2 plugin --profile web add dsh-code-index@0.9.1
npx @deepseek-ai/dsh@0.2.0-rc.2 web

For local development, run pnpm install and pnpm build at the repository root, then use plugin --profile web add .. See Install for profile options.

Project isolation and live updates

Open repo A → search finds A's symbols
Switch to repo B → search finds B's symbols, not A's
Edit files outside DSH → the next query sees the change
Switch back to A → A's context is still isolated

Each Git worktree gets its own index and change state. The plugin watches projects accessed by the session and checks file metadata on tool calls, so additions, edits, and deletions become visible without a manual rebuild.

See it in action

42 seconds in DSH Desktop: why did loading ' input ' produce 'INPUT'?

Actual DSH Desktop Agent calling code_context, with a bilingual task and explanation

One real code_context call returned loadConfig at src/config.ts:1–3, its callers, Git additions/modifications/deletions, and a likely test, with inclusion reasons and relationship provenance: 2347/5000 characters. The Agent used that context to identify .toUpperCase() as the cause.

This is actual desktop footage recorded on 2026-10-08, using the installed v0.9.0 plugin and a tiny demonstration repository. Only DSH is shown; waiting was cut and audio removed. No files were edited or tests run. The clip is not a latency measurement or a claim that a fix/tests succeeded. MP4 · Recording notes and provenance · Actual tool-card evidence.

The earlier bilingual terminal replay remains available as a separate, clearly labeled replay of audited 2026-10-05 Agent records. It also shows external-edit freshness and a 500-character signature-only fallback.

Try asking: “Use code_context to locate a config-loading bug, show the relevant source and callers, and identify likely tests.” Tell us what helped or what context was missing in the DSH discussion.

The earlier 30-second local tool demo remains available and can be reproduced with pnpm build, then node scripts/context-pack-demo.mjs. Web Context Card remains deferred; Card replay and file navigation have not been verified.

Tools

ToolPurpose
code_indexStatus / (re)build the index for the current workspace
code_symbolsList symbols (functions, classes, interfaces, types, methods…) with file:line — filtered by name, path, kind, exported
code_searchRanked lookup: exact > prefix > substring > subsequence-fuzzy, exports first, relevance score + file:line
code_mapBounded ranked repo map (top files by symbol density + import-graph PageRank, key symbols + lines)
code_refsTrace a symbol through the call graph: callers (who calls it) and callees (what it calls), resolved to file:line
code_change_contextStart from the working-tree or an explicit diff and return changed symbols, callers, import dependents, bounded impact paths, and likely tests
code_contextEdit-ready ContextPack: bounded source, reasons, relationships, changes/tests, gaps, and a hard budget; text by default
code_healthOpt-in (codeHealth: true): circular dependencies (import cycles) and orphan modules

Plus an optional auto-injected system prompt section (code-index:repo-map, order 60): a compact ranked map selected from the active DSH session workspace. Set autoInject: false to disable and rely on the code_map tool only.

Install

Requires dsh (any install path — npx, npm, or source) and Node ≥ 22.

The verified compatibility target is @deepseek-ai/dsh@0.2.0-rc.2 / @deepseek-ai/dsh-tools@0.2.0-rc.2 (Node 22 and 24 verification matrix). The DSH plugin surface is still a preview API, so upstream changes may require compatibility updates.

v0.9 requires the matching 0.2.0-rc.2 tool runtime; the peer pin prevents fresh npm installs from selecting the older registry latest tag. Upgrade the host group together. The text/config/tool-surface compatibility above does not promise support for older DSH APIs.

# from npm (prebuilt)
npx @deepseek-ai/dsh@0.2.0-rc.2 plugin --profile web add dsh-code-index@0.9.0

# or from a directory containing this checkout
npx @deepseek-ai/dsh@0.2.0-rc.2 plugin --profile web add ./dsh-code-index

Restart the Web UI (npx @deepseek-ai/dsh@0.2.0-rc.2 web) — startup logs confirm each tool:

[dsh-code-index] plugin loaded
[dsh-code-index] registered tool: code_index
...

Verify the composed config without booting: dsh --profile web --dump-config.

Using it

In a workspace session, ask the agent:

  • "Which repo are we in — run code_map first."
  • "Find every function whose name contains parse and where it lives."
  • "List the exported symbols in src/core."
  • "Rebuild the code index."
  • "What changed in the working tree, who calls it, and which tests are likely affected?"
  • "Fix duplicate configuration loading during startup." (the router selects the smallest useful context automatically)

No API key is needed to index; the model must of course be configured to call the tools.

More capabilities

The index builds lazily on first use; later calls are served from the on-disk cache with mtime-incremental refresh.

Call graph

code_refs traces definitions, callers, and callees. The following is an earlier real example of that existing tool, not a v0.9 Context Card:

Earlier code_refs output

Change-aware context

code_change_context defaults to the current Git working tree against HEAD. It also accepts an inline unified diff, repo-relative files, or stable symbols IDs. Results are bounded and each inferred relationship carries a provenance label: exact, import-scoped, or name-only. Deletions and renames use the baseline ref when available; untracked non-ignored files are included in working-tree mode.

Edit-ready Context Packs

code_context routes change, symbol, architecture, test, exploration, and ambiguous tasks. Deterministic camel/snake terms plus file/path/signature terms rank candidates; exact named symbols are retained before selection. Strong primary seeds find likely tests even on a clean tree. Graph neighborhoods are bounded. BM25 is not used.

budgetChars defaults to 5000 and is normalized to 300–20000; maxFiles defaults to 12 and maxSymbols to 10. Budget units are JavaScript string characters, not tokens or UTF-8 bytes. Both rendered text and serialized final pack must fit. Code is never cut mid-line to fill the cap. Very small budgets can leave only signatures or gaps; a repository identity that cannot fit produces an explicit error. Task display is summarized to 120 characters without affecting routing.

The default canonical return remains a string. Request outputFormat: "pack" explicitly for the exported ContextPack DTO. Its items are already selected, with source file/startLine/endLine/side/ref/mode/code, reason, and separate relationship resolution/provenance where relevant. budget.usedChars accounts for text; budget.packChars accounts for serialized JSON. Render with renderContextPack; no hidden candidate list is exposed through the result.

Git changes with a readable, frozen baseline commit classify declarations as added/modified/deleted. Reliable file renames remain supported. Unknown or ambiguous structural identity is unclassified; symbol renames are not guessed. Explicit files/symbols in code_change_context remain selection modes, not a proof of a Git modification.

Configuration

Options are passed as the plugin row's config in the profile patch (or defaults are used if absent):

# $DSH_HOME/profiles/<name>/cordis.patch.yml — a bare row overrides by id.
- id: code-index
  config:
    excludeDirs: [generated, playground]
    mapTopFiles: 30
    mapMaxChars: 4000
    autoInject: true
    toolSurface: full
KeyDefaultMeaning
excludeDirs[]Extra directory names appended to built-in excludes. Matching is by exact path component; glob patterns such as secrets/** are not supported.
mapTopFiles24Max files in a ranked map
mapMaxChars3200Hard cap on rendered map characters
mapTtlMs60000Refresh interval for the auto-injected map (ms, min 1000)
autoInjecttrueRegister the system prompt section
codeHealthfalseRegister the code_health tool (cycles / orphan modules)
toolSurfacefullExperimental compact mode exposes code_index, code_context, and enabled code_health; full preserves all tools
externalWatchtrueWatch source files in active project contexts for external edits
watchDebounceMs120Coalesce watcher events before refreshing affected files (minimum 20 ms)

Supported languages

ArkTS, TypeScript, JavaScript, Python, Go, Rust, Java, C++ and C (.ets .ts .tsx .mts .cts .js .jsx .mjs .cjs .py .pyi .go .rs .java .cpp .cc .cxx .c++ .hpp .hxx .hh .h .ipp .tpp .inl .c) via tree-sitter WASM — pure parsing, no native build. The symbol provider seam (src/extract.ts + grammars) is where other languages/embeddings plug in later. C/C++ symbol extraction resolves names through the declarator chain (templates, qualified ns::name definitions, in-class methods), and #include "…" specifiers feed the repo-map reference graph.

ArkTS scope and limits

  • Components declared with struct appear as kind: class, signature struct Name. Methods, fields, global functions, classes/interfaces/types/enums and module variables have stable qualified IDs, owners and source line ranges. Decorators (@Component, @ComponentV2, @State, @Local, @Builder, etc.) are retained as metadata and included in the definition's source range.
  • build() and nested declarative UI blocks parse as ArkTS. Local components and explicit ETS/TS imports feed symbols, search, map, references, change context and Context Packs. @Extend metadata and UI attribute chains are excluded from call relationships. Bare capitalized calls in UI bodies have no global-name or imported-module fallback; unbound SDK components cannot acquire unrelated same-named project targets. Ordinary callback/business calls retain existing provenance. code_refs uses binding-aware candidates for ArkTS call sites.
  • Relative mixed ETS/TS imports work when the target is statically unique. Extensionless stems with both ETS and another source file stay unresolved. Default imports remain import-scoped; no HAR/oh-package/module alias, SDK typing, re-export chain, state-update or UI rerender semantics are inferred. Unbound/global custom UI components may therefore have no relationship edge. Syntax acceptance does not prove valid ArkTS or HarmonyOS runtime behavior.
  • Each indexed file records parsed, partial, or failed syntax/read status, ERROR/MISSING counts and at most three issue locations. Unreliable ArkTS declarations are omitted rather than assigned misleading IDs. code_index reports a bounded incomplete-index summary, and Context Packs/change context carry gaps within their existing budgets. parsed means syntax extraction completed, not that the index contains every semantic reference. Cache schema 3 rebuilds older caches automatically; source bodies remain unpersisted.
  • Grammar: harmony-contrib 0.3.0, ABI 14, unchanged npm WASM bundled with its MIT notices. Consumer installation requires no native ArkTS addon. Asset provenance.

How it works

  • Index build (src/buildIndex.ts): recursive scan (excludes applied), per-file tree-sitter extraction (src/extract.ts), JSON cache under <repo>/.dsh-code-index/, incremental refresh by mtime (only touched files re-parse).
  • Search (src/search.ts): pure scoring — exact 1 / prefix 0.8 / substring 0.5, export boost, name order tiebreak.
  • Repo map (src/repomap.ts): personalized PageRank over the import graph (teleport = per-file density share, so hub files that are themselves imported by other hubs rise above flat in-degree counting), seeded by the density-aware file score (class/interface/function weighted, test paths damped), top-N files, per-file symbol cap, hard char truncation.
  • Call graph (src/refgraph.ts): call sites extracted per file (per language, with their enclosing function) are resolved by name into callers and callees — code_refs exposes this directly, and code_search uses call fan-in as a ranking tie-break.
  • Change context (src/change-context.ts): maps Git hunks to stable symbols, then follows bounded provenance-labeled callers, import dependents, entry paths, impact, and likely affected tests without returning the whole repository.
  • ContextPack (src/context.ts, src/context-pack.ts, src/source-excerpts.ts): ranks task candidates, reads ephemeral source evidence, selects a final DTO under text/JSON budgets, then renders only selected items.
  • Health (src/health.ts): Tarjan SCC over the import graph yields circular dependencies; orphan-module detection lists symbol-bearing files with no inbound or outbound imports (entry points and tests excluded).
  • Workspace resolution: each tool resolves the session cwd (agent.session.header.cwd) and walks up to the nearest .git (bounded — a directory without a repo marker is never indexed).
  • Project contexts (src/repo-context.ts): canonical real paths identify separate worktrees; up to four contexts are retained. Each tool call scans current metadata and reparses only changed files, while the watcher refreshes dirty files after a bounded debounce.
  • Ignore handling: Git ignore rules from root and nested .gitignore files are applied to indexing. excludeDirs remains a list of exact directory names, not glob patterns.

Known limitations

  • web-tree-sitter pinned to ^0.25 (ESM) — the 0.25 line uses ESM named exports (Language/Query); this pairing with tree-sitter-wasms static builds is verified working under Node ≥ 22/24.
  • Auto-injected maps use DSH's system-prompt assembly context for the active session. Agentless assembly falls back to the DSH process working directory. A newly accessed project may have an empty map on its first prompt while indexing completes; following assemblies receive its map.
  • The watcher starts only for projects accessed by a tool and is disposed with the plugin. With externalWatch: false, per-call metadata scans still detect ordinary mtime changes.
  • Large monorepos still require a directory metadata scan on each tool call. File parsing is incremental, but scan latency depends on repository size and storage speed.
  • Function-local variables are excluded. Module declarations and class members are indexed; a parser/graph is not a type checker.
  • Source reads reject files changed after the index snapshot, paths resolving outside the root, and current files over 1 MB. Signature-only fallbacks and gaps identify missing evidence; likely tests are leads, not proof of coverage.

Development

pnpm install
pnpm test        # vitest — extractor, scan, cache, search, repo map, call graph, health
pnpm typecheck
pnpm build       # tsup → dist/index.js (ESM, external deps)
pnpm build && pnpm release:smoke # pack, clean-install the tarball, boot the plugin, and exercise core tools

The benchmark harness under bench/ compares stock DSH, the published 0.5 baseline, the v0.6 change-aware treatment, and the v0.7 task-aware treatment. It records task completion, input tokens, tool calls, turns, and wall time; it does not invent missing provider usage. The repository contains infrastructure and sample tasks, not measured performance claims.

WSL → Windows checkouts: running pnpm install from WSL against a checkout on /mnt/c leaves Linux-style symlinks that Windows Node cannot traverse (Cannot find package 'web-tree-sitter', EACCES). Repair without a reinstall from the Windows side:

node.exe scripts\fix-wsl-links.mjs            # this repo's node_modules
node.exe scripts\fix-wsl-links.mjs C:\Users\you\.dsh\profiles\web   # a dsh profile install

It re-points every dead link at its real .pnpm store entry as a junction; safe to re-run (idempotent, reports fixed: 0 when clean).

Feedback

Used dsh-code-index? Tell me what helped, what broke, or what context it missed. Reply in the official DSH plugin discussion, or use the feedback issue form if issue submissions are enabled for the repository.

To make a report actionable, include the approximate repository size and languages, the task you tried, the context you expected, and what the agent actually received. Mention whether project switching, a worktree, or an external file edit was involved. Please do not include private source code, credentials, or API keys.

License

MIT. Not affiliated with DeepSeek; built on the public dsh plugin surface.

Keywords

dsh-plugin

FAQs

Package last updated on 13 Oct 2026

Related posts