dsh-score

🏆 dsh-score

• 1024 store channel: npm i -g dsh1024 once, then dsh1024 plugin --profile web add dsh-score (counts toward the deepseek1024.com install ranking).

Multi-dimensional quality scoring for DeepSeek Harness plugins.

Five dimensions, real gh/npm evidence, one weighted risk card and leaderboard.

English · 简体中文 · Español · Português · हिन्दी

dsh plugin --profile <name> add dsh-score

📖 Ecosystem knowledge base — measured data, not marketing: plugin development guide · plugin-selection data · maintenance criteria.

Install & uninstall

dsh plugin --profile web add dsh-score     # install (npm) — or the git form above
dsh plugin --profile web remove dsh-score  # uninstall

⭐ 如果它帮到了你

这个插件是 DSH 插件家族的一员（95 个，全部 Apache-2.0）。如果你在用，给个 star —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。

English: part of a 95 plugin family for DeepSeek Harness. If it is useful, a star helps the next person find it — nothing is gated behind it.

What is dsh-score?

Multi-dimensional quality scoring for DeepSeek Harness plugins.

Five dimensions, real gh/npm evidence, one weighted risk card and leaderboard.

The same run, animated.

Comparison

Compatibility

Component	Version
DeepSeek Harness	dsh-v0.2.1-rc.2 (GitHub tag). The engines.dsh gate is >=0.2.1-0 <0.3.0; dev/test pins and the typecheck:ci ruler measure 0.2.1-rc.2. The ctx.jobs seam uses the SessionId contract.
Node.js	^22.19.0 || >=24.0.0
Package manager	pnpm@11.7.0
Platform	Windows / macOS / Linux (host-only plugin)
External tools	gh CLI on PATH (authenticated for API reads), npm CLI on PATH

What you get

• score tool — one target through the five-dimension pipeline; returns the structured risk card, or { kind: 'background', jobId } with background: true.
• /score command — batch scoring of a whitespace/comma-separated target list as a score-batch background job over ctx.jobs, producing a leaderboard snapshot (JSON + Markdown).
• score_report tool — fetch any stored score card (sc_...), leaderboard (lb_...), or the latest leaderboard.
• score_badge tool — an embeddable README badge (shields.io flat SVG + endpoint URL) and the five-dimension JSON for one scored target.
• Five dimensions (weights configurable, defaults sum to 100): install success 25, maintenance 20, documentation 20, security 20, compliance 15.
• Evidence discipline — every dimension records its audit links (source, sanitized detail, observedAt); a dimension without evidence reports no-evidence (score 0, excluded from the weighted total), never a fabricated number.
• Structured results — every record carries schema: "dsh-score/v1" with first-class fields; this is the machine-readable contract downstream tooling consumes.

Quick start

Git channel

dsh plugin --profile web add github:PerryLink/dsh-score#<commit-sha>

The first add fails because pnpm blocks the package's prepare build; copy the exact key pnpm printed into the profile's pnpm-workspace.yaml and re-run:

allowBuilds:
  'dsh-score': true

npm channel

dsh plugin --profile web add dsh-score

Prebuilt packages need no build allowance. Restart the profile, then use score / /score from a session.

Configuration

All keys are optional (defaults shown); invalid values fail loudly at load.

Key	Default	Description
probeTimeoutMs	60000	Deadline for one gh/npm probe command.
outputTailBytes	8000	Cap on the sanitized output tail recorded per probe.
cacheMaxAgeMs	86400000	How long a cached score card is reused before re-scoring (0 disables the cache).
staleCommitWarnDays	90	Commit/publish age at which maintenance drops to warn.
staleCommitFailDays	365	Commit/publish age at which maintenance drops to fail.
staleIssueWarnDays	30	Oldest-open-issue age (response proxy) at which maintenance drops to warn.
staleIssueFailDays	180	Oldest-open-issue age at which maintenance drops to fail.
maxBatchTargets	20	/score batch cap.
batchConcurrency	1	Batch concurrency (serial avoids API-rate contention).
weights	{install:25, maintenance:20, documentation:20, security:20, compliance:15}	Per-dimension weights (each 0–100; at least one must be > 0).

Tools & surfaces

score

score(target: string, refresh?: boolean, background?: boolean)

• target — a GitHub repo (github:owner/repo, owner/repo, a git/https URL) or an npm package name.
• refresh: true bypasses the score cache and re-gathers evidence.
• background: true starts a score-batch job and returns its id.

/score <targets...>

Starts one background batch job; progress streams through the job output, and the final line names the leaderboard id for score_report.

score_report(id?)

Returns a score card (sc_...), a leaderboard (lb_...), or — with no id — the latest leaderboard.

score_badge(target? | id?, refresh?)

Generates an embeddable README badge and the five-dimension JSON for one target:

• target — score a GitHub repo or npm package (through the cache) and badge it; mutually exclusive with id.
• id — badge a stored score card (sc_...) without re-scoring.
• refresh: true — bypass the score cache (only applies to target).

Returns the badge (SVG + endpoint + Markdown embed) and the compact five-dimension JSON — see Badge & JSON API.

Structured result sample

{
  "schema": "dsh-score/v1",
  "scoreId": "sc_8f1c2e4a9b3d7f01",
  "target": { "kind": "repo", "spec": "github:owner/dsh-click#abc123" },
  "scoredAt": "2026-08-16T00:00:00.000Z",
  "durationMs": 3210,
  "pluginVersion": "0.2.22",
  "dimensions": {
    "install": { "dimension": "install", "status": "no-evidence", "score": 0, "weight": 25,
                 "summary": "no dsh-test-drive result recorded for this target (install success unmeasured)",
                 "evidence": [{ "source": "test-drive", "detail": "no test-drive record found in the test_drive domain", "observedAt": "2026-08-16T00:00:00.000Z" }] },
    "maintenance": { "dimension": "maintenance", "status": "pass", "score": 100, "weight": 20,
                     "summary": "active (2026-08-10T00:00:00Z; 0 open issues)",
                     "evidence": [{ "source": "gh-api", "detail": "last activity 2026-08-10T00:00:00Z", "observedAt": "2026-08-16T00:00:00.000Z" }] }
  },
  "total": 88,
  "grade": "B",
  "verdict": "healthy (weighted total 88/100)"
}

Scoring: the total is a weighted average over dimensions that gathered evidence (no-evidence dimensions are excluded and renormalized); A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F, and N/A when nothing had evidence.

Badge & JSON API

score_badge generates an embeddable README badge and the five-dimension JSON for one scored target.

Badge

Three forms, all derived from the same settled score card:

• Endpoint — a documented shields.io static URL, paste-ready for a README image (zero self-hosting).
• SVG — a self-contained shields.io flat-style SVG (badge.svg field / renderScoreBadge) for offline or self-hosted READMEs.
• Markdown — the embed snippet combining both.

Embed the total badge in any README:

![dsh-score: B · 84/100](https://img.shields.io/badge/dsh--score-B_%C2%B7_84%2F100-green)

Five-dimension JSON

The same call returns the compact JSON API envelope (schema: "dsh-score/badge/v1"):

{
  "schema": "dsh-score/badge/v1",
  "target": { "kind": "repo", "spec": "github:owner/dsh-click#abc123" },
  "scoredAt": "2026-08-16T00:00:00.000Z",
  "total": 84,
  "grade": "B",
  "dimensions": {
    "install":      { "label": "install", "status": "no-evidence", "score": 0,  "weight": 25, "summary": "no dsh-test-drive result recorded" },
    "maintenance":  { "label": "maintenance", "status": "pass", "score": 90, "weight": 20, "summary": "active (0 open issues)" },
    "documentation": { "label": "docs", "status": "pass", "score": 85, "weight": 20, "summary": "README + CHANGELOG + SECURITY" },
    "security":     { "label": "security", "status": "warn", "score": 60, "weight": 20, "summary": "permissive license" },
    "compliance":   { "label": "compliance", "status": "pass", "score": 100, "weight": 15, "summary": "dsh.bundle.patch + dsh-plugin topic" }
  }
}

A no-evidence dimension keeps its honest status and score 0 — the badge and JSON never fabricate a number.

Permissions & data

• Only public services are consumed: ctx.subprocess, ctx.jobs, ctx.storageDomain, ctx.tools, ctx.commands.
• Score cards and leaderboards are stored in the score storage-domain (tables scores, leaderboards; latest-leaderboard pointer). When the composition has no storageDomain (profiles that predate the base bundle's storage rows, such as the 0.1.1-rc.2-era headless profile), tools still work and score persistence is disabled with a logged reason. The published dsh-base bundle mounts storage-domain from 0.1.2-rc.1 on (verified against the 0.1.2-rc.1 and 0.1.5-alpha.1 tarballs), so persistence is active on the published line.
• Child processes inherit the provider's credential-scrubbed environment; gh reads its own credential store. No environment value is ever logged.
• All report/log strings pass through pure sanitizers: token literals, URL credentials, and bearer headers are redacted, and tails are byte-capped.

Security boundaries

• No code execution. The pipeline runs gh api and npm view only; it never installs, builds, or runs a target.
• Argv-only subprocesses. Every CLI invocation is an argv array, never shell-interpreted; repo owner/repo segments are validated against a restricted character set before use in an endpoint.
• Evidence discipline. No score is fabricated: a probe that fails or returns unparsable output yields no-evidence, never a number.
• Detection vs redaction. Secret-leak and malicious-install-script detection share the same pure regexes as redaction; both are unit-tested against extreme inputs.

Known limitations

• Repository probes require gh to be authenticated and network access to GitHub; npm probes require npm and registry access.
• A target without a resolvable GitHub repository cannot be inspected for documentation, security, or compliance (those dimensions report no-evidence).
• Install success depends on dsh-test-drive being mounted and having recorded the target; otherwise it is honestly no-evidence.
• The maintenance "issue response" signal is a proxy (oldest open issue age), not a direct response-time measurement.
• Score results are cached per target; use refresh: true (or wait past cacheMaxAgeMs) to force re-scoring.

Development

pnpm install
pnpm run typecheck && pnpm run typecheck:ci && pnpm test
pnpm run build && pnpm run verify:self-contained && pnpm run verify:artifacts && pnpm pack

• typecheck resolves @deepseek-ai/* through the local harness checkout; typecheck:ci checks against the published 0.1.7-rc.2 types.
• Tests use the real Context/Session/ToolRuntime/LocalJobRegistry/storage stack with a scripted subprocess provider.
• Real-CLI scoring (requires gh/npm on PATH, gh authenticated): invoke score from a mounted profile.
• Release: node scripts/release.mjs <x.y.z> (bumps, stamps CHANGELOG, re-runs the gate, commits + tags; never pushes).

Topics

dsh, dsh-plugin, deepseek-harness, deepseek, cordis, plugin-scoring, quality-score, leaderboard, supply-chain

Contributors

PerryLink — design and implementation.

PerryLink DSH Plugin Family

This project is one of the 87 actively maintained DeepSeek Harness plugins from PerryLink. The family roster is 95 plugins in total — 5 frozen, 3 retired — and stays collapsed below so every README keeps a short first screen. Expand it to see every row, with the reason in the Status column.

Expand all 95 plugins

Plugin	One-liner	Status
dsh-aqua-input-check	水产养殖投入品记录核对（按投入品用量、休药期与起捕间隔核对记录自洽，仅提示差异，不作出定性结论）
dsh-archive-check	档案归档完整性与保管期限核对（依据《档案法》及配套规定，仅提示差异，不作出定性结论）
dsh-auto-review	Second-model auto-review on the approval chain, fail-closed by default
dsh-autotier	Automatic strong/cheap model-tier routing with deterministic risk guards and a /tier command
dsh-background-agents	Durable background child agents with a Web UI sidebar, messaging and interrupt	🚫 RETIRED — see the repo README
dsh-bid-ca-precheck	投标文件符合性预检（按招标文件逐条核对响应情况，仅提示差异，不作出定性结论）
dsh-bid-qual-check	投标人资格条件核对（按资格条件与证明材料核对逐条响应，仅提示差异，不作出定性结论）
dsh-budget	Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel.	🧊 FROZEN — see the repo README
dsh-cert-mcp	Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence
dsh-checkpoint-rewind	Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore
dsh-claude-move	Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH	🧊 FROZEN — see the repo README
dsh-click	Cross-platform native desktop control for DeepSeek Harness — Windows first.
dsh-composer-history	Terminal-style input history for the web composer: arrows, Ctrl+R search
dsh-contract-stance	合同条款立场台账核对（按立场、风险等级与退让底线核对台账自洽，仅提示差异，不作出定性结论）
dsh-customs-doc-check	报关单证一致性核对（按公开的报关单填制规范核对单证间字段一致性，仅提示差异，不作出定性结论）
dsh-data-quality	Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here)
dsh-defend	Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness.	🧊 FROZEN — see the repo README
dsh-demurrage-ledger	滞箱费台账核对（按免箱期与费率核对超期天数与金额的自洽性，仅提示差异，不作出定性结论）
dsh-doublecheck	Engineering-discipline guard: requirements grill, test gates, adversary review
dsh-draw	Unified static-image generation routing for DeepSeek Harness.	🧊 FROZEN — see the repo README
dsh-drill-script-check	应急演练脚本核对（按阶段、响应分级、指挥与资源要素核对脚本齐备，仅提示差异，不作出定性结论）
dsh-eia-guide-check	环评导则适用性核对（按要素、导则名称与执行标准核对台账自洽，仅提示差异，不作出定性结论）
dsh-emergency-plan	应急预案要素齐备性与条款级页码定位（依据 GB/T 29639-2020 等公开文件，仅提示差异，不作出定性结论）
dsh-essay-rubric-check	作文量表评分核对（按评分项、原文定位与分值算术核对评分自洽，仅提示差异，不作出定性结论）
dsh-evidence-check	证据清单齐备性核对（按待证事实与证据要素核对清单自洽，仅提示差异，不作出定性结论）
dsh-export-ctl-check	出口管制物项核对（按管制清单、最终用途与许可证核对台账齐备，仅提示差异，不作出定性结论）
dsh-fast	Read-only performance diagnostics for DeepSeek Harness.
dsh-fmea-table-check	FMEA 分析表要素齐备性与风险顺序数一致性核对（按公开的 FMEA 方法标准核对表内自洽，仅提示差异，不作出定性结论）
dsh-forecast-penalty	预测准确率考核核对（按准确率、门槛与考核单价核对考核费用的算术自洽，仅提示差异，不作出定性结论）
dsh-fund-research	Deterministic research reports for Chinese public mutual funds
dsh-github	GitHub PR/issues integration for DSH, every write gated by approval
dsh-gongwen-flow-check	公文流转与办理时限核对（按公开的公文处理规范核对环节完整性与时限，仅提示差异，不作出定性结论）
dsh-gongwen-word-check	公文格式要素核对（按公开的党政机关公文格式标准核对版头与主体要素，仅提示差异，不作出定性结论）
dsh-guard-plan-qc	劳动保护与安全防护用品配置表核对（按公开的配备标准核对品名规格与配置数量，仅提示差异，不作出定性结论）
dsh-hazchem-check	危险化学品临界量与重大危险源辨识核对（按储存量与临界量核对台账自洽，仅提示差异，不作出定性结论）
dsh-hazplan-check	HAZOP 分析表要素齐备性与偏差推导一致性核对（依据公开的危险与可操作性分析标准，仅提示差异，不作出定性结论）
dsh-hidden-risk-map	安全隐患台账→《工贸企业重大事故隐患判定标准》（应急管理部令第10号）条款映射提示（仅提示差异，不作出定性结论）
dsh-hs-classify	商品归类层级一致性核对（按章、品目、子目与商品编号的层级关系核对自洽，仅提示差异，不作出定性结论）
dsh-icd-rule-check	ICD 合并编码与星剑号配对提示（依据 GB/T 14396-2016 与公开的 ICD 使用说明，仅提示差异，不作出定性结论）
dsh-industry-research	Industry research orchestration that seals its deliverables through this plugin's ctx.researchReport.assemble
dsh-lawcite-adapter	法条引用与文书要素核对（按名称、条号、原文与效力状态核对引用可核验性，仅提示差异，不作出定性结论）
dsh-laya	Laya typed decisions (noul/choice/score) as a first-class Cordis service and model-visible tools
dsh-lc-doc-check	信用证单据条款核对（按单据种类、份数、期限与不符点核对交单自洽，仅提示差异，不作出定性结论）
dsh-learning-gap-check	能力差距与培养计划核对（按能力等级差、培养措施与完成期限核对台账闭环，仅提示差异，不作出定性结论）
dsh-library	Local document knowledge base for DeepSeek Harness.
dsh-local-ai	Local-model (Ollama) integration for DeepSeek Harness.
dsh-lsp-actions	LSP diagnostics, formatting, completion, code actions and rename over language servers
dsh-mask	PII masking middleware: anonymize at the model boundary, restore at the display layer
dsh-mcp-panel	Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors
dsh-medrec-qc	病案首页形式质控与逻辑矛盾提示（依据国卫办医发〔2016〕24号等公开文件，仅提示差异，不作出定性结论）
dsh-memento	Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool
dsh-nsfc-form-check	国家自然科学基金申请书形式审查与匿名化提示（依据《国家自然科学基金条例》与申请人导入的当年指南，仅提示差异，不作出定性结论）
dsh-nurse-record-check	护理记录时限、签名与评估表完整性校验（依据《病历书写基本规范》等公开文件，仅提示差异，不作出定性结论）
dsh-observe	OpenTelemetry and Langfuse observability exporter for DeepSeek Harness.
dsh-origin-rvc-check	原产地区域价值成分核对（按 RVC 定义式与门槛核对原产地判定自洽，仅提示差异，不作出定性结论）
dsh-ota-review-check	在线点评回复台账核对（按回复时限、问题分类与整改状态核对台账闭环，仅提示差异，不作出定性结论）
dsh-output-styles	Claude Code outputStyles-equivalent runtime style switching
dsh-paper-doc-adapter	试卷解析结构核对（按题型、答案、分值与 yotta 标识核对试卷结构自洽，仅提示差异，不作出定性结论）
dsh-permission-rules	Claude Code-style declarative allow/deny/ask permission rules with audit
dsh-permit-report-check	行政许可办理核对（按申请材料、法定时限与决定记录核对台账闭环，仅提示差异，不作出定性结论）
dsh-pipeline-check	项目全流程文件链条核对（按环节先后与金额口径核对链条自洽，仅提示差异，不作出定性结论）
dsh-pleading-draft	起诉状要素齐备性核对（按诉请、事实、证据、法条四要素核对文书齐备，仅提示差异，不作出定性结论）
dsh-plugin-doctor	Zero-dependency static + sandbox smoke detector for DSH plugins
dsh-plugin-guide	Plugin-development knowledge base as an on-demand agent skill
dsh-plugin-kit	Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins
dsh-plugin-upgrade	One-package, one-corridor-index plugin upgrade skill: routes a repository to the matching closed corridor card
dsh-policy-brief-draft	政策专报要素核对（按观点、依据、出处与建议核对专报齐备，仅提示差异，不作出定性结论）
dsh-power-loss-split	线损电量拆分与考核表核对（依据公开的线损计算口径，仅提示差异，不作出定性结论）
dsh-power-ticket-check	电力工作票要素齐备性与签发许可顺序核对（依据现行电力安全工作规程，仅提示差异，不作出定性结论）
dsh-ppap-check	PPAP 提交要素齐备性核对（按公开的 PPAP 手册与提交等级核对要素齐备与版本填写，仅提示差异，不作出定性结论）
dsh-protest-deadline	质疑与投诉期限核对（按公开的政府采购质疑投诉规定核对期限与台账自洽，仅提示差异，不作出定性结论）
dsh-railway-window	铁路施工天窗台账核对（按时间窗、时长算术与命令号核对台账自洽，仅提示差异，不作出定性结论）
dsh-reach	Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console	🧊 FROZEN — see the repo README
dsh-repair-order-qc	维修工单结算核对（按项目金额、配件工时合计与结算总额核对算术自洽，仅提示差异，不作出定性结论）
dsh-research-report	Verifiable research-report engine: content-addressed evidence ledger and sealed versions
dsh-review-reply-check	审稿意见逐条回应覆盖核对（按意见与回应一一对应核对覆盖完整性，仅提示差异，不作出定性结论）
dsh-rulefile-check	规则库文件自检核对（按条款引用纪律与效力上限核对规则库自身合规，仅提示差异，不作出定性结论）
dsh-safety-brief-check	安全技术交底记录要素齐备性与签字闭环核对（依据公开的安全生产法规与检查标准，仅提示差异，不作出定性结论）
dsh-score	Multi-dimensional quality scoring for DeepSeek Harness plugins.
dsh-session-pin	Pin sessions in the Web sidebar with durable ordering	🚫 RETIRED — see the repo README
dsh-session-sync	Cross-device session sync for DeepSeek Harness — a dedicated git mirror of your session store.
dsh-site-log-check	监理日志跨日连续性与旁站覆盖提示（依据 GB/T 50319-2013 等公开文件，仅提示差异，不作出定性结论）
dsh-skill-pack-security	Security-audit skill pack: secret scan, dependency and supply-chain review
dsh-soe-decision-check	三重一大决策台账核对（按前置研究、会议审议与决议记录核对程序留痕，仅提示差异，不作出定性结论）
dsh-soilwater-check	土壤与地下水监测台账核对（按点位、监测项目、限值与超标判定核对台账自洽，仅提示差异，不作出定性结论）
dsh-sop-sync-check	作业规程与 FMEA／控制计划一致性核对（按编号与版本核对三份文件是否同步，仅提示差异，不作出定性结论）
dsh-spc-gbt-adapter	控制图常数与过程能力指数核对（按 GB/T 4091 的常规控制图常数表核对控制限与 Cp/Cpk 的自洽性，仅提示差异，不作出定性结论）
dsh-talk	Voice-first session loop for DeepSeek Harness: talk to it, hear it answer.
dsh-team-rooms	Cross-session team rooms: shared message bus, task board and timeline	🚫 RETIRED — see the repo README
dsh-tender-extract	招标文件条款摘录核对（按出处与原文逐字核对摘录完整性，仅提示差异，不作出定性结论）
dsh-tender-matrix	评标因素评分矩阵核对（按分值上限与合计核对矩阵自洽，仅提示差异，不作出定性结论）
dsh-test-drive	Isolated install-and-smoke test drives for DeepSeek Harness plugins.
dsh-ticktick	TickTick/Dida365 task bridge: session-header panel + 11 tools
dsh-translate	Vendor parameter translation and deterministic JSON repair for DeepSeek Harness.
dsh-warranty-calc	质保期与索赔金额核对（按质保期月数与里程、索赔金额算式核对自洽，仅提示差异，不作出定性结论）

Install from the DSH Desktop Market

All PerryLink plugins are browsable in the built-in DSH Desktop Market: Market → Sources → add source → paste https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json → select it. Installation still goes through the Market's npm-identity verification and your confirmation.

License

Apache-2.0