Four new verified plugins: dependency audit, llms.txt, CN bootstrap, timesheet

[zoahdev]

"## Four new verified plugins, one supply-chain → time story\n\nSince today I shipped four dsh plugins that cover the trust → readability → connectivity → time chain. All four: MIT, zero runtime dependencies, CI-verified (dsh-plugin-doctor preflight + unit tests + packed-artifact integration + fresh-profile dsh web boot smoke on Windows), published on npm, and installable with dsh plugin add.\n\n### 1. dsh-dep-audit — dependency supply-chain hygiene audit\n8 checks: peer-range resolvability against the registry, broken dist-tag detection (the #2763 class — it flags @deepseek-ai/dsh-tools's latest=0.0.1-rc.1 vs declared ^0.1.0-rc.6 on a live run), stale/missing-license/non-registry deps, and installed-vs-declared drift. CLI + agent-callable dep_audit, dsh-dep-audit/v1 reports.\n\n### 2. dsh-llms-forge — llms.txt generator\nAI agents look for llms.txt first; most dsh plugins don't have one. Generates it deterministically from package.json + README.md (install command, license, homepage, keywords, entry, CLI). Read-only by default, --write/--overwrite explicit. CLI + agent-callable llms_forge.\n\n### 3. dsh-cn-boot — China-network bootstrap\nProbes npm/npmmirror/GitHub/raw/HuggingFace/Gitee + local proxy ports (7897/10809), reads current npm/pnpm registry config, recommends mirrors/proxy, generates a PowerShell + bash bootstrap script. Read-only by default; --apply only sets the registry to npmmirror. Local run: 6/8 reachable, HuggingFace timeout flagged correctly.\n\n### 4. dsh-timesheet — turn-based time tracking\nToken dashboards tell you cost; this one tells you wall-clock time from *.jsonl session logs — totals, per-day/project/provider/source rollups, tool-call counts, failure rates, TTFT. Verified on real session logs: 52 turns / 4h56m / 1315 tool calls. CLI + agent-callable timesheet, dsh-timesheet/v1 reports.\n\nAll four are already listed in dsh-subscribe (verified) and the dsh-ecosystem catalog, with awesome-list PRs open. Happy to take feedback — especially on the dependency-audit check set, since plugin trust is the ecosystem's real bottleneck right now."

[zoahdev]

"## Update — 5th plugin: dsh-discussions-radar\n\nSince the original post, one more landed in the same family: a radar for these very official discussions.\n\n- Lists/filters/searches the official boards (Ideas / Q&A / Show Your Plugins! / General / Announcements / Polls) from inside dsh or the CLI\n- Agent tool discussions_radar + npx dsh-discussions-radar --category \"Show Your Plugins!\" --limit 10\n- Read-only public API, zero runtime dependencies, dsh-discussions-radar/v1 reports\n- Companion to dsh-github-release-radar: releases → community pulse\n- 11 unit tests, live-API integration, npm dsh-discussions-radar@0.1.0\n\nSo the family is now: trust (dep-audit) → discoverability (llms-forge) → connectivity (cn-boot) → time (timesheet) → community pulse (discussions-radar). Feedback welcome!"

[zoahdev]

"## Update — 8th plugin: dsh-disk-audit\n\n- Disk-usage audit for dsh data directories: total size, per-directory breakdown, largest files, oversized-file warnings (session logs grow append-only and can hit hundreds of MB — the ecosystem has seen the ~512 MB stringify cap), cleanup suggestions\n- Agent tool disk_audit + npx dsh-disk-audit ~/.dsh --json\n- Read-only, zero runtime dependencies, dsh-disk-audit/v1 reports\n- npm dsh-disk-audit@0.1.0\n\nThe family is now: trust (dep-audit) → discoverability (llms-forge / readme-forge) → connectivity (cn-boot) → time (timesheet) → community pulse (discussions-radar) → onboarding (firstrun) → storage (disk-audit). All 8 are in one README-based listing PR for the curated catalog (0xsline #401) — per maintainer feedback, curated READMEs not the generated CATALOG."

[zoahdev]

"## Write-up is now live — the full pipeline, not just the plugins\n\nI published the complete playbook behind the 8 plugins so anyone can copy the pipeline:\n\n- 中文（掘金/知乎可转载）: zh-24-pipeline — 插件骨架、质量基线（三件套 CI）、8 插件空位表、5 个真实踩坑、社区闭环\n- English (dev.to/Reddit/HN ready): en-24-pipeline\n\nHighlights from the write-up:\n\n- The quality gate that every plugin passes: typecheck → build → vitest → pack → packed-artifact integration (real handler invocation) → fresh-profile dsh web boot smoke on Windows\n- Why zero-runtime-dependency + read-only-by-default is the trust baseline here\n- Pitfalls with real fixes: npm name collisions, Windows .cmd shim spawning, pnpm's strict linking (the #55 failure class), and the broken latest dist-tag ecosystem issue (#2763)\n- How the community loop works: one evolving Show Your Plugins thread, evidence-based Q&A replies, and README-based curated-list PRs (not the CI-generated CATALOG)\n\nFeedback welcome — especially on the dependency-audit check set, since plugin trust is the ecosystem's real bottleneck."

[zoahdev]

"## Update — quality scorecard published + full-registry leaderboard v1\n\nTwo more pieces of the ecosystem data story are live:\n\n1. dsh-quality-score (npm 0.1.2) — plugin quality scorecard: 0-100 + grade + six components (manifest 30 / peer-resolvable 20 / dist-tag 15 / dead-ranges 15 / freshness 10 / dsh-tools peer 10), with per-deduction fix suggestions. CLI + agent-callable quality_score, batch leaderboard mode, offline-graceful. 11 unit tests, CI green.\n\n2. Full-registry leaderboard v1 (324 npm-installable plugins) — data + raw scores:\n\n- Top packages: 100/100 A\n- zoahdev suite: 90/100 A — the single deduction for every one of the 9 plugins is the #2763 dsh-tools peer contradiction (broken latest 0.0.1-rc.1). One upstream dist-tag fix raises them all to 100.\n- Dogfooding the scorecard on the real registry caught two bugs before wide use: abbreviated npm metadata omits description/license (fixed v0.1.1), and component weights summed to 90 not 100 (fixed v0.1.2). Both shipped with regression tests.\n\nThe diagnose -> quantify -> act loop is now complete: health scan (41) -> full-registry impact (77/100, what-if 69/77) -> per-plugin actionable scores (324). Feedback welcome, especially on component weights."

[zoahdev]

"## The complete ecosystem-health data story (consolidated)\n\nThe scorecard + leaderboard have now produced a full, quantified narrative for the registry:\n\n- Impact: 78/101 plugins declaring a dsh-tools peer are hit by the broken latest (0.0.1-rc.1, #2763); trend holds day-over-day.\n- Distribution (0.1.3 thresholds): 240 A / 84 B / 0 C/D/F (avg 97.4).\n- Per category: theme/skill/market/fun all 100; ui 98.4 (73 plugins); workflow 94.8 (weakest large category); security 90 (B) — the ecosystem's own security tooling is held back by the exact dist-tag issue it guards against.\n- Fix impact: all 78 affected score exactly 90 (B) — their only deduction. One official latest change moves 78 plugins B → A (318/324 = 98% at A).\n\nEvery number reproducible: dsh-quality-score (0.1.3) + scores.json + weekly. Live dashboard: https://zoahdev.github.io/dsh-ecosystem/ecosystem-health-dashboard.html"

[zoahdev]

Week in review (2026-08-18 → 08-19) — 套件周更

9 个验证插件全部线上（npm + GitHub + CI 绿），收录 PR 正在等 awesome-dsh-plugin 的 repo 年龄 gate（08-19 10:26 UTC 起陆续转绿；官方 regate.yml 也会自动兜底）：

• 套件：dsh-dep-audit · dsh-llms-forge · dsh-cn-boot · dsh-timesheet · dsh-discussions-radar · dsh-readme-forge · dsh-firstrun · dsh-disk-audit · dsh-quality-score
• 数据产品：生态健康仪表盘（917 注册表 / 325 可装 / [Bug Report] 包族 npm dist-tag `latest` 不一致：全新项目按默认版本安装必然 ERESOLVE（0.0.1-rc.1 的 peer 引用已不存在的包名） #2763 影响 78）+ 质量榜单 v1（240A/84B/1F）+ 商店端质量徽章
• 本周官方讨论区新增 16 条证据级技术回复（对照 main HEAD 99f6f02 逐行核验）：tmpfs 语义 / SQLite torn-tail / 投影缓存 / spill ENOENT / session.list 隔离 / CTRL_C_EVENT / pnpm peer 纠正 / 单波浪线实测 / WSL GPU 透传 / webServer 中间件 / Copilot 模型发现 / 全局单模型 / schannel TLS / idle Enter / CJK 检索 / 跨会话延续——清单与结论见 Q&A 库
• 周报：weekly-2026-08-19（完整数字可复现）
• 值班工具：discussion-triage.mjs（每日队列）+ verify-citation.mjs（引用核验）+ verify-2763-fix.mjs（修复日自动重扫）

#2763 仍未修复（latest 停 0.0.1-rc.1）；修复日验证器与评论模板已就绪。