dsh-plugin-guide 0.4.0 → 0.4.1

package/README-zh.md

@@ -56,7 +56,7 @@ dsh plugin --profile web add dsh-plugin-guide
 npx dsh-standards ./my-plugin --scope entry --entry-claim static
 
 # 三层审计；没跑的层保持 not-run / not-measured
-npx dsh-levels audit ./my-plugin --format json
+npx -p dsh-standards dsh-levels ./my-plugin --format json
 ```
 
 `recognized` 不是通过，`static` 不是通过，`not-run` 也不是通过。

package/README.md

@@ -58,7 +58,7 @@ The skill routes checks to `dsh-standards` and points build work at
 npx dsh-standards ./my-plugin --scope entry --entry-claim static
 
 # Three-layer audit; unrun layers stay not-run / not-measured
-npx dsh-levels audit ./my-plugin --format json
+npx -p dsh-standards dsh-levels ./my-plugin --format json
 ```
 
 A `recognized` result is not a pass. A `static` result is not a pass. A

package/SKILL.md

@@ -37,7 +37,7 @@ It defines the three layers and the difference between a check and advice.
 
 - **Run a check:** `npx dsh-standards <plugin-dir> --scope entry --entry-claim static`
   for recognition; add a host/runtime when claiming runtime.
-- **Three-layer self-check:** `npx dsh-levels audit <plugin-dir> --format json`.
+- **Three-layer self-check:** `npx -p dsh-standards dsh-levels <plugin-dir> --format json`.
 - **Build or scaffold a plugin:** use the `dsh-primer` skill/CLI. The old
   `dsh-plugin-dev` command belongs to `dsh-primer`, not to this guide.
 - **Read the rules:** `dsh-plugin-spec`; **read the guide:** this package;

package/docs/boost.md

@@ -25,23 +25,24 @@ An evidence card is per practice, per plugin, with a baseline and an after
 measurement. Example shape:
 
 ```yaml
-practice: LEV-6
-plugin: "@acme/dsh-hello@0.1.0"
-baseline:
-  startupMs: 180
-  tokensPerTurn: 1200
-after:
-  startupMs: 150
-  tokensPerTurn: 900
-environment:
-  dsh: 0.2.2-alpha.2
-  cordis: 4.0.6-alpha.1
-  node: 24
+subject: "@acme/dsh-hello@0.1.0"          # what was measured
+host: "dsh 0.2.2-alpha.2 / cordis 4.0.6-alpha.1 / node 24"
+method: "bench: startup ms and tokens per turn"
+scope: "single machine, 5 runs, synthetic prompt"
 command: "node bench/hello.mjs"
-result: "startup -17%, tokens -25%"
-caveats: "single machine, single run, not a performance baseline"
+result: "startup 180→150 ms; tokens 1200→900"
+negativeControl: "same bench with the plugin disabled"
+generatedAt: "2026-11-03"
+expiresAt: "2027-05-03"
+recordHash: "sha256:<64 hex of this record>"
+claimLevel: "self-assessed"               # self-reported | self-assessed | host-reviewed | independent | reference
+issuer: "author"
+selfAssessed: true
 ```
 
+All thirteen fields are required. A missing or malformed field makes the card
+`not-measured`; a status word alone is not evidence.
+
 If an effect cannot be measured (developer hours, maintenance cost, “fewer
 pitfalls”), record it as a WARN or a note. Do not invent a number.
 
@@ -56,7 +57,7 @@ pitfalls”), record it as a WARN or a note. Do not invent a number.
 ## Run the audit
 
 ```sh
-npx dsh-levels audit ./my-plugin \
+npx -p dsh-standards dsh-levels ./my-plugin \
   --boost-evidence boost.json --format json
 ```
 

package/docs/entry.md

@@ -50,10 +50,38 @@ pass.
 - `package.json` has a resolvable entry and, for bundles, a `dsh.bundle.patch`.
 - The patch target row exists; ordered patch arrays are allowed.
 - `engines.dsh` or an `@deepseek-ai/dsh*` peer range is declared.
+- `dsh.capabilities` lists every host surface the plugin touches (see below).
+- `dsh.labels` is declared when the plugin modifies prompts, runs red-team
+  workloads, adds a model provider, exposes remote access, or mirrors another
+  project.
 - The license is present; a missing license is advisory, not a fabricated pass.
 - README says how to install and what it needs.
 - No “official”, “certified”, “secure”, or ranking claim.
 
+## Declaration fields
+
+Two optional fields become checks `DSC-11` and `DSC-13` once they exist:
+
+```json
+{
+  "dsh": {
+    "capabilities": ["fs:read", "network:egress"],
+    "labels": ["remote-access"]
+  }
+}
+```
+
+Allowed `capabilities`: `fs:read`, `fs:write`, `shell`, `subprocess`,
+`network:egress`, `network:ingress`, `credentials:read`, `credentials:list`,
+`credentials:provider`, `llm:adapter`, `sessions:read`, `system-prompt:write`,
+`tools:register`, `remote:expose`, `plugin:install`.
+
+Allowed `labels`: `prompt-modification`, `red-team`,
+`third-party-model-provider`, `remote-access`, `mirror`.
+
+Do not label a plugin `official`, `verified`, `certified`, `secure`, or
+`audited` — those words are treated as an endorsement claim and fail `DSC-13`.
+
 ## What ENTRY does not do
 
 It is not a security audit, sandbox, full contract audit, market gate, score, or

package/docs/flow.md

@@ -23,10 +23,12 @@ The canonical text is
 
 | Status | Meaning |
 |---|---|
-| `flow-pass` | all required journeys pass, or a WARN has a documented alternative |
-| `flow-warn` | at least one WARN; not a pass |
-| `flow-fail` | at least one attributable FAIL |
-| `flow-not-run` | not run, or the environment is insufficient |
+| `runtime` | all eight journeys have pass evidence |
+| `failed` | at least one journey has an attributable FAIL |
+| `not-run` | no evidence, or fewer than eight journeys have pass evidence |
+
+Each journey is recorded as `pass` / `fail` / `not-run` / `manual`. There is no
+`flow-warn` status — a partial run is `not-run`, not a soft pass.
 
 `not-run` is never a pass. Do not publish a pass rate or a grade from FLOW.
 
@@ -44,7 +46,7 @@ and
 The three-layer audit reads FLOW evidence through `--flow-evidence`:
 
 ```sh
-npx dsh-levels audit ./my-plugin --flow-evidence flow.json --format json
+npx -p dsh-standards dsh-levels ./my-plugin --flow-evidence flow.json --format json
 ```
 
 ## Author checklist

package/docs/levels.md

@@ -58,7 +58,7 @@ Start here: [BOOST guide](boost.md) and the canonical
 npx dsh-standards ./my-plugin --scope entry --entry-claim static
 
 # Three-layer audit; FLOW/BOOST are only reported when evidence is supplied
-npx dsh-levels audit ./my-plugin --format json
+npx -p dsh-standards dsh-levels ./my-plugin --format json
 ```
 
 The checker and level audit ship in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-guide",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "A practical guide to DSH plugin quality: ENTRY checks, FLOW checks, and BOOST guidance. Community guide; not official, not a certification, not a ranking.",
   "type": "module",
   "main": "index.js",
@@ -27,8 +27,8 @@
     "test:pack": "npm pack --dry-run"
   },
   "engines": {
-    "node": "^22.19.0 || >=24.0.0",
-    "dsh": ">=0.2.1-0 <0.3.0"
+    "node": ">=24.9.0",
+    "dsh": ">=0.2.2-0 <0.3.0"
   },
   "keywords": [
     "dsh",
@@ -51,7 +51,7 @@
     "url": "https://github.com/PerryLink/dsh-plugin-guide/issues"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": ">=0.2.1-0 <0.3.0"
+    "@deepseek-ai/dsh": ">=0.2.2-0 <0.3.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh": {