dsh-plugin-guide 0.4.1 → 0.4.3

package/docs/boost.md

@@ -25,10 +25,18 @@ An evidence card is per practice, per plugin, with a baseline and an after
 measurement. Example shape:
 
 ```yaml
-subject: "@acme/dsh-hello@0.1.0"          # what was measured
-host: "dsh 0.2.2-alpha.2 / cordis 4.0.6-alpha.1 / node 24"
-method: "bench: startup ms and tokens per turn"
-scope: "single machine, 5 runs, synthetic prompt"
+practice: LEV-6
+plugin: "@acme/dsh-hello@0.1.0"
+baseline:
+  startupMs: 180
+  tokensPerTurn: 1200
+after:
+  startupMs: 150
+  tokensPerTurn: 900
+environment:
+  dsh: 0.2.2-alpha.3
+  cordis: 4.0.6-alpha.2
+  node: 24.9
 command: "node bench/hello.mjs"
 result: "startup 180→150 ms; tokens 1200→900"
 negativeControl: "same bench with the plugin disabled"

package/docs/entry.md

@@ -7,6 +7,7 @@ market, index, or user hits.
 
 - package manifest: name, version, license, entry, `dsh.bundle.patch`
 - engines/peer range for the DSH and Cordis generation being claimed
+- Node `>=24.9.0` for the 0.2.2 line; `engines.dsh`, when declared, decides alone since 0.2.1-alpha.4 (prereleases participate)
 - the declared entry point actually resolves
 - the bundle patch parses and its target row resolves
 - display metadata, labels, and forbidden-claim checks
@@ -49,12 +50,15 @@ pass.
 
 - `package.json` has a resolvable entry and, for bundles, a `dsh.bundle.patch`.
 - The patch target row exists; ordered patch arrays are allowed.
-- `engines.dsh` or an `@deepseek-ai/dsh*` peer range is declared.
+- `engines.dsh` or an `@deepseek-ai/dsh*` peer range is declared. For 0.2.2, prefer `>=0.2.2-0 <0.3.0`; npm default semver needs an explicit `^0.2.2-alpha.3` union arm.
 - `dsh.capabilities` lists every host surface the plugin touches (see below).
 - `dsh.labels` is declared when the plugin modifies prompts, runs red-team
   workloads, adds a model provider, exposes remote access, or mirrors another
   project.
 - The license is present; a missing license is advisory, not a fabricated pass.
+- Module scope stays side-effect free: no top-level `await`, timer, `process.on`,
+  fs write, or subprocess spawn. Do that work in `apply()` and clean up with
+  `ctx.effect()`.
 - README says how to install and what it needs.
 - No “official”, “certified”, “secure”, or ranking claim.
 
@@ -82,6 +86,28 @@ Allowed `labels`: `prompt-modification`, `red-team`,
 Do not label a plugin `official`, `verified`, `certified`, `secure`, or
 `audited` — those words are treated as an endorsement claim and fail `DSC-13`.
 
+## Import-time side effects
+
+`DSC-10` is advisory — it never changes the verdict — but it records module-scope
+work that runs before `apply()`: top-level `await`, timers, `process.on`, fs
+writes, and subprocess spawns. The check is scoped to the entry module; the same
+line in a shipped helper script that the entry does not import is not a hit.
+Move the work inside
+`apply()` and tie cleanup to `ctx.effect()`.
+
+```js
+// avoid: this runs when the package is imported, before the host can inject
+writeFileSync(cacheFile, '')
+
+export function apply(ctx) {
+  // prefer: runs when the plugin is applied, with a cleanup hook
+  ctx.effect(() => {
+    mkdirSync(dir, { recursive: true })
+    return () => rmSync(dir, { recursive: true, force: true })
+  })
+}
+```
+
 ## What ENTRY does not do
 
 It is not a security audit, sandbox, full contract audit, market gate, score, or

package/docs/levels.md

@@ -9,6 +9,8 @@
 | **FLOW** | Can a user install, configure, use, upgrade, and remove it without fighting it? | J1–J8 user-journey checks | Yes, where runtime evidence exists; otherwise `not-run` |
 | **BOOST** | Does it use Cordis well? | LEV-1–8 practice library and evidence cards | No plugin-level pass/fail; evidence is per practice |
 
+> **Current baseline (2026-11-04):** DSH `0.2.2-alpha.3` (npm `alpha`), Node `>=24.9.0` (since 0.2.2-alpha.2), Cordis `4.0.6-alpha.2`. `engines.dsh`, when declared, decides alone since 0.2.1-alpha.4; `ctx.menus` is gone in 0.2.2-alpha.3; Typert codecs use `create()` since 0.1.6-alpha.2; `@deepseek-ai/dsh-client-runtime` was removed in 0.1.2-alpha.1 and has no 0.2.x.
+
 ## ENTRY
 
 ENTRY is the compatibility floor. It checks the package shape, entry points,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-guide",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "A practical guide to DSH plugin quality: ENTRY checks, FLOW checks, and BOOST guidance. Community guide; not official, not a certification, not a ranking.",
   "type": "module",
   "main": "index.js",