dsh.so
EN
English中文
Panorama

Steady growth: 29,422 entries (+3,694 this week); 20,483 dsh plugins install-tested, 13,563 runtime-verified on dsh 0.2.1rc5 (66.26%); archive caliber 16 critical, 268 high and 1,083 medium awaiting review.

Metrics 2026-11-11 · Install Vol.10 (frozen 2026-11-03)
Security W46
29,422Indexed entriessince 08-24 +17,755 · incl. unledgered
66.26%L5 runtime pass ratepass 13,563 · Vol.9 74.9% → +-8.61pp
98.04%Test coveragetested 20,483 / dsh plugins 20,893
16 crit / 268 high / 1,083 medRisk exposureW46 archive caliber · 1,083 in review
18,066Unique authorswk +2,555 · 30d active 9,635
+3,694New entries this week11-03 → 11-11
Three ledgers25,442in ledger
25,442ledger
dsh plugins20,89382.12%
Eco-plugins4,05615.94%
Eco-apps4931.94%
Trust ladder L1-L513,56378.96%
L1 Found20,879 · 100.0%
L2 Structured20,872 · 100.0%
L3 Install spec20,879 · 100.0%
L4 Install tested17,177 · 83.9%
L5 Runtime verified13,563 · 79.0%
Security summary15critical · live
15critical · live252high · live1,036medium · live

low 26,406 · pending 359 / 28,068

W33W34W35W36W37W38W39W40W41W42W43W44W45W46
L5 pass rate · by version71.0%→ 79.0%
0.1.2a10.1.3a20.1.7a20.2.1a20.2.1rc5
passedpass rate
Registry size29,422
11.7k17.6k23.5k29.4k
08-2409-2010-1611-11

Date on x, cumulative indexed entries on y, one snapshot per day. The slope is the indexing rate; steep steps come from bulk discovery.

Active authors · 30d9,635
1.1k4.0k6.8k9.6k
08-1709-1710-1511-11

Distinct owners with a commit in the trailing 30 days — a rolling window, not a cumulative total.

npm weekly downloads · 86 pts7,802,934times / wk
1.2M3.4M5.6M7.8M
08-1709-1410-1311-10

Week on x, downloads inside a rolling 7-day window on y — flow, not a cumulative total. Gap days are repaired from their neighbours.

Total stars · 76 pts1,398,214stars · cumulative
268k645k1.0M1.4M
08-1709-1710-1511-11

Stars summed over installable plugins on record that day (eco-apps excluded); new plugins add stars in steps.

Star distribution28,142P50 0 · P99 182
014,509 · 51.56%
16,049 · 21.49%
2–54,763 · 16.92%
6–201,723 · 6.12%
21–100691 · 2.46%
100+407 · 1.45%

Entries per star bucket (0 / 1–5 / 6–20 …) — the long-tail shape. The bigger the leftmost bucket, the more of the registry is newly indexed.

Maintenance pulse21.67%updated ≤7d
6,101 / 21.7%3,651 / 13.0%5,204 / 18.5%13,192 / 46.9%
≤7d8–14d15–30d>30d

Share of entries by time since the last commit — how much of the registry is still under maintenance.

Ecosystem flow11-03 → 11-11
+3,694new entries11-03 → 11-11
+2,555new authors
-5medium1088 → 1083
16critical (archive)W45 → W46
10frozen report volumesVol.1 → Vol.10
Dig deeper → Verification · Growth story · Vol.10 report · data APIs

What changed in the last 8 days — new entries and authors, the medium-tier delta, critical findings opened and cleared. Flow, not stock.

Scenario mix28,148primary domain
28,148entries
Memory & knowledge15.13%
Office & docs9.50%
Files & data9.39%
Models & agents9.17%
Dev workflow8.94%
Connect & integrate8.69%
Web & search8.69%
Look & feel8.16%
Creation & media5.69%
Runtime & terminal4.72%
Security & audit3.17%
Interface add-ons2.82%
Finance & trading2.34%
Workbench1.36%
Fun & life1.30%
Desktop & clients0.85%
Unclassified0.07%

Share per primary scenario domain, one domain per plugin — the shape of what the ecosystem is used for. Eco-apps are excluded.

Caliber: pass rate = L5 pass ÷ (tested − captured eco-apps 15); coverage = tested ÷ dsh plugins; risk verdicts triaged since W38 · Methodology · risk donut & finding categories moved to the Security screen (summarized here by the Security summary card)
Reading

How to read the dashboard

The pages below explain what each chart on the dashboard says and what the current readings mean. Every number is computed at build time from the same data the dashboard uses, so they match panel by panel. No forecasts, no promises.

Panorama: what this ecosystem looks like now

The registry indexes 29,422 entries; the install ledger holds 25,442. The gap is what has not passed L3 or has been delisted. Three ledgers: dsh plugins 20,893, ecosystem plugins 4,056, ecosystem apps 493 — the last group cannot be installed with dsh plugin add, so every ratio uses dsh plugins as the denominator.

Net growth over the last 7 days is 3,694 entries. The indexing curve is a step function, not a smooth slope: most growth arrives in batches from topic discovery — read it as "how big is each step, how often does it land", not as day-to-day deltas.

Active authors 9,635 out of 17,346 ever seen — roughly half the registry committed in the last 30 days. That line peaked in mid-September and has faded since: the August wave is going quiet, while the cumulative count keeps climbing.

Usage: 7,802,934 npm downloads per week, but heavily concentrated — the top package alone is about 11% of it. Structurally, tools & data, memory & knowledge and dev workflow together hold more than half of the top-10 scenario domains; the star distribution is a long tail whose biggest bucket is 0 stars — the shape of a fast-growing registry.

Install ecosystem: the funnel is saturated, one gap remains

Coverage is 20,483 of 20,893 (98.04%): on the current dsh version, nearly every installable plugin has been really tested, so coverage is no longer the bottleneck.

The only real loss is L4→L5: 17,177 install cleanly in the sandbox (83.9%), but only 13,563 actually run (78.96%). Of the failures in between, 85.2% share a single cause: plugin tree failed to load. "Installs but will not load" is the dominant quality problem here — not "cannot install".

Channels differ little: npm packages 6,739 (65.4% verified) versus GitHub source 13,729 (66.7%). npm is slightly better, yet two thirds of the registry still installs from source — so "has an npm package" is not the right bar for recommending a plugin; the L5 result is.

Security: caliber matters more than the tiers

The live four-tier caliber (dynamic conclusion authoritative when present): 15 critical · 252 high · 1,036 medium · 26,406 low over 27,709 scanned of 28,068 in scope, with 359 still pending. Medium-or-worse is 1,303 entries, about 4.7%.

The six-week bars are archive caliber: W33–W37 are raw verdicts, W38 onward is post-triage, and the dashed rule must not be crossed. Critical dropping to zero at W38 is a caliber change, not disappearing risk; today’s 15 critical come from the live four-tier view, with model-audit conclusions folded in.

Dynamic audit: 2,341 plugins hold a model conclusion (578 audits ended without one — no conclusion is not a pass). Against the static tier the model raised 321 and lowered 794 — about 2.5× more corrections than escalations, i.e. static scanning over-reports and the model mostly cleans up. That cuts both ways: the model reads attacker-controlled source, so a lowered tier can be withdrawn by human review (currently 1), and exemptions stay hand-written — the audit script never writes them.

How to use it: critical / high → do not install; medium → open the per-plugin record, read the finding, then decide; pending → treat as "unaudited", never as "safe".

Was this page helpful?