dsh-dep-audit

The most dangerous dependency issues in a dsh plugin supply chain are the ones that never crash a build. A peer range that resolves to nothing on the registry, a latest dist-tag pointing at a stale broken release, an installed version that has silently drifted from what package.json declares, a git or workspace specifier nobody reviewed, a missing license field, a package whose last release was years ago—each one passes local tests and only surfaces in production where the cost of tracing it back is severe. dsh-dep-audit runs a systematic hygiene audit over the entire dependency graph so these issues become visible before they ship.

It performs eight checks—manifest integrity, peer resolvability, dist-tag consistency, source legitimacy, license declaration, freshness, version drift, and version staleness—each graded as fail or warn with a per-item breakdown. The report is pinned to the dsh-dep-audit/v1 schema: stable, machine-readable, and shaped for CI gate logic. Exit codes 0, 1, and 2 cover all-pass, at-least-one-fail, and usage/IO-error respectively, so wiring it into a pipeline takes a single command. Once installed in-harness, an agent can invoke the dep_audit tool directly and fold the audit result back into the conversation.

It serves three audiences: dsh plugin or profile authors who want a pre-release sanity pass on their dependency graph; supply-chain security teams that need a quantifiable, auditable CI threshold; and teams assembling a full security pipeline—dsh-dep-audit covers dependency hygiene, dsh-poison-guard covers malware and obfuscation scanning, and dsh-plugin-doctor covers publish readiness—together spanning the path from clean code to healthy dependencies to shippable output.