English | ไธญๆ
# @7dgroup/dsh-skill-7d-code-reviewer
**Author: 7DGroup**
A professional, template-driven code review skill plugin for DeepSeek Harness (DSH), developed by the 7DGroup team for AI-assisted code review in any dsh session. Built on TypeScript + Cordis, it installs as a composable bundle and registers the `7d-code-reviewer` skill with `ctx.skills`: a five-step review flow, critical/medium/minor severity grading, four-dimension scoring, and dual text + HTML report output. Zero core changes โ install to enable, remove the bundle row to uninstall.
---
## ๐ Project Info
| Field | Value |
|---|---|
| Author | 7DGroup |
| Version | 0.1.0 |
| Runtime | Node `^22.19.0 || >=24.0.0` ยท pnpm 10+ ยท dsh CLI |
| Supported dsh versions | 0.2.0-rc.2+ (0.2.x) |
| Peer dependencies | `@deepseek-ai/cordis` ยท `@deepseek-ai/dsh-skill` ยท `@deepseek-ai/dsh-invariants` |
| Skill name | `7d-code-reviewer` |
| Repository | [github.com/7dgroup-ai/dsh-skill-7d-code-reviewer](https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer) |
| License | MIT |
## ๐ผ๏ธ Plugin Effect
Skill invocation in a dsh session:
Sample HTML report generated from the pure-placeholder template:
**Core Capabilities**:
- **Template-driven mode** โ separation of concerns: `SKILL.md` decides what to review and how severe it is, `templates/` only presents. The HTML report template stays pure placeholders; all placeholders must be filled, and every dynamic value is HTML-escaped.
- **Five-step review flow** โ accept the task โ quick scan โ line-by-line review (loading `references/` on demand) โ severity grading โ report generation.
- **Three-level severity grading** โ ๐ด critical (must fix) / ๐ก medium (should fix) / ๐ข minor (optional polish).
- **Four-dimension scoring** โ code quality / security / performance / maintainability, each on a 1โ10 scale, plus an overall score and an auto-generated summary.
- **Dual output** โ a text summary for quick reading, plus a full HTML report saved as `code-review-report-{timestamp}.html`.
- **Built-in knowledge base** โ coding standards, security checklist (SQL injection, XSS, authentication/authorization, sensitive-data leaks) and worked review examples, loaded on demand instead of bloating the prompt.
- **Zero core changes** โ pure composable bundle; no patches to the DSH core, safe to install and remove.
**Use Cases**:
- Code review before commit / merge request
- Security audit of existing code
- Quality assessment before refactoring
- Enforcing team coding standards
- Any code quality question inside a dsh conversation
## โ
Features
- โ
Five-step template-driven review flow
- โ
Three-level severity grading with fix suggestions
- โ
Four-dimension scoring rubric (code quality / security / performance / maintainability)
- โ
Text summary + HTML report dual output
- โ
Pure-placeholder HTML report template with mandatory filling rules
- โ
Documented HTML escaping rules for all filled content
- โ
On-demand knowledge base (coding standards / security checklist / review examples)
- โ
No executable scripts ship with the skill
- โ
Installable from GitHub (`github:` shorthand), npm or tarball
- โ
Git-install build is self-contained (`prepare` hook, transpile-only)
## ๐ Project Structure
```
dsh-skill-7d-code-reviewer/
โโโ src/ # source code
โ โโโ index.ts # Cordis plugin: registers the skill provider
โ โโโ invariant.ts # companion plugin: package ownership invariant
โโโ assets/7d-code-reviewer/ # skill resources shipped with the package
โ โโโ SKILL.md # review logic + template selection
โ โโโ references/ # knowledge base, loaded on demand
โ โ โโโ coding-standards.md # naming rules, code complexity
โ โ โโโ security-checklist.md # SQL injection, XSS, auth, leaks
โ โ โโโ review-examples.md # worked review examples
โ โโโ templates/
โ โ โโโ report-template.html # pure-placeholder HTML report
โ โโโ scripts/
โ โโโ html-report-generation.md # HTML escaping rules for filled content
โโโ tests/ # vitest suite
โ โโโ skill-7d-code-reviewer.spec.ts
โโโ screenshots/ # README screenshots
โ โโโ skills.png # skill invocation
โ โโโ report-preview.png # sample HTML report
โโโ cordis.patch.yml # composition patch layer
โโโ tsdown.config.ts # build config (transpile-only)
โโโ 7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz # prebuilt tarball
โโโ package.json
โโโ README.md
```
## ๐ Quick Start
Prerequisites: `dsh` CLI, Node `^22.19.0 || >=24.0.0`, pnpm 10+.
### Install from within a dsh session (recommended)
The most direct way โ just ask the agent in any dsh conversation, and it runs the install for you. Use the GitHub spec โ the npm name `@7dgroup/dsh-skill-7d-code-reviewer` only works after the package is published:
> ๅฎ่ฃ
ๆไปถ github:7dgroup-ai/dsh-skill-7d-code-reviewer
(Or in English: "Install the plugin github:7dgroup-ai/dsh-skill-7d-code-reviewer" โ the agent executes the equivalent `dsh plugin` command through its session shell.)
For a git install the agent will hit the same pnpm `allowBuilds` gate and print the exact key to add to the profile's pnpm settings file (`~/.dsh/profiles//pnpm-workspace.yaml`); after you add it, ask the agent to retry and the skill is enabled.
### Install directly in dsh (CLI)
Run one command directly in dsh โ the `github:` shorthand is the fastest way:
```sh
dsh plugin --profile add github:7dgroup-ai/dsh-skill-7d-code-reviewer
```
`` is the profile you boot with `dsh --profile ` โ see [What is a dsh profile?](#what-is-a-dsh-profile) below for how profiles work, how to pick a name and where the profile files live.
The full URL form is equivalent:
```sh
dsh plugin --profile add git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git
```
`dsh plugin` appends the bundle to the profile's `dsh.profile.bundles`, and the bundle's own patch layer mounts the `skill-7d-code-reviewer` row over the base composition.
pnpm blocks a git dependency's build scripts until explicitly allowed, so the first `add` fails. Copy the exact package key pnpm printed into the profile's pnpm settings file โ `~/.dsh/profiles//pnpm-workspace.yaml` โ then re-run:
```yaml
allowBuilds:
'@7dgroup/dsh-skill-7d-code-reviewer@git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git#': true
```
(With the `github:` shorthand the key reads `@7dgroup/dsh-skill-7d-code-reviewer@github:7dgroup-ai/dsh-skill-7d-code-reviewer#` โ always copy the exact key pnpm prints.)
Allowing a build means letting that package's code run on your machine at install time, outside any agent sandbox. Prefer pinning a commit (`...#`) so later pushes cannot silently change what runs.
### What is a dsh profile?
Every dsh run boots a **profile** โ a named environment whose configuration lives under the harness home in `~/.dsh/profiles/` (or `$DSH_HOME/profiles/` if the `DSH_HOME` env var is set). A profile directory holds:
| File | Purpose |
|---|---|
| `package.json` | Profile manifest: `dsh.profile.bundles` lists the ordered plugin bundles to mount; `dependencies` holds out-of-tree plugins |
| `cordis.patch.yml` | Your own patch layer, applied after every bundle layer |
| `pnpm-workspace.yaml` | pnpm settings for the profile; the `allowBuilds` key goes here |
| `node_modules` | pnpm-managed plugin dependencies |
There is **no default profile** โ `dsh --profile ` is required on every run (`dsh web` is a shorthand for `dsh --profile web`). The shipped `web` and `headless` profiles auto-initialize on first boot; any other name is created automatically the first time you run a `dsh plugin --profile ...` command, which reports where it was created:
```sh
dsh plugin --profile tui add github:7dgroup-ai/dsh-skill-7d-code-reviewer
# dsh: initialized profile tui at ~/.dsh/profiles/tui
```
To see which profiles already exist, list `~/.dsh/profiles/` โ each subdirectory is one profile name. A custom name must be created this way before it can boot: `dsh --profile ` on an unknown custom name fails with the hint `create it with 'dsh plugin --profile add '`.
### Install from tarball (no build approval)
A prebuilt tarball is committed at the repository root โ download it and install directly:
```sh
dsh plugin --profile add ./7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz
```
Or once published on npm:
```sh
dsh plugin --profile add @7dgroup/dsh-skill-7d-code-reviewer
```
Both forms ship prebuilt code and need no `allowBuilds` allowance.
### Recommended setup โ install into the `web` profile
Most sessions boot the default `web` profile (`dsh web` is a shorthand for `dsh --profile web`), so the recommended path is to install the skill there โ no new profile needed:
**Step 0 โ pnpm on PATH.** `dsh plugin` forwards to pnpm in the profile directory, so pnpm must be installed and on PATH:
```sh
corepack prepare pnpm@latest --activate # or: npm install -g pnpm@10
```
**Step 1 โ install via the `github:` shorthand.** A git install runs the package's `prepare` build, which pnpm blocks until explicitly allowed โ so the first `add` fails:
```sh
dsh plugin --profile web add github:7dgroup-ai/dsh-skill-7d-code-reviewer
```
Copy the exact key pnpm prints into `~/.dsh/profiles/web/pnpm-workspace.yaml`:
```yaml
allowBuilds:
'@7dgroup/dsh-skill-7d-code-reviewer@github:7dgroup-ai/dsh-skill-7d-code-reviewer#': true
```
then re-run the same command. Prefer **pinning a commit** โ append `#` to the spec (`github:7dgroup-ai/dsh-skill-7d-code-reviewer#`) so later pushes cannot silently change what runs.
**Prefer no build approval?** Install the prebuilt tarball instead โ it ships ready-to-run code and never hits the `allowBuilds` gate:
```sh
dsh plugin --profile web add ./7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz
```
**After install.** The profile manifest `~/.dsh/profiles/web/package.json` gains the dependency and the bundle row:
```json
{
"name": "dsh-profile-web",
"private": true,
"dependencies": {
"@7dgroup/dsh-skill-7d-code-reviewer": ""
},
"dsh": {
"profile": {
"bundles": [
"@deepseek-ai/dsh-base",
"@deepseek-ai/dsh-web-app",
"@7dgroup/dsh-skill-7d-code-reviewer"
]
}
}
}
```
Nothing else needs editing โ `cordis.patch.yml` stays `[]`, because the bundle's own patch layer mounts the `skill-7d-code-reviewer` row automatically. Verify the mount with `dsh --profile web --dump-config`, restart the session (bundle changes apply on the next boot), then run `/7d-code-reviewer`.
**Using a different profile?** Replace `web` with the name you boot (`dsh --profile `); the skill only activates in the profile it is installed into.
### Build and test
```sh
pnpm install
pnpm build # tsdown; also runs as the `prepare` hook on git installs
pnpm test # vitest
```
## ๐ก Usage
The skill activates whenever you ask for a code review โ either with the slash command or in natural language:
> /7d-code-reviewer Review this module: ...
The five-step review flow:
| Step | What happens |
|---|---|
| 1. Accept the task | Take the submitted code or file paths; determine the language and business context |
| 2. Quick scan | Classify the change (new feature / bugfix / refactor); locate the core files and key logic |
| 3. Line-by-line review | Load the matching references on demand; check naming, security, performance and error handling |
| 4. Severity grading | ๐ด critical โ must fix ยท ๐ก medium โ should fix ยท ๐ข minor โ optional improvement |
| 5. Report generation | Fill the placeholder HTML template; output the text summary plus `code-review-report-{timestamp}.html` |
### Output example (text summary)
```
โ
ไผ็น
- ๅฝๆฐๆๅพๆ็กฎ๏ผ่ฟๅ็จๆทๆฐๆฎ
โ ๏ธ ้ฎ้ข
๐ด ไธฅ้๏ผSQL ๆณจๅ
ฅ้ฃ้ฉ
ไฝ็ฝฎ๏ผget_user() ็ฌฌ 2 ่ก
ๆ่ฟฐ๏ผ็ดๆฅไฝฟ็จ f-string ๆผๆฅ็จๆท่พๅ
ฅๅฐ SQL ่ฏญๅฅ
ๅปบ่ฎฎไฟฎๅค๏ผไฝฟ็จๅๆฐๅๆฅ่ฏข๏ผๅฆ cursor.execute("SELECT * FROM users WHERE id=?", [uid])
๐ ๆปไฝ่ฏๅ๏ผ3/10
ไปฃ็ ่ดจ้: 5/10 | ๅฎๅ
จๆง: 1/10 | ๆง่ฝ: 7/10 | ๅฏ็ปดๆคๆง: 4/10
```
The full HTML report is saved to `code-review-report-{timestamp}.html` and the file path is reported back to you.
## ๐ Grading & Scoring Standards
Severity levels:
| Level | Marker | Definition | Handling |
|---|---|---|---|
| Critical | ๐ด | security vulnerability, crash risk | must fix |
| Medium | ๐ก | performance hazard, logic flaw | should fix |
| Minor | ๐ข | naming, comments | optional improvement |
Dimension scoring (each on a 1โ10 scale):
| Dimension | Excellent (8โ10) | Good (6โ7) | Needs work (4โ5) | Poor (1โ3) |
|---|---|---|---|---|
| Code quality | clear naming, clean structure, no duplication | mostly compliant, minor issues | confusing naming or high complexity | violates coding standards |
| Security | no risk, parameterized queries, full validation | basically safe, small flaws | security hazards | severe vulnerabilities |
| Performance | efficient algorithms, caching, no N+1 | acceptable | obvious problems | severe defects |
| Maintainability | documented, modular, high test coverage | maintainable | missing comments/tests | hard to maintain |
Overall score bands: 9โ10 excellent ยท 7โ8 good ยท 5โ6 fair ยท 3โ4 poor ยท 1โ2 very poor (fix immediately).
## ๐ HTML Report
- **Score circle** โ overall score (1โ10) with an auto-generated summary
- **Issue statistics bar** โ critical / medium / minor counts and good points
- **Dimension score cards** โ code quality / security / performance / maintainability
- **Issues grouped by severity** โ location, description and fix suggestion (with code sample)
- **Good points & improvement suggestions** sections
- Pure-placeholder template โ all placeholders must be filled; every dynamic value is HTML-escaped per `scripts/html-report-generation.md`
- Empty sections follow the no-content rule (e.g. "๐ ๆชๅ็ฐไธฅ้้ฎ้ข๏ผ")
## โ ๏ธ Notes
1. The provider contributes one fixed skill; no runtime customization.
2. Report quality depends on the model following the placeholder-filling and HTML-escaping rules; nothing validates the generated report.
3. The prepared build ships no type declarations; the dsh Loader loads the runtime entry only.
4. The build is transpile-only (`dts: false`) with no lint or typecheck scripts โ type errors surface in the editor/IDE.
5. Commit messages in this repository follow the Simplified Chinese convention: `ใ็ฑปๅใ็ฎ็ญๆ่ฟฐ` (nine fixed type tags).
## โ FAQ
**Q: Why does the first `dsh plugin add` fail?**
A: pnpm refuses to run build scripts of git dependencies until explicitly allowed. Copy the exact package key pnpm printed into the profile's `pnpm-workspace.yaml` โ `allowBuilds`, then re-run.
**Q: How do I pin a specific commit?**
A: Append `#` to the spec, e.g. `git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git#` โ later pushes cannot silently change what runs.
**Q: How do I uninstall?**
A: Run `dsh plugin --profile remove @7dgroup/dsh-skill-7d-code-reviewer` (pnpm removes the dependency and the bundle row is reconciled away), or edit the profile's `package.json` and remove the row from `dsh.profile.bundles`. No core patches are left behind.
**Q: Can I install without approving builds?**
A: Yes โ use the prebuilt tarball (committed at the repository root) or the npm package (once published); neither needs `allowBuilds`.
**Q: Which profile should I install into?**
A: The one you boot โ `dsh --profile ` is required on every run, and the skill only activates in the profile it is installed into. Most sessions boot `web` (`dsh web`), so `dsh plugin --profile web add ...` is the typical command.
**Q: `dsh plugin` fails with "pnpm not found"?**
A: `dsh plugin` forwards to pnpm in the profile directory โ install pnpm and put it on PATH (`corepack prepare pnpm@latest --activate` or `npm install -g pnpm@10`), then re-run.
## ๐ License
[MIT](LICENSE) ยท Copyright (c) 2026 7DGroup