dsh-code-review-ai

Deterministic static code review for DeepSeek Harness. Two model tools scan text you hand them — source code or a unified diff — and return severity-tagged, line-anchored findings plus a 0-100 health score.

No LLM call, no subprocess, no filesystem or network access: every check is a pure text heuristic (comment/string-aware line lexing, brace and indentation depth, keyword patterns), so the same input always produces the same report and results are cheap enough to re-run after every edit.

Install

npx -y @deepseek-ai/dsh plugin --profile web add @qingshanjiluo/dsh-code-review-ai

The bundled cordis.patch.yml layer inserts the plugin with the default budgets below; override any field in your profile's config block.

Tools

Tool	Arguments	Result
review_text	code (source text), language (auto or an id such as typescript, python, go)	Findings with 1-based line numbers, per-severity counts, health score, resolved language, scanned line count.
review_diff	diff (unified diff / patch text), language (auto takes each file's language from its path)	Findings for added lines only, anchored to new-side line numbers, plus per-file +/- stats, hunk and added-line counts, health score.

Both tools are pure (isConcurrencySafe) and accept text the caller supplies; the plugin never reads files or runs git itself.

Checks

Rule	Severity	What it catches
merge_conflict	error	<<<<<<< / >>>>>>> markers left in the text.
empty_catch	error	catch (e) {}, except ...: pass — an error that is swallowed.
try_without_handler	error	A try with no matching catch/except/finally in the reviewed text.
deep_nesting	warning	Blocks that nest past maxNestingDepth (brace depth, or indentation levels in Python).
long_block	warning	A top-level block or Python def longer than maxBlockLines.
magic_number	warning	Un-named numeric literals above magicNumberThreshold (UPPER_SNAKE constants, hex, and small integers are exempt).
catch_all	warning	catch (Exception …), bare except:, except Exception: — too broad to be intentional.
leftover_debug	error / warning	debugger statements (error); console.log, System.out.print, println, fmt.Print, var_dump, puts (warning).
none_identity	warning	== None / != None instead of is None / is not None.
todo_comment	warning / info	FIXME, XXX, HACK (warning) and TODO (info) notes, with the comment text quoted.
long_line / legacy_var	info	Lines over maxLineLength; var declarations in brace languages.
unbalanced_braces	warning	Braces still open at end of input, which usually means a fragment was passed.
tests_untouched	info (diff)	The change adds source lines but touches no test file.
large_change / no_newline_eof	info (diff)	More than 400 added lines in one file; a file whose trailing newline was dropped.

Results are sorted by line, capped at 40 findings per rule (a truncated finding names what was suppressed), and bounded to 20 000 scanned lines.

Configuration

Field	Type	Default	Meaning
maxBlockLines	number	60	Largest tolerated top-level block / function.
maxNestingDepth	number	4	Tolerated nesting levels before deep_nesting.
maxLineLength	number	120	Column budget per line.
magicNumberThreshold	number	10	Integers up to this absolute value are idiomatic, not magic.
includeInfo	boolean	true	When false, info findings are dropped from every result.

Example

// review_text
{
  code: 'function handler(req) {\n  const ms = 86400000\n  try { go(req) } catch (e) {}\n}\n',
  language: 'typescript',
}
// -> findings: magic_number (L2), empty_catch (L3); score 89

// review_diff — only "+" lines are reported, at new-side numbers
{
  diff: '--- a/src/a.ts\n+++ b/src/a.ts\n@@ -1,1 +1,2 @@\n export const a = 1\n+const port = 8080\n',
  language: 'auto',
}
// -> files: [{ path: 'src/a.ts', language: 'typescript', added: 1, removed: 0 }]
// -> findings: magic_number (L2) plus a tests_untouched advisory

Development

npm install --no-audit --no-fund
npx tsc --noEmit
npm run build          # lib/index.js + lib/index.d.ts
npx vitest run         # contract + behaviour tests
node scripts/load-smoke.mjs

License

MIT