npm:dsh-pet@0.3.1

dsh.manifestVersion is not declared; the reader does not infer a default

{
  "fileCount": 244,
  "unpackedBytes": 64788596,
  "patchPaths": [
    "./cordis.patch.yml"
  ],
  "declaredEnginesDsh": null,
  "shipsSource": true
}

the CLI completed the install with exit code 0

no dependency build script was approved by the verifier; approval permits commands with the host user permissions

{
  "durationMs": 2390,
  "exitCode": 0,
  "declaredPeers": null,
  "bundlesAfterInstall": [
    "@deepseek-ai/dsh-base",
    "dsh-pet"
  ],
  "pendingBuildScripts": [],
  "buildScriptsApproved": 0,
  "diagnosticsLog": null
}

the process was still running when the wall-clock bound reached it and reported no failure diagnostics, so the bundle was neither skipped nor rejected

the fiber phase is not read directly: an early exit with diagnostics is the load-failure signal, and a boot that settles and waits is the success signal

{
  "bootBoundMs": 25000,
  "durationMs": 25069,
  "signal": null
}

the model call was served by the official replay adapter from a fixture authored in this repository; no provider was contacted and no credential was present

probe task, stated verbatim: "reply with any text"

{
  "replayAdapter": "@deepseek-ai/dsh-llm-replay@0.2.0-rc.2",
  "probeTask": "reply with any text",
  "events": {
    "session": "session-65be6ed5-c274-4986-80c7-d3d328963f15",
    "turnEndReason": {
      "kind": "completed"
    },
    "finalText": "Replay fixture: no provider was called.",
    "textEventCount": 1,
    "error": null,
    "exitCode": 0,
    "durationMs": 1275,
    "eventCount": 7
  }
}

static analysis cannot see dynamically constructed code or prove intent

{
  "scannedFiles": 95,
  "scannedBytes": 1170808,
  "skippedFiles": 0
}

no metric moved beyond the significance thresholds; that is the finding

differential attribution: baseline profile first, then the subject activated, same container and order

thresholds are coarse on purpose — order-of-magnitude watcher changes, RSS growth beyond 100 MiB, steady state more than 2 s later

{
  "samples": 6,
  "baseline": {
    "atMs": 8040,
    "rss": 198942720,
    "heapUsed": 68467064,
    "external": 5188103,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activated": {
    "atMs": 8039,
    "rss": 200863744,
    "heapUsed": 74278352,
    "external": 5174866,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 24,
    "libuvActiveHandles": 19,
    "fds": 20
  },
  "delta": {
    "atMs": -1,
    "rss": 1921024,
    "heapUsed": 5811288,
    "external": -13237,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 2,
    "libuvActiveHandles": 2,
    "fds": 0
  }
}

the profile retains no bundle selection, dependency entry or files for the subject

{
  "residue": [],
  "durationMs": 269
}

{
  "name": "dsh-pet",
  "version": "0.3.1",
  "registry": "https://registry.npmjs.org",
  "tarball": "https://registry.npmjs.org/dsh-pet/-/dsh-pet-0.3.1.tgz",
  "advertisedIntegrity": "sha512-7K8jDdoIT9nCX6HN0xhdcdOVAtSygSArE+zAWSBUfivC+gs6k9Szl7T8ozHfPs/QzOg45YRLLWvZVNZZfewcyQ==",
  "publishedAt": "2026-09-30T07:04:19.661Z"
}

{
  "bytes": 62222739,
  "resolvedIntegrity": "sha512-7K8jDdoIT9nCX6HN0xhdcdOVAtSygSArE+zAWSBUfivC+gs6k9Szl7T8ozHfPs/QzOg45YRLLWvZVNZZfewcyQ==",
  "advertisedIntegrity": "sha512-7K8jDdoIT9nCX6HN0xhdcdOVAtSygSArE+zAWSBUfivC+gs6k9Szl7T8ozHfPs/QzOg45YRLLWvZVNZZfewcyQ==",
  "integrityMatchesRegistry": true,
  "sha256": "c54409ea3d67f582de7dc7bb3d110198ae667a14bca7e27837bbb59690722f35"
}

{
  "status": "pass",
  "reasons": [],
  "declared": {
    "manifestVersion": null,
    "bundlePatch": [
      "./cordis.patch.yml"
    ],
    "clientPlatform": "web",
    "enginesDsh": null,
    "enginesNode": null
  },
  "missingPatchPaths": [],
  "fileCount": 244,
  "unpackedBytes": 64788596,
  "shipsSource": true
}

# ============================================================================
# dsh-pet 的 bundle patch —— 把宠物插件挂进 DSH 配置树
# ============================================================================
#
# 【这是什么】
#   这是 dsh-pet 的"挂载声明"。DSH 启动时按 bundle 层栈把各个插件的
#   patch 叠起来组成配置树。本文件就是 dsh-pet 这一层的内容。
#
# 【工作原理】
#   - insert：往配置树里添加新的插件行（entry）
#   - 每个 entry 有 id（行标识，patch 覆盖时按它定位）和 name（插件模块）
#   - name: 'dsh-pet' 会解析包入口 lib/index.js（宿主半侧）
#   - 因为 package.json 声明了 dsh.client，DSH 的模块系统同时会把
#     这个包扫描为"浏览器插件"，提供 /plugins/dsh-pet/client.js 给页面
#
# ============================================================================

- insert:
    - id: pet                     # 插件行 id（唯一）
      name: 'dsh-pet'             # 模块名：解析到 lib/index.js

{
  "present": [
    {
      "id": "listens_on_port",
      "confidence": "medium",
      "attribution": "unknown",
      "firstEvidence": {
        "file": "package/runtime/electron-helper/main.js",
        "line": 554,
        "snippet": "const server = http.createServer((req, res) => {"
      }
    },
    {
      "id": "network_egress",
      "confidence": "medium",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/host/balance.ts",
        "line": 63,
        "snippet": "return fetch(url, {"
      }
    },
    {
      "id": "spawns_process",
      "confidence": "high",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/host/helper-process.ts",
        "line": 14,
        "snippet": "import { spawn } from 'node:child_process';"
      }
    },
    {
      "id": "writes_outside_workspace",
      "confidence": "low",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/host/helper-process.test.ts",
        "line": 35,
        "snippet": "const savedHome = process.env.DSH_HOME;"
      }
    }
  ],
  "scannedFiles": 95,
  "skippedFiles": 0,
  "limits": [
    "static analysis cannot see dynamically constructed code or prove intent"
  ]
}

Downloading dsh-pet@0.3.1: 0.00 B/62.22 MB
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /home/verifier/.local/share/pnpm/store/v11
  Virtual store is at:             node_modules/.pnpm
Packages: +11
+++++++++++
Progress: resolved 11, reused 0, downloaded 11, added 11, done
[WARN] Issues with peer dependencies found. Run "pnpm peers check" to list them.

dependencies:
+ dsh-pet 0.3.1

Done in 666ms using pnpm v12.8.1
dsh: initialized profile verify at /work/dsh-home/profiles/verify

dsh: warning: 1 entry did not activate
pet (dsh-pet): pending (waiting for service: webServer)

Packages: -11
-----------

dependencies:
- dsh-pet 0.3.1

Done in 15ms using pnpm v12.8.1

{
  "method": "differential",
  "status": "no-significant-delta",
  "samples": 6,
  "baselineMedian": {
    "atMs": 8040,
    "rss": 198942720,
    "heapUsed": 68467064,
    "external": 5188103,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activatedMedian": {
    "atMs": 8039,
    "rss": 200863744,
    "heapUsed": 74278352,
    "external": 5174866,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 24,
    "libuvActiveHandles": 19,
    "fds": 20
  },
  "delta": {
    "atMs": -1,
    "rss": 1921024,
    "heapUsed": 5811288,
    "external": -13237,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 2,
    "libuvActiveHandles": 2,
    "fds": 0
  },
  "significant": []
}

{"type":"session","sessionId":"session-65be6ed5-c274-4986-80c7-d3d328963f15","cwd":"/work"}
{"type":"status","phase":"turn_start","turn":1}
{"type":"status","phase":"step_start","turn":1,"step":1}
{"type":"text","text":"Replay fixture: no provider was called."}
{"type":"status","phase":"step_end","turn":1,"step":1}
{"type":"status","phase":"turn_end","turn":1,"reason":{"kind":"completed"}}
{"type":"final","text":"Replay fixture: no provider was called."}
dsh: warning: 1 entry did not activate
pet (dsh-pet): pending (waiting for service: webServer)