npm:dsh-pocket@2.10.6

Method limitation. This historical execution used a container with network access and published container paths and replay fixture text. The no-egress and redaction conditions were not met. See the security incident.

sha512-yqybeWWutozi1yBLDpSs6ien9SndFPVNK6HlmhJf8q0AOLauzcLntmFyGQ0/v3EzS3V8ftM4yvqcc/o6LcGcGA==

Subject

name	`dsh-pocket`
version	`2.10.6`
integrity	`sha512-yqybeWWutozi1yBLDpSs6ien9SndFPVNK6HlmhJf8q0AOLauzcLntmFyGQ0/v3EzS3V8ftM4yvqcc/o6LcGcGA==`
repository	git+https://github.com/shaobeichen/dsh-pocket.git
declared bundle patch	`"./cordis.patch.yml"`
declared engines.dsh	`not declared` — declarative and unenforced

Environment

DSH	`0.2.0-rc.2`
Node	`v24.21.0`
OS / arch	`linux 6.17.0-1022-azure x64`
verifier	`dsh-verified 0.1.0` `ec8d77c8d74d`
generated	`2026-10-03T16:30:14.999Z`

Dimensions

	status	summary	evidence
`L0`	pass	declares dsh.bundle.patch and every declared patch path exists (29 files, 528425 bytes unpacked) dsh.manifestVersion is not declared; the reader does not infer a default tarball ships no src/ paths, so capability findings are limited to build output metrics { "fileCount": 29, "unpackedBytes": 528425, "patchPaths": [ "./cordis.patch.yml" ], "declaredEnginesDsh": null, "shipsSource": false }	`e-resolve`, `e-tarball`, `e-l0`
`L1`	pass	installed the CLI completed the install with exit code 0 no dependency build script was approved by the verifier; approval permits commands with the host user permissions metrics { "durationMs": 3280, "exitCode": 0, "declaredPeers": null, "bundlesAfterInstall": [ "@deepseek-ai/dsh-base", "dsh-pocket" ], "pendingBuildScripts": [], "buildScriptsApproved": 0, "diagnosticsLog": null }	`e-l1-install`
`L2`	pass	booted, mounted and stayed alive the process was still running when the wall-clock bound reached it and reported no failure diagnostics, so the bundle was neither skipped nor rejected the fiber phase is not read directly: an early exit with diagnostics is the load-failure signal, and a boot that settles and waits is the success signal metrics { "bootBoundMs": 25000, "durationMs": 25067, "signal": null }	`e-l2-boot`
`L3`	pass	a session completed with no credential the model call was served by the official replay adapter from a fixture authored in this repository; no provider was contacted and no credential was present probe task, stated verbatim: "reply with any text" metrics { "replayAdapter": "@deepseek-ai/dsh-llm-replay@0.2.0-rc.2", "probeTask": "reply with any text", "events": { "session": "session-cfe09871-d850-4cb9-b158-61786b26ef03", "turnEndReason": { "kind": "completed" }, "finalText": "Replay fixture: no provider was called.", "textEventCount": 1, "error": null, "exitCode": 0, "durationMs": 1247, "eventCount": 7 } }	`e-l3-session`
`L4`	pass	5 capability signal(s) present across 23 scanned file(s) the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency static analysis cannot see dynamically constructed code or prove intent metrics { "scannedFiles": 23, "scannedBytes": 469759, "skippedFiles": 0 }	`e-l4`, `e-patch`
`L5`	pass	no significant delta across 6 sampled run(s) no metric moved beyond the significance thresholds; that is the finding differential attribution: baseline profile first, then the subject activated, same container and order thresholds are coarse on purpose — order-of-magnitude watcher changes, RSS growth beyond 100 MiB, steady state more than 2 s later metrics { "samples": 6, "baseline": { "atMs": 8037, "rss": 199614464, "heapUsed": 68418328, "external": 5188103, "activeTotal": 10, "watchers": 7, "timers": 0, "libuvHandles": 22, "libuvActiveHandles": 17, "fds": 20 }, "activated": { "atMs": 8039, "rss": 200163328, "heapUsed": 71356000, "external": 5238689, "activeTotal": 11, "watchers": 8, "timers": 0, "libuvHandles": 23, "libuvActiveHandles": 18, "fds": 20 }, "delta": { "atMs": 2, "rss": 548864, "heapUsed": 2937672, "external": 50586, "activeTotal": 1, "watchers": 1, "timers": 0, "libuvHandles": 1, "libuvActiveHandles": 1, "fds": 0 } }	`e-l5-overhead`
`L6`	pass	removed without residue the profile retains no bundle selection, dependency entry or files for the subject metrics { "residue": [], "durationMs": 266 }	`e-l6-remove`

Capability (L4, static)

capability	confidence	attribution	first evidence
`listens_on_port`	medium	unknown	`package/lib/proxy.mjs:717`
`network_egress`	medium	unknown	`package/lib/web-rpc.js:71`
`runtime_patch`	medium	unknown	`package/lib/proxy.mjs:52`
`spawns_process`	medium	unknown	`package/lib/index.js:13`
`writes_outside_workspace`	low	unknown	`package/lib/index.js:82`

Capability is not intent. A signature records what the code can reach for, not what it does.

Overhead (L5, dynamic)

{
  "status": "no-significant-delta",
  "samples": 6,
  "baseline": {
    "atMs": 8037,
    "rss": 199614464,
    "heapUsed": 68418328,
    "external": 5188103,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activated": {
    "atMs": 8039,
    "rss": 200163328,
    "heapUsed": 71356000,
    "external": 5238689,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 23,
    "libuvActiveHandles": 18,
    "fds": 20
  },
  "delta": {
    "atMs": 2,
    "rss": 548864,
    "heapUsed": 2937672,
    "external": 50586,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 1,
    "libuvActiveHandles": 1,
    "fds": 0
  },
  "significant": []
}

Evidence

id	kind	artifact
`e-resolve`	command exit 0 184 ms	`resolve dsh-pocket@2.10.6 -> dsh-pocket@2.10.6` { "name": "dsh-pocket", "version": "2.10.6", "registry": "https://registry.npmjs.org", "tarball": "https://registry.npmjs.org/dsh-pocket/-/dsh-pocket-2.10.6.tgz", "advertisedIntegrity": "sha512-yqybeWWutozi1yBLDpSs6ien9SndFPVNK6HlmhJf8q0AOLauzcLntmFyGQ0/v3EzS3V8ftM4yvqcc/o6LcGcGA==", "publishedAt": "2026-09-10T14:57:55.747Z" }
`e-tarball`	artifact exit 0 36 ms	`fetch https://registry.npmjs.org/dsh-pocket/-/dsh-pocket-2.10.6.tgz` { "bytes": 168943, "resolvedIntegrity": "sha512-yqybeWWutozi1yBLDpSs6ien9SndFPVNK6HlmhJf8q0AOLauzcLntmFyGQ0/v3EzS3V8ftM4yvqcc/o6LcGcGA==", "advertisedIntegrity": "sha512-yqybeWWutozi1yBLDpSs6ien9SndFPVNK6HlmhJf8q0AOLauzcLntmFyGQ0/v3EzS3V8ftM4yvqcc/o6LcGcGA==", "integrityMatchesRegistry": true, "sha256": "3f611b8115d09bf4ed803378bc2e1b81547f7988dbd29c2d1fe241b411f12055" }
`e-l0`	static	`read published package.json and verify declared dsh.bundle.patch paths exist` { "status": "pass", "reasons": [], "declared": { "manifestVersion": null, "bundlePatch": [ "./cordis.patch.yml" ], "clientPlatform": "web", "enginesDsh": null, "enginesNode": ">=22" }, "missingPatchPaths": [], "fileCount": 29, "unpackedBytes": 528425, "shipsSource": false }
`e-patch`	static	`read cordis.patch.yml` # dsh-pocket bundle patch（dsh.bundle manifest 要求的加载配置） # 单包单插件：装一次，设置页「手机访问」全部功能到位。 - insert: - id: dsh-pocket name: dsh-pocket
`e-l4`	static	`scan 23 shipped source file(s) for capability signatures` { "present": [ { "id": "listens_on_port", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/proxy.mjs", "line": 717, "snippet": "const server = createServer((req, res) => {" } }, { "id": "network_egress", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/web-rpc.js", "line": 71, "snippet": "async fetch(request) {" } }, { "id": "runtime_patch", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/proxy.mjs", "line": 52, "snippet": "export const TRANSPORT_API_CLIENT_SHIM = `<script data-dsh-pocket-transport-shim=\"1\">!function(){try{var K='__DSH_TRANSPORT__',cur=globalThis[K];function patch(t){try{if(t&&typeof t==='object'&&typeof…" } }, { "id": "spawns_process", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/index.js", "line": 13, "snippet": "import { spawn } from 'node:child_process';" } }, { "id": "writes_outside_workspace", "confidence": "low", "attribution": "unknown", "firstEvidence": { "file": "package/lib/index.js", "line": 82, "snippet": "return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), tokenRel);" } } ], "scannedFiles": 23, "skippedFiles": 0, "limits": [ "the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency", "static analysis cannot see dynamically constructed code or prove intent" ] }
`e-l1-install`	command exit 0 3280 ms	`dsh plugin --profile verify add dsh-pocket@2.10.6` Progress: resolved 0, reused 0, downloaded 1, added 0 Packages are hard linked from the content-addressable store to the virtual store. Content-addressable store is at: /home/verifier/.local/share/pnpm/store/v11 Virtual store is at: node_modules/.pnpm Packages: +31 +++++++++++++++++++++++++++++++ Progress: resolved 31, reused 0, downloaded 31, added 31, done [WARN] Issues with peer dependencies found. Run "pnpm peers check" to list them. dependencies: + dsh-pocket 2.10.6 Done in 446ms using pnpm v12.8.1 dsh: initialized profile verify at /work/dsh-home/profiles/verify
`e-l2-boot`	command exit 0 25067 ms	`dsh --profile verify` dsh: warning: 1 entry did not activate dsh-pocket (dsh-pocket): pending (waiting for services: connection, webServer)
`e-l6-remove`	command exit 0 266 ms	`dsh plugin --profile verify remove dsh-pocket` Packages: -31 ------------------------------- dependencies: - dsh-pocket 2.10.6 Done in 15ms using pnpm v12.8.1
`e-l5-overhead`	sample	`dsh --profile <baseline\|activated> with the host sampler injected via NODE_OPTIONS=--import` { "method": "differential", "status": "no-significant-delta", "samples": 6, "baselineMedian": { "atMs": 8037, "rss": 199614464, "heapUsed": 68418328, "external": 5188103, "activeTotal": 10, "watchers": 7, "timers": 0, "libuvHandles": 22, "libuvActiveHandles": 17, "fds": 20 }, "activatedMedian": { "atMs": 8039, "rss": 200163328, "heapUsed": 71356000, "external": 5238689, "activeTotal": 11, "watchers": 8, "timers": 0, "libuvHandles": 23, "libuvActiveHandles": 18, "fds": 20 }, "delta": { "atMs": 2, "rss": 548864, "heapUsed": 2937672, "external": 50586, "activeTotal": 1, "watchers": 1, "timers": 0, "libuvHandles": 1, "libuvActiveHandles": 1, "fds": 0 }, "significant": [] }
`e-l3-session`	command exit 0 1247 ms	`dsh --profile l3 --patch /work/fixtures/replay/l3-overlay.yml --json reply with any text` {"type":"session","sessionId":"session-cfe09871-d850-4cb9-b158-61786b26ef03","cwd":"/work"} {"type":"status","phase":"turn_start","turn":1} {"type":"status","phase":"step_start","turn":1,"step":1} {"type":"text","text":"Replay fixture: no provider was called."} {"type":"status","phase":"step_end","turn":1,"step":1} {"type":"status","phase":"turn_end","turn":1,"reason":{"kind":"completed"}} {"type":"final","text":"Replay fixture: no provider was called."} dsh: warning: 1 entry did not activate dsh-pocket (dsh-pocket): pending (waiting for services: connection, webServer)

Limits

the artifact ships no source paths, so capability findings describe build output only; code-level attribution between the author and inlined dependencies is not resolvable from this artifact
the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency
static analysis cannot see dynamically constructed code or prove intent
L3 ran against a replayed transcript from a fixture authored by the verifier, not against a provider: it establishes that a session completes without a credential, not that the plugin behaves correctly against a live model
the load result is inferred from exit behaviour and diagnostics rather than a directly read fiber phase
no dependency build script was approved by this executor
overhead is reported only where a delta cleared the significance thresholds; otherwise the result is no-significant-delta
sampling happens inside the host process via NODE_OPTIONS=--import, so process.getActiveResourcesInfo() and process.report.getReport() describe the process under test

Disclaimers

Verification is not a security audit and not an endorsement. It records what was executed and observed on one machine at one time. Absence of a finding is not a finding of absence.

raw report JSON · badge · dispute this report