npm:@morlay/session-branch@0.1.5

Method limitation. This historical execution used a container with network access and published container paths and replay fixture text. The no-egress and redaction conditions were not met. See the security incident.

sha512-l2H7RhC7Tw9w2sXB0VZ+FdxNKvYtqT4MaGc6j93THglh+OqtD1qrbeR7lVfSLSo609+LCXo5C4q/g3ahd7OcNQ==

Subject

name	`@morlay/session-branch`
version	`0.1.5`
integrity	`sha512-l2H7RhC7Tw9w2sXB0VZ+FdxNKvYtqT4MaGc6j93THglh+OqtD1qrbeR7lVfSLSo609+LCXo5C4q/g3ahd7OcNQ==`
repository	https://github.com/morlay/dsh-plugin.git
declared bundle patch	`null`
declared engines.dsh	`not declared` — declarative and unenforced

Environment

DSH	`0.2.0-rc.2`
Node	`v24.21.0`
OS / arch	`linux 6.17.0-1022-azure x64`
verifier	`dsh-verified 0.1.0` `b07a7e8d0093`
generated	`2026-10-03T15:58:13.711Z`

Dimensions

	status	summary	evidence
`L0`	fail	package.json declares no dsh.bundle.patch, so this is not an installable DSH plugin bundle dsh.manifestVersion is not declared; the reader does not infer a default metrics { "fileCount": 15, "unpackedBytes": 17191, "patchPaths": [], "declaredEnginesDsh": null, "shipsSource": true }	`e-resolve`, `e-tarball`, `e-l0`
`L1`	skip	not run: the subject declares no dsh.bundle.patch, so it installs as a plain dependency that is never composed; running this dimension would measure the absence of the subject rather than the subject a package that is not a bundle cannot be loaded, run, measured or uninstalled as a plugin this dimension was skipped by the L0 pre-filter rather than measured	no evidence cited
`L2`	skip	not run: the subject declares no dsh.bundle.patch, so it installs as a plain dependency that is never composed; running this dimension would measure the absence of the subject rather than the subject a package that is not a bundle cannot be loaded, run, measured or uninstalled as a plugin this dimension was skipped by the L0 pre-filter rather than measured	no evidence cited
`L3`	skip	not run: the subject declares no dsh.bundle.patch, so it installs as a plain dependency that is never composed; running this dimension would measure the absence of the subject rather than the subject a package that is not a bundle cannot be loaded, run, measured or uninstalled as a plugin this dimension was skipped by the L0 pre-filter rather than measured	no evidence cited
`L4`	pass	0 capability signal(s) present across 10 scanned file(s) the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency static analysis cannot see dynamically constructed code or prove intent metrics { "scannedFiles": 10, "scannedBytes": 12949, "skippedFiles": 0 }	`e-l4`
`L5`	skip	not run: the subject declares no dsh.bundle.patch, so it installs as a plain dependency that is never composed; running this dimension would measure the absence of the subject rather than the subject a package that is not a bundle cannot be loaded, run, measured or uninstalled as a plugin this dimension was skipped by the L0 pre-filter rather than measured	no evidence cited
`L6`	skip	not run: the subject declares no dsh.bundle.patch, so it installs as a plain dependency that is never composed; running this dimension would measure the absence of the subject rather than the subject a package that is not a bundle cannot be loaded, run, measured or uninstalled as a plugin this dimension was skipped by the L0 pre-filter rather than measured	no evidence cited

Capability (L4, static)

No capability signature was found in the shipped files.

Capability is not intent. A signature records what the code can reach for, not what it does.

Overhead (L5, dynamic)

No overhead measurement was published for this report.

Evidence

id	kind	artifact
`e-resolve`	command exit 0 429 ms	`resolve @morlay/session-branch@0.1.5 -> @morlay/session-branch@0.1.5` { "name": "@morlay/session-branch", "version": "0.1.5", "registry": "https://registry.npmjs.org", "tarball": "https://registry.npmjs.org/@morlay/session-branch/-/session-branch-0.1.5.tgz", "advertisedIntegrity": "sha512-l2H7RhC7Tw9w2sXB0VZ+FdxNKvYtqT4MaGc6j93THglh+OqtD1qrbeR7lVfSLSo609+LCXo5C4q/g3ahd7OcNQ==", "publishedAt": "2026-10-02T10:52:44.685Z" }
`e-tarball`	artifact exit 0 181 ms	`fetch https://registry.npmjs.org/@morlay/session-branch/-/session-branch-0.1.5.tgz` { "bytes": 5903, "resolvedIntegrity": "sha512-l2H7RhC7Tw9w2sXB0VZ+FdxNKvYtqT4MaGc6j93THglh+OqtD1qrbeR7lVfSLSo609+LCXo5C4q/g3ahd7OcNQ==", "advertisedIntegrity": "sha512-l2H7RhC7Tw9w2sXB0VZ+FdxNKvYtqT4MaGc6j93THglh+OqtD1qrbeR7lVfSLSo609+LCXo5C4q/g3ahd7OcNQ==", "integrityMatchesRegistry": true, "sha256": "1bfe2527e8a1224b9cf65258d057d28d19cfdddf6a67572690d8ebb0fe87bf15" }
`e-l0`	static	`read published package.json and verify declared dsh.bundle.patch paths exist` { "status": "fail", "reasons": [ "package.json declares no dsh.bundle.patch, so this is not an installable DSH plugin bundle" ], "declared": { "manifestVersion": null, "bundlePatch": null, "clientPlatform": null, "enginesDsh": null, "enginesNode": null }, "missingPatchPaths": [], "fileCount": 15, "unpackedBytes": 17191, "shipsSource": true }
`e-l4`	static	`scan 10 shipped source file(s) for capability signatures` { "present": [], "scannedFiles": 10, "skippedFiles": 0, "limits": [ "the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency", "static analysis cannot see dynamically constructed code or prove intent" ] }
`e-l1-install`	command exit 0 2045 ms	`dsh plugin --profile verify add @morlay/session-branch@0.1.5` Progress: resolved 1, reused 0, downloaded 0, added 0 Packages are hard linked from the content-addressable store to the virtual store. Content-addressable store is at: /home/verifier/.local/share/pnpm/store/v11 Virtual store is at: node_modules/.pnpm Packages: +1 + Progress: resolved 1, reused 0, downloaded 1, added 1, done [WARN] Issues with peer dependencies found. Run "pnpm peers check" to list them. dependencies: + @morlay/session-branch 0.1.5 Done in 292ms using pnpm v12.8.1 dsh: initialized profile verify at /work/dsh-home/profiles/verify dsh: warning: @morlay/session-branch declares no dsh.bundle — installed as a plain dependency, not a profile layer
`e-l2-boot`	command exit 0 25066 ms	`dsh --profile verify`
`e-l6-remove`	command exit 0 261 ms	`dsh plugin --profile verify remove @morlay/session-branch` Packages: -1 - dependencies: - @morlay/session-branch 0.1.5 Done in 14ms using pnpm v12.8.1
`e-l5-overhead`	sample	`dsh --profile <baseline\|activated> with the host sampler injected via NODE_OPTIONS=--import` { "method": "differential", "status": "no-significant-delta", "samples": 6, "baselineMedian": { "atMs": 8040, "rss": 199372800, "heapUsed": 68378376, "external": 5188103, "activeTotal": 10, "watchers": 7, "timers": 0, "libuvHandles": 22, "libuvActiveHandles": 17, "fds": 20 }, "activatedMedian": { "atMs": 8039, "rss": 199806976, "heapUsed": 68531224, "external": 5189831, "activeTotal": 11, "watchers": 8, "timers": 0, "libuvHandles": 23, "libuvActiveHandles": 18, "fds": 20 }, "delta": { "atMs": -1, "rss": 434176, "heapUsed": 152848, "external": 1728, "activeTotal": 1, "watchers": 1, "timers": 0, "libuvHandles": 1, "libuvActiveHandles": 1, "fds": 0 }, "significant": [] }
`e-l3-session`	command exit 0 1259 ms	`dsh --profile l3 --patch /work/fixtures/replay/l3-overlay.yml --json reply with any text` {"type":"session","sessionId":"session-755be1b0-6fce-4678-a0c7-9480117b594d","cwd":"/work"} {"type":"status","phase":"turn_start","turn":1} {"type":"status","phase":"step_start","turn":1,"step":1} {"type":"text","text":"Replay fixture: no provider was called."} {"type":"status","phase":"step_end","turn":1,"step":1} {"type":"status","phase":"turn_end","turn":1,"reason":{"kind":"completed"}} {"type":"final","text":"Replay fixture: no provider was called."}

Limits

the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency
static analysis cannot see dynamically constructed code or prove intent
the subject is not an installable plugin bundle, so no execution dimension applies to it
L3 ran against a replayed transcript from a fixture authored by the verifier, not against a provider: it establishes that a session completes without a credential, not that the plugin behaves correctly against a live model
the load result is inferred from exit behaviour and diagnostics rather than a directly read fiber phase
no dependency build script was approved by this executor
overhead is reported only where a delta cleared the significance thresholds; otherwise the result is no-significant-delta
sampling happens inside the host process via NODE_OPTIONS=--import, so process.getActiveResourcesInfo() and process.report.getReport() describe the process under test

Disclaimers

Verification is not a security audit and not an endorsement. It records what was executed and observed on one machine at one time. Absence of a finding is not a finding of absence.

raw report JSON · badge · dispute this report