npm:@xmanrui/dsh-im@4.34.2

dsh.manifestVersion is not declared; the reader does not infer a default

{
  "fileCount": 417,
  "unpackedBytes": 21135309,
  "patchPaths": [
    "./cordis.patch.yml"
  ],
  "declaredEnginesDsh": null,
  "shipsSource": true
}

the CLI completed the install with exit code 0

no dependency build script was approved by the verifier; approval permits commands with the host user permissions

{
  "durationMs": 3068,
  "exitCode": 0,
  "declaredPeers": null,
  "bundlesAfterInstall": [
    "@deepseek-ai/dsh-base",
    "@xmanrui/dsh-im"
  ],
  "pendingBuildScripts": [],
  "buildScriptsApproved": 0,
  "diagnosticsLog": null
}

the process was still running when the wall-clock bound reached it and reported no failure diagnostics, so the bundle was neither skipped nor rejected

the fiber phase is not read directly: an early exit with diagnostics is the load-failure signal, and a boot that settles and waits is the success signal

{
  "bootBoundMs": 25000,
  "durationMs": 25053,
  "signal": null
}

the model call was served by the official replay adapter from a fixture authored in this repository; no provider was contacted and no credential was present

probe task, stated verbatim: "reply with any text"

{
  "replayAdapter": "@deepseek-ai/dsh-llm-replay@0.2.0-rc.2",
  "probeTask": "reply with any text",
  "events": {
    "session": "session-ef11223d-acd0-43cf-b035-47666e8c1478",
    "turnEndReason": {
      "kind": "completed"
    },
    "finalText": "Replay fixture: no provider was called.",
    "textEventCount": 1,
    "error": null,
    "exitCode": 0,
    "durationMs": 1808,
    "eventCount": 7
  }
}

1 file(s) larger than 2097152 bytes were not scanned

the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency

static analysis cannot see dynamically constructed code or prove intent

{
  "scannedFiles": 395,
  "scannedBytes": 5440080,
  "skippedFiles": 1
}

no metric moved beyond the significance thresholds; that is the finding

differential attribution: baseline profile first, then the subject activated, same container and order

thresholds are coarse on purpose — order-of-magnitude watcher changes, RSS growth beyond 100 MiB, steady state more than 2 s later

{
  "samples": 6,
  "baseline": {
    "atMs": 8040,
    "rss": 199176192,
    "heapUsed": 68620336,
    "external": 5186663,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activated": {
    "atMs": 8039,
    "rss": 288210944,
    "heapUsed": 118081184,
    "external": 23946431,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 23,
    "libuvActiveHandles": 18,
    "fds": 20
  },
  "delta": {
    "atMs": -1,
    "rss": 89034752,
    "heapUsed": 49460848,
    "external": 18759768,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 1,
    "libuvActiveHandles": 1,
    "fds": 0
  }
}

the profile retains no bundle selection, dependency entry or files for the subject

{
  "residue": [],
  "durationMs": 293
}

{
  "name": "@xmanrui/dsh-im",
  "version": "4.34.2",
  "registry": "https://registry.npmjs.org",
  "tarball": "https://registry.npmjs.org/@xmanrui/dsh-im/-/dsh-im-4.34.2.tgz",
  "advertisedIntegrity": "sha512-6t3Epsq8ZqCqAEhmJzvtBgwjUKC2bBxsfnJj26uqWOAGDt+6jpBlaDZFr/So1RTS0SJ3SbfW9KDJ5verP4iHCQ==",
  "publishedAt": "2026-10-02T19:07:18.009Z"
}

{
  "bytes": 9488652,
  "resolvedIntegrity": "sha512-6t3Epsq8ZqCqAEhmJzvtBgwjUKC2bBxsfnJj26uqWOAGDt+6jpBlaDZFr/So1RTS0SJ3SbfW9KDJ5verP4iHCQ==",
  "advertisedIntegrity": "sha512-6t3Epsq8ZqCqAEhmJzvtBgwjUKC2bBxsfnJj26uqWOAGDt+6jpBlaDZFr/So1RTS0SJ3SbfW9KDJ5verP4iHCQ==",
  "integrityMatchesRegistry": true,
  "sha256": "e3cfc7261bdb373377894a8a5cb134913b6e414903f32438ea67453303d56521"
}

{
  "status": "pass",
  "reasons": [],
  "declared": {
    "manifestVersion": null,
    "bundlePatch": [
      "./cordis.patch.yml"
    ],
    "clientPlatform": "web",
    "enginesDsh": null,
    "enginesNode": ">=22.19"
  },
  "missingPatchPaths": [],
  "fileCount": 417,
  "unpackedBytes": 21135309,
  "shipsSource": true
}

- insert:
    - id: xmanrui-dsh-im
      name: '@xmanrui/dsh-im'

{
  "present": [
    {
      "id": "hooks_system_prompt",
      "confidence": "medium",
      "attribution": "unknown",
      "firstEvidence": {
        "file": "package/plugin-src/host/index.mjs",
        "line": 144,
        "snippet": "ctx.inject(['tools', 'systemPrompt'], (artifactCtx) => {"
      }
    },
    {
      "id": "listens_on_port",
      "confidence": "high",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/channels/wecom-app/callback-server.mjs",
        "line": 123,
        "snippet": "const server = createServer((request, response) => {"
      }
    },
    {
      "id": "network_egress",
      "confidence": "medium",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/channels/dingtalk/connection-error.mjs",
        "line": 54,
        "snippet": "const axios = dingtalkStream ? resolvedPackage('axios', dingtalkStream.require) : null;"
      }
    },
    {
      "id": "reads_secret_env",
      "confidence": "high",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/channels/feishu/config.mjs",
        "line": 12,
        "snippet": "if (process.env.FEISHU_APP_SECRET?.trim()) return process.env.FEISHU_APP_SECRET.trim();"
      }
    },
    {
      "id": "runtime_patch",
      "confidence": "medium",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/channels/feishu/bridge.mjs",
        "line": 3122,
        "snippet": "const response = await this.#client.im.v1.message.patch({"
      }
    },
    {
      "id": "spawns_process",
      "confidence": "high",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "package/src/channels/email/transports/agently-cli.mjs",
        "line": 19,
        "snippet": "import { spawn } from 'node:child_process';"
      }
    },
    {
      "id": "watches_filesystem",
      "confidence": "high",
      "attribution": "author-source",
      "firstEvidence": {
        "file": "pack

Downloading @xmanrui/dsh-im@4.34.2: 0.00 B/9.48 MB
Downloading @img/sharp-libvips-linux-x64@1.3.3: 0.00 B/8.17 MB
Added 1 entry to minimumReleaseAgeExclude in pnpm-workspace.yaml (set minimumReleaseAgeStrict to true to gate these updates with a prompt):
  @xmanrui/dsh-im@4.34.2
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /home/verifier/.local/share/pnpm/store/v11
  Virtual store is at:             node_modules/.pnpm
Packages: +120
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Progress: resolved 120, reused 0, downloaded 123, added 120, done

dependencies:
+ @xmanrui/dsh-im 4.34.2

Done in 1.1s using pnpm v12.8.1
dsh: initialized profile verify at /work/dsh-home/profiles/verify

dsh: warning: 1 entry did not activate
xmanrui-dsh-im (@xmanrui/dsh-im): pending (waiting for service: connection)

Packages: -151
--------------------------------------------------------------------------------

dependencies:
- @xmanrui/dsh-im 4.34.2

Done in 46ms using pnpm v12.8.1

{
  "method": "differential",
  "status": "no-significant-delta",
  "samples": 6,
  "baselineMedian": {
    "atMs": 8040,
    "rss": 199176192,
    "heapUsed": 68620336,
    "external": 5186663,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activatedMedian": {
    "atMs": 8039,
    "rss": 288210944,
    "heapUsed": 118081184,
    "external": 23946431,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 23,
    "libuvActiveHandles": 18,
    "fds": 20
  },
  "delta": {
    "atMs": -1,
    "rss": 89034752,
    "heapUsed": 49460848,
    "external": 18759768,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 1,
    "libuvActiveHandles": 1,
    "fds": 0
  },
  "significant": []
}

{"type":"session","sessionId":"session-ef11223d-acd0-43cf-b035-47666e8c1478","cwd":"/work"}
{"type":"status","phase":"turn_start","turn":1}
{"type":"status","phase":"step_start","turn":1,"step":1}
{"type":"text","text":"Replay fixture: no provider was called."}
{"type":"status","phase":"step_end","turn":1,"step":1}
{"type":"status","phase":"turn_end","turn":1,"reason":{"kind":"completed"}}
{"type":"final","text":"Replay fixture: no provider was called."}
dsh: warning: 1 entry did not activate
xmanrui-dsh-im (@xmanrui/dsh-im): pending (waiting for service: connection)