dsh-standards 0.0.3 → 1.0.0

package/40-checker/results/webruntime/DDDMUC__dsh-free-search/probe.json

@@ -0,0 +1,129 @@
+{
+  "schema": "dsh-web-probe/1",
+  "ok": true,
+  "expected": [
+    "dsh-free-search"
+  ],
+  "expectedEntries": {
+    "dsh-free-search": true
+  },
+  "bootGraph": "ok",
+  "bootRev": "b7d64cb39e5f",
+  "bootIds": [
+    "@deepseek-ai/dsh-api-gateway",
+    "@deepseek-ai/dsh-client-ui-open-in-app",
+    "@deepseek-ai/dsh-api-job-controller",
+    "@deepseek-ai/dsh-api-terminal-controller",
+    "@deepseek-ai/dsh-api-workspace-files",
+    "@deepseek-ai/dsh-client-ui-settings-account",
+    "@deepseek-ai/dsh-client-hmr",
+    "@deepseek-ai/dsh-client-modules",
+    "@deepseek-ai/dsh-cordis-client-runner",
+    "@deepseek-ai/dsh-client-ui-theme",
+    "@deepseek-ai/dsh-client-locale",
+    "@deepseek-ai/dsh-client-shortcuts",
+    "@deepseek-ai/dsh-client-ui-shortcuts",
+    "@deepseek-ai/dsh-client-ui-layout",
+    "@deepseek-ai/dsh-client-ui-renderer",
+    "@deepseek-ai/dsh-client-ui-session",
+    "@deepseek-ai/dsh-client-resources",
+    "@deepseek-ai/dsh-client-ui-sidebar",
+    "@deepseek-ai/dsh-client-ui-sidebar-right",
+    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview",
+    "@deepseek-ai/dsh-client-ui-sidebar-terminal",
+    "@deepseek-ai/dsh-client-ui-sidebar-files",
+    "@deepseek-ai/dsh-client-ui-settings",
+    "@deepseek-ai/dsh-client-ui-settings-general",
+    "@deepseek-ai/dsh-client-ui-settings-models",
+    "@deepseek-ai/dsh-client-ui-plugin-manager",
+    "@deepseek-ai/dsh-client-ui-settings-plugin-inventory",
+    "@deepseek-ai/dsh-client-ui-conversation",
+    "@deepseek-ai/dsh-client-ui-approval",
+    "@deepseek-ai/dsh-message-quotes",
+    "@deepseek-ai/dsh-client-ui-chat",
+    "@deepseek-ai/dsh-client-ui-brand-official",
+    "@deepseek-ai/dsh-client-ui-attachment",
+    "@deepseek-ai/dsh-client-ui-file-drag",
+    "@deepseek-ai/dsh-client-ui-tool",
+    "@deepseek-ai/dsh-client-ui-cordis",
+    "@deepseek-ai/dsh-client-ui-workspace",
+    "@deepseek-ai/dsh-client-ui-workflow-run",
+    "@deepseek-ai/dsh-client-ui-input-trigger",
+    "@deepseek-ai/dsh-client-ui-commands",
+    "@deepseek-ai/dsh-client-ui-skill",
+    "@deepseek-ai/dsh-client-ui-subagent",
+    "@deepseek-ai/dsh-client-ui-reference",
+    "@deepseek-ai/dsh-client-ui-secret-mask",
+    "@deepseek-ai/dsh-client-ui-jobs",
+    "@deepseek-ai/dsh-client-ui-schedule",
+    "@deepseek-ai/dsh-client-ui-goal",
+    "@deepseek-ai/dsh-client-ui-message-feedback",
+    "@deepseek-ai/dsh-client-ui-model-selection",
+    "@deepseek-ai/dsh-client-ui-permission-presets",
+    "@deepseek-ai/dsh-client-ui-agent-preset",
+    "@deepseek-ai/dsh-client-ui-entry-customization",
+    "@deepseek-ai/dsh-client-ui-settings-session-log",
+    "@deepseek-ai/dsh-client-ui-settings-plugins",
+    "@deepseek-ai/dsh-client-ui-settings-shell",
+    "@deepseek-ai/dsh-client-ui-settings-agent-loop",
+    "@deepseek-ai/dsh-client-ui-settings-subagent",
+    "@deepseek-ai/dsh-client-ui-settings-web-search",
+    "@deepseek-ai/dsh-client-ui-plan",
+    "@deepseek-ai/dsh-client-ui-user-questions",
+    "@deepseek-ai/dsh-client-ui-trajectory",
+    "@deepseek-ai/dsh-api-remote-access",
+    "@deepseek-ai/dsh-session-log-export",
+    "@deepseek-ai/dsh-client-file-upload",
+    "@deepseek-ai/dsh-api-remotes",
+    "@deepseek-ai/dsh-client-ui-deliverables",
+    "dsh-free-search",
+    "@deepseek-ai/dsh-typert-registry",
+    "@deepseek-ai/dsh-client-connection",
+    "@deepseek-ai/dsh-api-workspace-controller",
+    "@deepseek-ai/dsh-api-session-controller",
+    "@deepseek-ai/dsh-client-ui-directory-picker-browse"
+  ],
+  "loadedEntries": [
+    "dsh-free-search"
+  ],
+  "notLoadedEntries": [],
+  "missingEntries": [],
+  "entries": [
+    {
+      "id": "dsh-free-search",
+      "booted": true,
+      "loaded": true,
+      "url": "plugins/??dsh-free-search/client.js&rev=5dc786dc1f56",
+      "matchedResource": "http://127.0.0.1:18770/plugins/??@deepseek-ai/dsh-client-ui-plan/client.js,@deepseek-ai/dsh-client-ui-user-questions/client.js,@deepseek-ai/dsh-client-ui-trajectory/client.js,@deepseek-ai/dsh-api-remote-access/client.js,@deepseek-ai/dsh-session-log-export/client.js,@deepseek-ai/dsh-client-file-upload/client.js,@deepseek-ai/dsh-api-remotes/client.js,@deepseek-ai/dsh-client-ui-deliverables/client.js,dsh-free-search/client.js,@deepseek-ai/dsh-typert-registry/client.js,@deepseek-ai/dsh-client-connection/client.js,@deepseek-ai/dsh-api-workspace-controller/client.js,@deepseek-ai/dsh-api-session-controller/client.js,@deepseek-ai/dsh-client-ui-directory-picker-browse/client.js&rev=b023bcac698c"
+    }
+  ],
+  "consoleErrors": [],
+  "consoleWarnings": [],
+  "pageErrors": [],
+  "failedRequests": [],
+  "login": false,
+  "loginError": null,
+  "navigationStatus": 200,
+  "finalUrl": "http://127.0.0.1:18770/",
+  "title": "DeepSeek Harness",
+  "rootChildren": 1,
+  "bootPageVisible": false,
+  "bootPageText": "",
+  "bodyTextLength": 940,
+  "bodyText": "New Session\nPlugins\nAutomation tasks\nMore\nWorkspaces\nNo sessions yet\nMore\nInto the Unknown\nPreview\nChoose workspace\nStandard mode\nChoose a workspace to start\nPreview Notice\n\nDeepSeek Harness 0.2 is still in preview, and many areas need continued improvement and refinement. We welcome feedback and suggestions from all developers and users. The new desktop app now targets a broad range of users, while developer-related advanced features can be enabled in the settings. DeepSeek Harness’s product features and plugin APIs are expected to continue rapid iteration and evolution, and will gradually stabilize over time.\n\nWe look forward to exploring the limits of intelligence together with users and developers around the world, building on open-source, reusable, and composable infrastructure. We welcome everyone to bring their ideas to life with DeepSeek Harness and participate in the community to enrich the plugin ecosystem.\n\nContinue",
+  "screenshot": "/home/runner/work/dsh-standards/dsh-standards/40-checker/results/webruntime/DDDMUC__dsh-free-search/shot.png",
+  "elapsedMs": 1932,
+  "error": null,
+  "url": "http://127.0.0.1:18770/?token=<redacted>",
+  "generatedAt": "2026-10-31T16:11:54.714Z",
+  "id": "DDDMUC__dsh-free-search",
+  "pkg": "dsh-free-search",
+  "webapp": false,
+  "hasClient": true,
+  "clientClaim": true,
+  "skipped": null,
+  "installed": {
+    "name": "dsh-free-search",
+    "version": "0.9.26"
+  }
+}

package/40-checker/results/webruntime/DDDMUC__dsh-free-search/summary.md

@@ -0,0 +1,16 @@
+# DDDMUC__dsh-free-search
+
+- package: `dsh-free-search`
+- webapp: false
+- client export: yes
+- ok: yes
+- bootGraph: ok
+- expected: dsh-free-search
+- loadedEntries: dsh-free-search
+- missingEntries: (none)
+- notLoadedEntries: (none)
+- consoleErrors: 0
+- pageErrors: 0
+- failedRequests: 0
+- rootChildren: 1
+- bootPageVisible: false

package/40-checker/results/webruntime/Ebony-Vinyl__dsh-our-free-model/client-export.json

@@ -0,0 +1,7 @@
+{
+  "name": "dsh-our-free-model",
+  "version": "2.1.0",
+  "hasClientExport": true,
+  "clientExport": "./client.js",
+  "declaresDshClient": true
+}

package/40-checker/results/webruntime/Ebony-Vinyl__dsh-our-free-model/installed-package.json

@@ -0,0 +1,76 @@
+{
+  "name": "dsh-our-free-model",
+  "version": "2.1.0",
+  "type": "module",
+  "description": "Our Free Model — 在 dsh 里装上这个插件即可，无需登录、注册或填 API Key，就能使用包括 DeepSeek V4.1 Flash、Kimi K3 在内的前沿模型，桌面端另有 EAC 协付渠道；2.0 起接入 CodeArts、CodeBuddy、WorkBuddy、LobsterAI、Qoder、TRAE、Cline、Loomy、Raccoon、MiniMax、ZCode、Gemini 十三个账号渠道（原有匿名免费通道保留）（登录、账号池、积分领取、本地 OpenAI 网关与局域网转发、数据看板与运行日志），六页毛玻璃界面统一呈现。",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "scripts": {
+    "pack:standalone": "node scripts/pack-standalone.mjs",
+    "test:package": "node scripts/standalone-package-test.mjs",
+    "start:standalone": "node packages/standalone/cli.mjs",
+    "test:standalone": "node scripts/standalone-test.mjs",
+    "test:management": "node scripts/standalone-management-test.mjs",
+    "build:standalone-channels": "node scripts/build-standalone-channels.mjs",
+    "build:standalone-ui": "node scripts/build-standalone-ui.mjs",
+    "typecheck:standalone": "npm --prefix packages/standalone run typecheck",
+    "test:standalone-channels": "node scripts/standalone-channels-test.mjs",
+    "test": "node scripts/test-all.mjs",
+    "test:contributor": "node scripts/test-all.mjs --mode contributor",
+    "test:release": "node scripts/test-all.mjs --mode release",
+    "manifest": "node scripts/build-manifest.mjs",
+    "channel-pack": "node scripts/build-channel-pack.mjs",
+    "manifest:check": "node scripts/build-manifest.mjs --check",
+    "selftest": "node scripts/host-selftest.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "adapter",
+    "src",
+    "vendor/channel-pack/pack.js",
+    "vendor/channel-pack/qoder-auth-wasm.wasm",
+    "vendor/channel-pack/NOTICE.md",
+    "vendor/channel-pack/LICENSE",
+    "locale",
+    "icon.svg",
+    "cordis.patch.yml",
+    "LICENSE"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "free-model",
+    "llm-provider"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": []
+    }
+  },
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-commands": "^0.1.2-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.2-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.4"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.2"
+  }
+}

package/40-checker/results/webruntime/Ebony-Vinyl__dsh-our-free-model/probe.json

@@ -0,0 +1,129 @@
+{
+  "schema": "dsh-web-probe/1",
+  "ok": true,
+  "expected": [
+    "dsh-our-free-model"
+  ],
+  "expectedEntries": {
+    "dsh-our-free-model": true
+  },
+  "bootGraph": "ok",
+  "bootRev": "902d1016dca0",
+  "bootIds": [
+    "@deepseek-ai/dsh-api-gateway",
+    "@deepseek-ai/dsh-client-ui-open-in-app",
+    "@deepseek-ai/dsh-api-job-controller",
+    "@deepseek-ai/dsh-api-terminal-controller",
+    "@deepseek-ai/dsh-api-workspace-files",
+    "@deepseek-ai/dsh-client-ui-settings-account",
+    "@deepseek-ai/dsh-client-hmr",
+    "@deepseek-ai/dsh-client-modules",
+    "@deepseek-ai/dsh-cordis-client-runner",
+    "@deepseek-ai/dsh-client-ui-theme",
+    "@deepseek-ai/dsh-client-locale",
+    "@deepseek-ai/dsh-client-shortcuts",
+    "@deepseek-ai/dsh-client-ui-shortcuts",
+    "@deepseek-ai/dsh-client-ui-layout",
+    "@deepseek-ai/dsh-client-ui-renderer",
+    "@deepseek-ai/dsh-client-ui-session",
+    "@deepseek-ai/dsh-client-resources",
+    "@deepseek-ai/dsh-client-ui-sidebar",
+    "@deepseek-ai/dsh-client-ui-sidebar-right",
+    "@deepseek-ai/dsh-client-ui-sidebar-documentpreview",
+    "@deepseek-ai/dsh-client-ui-sidebar-terminal",
+    "@deepseek-ai/dsh-client-ui-sidebar-files",
+    "@deepseek-ai/dsh-client-ui-settings",
+    "@deepseek-ai/dsh-client-ui-settings-general",
+    "@deepseek-ai/dsh-client-ui-settings-models",
+    "@deepseek-ai/dsh-client-ui-plugin-manager",
+    "@deepseek-ai/dsh-client-ui-settings-plugin-inventory",
+    "@deepseek-ai/dsh-client-ui-conversation",
+    "@deepseek-ai/dsh-client-ui-approval",
+    "@deepseek-ai/dsh-message-quotes",
+    "@deepseek-ai/dsh-client-ui-chat",
+    "@deepseek-ai/dsh-client-ui-brand-official",
+    "@deepseek-ai/dsh-client-ui-attachment",
+    "@deepseek-ai/dsh-client-ui-file-drag",
+    "@deepseek-ai/dsh-client-ui-tool",
+    "@deepseek-ai/dsh-client-ui-cordis",
+    "@deepseek-ai/dsh-client-ui-workspace",
+    "@deepseek-ai/dsh-client-ui-workflow-run",
+    "@deepseek-ai/dsh-client-ui-input-trigger",
+    "@deepseek-ai/dsh-client-ui-commands",
+    "@deepseek-ai/dsh-client-ui-skill",
+    "@deepseek-ai/dsh-client-ui-subagent",
+    "@deepseek-ai/dsh-client-ui-reference",
+    "@deepseek-ai/dsh-client-ui-secret-mask",
+    "@deepseek-ai/dsh-client-ui-jobs",
+    "@deepseek-ai/dsh-client-ui-schedule",
+    "@deepseek-ai/dsh-client-ui-goal",
+    "@deepseek-ai/dsh-client-ui-message-feedback",
+    "@deepseek-ai/dsh-client-ui-model-selection",
+    "@deepseek-ai/dsh-client-ui-permission-presets",
+    "@deepseek-ai/dsh-client-ui-agent-preset",
+    "@deepseek-ai/dsh-client-ui-entry-customization",
+    "@deepseek-ai/dsh-client-ui-settings-session-log",
+    "@deepseek-ai/dsh-client-ui-settings-plugins",
+    "@deepseek-ai/dsh-client-ui-settings-shell",
+    "@deepseek-ai/dsh-client-ui-settings-agent-loop",
+    "@deepseek-ai/dsh-client-ui-settings-subagent",
+    "@deepseek-ai/dsh-client-ui-settings-web-search",
+    "@deepseek-ai/dsh-client-ui-plan",
+    "@deepseek-ai/dsh-client-ui-user-questions",
+    "@deepseek-ai/dsh-client-ui-trajectory",
+    "@deepseek-ai/dsh-api-remote-access",
+    "@deepseek-ai/dsh-session-log-export",
+    "@deepseek-ai/dsh-client-file-upload",
+    "@deepseek-ai/dsh-api-remotes",
+    "@deepseek-ai/dsh-client-ui-deliverables",
+    "dsh-our-free-model",
+    "@deepseek-ai/dsh-typert-registry",
+    "@deepseek-ai/dsh-client-connection",
+    "@deepseek-ai/dsh-api-workspace-controller",
+    "@deepseek-ai/dsh-api-session-controller",
+    "@deepseek-ai/dsh-client-ui-directory-picker-browse"
+  ],
+  "loadedEntries": [
+    "dsh-our-free-model"
+  ],
+  "notLoadedEntries": [],
+  "missingEntries": [],
+  "entries": [
+    {
+      "id": "dsh-our-free-model",
+      "booted": true,
+      "loaded": true,
+      "url": "plugins/??dsh-our-free-model/client.js&rev=edead09bd873",
+      "matchedResource": "http://127.0.0.1:18770/plugins/??@deepseek-ai/dsh-client-ui-plan/client.js,@deepseek-ai/dsh-client-ui-user-questions/client.js,@deepseek-ai/dsh-client-ui-trajectory/client.js,@deepseek-ai/dsh-api-remote-access/client.js,@deepseek-ai/dsh-session-log-export/client.js,@deepseek-ai/dsh-client-file-upload/client.js,@deepseek-ai/dsh-api-remotes/client.js,@deepseek-ai/dsh-client-ui-deliverables/client.js,dsh-our-free-model/client.js,@deepseek-ai/dsh-typert-registry/client.js,@deepseek-ai/dsh-client-connection/client.js,@deepseek-ai/dsh-api-workspace-controller/client.js,@deepseek-ai/dsh-api-session-controller/client.js,@deepseek-ai/dsh-client-ui-directory-picker-browse/client.js&rev=5bf7c7c950ce"
+    }
+  ],
+  "consoleErrors": [],
+  "consoleWarnings": [],
+  "pageErrors": [],
+  "failedRequests": [],
+  "login": false,
+  "loginError": null,
+  "navigationStatus": 200,
+  "finalUrl": "http://127.0.0.1:18770/",
+  "title": "DeepSeek Harness",
+  "rootChildren": 1,
+  "bootPageVisible": false,
+  "bootPageText": "",
+  "bodyTextLength": 940,
+  "bodyText": "New Session\nPlugins\nAutomation tasks\nMore\nWorkspaces\nNo sessions yet\nMore\nInto the Unknown\nPreview\nChoose workspace\nStandard mode\nChoose a workspace to start\nPreview Notice\n\nDeepSeek Harness 0.2 is still in preview, and many areas need continued improvement and refinement. We welcome feedback and suggestions from all developers and users. The new desktop app now targets a broad range of users, while developer-related advanced features can be enabled in the settings. DeepSeek Harness’s product features and plugin APIs are expected to continue rapid iteration and evolution, and will gradually stabilize over time.\n\nWe look forward to exploring the limits of intelligence together with users and developers around the world, building on open-source, reusable, and composable infrastructure. We welcome everyone to bring their ideas to life with DeepSeek Harness and participate in the community to enrich the plugin ecosystem.\n\nContinue",
+  "screenshot": "/home/runner/work/dsh-standards/dsh-standards/40-checker/results/webruntime/Ebony-Vinyl__dsh-our-free-model/shot.png",
+  "elapsedMs": 2104,
+  "error": null,
+  "url": "http://127.0.0.1:18770/?token=<redacted>",
+  "generatedAt": "2026-10-31T16:11:44.397Z",
+  "id": "Ebony-Vinyl__dsh-our-free-model",
+  "pkg": "dsh-our-free-model",
+  "webapp": false,
+  "hasClient": true,
+  "clientClaim": true,
+  "skipped": null,
+  "installed": {
+    "name": "dsh-our-free-model",
+    "version": "2.1.0"
+  }
+}

package/40-checker/results/webruntime/Ebony-Vinyl__dsh-our-free-model/summary.md

@@ -0,0 +1,16 @@
+# Ebony-Vinyl__dsh-our-free-model
+
+- package: `dsh-our-free-model`
+- webapp: false
+- client export: yes
+- ok: yes
+- bootGraph: ok
+- expected: dsh-our-free-model
+- loadedEntries: dsh-our-free-model
+- missingEntries: (none)
+- notLoadedEntries: (none)
+- consoleErrors: 0
+- pageErrors: 0
+- failedRequests: 0
+- rootChildren: 1
+- bootPageVisible: false

package/40-checker/results/webruntime/REPORT.md

@@ -0,0 +1,253 @@
+# Web runtime evidence — real Chromium client-module probe
+
+Status: **measured in CI.** Run
+[41217382935](https://github.com/PerryLink/dsh-standards/actions/runs/41217382935)
+produced 18 row artifacts: **15/15 client-bearing rows `client-module-loaded`**,
+**4/4 web-app rows loaded**, 3 shell-only/skipped rows, and 2 host-gate
+rejections (`telemetry`, `verification`) recorded from the install gate. Run
+41218358951 re-runs the same matrix with gate rejection recorded as a row rather
+than a job failure; use its artifacts for the cleaner per-row set.
+
+Local pre-CI evidence (five rows + one negative) is in `local-pre-ci/`; it is
+kept as an independent reproduction, not as the CI result.
+
+The previous blocker was `GET /` returning `401`. That is the intended
+authentication boundary. The real path is the token URL printed by the Web app:
+
+```
+dsh web: http://127.0.0.1:<port>/?token=<process-launch-token>
+```
+
+The token exchange mints the signed `dsh-auth-*` cookie and redirects to `./`;
+the cookie-authenticated page is the real `index.html`. This was re-read from
+`packages/client/connection/src/browser-auth.ts` and rechecked against
+`.github/workflows/web-smoke.yml` (run 41215756898, commit `c0cc157`).
+
+## 1. What a passing row means
+
+**Claim:** `client-module-loaded`.
+
+A passing row proves all of the following in a real browser host page:
+
+1. the host composed the package's `dsh.client` entry into
+   `window.__DSH_BOOT__.entries` (the package id is present);
+2. the browser fetched the corresponding client bundle (the entry's `url` or id
+   appears in `performance.getEntriesByType('resource')`);
+3. the boot page marker `[data-dsh-boot]` disappeared and `#root` contains the
+   mounted shell;
+4. there were no console errors, no `pageerror` events, and no failed or
+   non-2xx same-origin script requests.
+
+**Not claimed:** every plugin's UI slot is visually correct, laid out correctly,
+or interactive. The probe does not inspect plugin-specific DOM. Do **not** call
+a passing row `UI-rendered`; it is not a pixel or slot review.
+
+**Failure rule:** a package that is in `__DSH_BOOT__` but whose client `apply`
+throws produces a `console.error`/`pageerror` and leaves the boot page visible;
+the probe fails. A missing boot entry is a **real failure**, not a skip.
+
+## 2. CI design
+
+Workflow: `.github/workflows/web-runtime.yml`.
+
+- `workflow_dispatch`, Ubuntu, Node 24, `timeout-minutes: 30`,
+  `fail-fast: false`, `max-parallel: 4`.
+- **18 rows**, one boot per package. The 4 web-app rows are the same rows
+  flagged `webapp: true`; they are not booted twice.
+- 15 of the 18 declare `exports["./client"]`. The workflow reads the installed
+  `package.json` and records `hasClientExport`; the summary job fails unless it
+  sees exactly 15 client-bearing rows, 3 skipped rows, and 4 webapp rows.
+- Rows without `./client` are not failed: they are probed shell-only (empty
+  `--expect`) and annotated `skipped: "no ./client export"`,
+  `clientClaim: false`.
+- `dsh-ui-auth` gates the whole Web UI. Its row passes
+  `--login-file "$RUNNER_TEMP/dsh-ui-auth-bootstrap.txt"`; the probe performs
+  `POST /auth/login` through the browser context **before** opening the token
+  URL, so the token exchange reaches the real shell. Credentials are generated
+  by the plugin on first boot into `$RUNNER_TEMP` (process cwd), never the repo,
+  and are deleted after the probe.
+- A host-gate rejection during `dsh plugin add` is recorded as
+  `gateRejected: true` / `skipped: "host-gate-reject"` instead of crashing the
+  step. It still produces a row artifact; the summary separately requires
+  15 client-bearing rows and 4 webapp rows.
+
+Per job:
+
+```sh
+# 1. install
+npm install -g pnpm@10
+npm install -g @deepseek-ai/dsh@0.2.2-alpha.2
+npm install --no-save playwright@1.49.1
+npx playwright install --with-deps chromium
+
+# 2. custom profile backed by the shipped web template
+export DSH_HOME="$RUNNER_TEMP/dsh-home"
+dsh --profile wr --from-default-profile web --dump-config
+
+# 3. sample install (third-party lifecycle scripts intentionally not run)
+dsh plugin --profile wr add --ignore-scripts "<matrix.spec>"
+
+# 4. boot the custom profile; there is NO trailing "web" token
+cd "$RUNNER_TEMP"
+dsh --profile wr --no-open --port 18770 > web.log 2>&1 &
+# wait up to 180 s for: dsh web: http://127.0.0.1:18770/?token=...
+
+# 5. real browser
+node 40-checker/scripts/web-probe.mjs \
+  --url "$APP_URL" --expect "<package-name>" \
+  --out "$EVID/probe.json" --screenshot "$EVID/shot.png" --timeout 90000
+# ui-auth only: --login-file "$RUNNER_TEMP/dsh-ui-auth-bootstrap.txt"
+```
+
+Exact dispatch command once the parent pushes:
+
+```sh
+gh workflow run web-runtime.yml --repo PerryLink/dsh-standard --ref main
+```
+
+Artifacts per row: `40-checker/results/webruntime/<id>/` containing
+`probe.json`, `shot.png`, `web.log` (token/password redacted),
+`client-export.json`, `installed-package.json`, `plugin-add.log`,
+`dump-config.yml`, and `summary.md`. The summary job downloads all 18 and
+prints the denominator table.
+
+## 3. The four web-app rows
+
+| row id | source | install spec | expected boot id | local pre-CI |
+|---|---|---|---|---|
+| `SeaOf0__dsh-redteam-model` | `SeaOf0/dsh-redteam-model` | `github:SeaOf0/dsh-redteam-model#ce24bb2…` (`1.1.2`) | `@dsh-external/dsh-redteam-model` | **PASS** (local checkout at the same commit) |
+| `liguobao__ds-harness-remote` | `liguobao/ds-harness-remote` | `ds-harness-remote@0.6.0` | `ds-harness-remote` | CI pending |
+| `shaobeichen__dsh-pocket` | `shaobeichen/dsh-pocket` | `dsh-pocket@2.12.0` | `dsh-pocket` | **PASS** |
+| `ui-auth` | `0QwQ0/dsh-ui-auth` | `dsh-ui-auth@0.7.1` | `dsh-ui-auth` | **PASS** (with bootstrap login) |
+
+## 4. The 15 client-bearing rows
+
+Local manifest inspection (`local-pre-ci/client-exports.json`) confirms these 15
+of the 18 identities declare `exports["./client"]`:
+
+| # | package | version | expected boot id | local pre-CI |
+|---|---|---|---|---|
+| 1 | `dsh-free-search` | 0.9.26 | `dsh-free-search` | **PASS** |
+| 2 | `dsh-our-free-model` | 2.1.0 | `dsh-our-free-model` | CI pending |
+| 3 | `@dsh-external/dsh-redteam-model` | 1.1.2 | `@dsh-external/dsh-redteam-model` | **PASS** (local checkout) |
+| 4 | `dsh-purge` (YuJunZhiXue) | 1.1.85 | `dsh-purge` | CI pending |
+| 5 | `dsh-ci-diet` | 0.5.2 | `dsh-ci-diet` | CI pending |
+| 6 | `@zzerx/dsh-plugin-daily-log` | 0.4.3 | `@zzerx/dsh-plugin-daily-log` | CI pending |
+| 7 | `@howmp/dsh-pentest` | 0.1.0-rc.37 | `@howmp/dsh-pentest` | CI pending |
+| 8 | `dsh-purge-community` (kingcharleslzy-ai) | 1.6.67 | `dsh-purge-community` | CI pending |
+| 9 | `ds-harness-remote` | 0.6.0 | `ds-harness-remote` | CI pending |
+| 10 | `dsh-purge` (mmparko) | 1.1.71 | `dsh-purge` | CI pending |
+| 11 | `@yolk_vat-y/dsh-project-memory` | 0.6.7 | `@yolk_vat-y/dsh-project-memory` | CI pending |
+| 12 | `dsh-pocket` | 2.12.0 | `dsh-pocket` | **PASS** |
+| 13 | `dsh-status-rotator` | 0.38.0 | `dsh-status-rotator` | CI pending |
+| 14 | `dsh-ui-auth` | 0.7.1 | `dsh-ui-auth` | **PASS** (with bootstrap login) |
+| 15 | `dsh-vision-router` | 3.1.0 | `dsh-vision-router` | CI pending |
+
+The 3 identities without `./client` are probed shell-only and recorded as
+skipped, not failed:
+
+| package | version | disposition |
+|---|---|---|
+| `qiushi-dsh-evidence-audit` | 0.1.0 | shell-only **PASS**, `skipped: "no ./client export"` |
+| `dsh-telemetry-redactor` | 0.1.0 | skipped for client claim |
+| `dsh-verification-receipt` | 0.1.0 | skipped for client claim |
+
+This is why the denominator is **15/18 client-bearing**, not 18/18.
+
+## 5. Local pre-CI browser evidence
+
+Real Chromium 131, not a jsdom/mock. The WSL image lacked three shared
+libraries; their `.deb` payloads were extracted under `/tmp` and supplied via
+`LD_LIBRARY_PATH`. CI does not need this workaround (`--with-deps` installs
+them). Raw sanitized JSON is in `local-pre-ci/`.
+
+| probe | result | boot entries | loaded | console/page | root | boot page |
+|---|---|---|---|---|---|---|
+| `dsh-ui-auth@0.7.1` + login | **ok** | 72 | 1/1 | 0/0 | 1 child | gone |
+| `dsh-free-search@0.9.26` | **ok** | 72 | 1/1 | 0/0 | 1 child | gone |
+| `@dsh-external/dsh-redteam-model@1.1.2` (local checkout) | **ok** | 72 | 1/1 | 0/0 | 1 child | gone |
+| `dsh-pocket@2.12.0` | **ok** | 72 | 1/1 | 0/0 | 1 child | gone |
+| `qiushi-dsh-evidence-audit@0.1.0` (shell-only) | **ok** | 71 | n/a | 0/0 | 1 child | gone |
+| `dsh-ui-auth` without login (negative) | **fail** | 0 / missing | n/a | 1 console | 0 | n/a |
+
+The negative run lands on `/auth/login` (`<title>登录 · DeepSeek Harness</title>`)
+and has no `__DSH_BOOT__`, which is exactly why the workflow passes
+`--login-file` for that row. A second negative check expecting
+`dsh-pocket` in the `dsh-free-search` profile failed with
+`missingEntries: ["dsh-pocket"]`, proving missing boot entries are failures.
+
+## 6. Validation performed
+
+- `node --check 40-checker/scripts/web-probe.mjs` passes.
+- Python `yaml.safe_load` parses the workflow; 18 matrix rows, 4 webapp flags,
+  1 login row, unique ids.
+- `bash -n` on all 11 `run:` blocks (GitHub expressions replaced by
+  placeholders) — 0 syntax failures.
+- Pure parser fixture: `summarizeBootGraph` on a synthetic graph returns
+  `bootGraph: "ok"`, the expected `bootIds`, one loaded entry, and a missing
+  entry; `null` returns `bootGraph: "missing"`.
+- The annotation script was run against real and synthetic result JSON; the
+  summary script was run against a synthetic 18-row artifact tree and produced
+  `15/15 client, 3/3 skipped, 4/4 webapp`, exit 0.
+- Real browser probes as listed in §5.
+
+## 7. Uncertainties / VERIFY notes
+
+1. **GitHub install specs.** `github:SeaOf0/dsh-redteam-model#<sha>` and the
+   three `dsh-purge` forks are pinned to commits whose local `package.json`
+   versions match the matrix. A local `dsh plugin add github:…` attempt timed
+   out on this WSL network; the package content was instead validated from the
+   local checkout at the same commit. GitHub-hosted runners should fetch these
+   normally.
+2. **`--ignore-scripts`.** Third-party lifecycle scripts are deliberately not
+   run in CI. If a package depends on `postinstall` to insert its root row
+   (notably `YuJunZhiXue/dsh-purge`), the client entry may be absent from
+   `__DSH_BOOT__` and that row will fail. That is an honest artifact-level
+   result under a scripts-disabled install, not a probe bug.
+3. **`dsh-ui-auth` login.** The probe hardcodes `POST /auth/login`, the
+   documented first-run form, and reads the credential file the plugin writes
+   into its process cwd (`$RUNNER_TEMP`). If a future version moves the route or
+   the file, that one row fails loudly.
+4. **Custom profile syntax.** Verified locally:
+   `dsh --profile wr --from-default-profile web --dump-config` creates the
+   profile from the shipped web template, and the boot command is
+   `dsh --profile wr --no-open --port 18770` (no trailing `web`). `--profile`
+   precedes the app arguments.
+5. **Port.** Each row uses `18770` on its own runner; no cross-row conflict. A
+   local port conflict produced `EADDRINUSE`, which the workflow would surface
+   as "did not print its URL within 180 s" with the boot log attached.
+
+## 8. Next step
+
+Push and dispatch the workflow, then collect the 18 artifacts. Only after that
+run may the report claim a CI denominator (expected: 15 client rows, 3 skipped,
+4 webapp rows). Local evidence above is pre-CI only.
+
+---
+
+## 8. Final CI run (2026-11-01)
+
+Run [41218358951](https://github.com/PerryLink/dsh-standards/actions/runs/41218358951)
+(`web-runtime`, commit `d68e817`): **19/19 jobs success** (18 rows + denominator
+summary), 0 failures.
+
+| Metric | Result |
+|---|---|
+| rows | **18/18** |
+| client-bearing rows | **15/15** |
+| client rows `client-module-loaded` | **15/15** |
+| web-app rows | **4/4** |
+| web-app rows loaded | **4/4** |
+| shell-only rows | **1/1** (`qiushi`, no `./client` export) |
+| host-gate rejections | **2/2** (`telemetry`, `verification`) — install gate, recorded as rows |
+| console errors / page errors on the 16 loaded rows | **0 / 0** |
+
+`4/4` web-app rows: `SeaOf0/dsh-redteam-model`, `liguobao/ds-harness-remote`,
+`shaobeichen/dsh-pocket`, `dsh-ui-auth` (the last one after the bootstrap login).
+The two gate rows are **not** probe failures: the host install gate refuses their
+stale peer ranges before boot, which is the correct behavior recorded by the
+`--ignore-scripts` path.
+
+Per-row evidence is in `summary.json`, and each `<id>/` directory has
+`probe.json`, `summary.md`, `shot.png`, `web.log`, `client-export.json`.
+The claim remains **`client-module-loaded`**, not `UI-rendered`.

package/40-checker/results/webruntime/SeaOf0__dsh-redteam-model/client-export.json

@@ -0,0 +1,7 @@
+{
+  "name": "@dsh-external/dsh-redteam-model",
+  "version": "1.1.2",
+  "hasClientExport": true,
+  "clientExport": "./lib/client.js",
+  "declaresDshClient": true
+}