dsh-standards 0.0.3 → 1.0.1

package/40-checker/src/cli.mjs

@@ -0,0 +1,300 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { runManifestChecks, DEFAULT_RUNTIME_VERSION } from './manifest.mjs'
+import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from './declarations.mjs'
+import { runRuntimeChecks } from './runtime.mjs'
+import { spawnSync } from 'node:child_process'
+import { readSources } from './util.mjs'
+import { buildReport, writeReport } from './report.mjs'
+
+const VERSION = '0.1.0'
+const DEFAULT_COMMIT = 'ce7073d51254c26cd63b22a60835b8f948deb447'
+const DEFAULT_CORDIS = '4.0.6-alpha.1'
+
+function usage() {
+  return `${process.env.DSH_CHECKER_BRAND || 'dsh-plugin-verify ' + VERSION} — DS-C conformance checker (MVP)
+
+Usage:
+  dsh-plugin-verify <package-dir> [options]
+
+Options:
+  --format text|json|sarif   output format (default: text)
+  --scope mvp|ds-c|entry     mvp = 8 MVP ids; ds-c = full claim (default); entry = compatibility gate
+  --profile package|listing|both  evaluation profile (default: package; listing if --market-index is set)
+  --runtime <path>           path to a built @deepseek-ai/cordis lib/index.js; enables L1-L3
+  --runtime-version <v>      dsh runtime version used for C-2 (default: ${DEFAULT_RUNTIME_VERSION})
+  --cordis-version <v>       cordis version recorded in the anchor (default: ${DEFAULT_CORDIS})
+  --commit <sha>             harness commit recorded in the anchor (default: ${DEFAULT_COMMIT.slice(0, 12)})
+  --install-spec <spec>      recommended install spec for C-3 (listing/install check)
+  --market-index <file>      format-1 market index JSON for C-3 listing mode
+  --plugin-name <name>       plugin name inside the market index
+  --timeout <ms>             L1-L3 timeout (default: 10000)
+  --no-exec                  skip L1-L3 entirely (reported as not-run/NA, never PASS)
+  --static-only              M1 mode: listing profile, only C-1/C-2/C-3/C-11/C-12/C-13; C-4..C-9 are out of scope
+  --treat-as-plugin          run L1-L3 on a bundle's server entry (lib/index.js, index.js, lib/public-entry.js, src/index.ts)
+  --entry-runtime require|server-entry  entry scope: require full G0-G3 (default) or accept server-entry proxy (not bundle)
+  --entry-claim runtime|static  entry scope: runtime (default, needs DSC-14) or static recognized (no runtime claim)
+  --host <file>              app-boot lib/index.js; enables bundle G0-G3 smoke
+  --base <file>              optional base cordis.patch.yml for bundle smoke
+  --web <file>               optional web-app cordis.patch.yml for bundle smoke
+  --bare <dir>               optional bare-module base for bundle smoke (host farm)
+  --out <file>               write the report to a file (stdout otherwise)
+  --help                     show this help
+  --version                  show the checker version
+
+Exit codes:
+  0  completed, no FAIL (PASS or WARN; WARN does not claim a clean PASS)
+  1  completed, at least one FAIL
+  2  incomplete: a mandatory check did not run, or the checker itself failed
+  3  usage error
+`
+}
+
+function parseArgs(argv) {
+  const options = {
+    target: null,
+    format: 'text',
+    scope: 'ds-c',
+    profile: null,
+    runtime: null,
+    runtimeVersion: DEFAULT_RUNTIME_VERSION,
+    cordisVersion: DEFAULT_CORDIS,
+    commit: DEFAULT_COMMIT,
+    installSpec: null,
+    marketIndex: null,
+    pluginName: null,
+    timeoutMs: 10_000,
+    noExec: false,
+    staticOnly: false,
+    treatAsPlugin: false,
+    entryRuntime: 'require',
+    entryClaim: 'runtime',
+    host: null,
+    base: null,
+    web: null,
+    bare: null,
+    out: null,
+    help: false,
+    version: false,
+  }
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === '--help' || arg === '-h') { options.help = true; continue }
+    if (arg === '--version' || arg === '-v') { options.version = true; continue }
+    if (!arg.startsWith('--')) {
+      if (options.target !== null) throw new Error(`unexpected positional argument: ${arg}`)
+      options.target = arg
+      continue
+    }
+    const [key, inline] = arg.split('=', 2)
+    const value = () => {
+      if (inline !== undefined) return inline
+      const next = argv[index + 1]
+      if (next === undefined || next.startsWith('--')) throw new Error(`missing value for ${key}`)
+      index += 1
+      return next
+    }
+    switch (key) {
+      case '--format': options.format = value(); break
+      case '--scope': options.scope = value(); break
+      case '--profile': options.profile = value(); break
+      case '--runtime': options.runtime = value(); break
+      case '--runtime-version': options.runtimeVersion = value(); break
+      case '--cordis-version': options.cordisVersion = value(); break
+      case '--commit': options.commit = value(); break
+      case '--install-spec': options.installSpec = value(); break
+      case '--market-index': options.marketIndex = value(); break
+      case '--plugin-name': options.pluginName = value(); break
+      case '--timeout': options.timeoutMs = Number(value()); break
+      case '--out': options.out = value(); break
+      case '--no-exec': options.noExec = true; break
+      case '--static-only': options.staticOnly = true; break
+      case '--treat-as-plugin': options.treatAsPlugin = true; break
+      case '--entry-runtime': options.entryRuntime = value(); break
+      case '--entry-claim': options.entryClaim = value(); break
+      case '--host': options.host = value(); break
+      case '--base': options.base = value(); break
+      case '--web': options.web = value(); break
+      case '--bare': options.bare = value(); break
+      default: throw new Error(`unknown option: ${key}`)
+    }
+  }
+  if (!['text', 'json', 'sarif'].includes(options.format)) throw new Error(`unsupported --format: ${options.format}`)
+  if (!['mvp', 'ds-c', 'entry'].includes(options.scope)) throw new Error(`unsupported --scope: ${options.scope}`)
+  if (!['require', 'server-entry'].includes(options.entryRuntime)) throw new Error('--entry-runtime must be require or server-entry')
+  if (!['runtime', 'static'].includes(options.entryClaim)) throw new Error('--entry-claim must be runtime or static')
+  if (options.staticOnly) { options.scope = 'ds-c'; options.profile = 'listing' }
+  if (!options.profile) options.profile = options.marketIndex ? 'listing' : 'package'
+  if (!['package', 'listing', 'both'].includes(options.profile)) throw new Error(`unsupported --profile: ${options.profile}`)
+  if (options.staticOnly && options.treatAsPlugin) throw new Error('--static-only and --treat-as-plugin are mutually exclusive')
+  if (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 100 || options.timeoutMs > 120_000) throw new Error('--timeout must be between 100 and 120000 ms')
+  if (options.target === null) options.target = '.'
+  return options
+}
+
+async function entryRunCheck(kind, runtimeChecks, options, dir) {
+  const byId = new Map(runtimeChecks.map(item => [item.id, item]))
+  const c4 = byId.get('DSC-04')
+  const base = {
+    id: 'DSC-14', clause: 'C-14', layer: 'L1', method: 'M', advisory: false,
+    details: [], evidence: c4?.evidence ?? [],
+  }
+  if (options.entryClaim === 'static') {
+    return { ...base, result: 'NA', coverage: 'not-run', reason: 'entry static claim: no runtime evidence' }
+  }
+  if (['client', 'preset', 'skill', 'theme', 'mcp-config', 'unknown'].includes(kind)) {
+    return { ...base, result: 'NA', coverage: 'not-run', reason: `kind=${kind}; no runtime claim` }
+  }
+  if (kind === 'bundle' && options.entryRuntime !== 'server-entry') {
+    if (!options.host) return { ...base, result: 'ERROR', coverage: 'not-run', reason: 'bundle runtime requires --host <app-boot/lib/index.js> for G0-G3' }
+    const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'scripts', 'bundle-smoke.mjs')
+    const args = [script, '--package', dir, '--host', options.host, '--json', '--timeout', String(options.timeoutMs)]
+    if (options.base) args.push('--base', options.base)
+    if (options.web) args.push('--web', options.web)
+    if (options.bare) args.push('--bare', options.bare)
+    const run = spawnSync(process.execPath, args, { encoding: 'utf8', timeout: options.timeoutMs + 5000, maxBuffer: 8 * 1024 * 1024 })
+    if (run.error) return { ...base, result: 'ERROR', coverage: 'not-run', reason: `bundle smoke failed to start: ${run.error.message}` }
+    let smoke
+    try { smoke = JSON.parse(run.stdout) } catch { return { ...base, result: 'ERROR', coverage: 'not-run', reason: `bundle smoke produced no JSON: ${(run.stderr || '').slice(0, 300)}` } }
+    const state = smoke.g3?.state
+    if (smoke.g2?.compatibility === 'reject') return { ...base, result: 'FAIL', coverage: 'full', reason: 'G2 gate rejected: host would skip this bundle', details: [{ item: 'G2', result: 'FAIL', reason: JSON.stringify(smoke.g2) }] }
+    if (state === 'verified' && smoke.g4?.ok === false) return { ...base, result: 'FAIL', coverage: 'full', reason: 'G4 failed: dsh.client has no package-root row or missing client export', details: [{ item: 'G4', result: 'FAIL', reason: JSON.stringify(smoke.g4) }] }
+    if (state === 'verified') return { ...base, result: 'PASS', coverage: 'full', reason: `G0-G3 verified; rows=${smoke.g3.active}/${smoke.g3.rows.length}${smoke.g4?.hasClient ? '; G4 static ok' : ''}`, details: [{ item: 'G0', result: 'PASS', reason: 'patch parsed' }, { item: 'G1', result: 'PASS', reason: `rows ${smoke.g1.targetRows}` }, { item: 'G3', result: 'PASS', reason: `rows ${smoke.g3.active}/${smoke.g3.rows.length} ACTIVE` }] }
+    if (state === 'partial') return { ...base, result: 'ERROR', coverage: 'not-run', reason: `G3 partial: ${smoke.g3.active}/${smoke.g3.rows.length} ACTIVE; target profile does not provide all services`, details: [{ item: 'G3', result: 'WARN', reason: JSON.stringify(smoke.g3.rows) }] }
+    return { ...base, result: 'FAIL', coverage: 'full', reason: `bundle smoke failed: ${JSON.stringify(smoke.g3?.rows ?? [])}` }
+  }
+  if (c4?.result === 'PASS') {
+    return { ...base, result: 'PASS', coverage: 'full', reason: kind === 'bundle' ? 'server-entry ACTIVE only; bundle G0-G4 not run' : '' }
+  }
+  if (c4?.result === 'FAIL') return { ...base, result: 'FAIL', coverage: 'full', reason: c4.reason || 'runtime failed' }
+  return { ...base, result: 'ERROR', coverage: 'not-run', reason: c4?.reason || 'no runtime evidence' }
+}
+
+function anchorOf(options, runtime) {
+  return {
+    repo: 'deepseek-ai/deepseek-harness',
+    commit: options.commit,
+    scanner: `dsh-plugin-verify@${VERSION}`,
+    dsh: options.runtimeVersion,
+    cordis: options.cordisVersion,
+    runtime: runtime ? path.resolve(runtime) : null,
+  }
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  let options
+  try {
+    options = parseArgs(argv)
+  } catch (error) {
+    process.stderr.write(`dsh-plugin-verify: ${error.message}\n`)
+    process.stderr.write(usage())
+    return 3
+  }
+  if (options.help) { process.stdout.write(usage()); return 0 }
+  if (options.version) { process.stdout.write(`${VERSION}\n`); return 0 }
+
+  const dir = path.resolve(options.target)
+  let stat
+  try { stat = fs.statSync(dir) } catch {
+    process.stderr.write(`dsh-plugin-verify: target not found: ${dir}\n`)
+    return 3
+  }
+  if (!stat.isDirectory()) {
+    process.stderr.write(`dsh-plugin-verify: target must be a package directory (tarball support is not in the MVP): ${dir}\n`)
+    return 3
+  }
+
+  const { manifest, kind, kindInferred, entry, patch, g4, checks: manifestChecks } = runManifestChecks(dir, {
+    runtimeVersion: options.runtimeVersion,
+    installSpec: options.installSpec,
+    marketIndex: options.marketIndex,
+    pluginName: options.pluginName,
+  })
+
+  let sources = []
+  try { sources = readSources(dir) } catch { sources = [] }
+  const declarationChecks = manifest ? [
+    checkCapabilities(manifest, sources, patch),
+    checkCredentials(manifest, sources),
+    checkLabels(manifest, sources),
+  ] : [
+    { id: 'DSC-11', clause: 'C-11', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
+    { id: 'DSC-12', clause: 'C-12', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
+    { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
+  ]
+  const advisoryChecks = [checkImportTimeAdvisory(sources)]
+
+  if (options.scope === 'entry' && options.entryRuntime === 'server-entry' && kind !== 'plugin') options.treatAsPlugin = true
+  let runtimeKind = kind
+  let runtimeEntry = entry
+  if (options.treatAsPlugin && manifest) {
+    runtimeKind = 'plugin'
+    if (!runtimeEntry?.exists) {
+      const candidates = ['lib/index.js', 'index.js', 'lib/public-entry.js', 'src/index.ts', 'src/index.js', 'src/index.mjs']
+      for (const relative of candidates) {
+        const absolute = path.resolve(dir, relative)
+        if (fs.existsSync(absolute)) { runtimeEntry = { exists: true, absolute, relative, source: '--treat-as-plugin' }; break }
+      }
+    }
+  }
+
+  let runtimeChecks
+  if (options.noExec || !manifest) {
+    const reason = options.noExec ? '--no-exec' : 'manifest unavailable'
+    runtimeChecks = ['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'].map(id => ({
+      id, clause: { 'DSC-04': 'C-4', 'DSC-05': 'C-5', 'DSC-06': 'C-6', 'DSC-07': 'C-7', 'DSC-08': 'C-8', 'DSC-09': 'C-9' }[id],
+      layer: { 'DSC-04': 'L1', 'DSC-05': 'L1', 'DSC-06': 'L1+L2', 'DSC-07': 'L2', 'DSC-08': 'L3', 'DSC-09': 'L1' }[id],
+      result: 'ERROR', coverage: 'not-run', reason, details: [], evidence: [], method: 'M', advisory: false,
+    }))
+  } else {
+    runtimeChecks = await runRuntimeChecks({
+      dir, manifest, kind: runtimeKind, entry: runtimeEntry,
+      runtimePath: options.runtime, timeoutMs: options.timeoutMs, sources,
+    })
+  }
+
+  const runCheck = await entryRunCheck(kind, runtimeChecks, options, dir)
+  const checks = [
+    manifestChecks[0], manifestChecks[1], manifestChecks[2],
+    ...runtimeChecks,
+    runCheck,
+    advisoryChecks[0],
+    ...declarationChecks,
+  ]
+
+  const subject = {
+    mode: options.profile === 'listing' || options.profile === 'both' ? 'listing' : 'package',
+    profile: options.profile,
+    kind,
+    kindInferred,
+    kindEvaluated: runtimeKind,
+    name: manifest?.name ?? null,
+    version: manifest?.version ?? null,
+    path: dir,
+  }
+  const report = buildReport({
+    subject,
+    anchor: anchorOf(options, options.runtime),
+    checks,
+    g4,
+    scope: options.scope,
+    profile: options.profile,
+    kind,
+    staticOnly: options.staticOnly,
+    entryRuntime: options.entryRuntime,
+    entryClaim: options.entryClaim,
+  })
+  const output = writeReport(report, options.format)
+  if (options.out) {
+    const outPath = path.resolve(options.out)
+    fs.mkdirSync(path.dirname(outPath), { recursive: true })
+    fs.writeFileSync(outPath, output)
+    process.stderr.write(`dsh-plugin-verify: wrote ${outPath}\n`)
+  } else {
+    process.stdout.write(output)
+  }
+  return report.conclusion.exitCode
+}
+
+export { parseArgs, usage, VERSION }

package/40-checker/src/client-shape.mjs

@@ -0,0 +1,37 @@
+/**
+ * Static G4 check: when `dsh.client` exists, the package must expose
+ * `exports["./client"]` and declare the client at the package root.
+ *
+ * This is a static shape check. It does not prove the client module loads or
+ * renders; that is a runtime/UI probe and is reported separately.
+ */
+export function checkClientShape(manifest) {
+  const hasClient = manifest?.dsh?.client !== undefined
+  if (!hasClient) {
+    return {
+      hasClient: false,
+      ok: true,
+      result: 'NA',
+      reason: 'no dsh.client declaration',
+    }
+  }
+  const client = manifest.dsh.client
+  if (client === null || client === undefined || client === '') {
+    return { hasClient: true, ok: false, result: 'FAIL', reason: 'dsh.client is empty' }
+  }
+  const exported = manifest.exports?.['./client']
+  if (!exported) {
+    return {
+      hasClient: true,
+      ok: false,
+      result: 'FAIL',
+      reason: 'dsh.client exists but exports["./client"] is missing; a package-root row cannot resolve it',
+    }
+  }
+  return {
+    hasClient: true,
+    ok: true,
+    result: 'PASS',
+    reason: 'dsh.client + exports["./client"] present (static only)',
+  }
+}

package/40-checker/src/declarations.mjs

@@ -0,0 +1,242 @@
+import { isObject, regexHits } from './util.mjs'
+import { check, detail, worst } from './result.mjs'
+import { validateCommitments, validateDisclosure } from './permissions.mjs'
+
+export const CAPABILITIES = new Set([
+  'fs:read', 'fs:write', 'shell', 'subprocess', 'network:egress', 'network:ingress',
+  'credentials:read', 'credentials:list', 'credentials:provider', 'llm:adapter',
+  'sessions:read', 'system-prompt:write', 'tools:register', 'remote:expose', 'plugin:install',
+])
+
+export const LABELS = new Set([
+  'prompt-modification', 'red-team', 'third-party-model-provider', 'remote-access', 'mirror',
+])
+
+export const FORBIDDEN_LABELS = new Set(['official', 'verified', 'certified', 'secure', 'audited'])
+
+const TRIGGERS = [
+  { cap: 'network:ingress', pattern: /ctx\.(?:webServer|webhookRuntime)\b/g },
+  { cap: 'plugin:install', pattern: /\b(?:installBundle|removeBundle)\s*\(/g },
+  { cap: 'llm:adapter', pattern: /registerAdapter\s*\(|ctx\.llm\.register/g },
+  { cap: 'system-prompt:write', pattern: /ctx\.systemPrompt\.(?:section|context|variable)\s*\(/g },
+  { cap: 'tools:register', pattern: /ctx\.tools\.register\s*\(/g },
+  { cap: 'remote:expose', pattern: /@Remote(?:Scope)?\s*\(/g },
+  { cap: 'credentials:list', pattern: /\.listRecords\s*\(/g },
+  { cap: 'sessions:read', pattern: /ctx\.(?:sessions|sessionQuery)\b/g },
+  { cap: 'shell', pattern: /ctx\.(?:shell|bash)\b/g },
+  { cap: 'subprocess', pattern: /ctx\.subprocess\b/g },
+  { cap: 'fs:read', pattern: /ctx\.fs\b/g },
+  { cap: 'network:egress', pattern: /ctx\.web\b|\bfetch\s*\(/g },
+]
+
+function capabilityList(manifest) {
+  const value = manifest?.dsh?.capabilities
+  if (value === undefined) return { defined: false, list: [], error: null }
+  if (!Array.isArray(value) || value.some(item => typeof item !== 'string')) {
+    return { defined: true, list: [], error: 'dsh.capabilities must be a string array' }
+  }
+  return { defined: true, list: value, error: null }
+}
+
+function labelList(manifest) {
+  const value = manifest?.dsh?.labels
+  if (value === undefined) return { defined: false, list: [], error: null }
+  if (!Array.isArray(value) || value.some(item => typeof item !== 'string')) {
+    return { defined: true, list: [], error: 'dsh.labels must be a string array' }
+  }
+  return { defined: true, list: value, error: null }
+}
+
+function hitEvidence(hits, limit = 3) {
+  return hits.slice(0, limit).map(hit => `${hit.file}:${hit.line}`)
+}
+
+/** DSC-10: advisory only; never FAIL. */
+export function checkImportTimeAdvisory(sources) {
+  const patterns = [
+    { name: 'top-level await', pattern: /^await\s/m },
+    { name: 'top-level setInterval', pattern: /^setInterval\s*\(/m },
+    { name: 'top-level process.on', pattern: /^process\.on\s*\(/m },
+    { name: 'top-level process.env assignment', pattern: /^process\.env\.[A-Za-z_][A-Za-z0-9_]*\s*=/m },
+    { name: 'top-level globalThis assignment', pattern: /^globalThis\.[A-Za-z_][A-Za-z0-9_]*\s*=/m },
+  ]
+  const hits = []
+  for (const item of patterns) {
+    for (const hit of regexHits(sources, item.pattern)) hits.push({ ...hit, pattern: item.name })
+  }
+  const result = hits.length > 0 ? 'WARN' : sources.length === 0 ? 'WARN' : 'PASS'
+  return check({
+    id: 'DSC-10',
+    clause: 'C-10',
+    layer: 'L0',
+    result,
+    advisory: true,
+    reason: hits.length > 0 ? `advisory: ${hits.length} import-time side-effect clue(s)` : sources.length === 0 ? 'no source files scanned' : '',
+    details: hits.slice(0, 20).map(hit => detail('C-10.1/2', 'WARN', `${hit.pattern} at ${hit.file}:${hit.line}`, [`${hit.file}:${hit.line}`])),
+    evidence: hitEvidence(hits),
+  })
+}
+
+/** DSC-11: dsh.capabilities declaration + high-signal static triggers. */
+export function checkCapabilities(manifest, sources, patch) {
+  const caps = capabilityList(manifest)
+  const details = []
+  if (caps.error) details.push(detail('C-11.1', 'FAIL', caps.error, ['package.json#dsh.capabilities']))
+  if (!caps.defined) {
+    details.push(detail('C-11.1', 'WARN', 'dsh.capabilities is not declared (transitional WARN; host does not read it yet)', ['package.json#dsh.capabilities']))
+  } else if (!caps.error) {
+    for (const id of caps.list) {
+      if (!CAPABILITIES.has(id)) details.push(detail('C-11.1', 'FAIL', `unknown capability id: ${id}`, ['package.json#dsh.capabilities']))
+    }
+    if (caps.list.length === 0) details.push(detail('C-11.1', 'WARN', 'dsh.capabilities is empty', ['package.json#dsh.capabilities']))
+  }
+
+  const triggered = new Map()
+  for (const trigger of TRIGGERS) {
+    const hits = regexHits(sources, trigger.pattern)
+    if (hits.length > 0) triggered.set(trigger.cap, hits)
+  }
+  if (!caps.defined) {
+    for (const [cap, hits] of triggered) {
+      details.push(detail('C-11.2', 'WARN', `trigger for ${cap} observed but dsh.capabilities is absent`, hitEvidence(hits)))
+    }
+  } else if (!caps.error) {
+    for (const [cap, hits] of triggered) {
+      const satisfied = caps.list.includes(cap) || (cap === 'fs:read' && caps.list.includes('fs:write'))
+      if (!satisfied) {
+        details.push(detail('C-11.2', 'FAIL', `static trigger ${cap} is not declared in dsh.capabilities`, hitEvidence(hits)))
+      }
+    }
+    for (const cap of caps.list) {
+      const observed = triggered.has(cap) || (cap === 'fs:write' && triggered.has('fs:read'))
+      if (!observed) details.push(detail('C-11.5', 'WARN', `declared capability ${cap} was not observed statically`, ['package.json#dsh.capabilities']))
+    }
+  }
+
+  if (patch?.enabledPluginManagerTools) {
+    details.push(detail('C-11.3', 'FAIL', 'bundle patch enables @deepseek-ai/dsh-plugin-manager/tools', ['dsh.bundle.patch']))
+  }
+  const dangerHits = regexHits(sources, /danger-full-access/g)
+  if (dangerHits.length > 0) details.push(detail('C-11.4', 'WARN', 'danger-full-access literal found', hitEvidence(dangerHits)))
+  if (details.length === 0) details.push(detail('C-11.1', 'PASS', 'dsh.capabilities is declared and consistent with static triggers'))
+
+  const result = worst(details.map(item => item.result))
+  return check({
+    id: 'DSC-11', clause: 'C-11', layer: 'L0', result,
+    reason: details.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details,
+    evidence: ['package.json#dsh.capabilities', 'dsh.bundle.patch'],
+  })
+}
+
+/** DSC-12: direct credential backing-file access / listRecords. */
+export function checkCredentials(manifest, sources) {
+  const caps = capabilityList(manifest)
+  const details = []
+  const backingPatterns = [
+    /\.credentials\.yaml/g,
+    /\bCREDENTIALS_FILENAME\b/g,
+    /@deepseek-ai\/dsh-credentials-local/g,
+    /\$DSH_HOME[^\n]{0,80}credentials/gi,
+  ]
+  const backingHits = []
+  for (const pattern of backingPatterns) backingHits.push(...regexHits(sources, pattern))
+  const provider = caps.defined && caps.list.includes('credentials:provider')
+  const hardHits = backingHits.filter(hit => {
+    if (/credentials-local/.test(hit.text)) return true
+    const source = sources.find(item => item.relative === hit.file)
+    if (!source) return false
+    const lines = source.text.split('\n')
+    const window = lines.slice(Math.max(0, hit.line - 6), hit.line + 6).join('\n')
+    return /readFile|readFileSync|createReadStream|openSync|\.load\s*\(|\.parse\s*\(/.test(window)
+  })
+  if (backingHits.length === 0) {
+    details.push(detail('C-12.1', 'PASS', 'no credential backing-file reference found'))
+  } else if (provider) {
+    details.push(detail('C-12.1', 'PASS', 'credential backing-file reference is declared as credentials:provider', hitEvidence(backingHits)))
+  } else if (hardHits.length > 0) {
+    details.push(detail('C-12.1', 'FAIL', 'credential backing-file access near a file-read API without credentials:provider', hitEvidence(hardHits)))
+  } else {
+    details.push(detail('C-12.1', 'PASS', 'credential backing-file path appears in text/UI only; no file-read API found nearby', hitEvidence(backingHits)))
+  }
+
+  const listHits = regexHits(sources, /\.listRecords\s*\(/g)
+  if (listHits.length > 0) {
+    if (!caps.defined) details.push(detail('C-12.2', 'WARN', 'listRecords() used but dsh.capabilities is absent (transitional WARN)', hitEvidence(listHits)))
+    else if (!caps.list.includes('credentials:list')) details.push(detail('C-12.2', 'FAIL', 'listRecords() used without credentials:list', hitEvidence(listHits)))
+    else details.push(detail('C-12.2', 'PASS', 'listRecords() is declared as credentials:list'))
+  } else {
+    details.push(detail('C-12.2', 'PASS', 'listRecords() not used'))
+  }
+
+  const providerHits = regexHits(sources, /ctx\.provide\(\s*['"](?:shell|credentials|sandboxPolicy|sandbox|deepseekAccount)['"]/g)
+  if (providerHits.length > 0) details.push(detail('C-12.3', 'WARN', 'global seam provider registration detected; declaration ownership needs review', hitEvidence(providerHits)))
+  const dangerHits = regexHits(sources, /danger-full-access|--add-dir/g)
+  if (dangerHits.length > 0) details.push(detail('C-12.4', 'WARN', 'danger-full-access/--add-dir literal found', hitEvidence(dangerHits)))
+  details.push(...validateCommitments(manifest), ...validateDisclosure(manifest))
+
+  const result = worst(details.map(item => item.result))
+  return check({
+    id: 'DSC-12', clause: 'C-12', layer: 'L0', result,
+    reason: details.filter(item => item.result !== 'PASS' && item.result !== 'NA').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details,
+    evidence: ['package.json#dsh.capabilities'],
+  })
+}
+
+/** DSC-13: high-risk labels + mirror/upstream. */
+export function checkLabels(manifest, sources) {
+  const caps = capabilityList(manifest)
+  const labels = labelList(manifest)
+  const details = []
+  if (labels.error) details.push(detail('C-13.1', 'FAIL', labels.error, ['package.json#dsh.labels']))
+  if (!labels.defined) {
+    details.push(detail('C-13.1', 'WARN', 'dsh.labels is not declared', ['package.json#dsh.labels']))
+  } else if (!labels.error) {
+    for (const label of labels.list) {
+      if (!LABELS.has(label)) details.push(detail('C-13.1', 'FAIL', `unknown label: ${label}`, ['package.json#dsh.labels']))
+    }
+  }
+
+  for (const label of labels.list) {
+    if (FORBIDDEN_LABELS.has(label)) details.push(detail('C-13.4', 'FAIL', `forbidden endorsement label: ${label}`, ['package.json#dsh.labels']))
+  }
+
+  const upstream = manifest?.dsh?.upstream
+  if (upstream !== undefined) {
+    let url = null
+    try { url = new URL(String(upstream)) } catch { /* handled below */ }
+    if (!url || url.protocol !== 'https:') {
+      details.push(detail('C-13.3', 'FAIL', 'dsh.upstream must be an https URL', ['package.json#dsh.upstream']))
+    } else if (isObject(manifest.repository) && typeof manifest.repository.url === 'string' && manifest.repository.url.includes(url.hostname + url.pathname)) {
+      details.push(detail('C-13.3', 'FAIL', 'dsh.upstream points at the package itself', ['package.json#dsh.upstream']))
+    } else if (!labels.list.includes('mirror')) {
+      details.push(detail('C-13.2', 'FAIL', 'dsh.upstream is declared but the mirror label is missing', ['package.json#dsh.labels']))
+    }
+  }
+
+  if (!caps.defined) {
+    details.push(detail('C-13.2', 'WARN', 'dsh.capabilities is absent; trigger-to-label mapping cannot be evaluated', ['package.json#dsh.capabilities']))
+  } else if (!caps.error) {
+    const required = new Set()
+    if (caps.list.includes('system-prompt:write')) required.add('prompt-modification')
+    if (caps.list.includes('llm:adapter') && caps.list.includes('network:egress')) required.add('third-party-model-provider')
+    if (caps.list.includes('network:ingress')) required.add('remote-access')
+    for (const label of required) {
+      if (!labels.list.includes(label)) details.push(detail('C-13.2', 'FAIL', `capability trigger requires label ${label}`, ['package.json#dsh.labels']))
+    }
+  }
+
+  if (labels.list.includes('red-team') && manifest?.dsh?.usageScope === undefined) {
+    details.push(detail('C-13.5', 'WARN', 'red-team label without dsh.usageScope', ['package.json#dsh.labels']))
+  }
+  if (details.length === 0) details.push(detail('C-13.1', 'PASS', 'dsh.labels is declared and consistent with capability triggers'))
+
+  const result = worst(details.map(item => item.result))
+  return check({
+    id: 'DSC-13', clause: 'C-13', layer: 'L0', result,
+    reason: details.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details,
+    evidence: ['package.json#dsh.labels', 'package.json#dsh.upstream'],
+  })
+}

package/40-checker/src/index.mjs

@@ -0,0 +1,8 @@
+/** Programmatic API for dsh-plugin-verify. */
+export { main, parseArgs, usage, VERSION } from './cli.mjs'
+export { runManifestChecks, checkMarketEntry, DEFAULT_RUNTIME_VERSION, inferKind, resolveEntry } from './manifest.mjs'
+export { checkCapabilities, checkCredentials, checkLabels, checkImportTimeAdvisory, CAPABILITIES, LABELS } from './declarations.mjs'
+export { runRuntimeChecks } from './runtime.mjs'
+export { buildReport, formatText, formatSarif, writeReport } from './report.mjs'
+export { satisfies, validRange, parseVersion, compareVersions } from './semver.mjs'
+export { parseInstallSpec } from './install-spec.mjs'

package/40-checker/src/install-spec.mjs

@@ -0,0 +1,67 @@
+/**
+ * Minimal port of plugin-manager/src/install-spec.ts:69 (parseInstallSpec).
+ * The checker must not import the host TypeScript source (it is not built in
+ * a plugin checkout), so this file reimplements the accepted forms and
+ * refusal rules. It is deliberately narrower: it also requires a pinned
+ * reference for git specs, which DS-C C-3 requires.
+ */
+
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/
+const PACKAGE_NAME_MAX_LENGTH = 214
+const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i
+const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i
+const HOSTED_REPOSITORY_URL = /^https?:\/\/[^/]+\/[^/]+\/[^/#]+(?:\.git)?(?:#.*)?$/i
+const TARBALL_SPEC = /\.(?:tgz|tar\.gz)(?:#.*)?$/i
+const COMMIT = /^[0-9a-f]{40}$/
+
+export class InvalidInstallSpec extends Error {
+  constructor(spec, reason) {
+    super(`invalid install spec: ${reason}: ${spec}`)
+    this.name = 'InvalidInstallSpec'
+    this.spec = spec
+    this.reason = reason
+  }
+}
+
+function fail(spec, reason) {
+  throw new InvalidInstallSpec(spec, reason)
+}
+
+/**
+ * @param {string} raw
+ * @returns {{kind:'registry'|'path'|'tarball'|'git', spec:string, name?:string, range?:string, path?:string, host?:string, commit?:string, pinned:boolean}}
+ */
+export function parseInstallSpec(raw) {
+  if (typeof raw !== 'string') fail(String(raw), 'the spec must be a string')
+  const spec = raw.trim()
+  if (spec === '') fail(spec, 'the package spec must not be empty')
+
+  const path = spec.replace(/^(?:file|link):/, '')
+  if (path !== spec || /^(?:\/|[A-Za-z]:[\\/])/.test(spec)) {
+    if (!/^(?:\/|[A-Za-z]:[\\/])/.test(path)) fail(spec, 'a local path must be absolute')
+    if (TARBALL_SPEC.test(path)) return { kind: 'tarball', spec, path, pinned: true }
+    return { kind: 'path', spec, path, pinned: true }
+  }
+  if (/^\.{1,2}(?:[\\/]|$)/.test(spec)) fail(spec, 'a local path must be absolute')
+
+  const git = GIT_SHORTHAND.test(spec) || GIT_URL.test(spec) || HOSTED_REPOSITORY_URL.test(spec)
+  if (git && !TARBALL_SPEC.test(spec)) {
+    if (!/#[0-9a-f]{40}$/.test(spec)) fail(spec, 'a git spec must pin a 40-hex-digit commit (no HEAD/branch/tag)')
+    return { kind: 'git', spec, host: 'git', commit: spec.slice(-40), pinned: true }
+  }
+  if (/^https?:\/\//i.test(spec)) {
+    if (TARBALL_SPEC.test(spec)) return { kind: 'tarball', spec, host: new URL(spec).host, pinned: true }
+    fail(spec, 'a URL must point at a git repository or a tarball')
+  }
+
+  const at = spec.indexOf('@', 1)
+  const name = at === -1 ? spec : spec.slice(0, at)
+  const range = at === -1 ? undefined : spec.slice(at + 1)
+  if (name.length > PACKAGE_NAME_MAX_LENGTH || !PACKAGE_NAME.test(name)) {
+    fail(spec, 'not a package name the registry accepts')
+  }
+  if (range === '') fail(spec, 'a version after @ must not be empty')
+  return range === undefined
+    ? { kind: 'registry', spec, name, pinned: false }
+    : { kind: 'registry', spec, name, range, pinned: !/^(?:latest|next|beta|canary|\*|x)$/i.test(range) }
+}