upstream-radar 0.37.0 → 0.39.0

package/README.md

@@ -10,7 +10,7 @@ Upstream Radar is not another package-name vulnerability scanner. It follows one
 
 | Product job | What Radar establishes |
 | --- | --- |
-| **DSH compatibility / admission** | Whether the exact published bundle can be registered and loaded by the DSH releases you care about. |
+| **DSH compatibility / admission** | Whether the exact published bundle can be installed, registered, and loaded by the DSH releases you care about, with an isolated execution lane for behavior evidence. |
 | **Real dependency graph** | Which exact package versions and physical paths the plugin brings into the DSH profile, including unresolved edges. |
 | **Continuous upstream monitoring** | Whether an advisory, npm release, DSH/Cordis change, or breaking signal changes the old → new situation. |
 | **Author-facing repair** | Which plugin, dependency path, version, lockfile, or DSH declaration gives the author a concrete next fix. |
@@ -21,7 +21,7 @@ The deterministic scanner establishes package, graph, advisory, and compatibilit
 
 ```mermaid
 flowchart TD
-  A["DSH plugin source or exact npm artifact"] --> B["DSH compatibility / admission check"]
+  A["DSH plugin source or exact npm artifact"] --> B["Static review + DSH compatibility check"]
   B --> C["Build the real plugin → dependency graph"]
   C --> D["Monitor advisories, npm, DSH and Cordis changes"]
   D --> E{"Meaningful affected change?"}
@@ -63,26 +63,67 @@ baseline report, and defined in [`schemas/upstream-downstream-ir.schema.json`](s
 
 ```bash
 # No DSH profile, API key, or network state required
-npx --yes upstream-radar@0.37.0 demo
+npx --yes upstream-radar@0.39.0 demo
 
 # Scan a public DSH plugin repository without installing it
-npx --yes upstream-radar@0.37.0 scan \
+npx --yes upstream-radar@0.39.0 scan \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --fail-on never
 
 # Review a real browser plugin users would install, then check two DSH releases
-npx --yes upstream-radar@0.37.0 review dsh-plugin dsh-cloudflare-browser-run@0.1.1 \
+npx --yes upstream-radar@0.39.0 review dsh-plugin dsh-cloudflare-browser-run@0.1.1 \
   --dsh-version 0.1.0-rc.6,0.1.0-rc.7
 ```
 
 The important output is evidence, not a green badge: exact package identity, dependency paths, unresolved edges, install-time scripts, npm integrity/signature/provenance, advisory matches, and DSH load results.
 
+## The isolated execution lane
+
+Static metadata tells us that a lifecycle script exists; it cannot tell us what
+actually ran. The new [`dsh-install` workflow](.github/workflows/observe-dsh-plugin-install.yml)
+therefore uses a separate, deliberately untrusted lane:
+
+```text
+fresh GitHub-hosted VM (no secrets, read-only repository token)
+  → restricted container (no host workspace or Docker socket)
+  → npm pack exact package@version with scripts disabled
+  → record the exact Node and pnpm runtime used by the check
+  → DSH installs that same tarball with only the declared dependency-build approvals
+  → strace records child processes, network destinations and file writes
+  → DSH loads the registered bundle under the same exact release
+  → bounded JSON report survives and a non-compatible pair fails the check
+  → the container and VM are discarded
+```
+
+Use **Actions → Observe one DSH plugin install** and supply one exact plugin and
+one exact DSH version. The CLI also exposes `probe dsh-install`, but it refuses
+to run unless both `--execute` and `UPSTREAM_RADAR_ISOLATED_RUNNER=1` are present;
+it is not intended as a normal laptop command.
+
+This lane is wired into the always-on observer. Radar now watches the official
+`@deepseek-ai/dsh` `next` release channel (current DSH releases are prereleases
+rather than npm `latest`). A new exact DSH publication fans out the small
+[maintained plugin corpus](examples/dsh/install-observer/targets.json), one fresh
+VM per plugin. A mapped plugin publication retests only that plugin. Unchanged
+evidence keeps `observations.json` byte-stable, persistent source/publish drift
+does not wake the Agent again, and the DSH Agent/API key never enters the execution job.
+Build-script approvals are exact package names stored in the maintained target
+and copied into every report; an absent list approves nothing.
+
+The first implementation is intentionally honest about its limit: a container
+shares the hosted VM's kernel, and same-container `strace` evidence is not
+tamper-proof against determined malicious code. The outer VM is disposable and
+secret-free; a Firecracker collector is the later high-assurance backend, not a
+claim made by this report. See the [execution boundary and result semantics](examples/dsh/install-observer/README.md)
+and [`dsh-install-observation.schema.json`](schemas/dsh-install-observation.schema.json).
+
 ## What we have already found
 
 These are real, reproducible cases in this repository—not synthetic “vulnerable package” demos.
 
 | Case | Finding | Why it matters |
 | --- | --- | --- |
+| [Live DSH `0.1.1-rc.1` isolated matrix](examples/dsh/install-observer/reports/2026-08-21-dsh-0.1.1-rc.1.md) | All three maintained plugins install/register/load under their recorded contracts; Feishu's raw control fails until its documented `protobufjs` approval is supplied | This is the first always-on behavior result: Radar preserves a red negative control without mislabeling a documented install policy as a new author defect. |
 | [`dsh-cloudflare-browser-run@0.1.1`](examples/reports/dsh-cloudflare-browser-run-0.1.1.txt) | 18 resolved packages, 2 unresolved optional Cordis edges, 0 known vulnerabilities, and DSH rc.6/rc.7 both loaded the bundle | A real browser plugin demonstrates the DSH admission boundary and why incomplete edges stay visible. |
 | [50-plugin batch](examples/dsh/reports/dsh-batch-50-2026-08-17.md) / [real graph corpus](examples/dsh/first-batch/README.md) | 50 source scans, 30 exact npm reviews, 37 real plugin graphs indexed; 13 targets kept as missing evidence | The reverse index is now built from real DSH plugins, and missing graphs are not treated as clean. |
 | [`dsh-feishu-bot@0.15.8`](examples/dsh/reports/dsh-feishu-bot-0.15.8-review-2026-08-18.md) | 89-package graph, 12 unresolved optional edges, reachable `protobufjs` `postinstall`, DSH rc.6/rc.7 compatible | “No known CVE” is not the same as “no installation trust boundary.” |
@@ -91,6 +132,30 @@ These are real, reproducible cases in this repository—not synthetic “vulnera
 
 We report a confirmed vulnerability only when the affected exact version and runtime path are supported by the available evidence. Development-only hits, missing data, and advisory-source outages remain visibly different states.
 
+## Monitor the findings we already found
+
+The repository now has a focused watch for seven real DSH plugins from the first
+batch. It re-runs the source scan and the exact npm artifact review, then stores
+only trusted observations in [`state.json`](examples/dsh/finding-watch/state.json)
+and writes the current author-facing result to
+[`report.md`](examples/dsh/finding-watch/report.md).
+
+```bash
+pnpm run monitor:dsh-findings
+```
+
+The watch distinguishes `persisting`, `added`, `resolved`, `changed`, and
+`unknown`. A failed registry request never becomes “resolved”; a source fix also
+does not erase a finding that remains in the published npm artifact. The same
+loop runs daily in [the dedicated GitHub Actions workflow](.github/workflows/dsh-finding-watch.yml)
+and commits the state only when a trusted observation changes. It does not install
+plugins, execute lifecycle scripts, load DSH, or call an LLM.
+
+The current run is already useful: `dsh-msg-hub@0.1.8` has removed the old source
+lockfile findings, but its npm artifact still reaches `protobufjs@7.6.5` with a
+`postinstall`; `dsh-wsl-workspace` now resolves `koffi@3.1.6`, while the native
+install step remains. The other reviewed install/lifecycle findings persist.
+
 ## The dependency graph behind every alert
 
 ```text
@@ -107,11 +172,11 @@ Two copies of `parser` are different nodes. An alert names the exact version and
 For a collection of saved reports, build the reverse index that turns an upstream package update into affected plugins:
 
 ```bash
-npx --yes upstream-radar@0.37.0 graph reverse ./reports \
+npx --yes upstream-radar@0.39.0 graph reverse ./reports \
   --output reverse-dependency-index.json
 
 # Ask: which plugins currently depend on this exact package?
-npx --yes upstream-radar@0.37.0 graph reverse ./reports \
+npx --yes upstream-radar@0.39.0 graph reverse ./reports \
   --package parser@2.9.0
 
 # Rebuild the checked-in index from the real first 50 DSH plugin reports
@@ -130,7 +195,7 @@ To route an upstream old → new change to that index, pass it to the always-on
 observer:
 
 ```bash
-npx --yes upstream-radar@0.37.0 observe ./targets.yml \
+npx --yes upstream-radar@0.39.0 observe ./targets.yml \
   --reverse-index ./reverse-dependency-index.json \
   --state ./observations.json \
   --report ./upstream-radar-observer.md
@@ -156,7 +221,7 @@ replay baseline → one Agent task → quiet run without network access.
 The repository already contains a reusable, composite Action in [`action.yml`](action.yml). It runs the same frozen Radar check in CI and writes a short Job Summary.
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.39.0
   with:
     config: upstream-radar.config.json
     fail-on: high
@@ -170,8 +235,9 @@ See the [consumer workflow](examples/github-actions/consumer/README.md) for conf
 | --- | --- |
 | Reconstruct exact npm/pnpm dependency paths | An empty finding list is a safety certificate |
 | Query OSV and GitHub Advisory evidence for exact versions | A missing provenance statement proves maliciousness |
-| Compare source and published artifact evidence | Static review replaces sandboxing or runtime testing |
-| Check DSH bundle/profile compatibility without business execution | “Compatible” means the plugin is secure |
+| Compare source and published artifact evidence | Static review replaces runtime evidence |
+| Observe exact install/load behavior in a disposable VM and restricted container | One observed run proves adversarial code is safe |
+| Check DSH bundle/profile compatibility without business actions | “Compatible” means the plugin is secure |
 | Monitor old → new upstream observations | An LLM can repair evidence that was never collected |
 
 ## Install and connect to DSH
@@ -180,7 +246,7 @@ See the [consumer workflow](examples/github-actions/consumer/README.md) for conf
 pnpm add upstream-radar
 
 # Generate a reviewable DSH profile inventory from the installed profile
-npx --yes upstream-radar@0.37.0 setup
+npx --yes upstream-radar@0.39.0 setup
 ```
 
 For Feishu/webhook routing, DSH Agent handoff, observer state, report schemas, and troubleshooting, use the [full Chinese guide](docs/README.zh-CN.md). The [architecture notes](docs/architecture.md) explain the boundaries and evidence model.

package/dist/src/cli.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import process from 'node:process';
 import { spawnSync } from 'node:child_process';
-import { access, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { access, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { renderCompatibilityBenchmark, runCompatibilityBenchmark } from './compatibility-benchmark.js';
 import { assessCompatibilityChange } from './compatibility.js';
 import { probeDshLoad, probeDshLoadMatrix, renderDshLoadMatrix, renderDshLoadProbe } from './dsh-probe.js';
+import { observeDshPluginInstall, renderDshInstallObservation, } from './dsh-install-observation.js';
 import { renderDshPluginReview, reviewDshPlugin } from './dsh-review.js';
 import { createAnalysisTask, renderAgentAnalysisPrompt } from './dsh-analysis.js';
 import { createDshCaseReport, renderDshCase } from './dsh-case.js';
@@ -271,9 +272,16 @@ third-party bundles is selected automatically.
 Usage:
   upstream-radar probe dsh-load <package.tgz> [--dsh-version <exact-version>] [--json]
   upstream-radar probe dsh-matrix <package.tgz> --dsh-version <v1>,<v2>,... [--json]
-
-The probe is bounded and isolated. It is a compatibility/load check, not a
-semantic safety review or a substitute for dependency monitoring.
+  upstream-radar probe dsh-install [npm:]<package>@<exact-version>
+    --dsh-version <exact-version> --isolation-provider <provider> --execute
+    [--allow-build <package>]... [--timeout <seconds>] [--report <report.json>] [--json]
+
+The load probes disable lifecycle scripts and check bundle registration/load.
+The dsh-install probe deliberately executes the exact plugin's lifecycle scripts
+and loads the bundle while recording Linux process, network, and file-change
+evidence. Run it only inside a disposable, secret-free Linux environment. It
+requires both --execute and UPSTREAM_RADAR_ISOLATED_RUNNER=1.
+Radar records the caller's isolation-provider claim but cannot verify it.
 `,
         review: `Upstream Radar — review one exact published DSH plugin in one command
 
@@ -469,6 +477,7 @@ Usage:
   upstream-radar profile-check [profile-directory] [--patch <path>] [--report <path>] [--summary] [--json]
   upstream-radar probe dsh-load <package.tgz> [--dsh-version <exact-version>] [--timeout <seconds>] [--keep-profile] [--json]
   upstream-radar probe dsh-matrix <package.tgz> --dsh-version <v1>[,<v2>,...] [--timeout <seconds>] [--keep-profile] [--json]
+  upstream-radar probe dsh-install [npm:]<package>@<exact-version> --dsh-version <exact-version> --isolation-provider <github-actions-hosted-runner|firecracker|other> --execute [--allow-build <package>]... [--timeout <seconds>] [--report <report.json>] [--json]
   upstream-radar review dsh-plugin [npm:]<package>@<exact-version> --dsh-version <v1>,<v2>,... [--json]
   upstream-radar demo [--json]
   upstream-radar case dsh-web-ui [--json]
@@ -1203,6 +1212,8 @@ async function runDshCase(args) {
 }
 async function runProbe(args) {
     const mode = args[0];
+    if (mode === 'dsh-install')
+        return runDshInstallObservation(args.slice(1));
     if (mode !== 'dsh-load' && mode !== 'dsh-matrix')
         throw new Error('probe requires dsh-load or dsh-matrix');
     const packagePath = args[1];
@@ -1267,6 +1278,85 @@ async function runProbe(args) {
     process.stdout.write(json ? `${JSON.stringify(report, null, 2)}\n` : renderDshLoadMatrix(report));
     return report.result === 'compatible' ? 0 : report.result === 'incompatible' ? 2 : 1;
 }
+async function runDshInstallObservation(args) {
+    const packageSpec = args[0];
+    if (packageSpec === undefined || packageSpec.startsWith('-')) {
+        throw new Error('probe dsh-install requires an exact npm package');
+    }
+    let dshVersion;
+    let isolationProvider;
+    let timeoutSeconds = 180;
+    let reportPath;
+    const allowedBuilds = [];
+    let execute = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--execute') {
+            execute = true;
+        }
+        else if (argument === '--json') {
+            json = true;
+        }
+        else if (argument === '--dsh-version' || argument === '--isolation-provider' || argument === '--allow-build' || argument === '--timeout' || argument === '--report') {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith('-'))
+                throw new Error(`${argument} requires a value`);
+            if (argument === '--dsh-version') {
+                if (dshVersion !== undefined)
+                    throw new Error('probe dsh-install accepts only one --dsh-version');
+                dshVersion = value;
+            }
+            else if (argument === '--isolation-provider') {
+                if (value !== 'github-actions-hosted-runner' && value !== 'firecracker' && value !== 'other') {
+                    throw new Error('--isolation-provider must be github-actions-hosted-runner, firecracker or other');
+                }
+                isolationProvider = value;
+            }
+            else if (argument === '--timeout') {
+                const parsed = Number(value);
+                if (!Number.isSafeInteger(parsed) || parsed < 30 || parsed > 600) {
+                    throw new Error('--timeout must be an integer between 30 and 600 seconds');
+                }
+                timeoutSeconds = parsed;
+            }
+            else if (argument === '--allow-build') {
+                allowedBuilds.push(value);
+            }
+            else {
+                reportPath = value;
+            }
+            index += 1;
+        }
+        else {
+            throw new Error(`unknown option for probe dsh-install: ${argument}`);
+        }
+    }
+    if (dshVersion === undefined)
+        throw new Error('probe dsh-install requires one exact --dsh-version');
+    if (isolationProvider === undefined)
+        throw new Error('probe dsh-install requires --isolation-provider');
+    if (!execute)
+        throw new Error('probe dsh-install requires --execute because third-party code may run');
+    if (process.env.UPSTREAM_RADAR_ISOLATED_RUNNER !== '1') {
+        throw new Error('probe dsh-install requires UPSTREAM_RADAR_ISOLATED_RUNNER=1 in the disposable environment');
+    }
+    const report = await observeDshPluginInstall({
+        packageSpec,
+        dshVersion,
+        allowExecution: true,
+        isolationProvider,
+        allowedBuilds,
+        timeoutMs: timeoutSeconds * 1_000,
+    });
+    if (reportPath !== undefined) {
+        const absoluteReportPath = resolve(reportPath);
+        await mkdir(dirname(absoluteReportPath), { recursive: true });
+        await writeFile(absoluteReportPath, `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 });
+    }
+    process.stdout.write(json ? `${JSON.stringify(report, null, 2)}\n` : renderDshInstallObservation(report));
+    return report.result === 'compatible' ? 0 : report.result === 'unknown' ? 1 : 2;
+}
 async function runDshPluginReview(args) {
     if (args[0] !== 'dsh-plugin')
         throw new Error('review requires dsh-plugin');