Case Study: dsh-shelf

This case study records a public, exact-artifact compatibility finding. It is community evidence for the value of a real-host lifecycle gate, not a ranking, security assessment, certification, or endorsement.

Finding

dsh-shelf@0.7.0 installed and assembled successfully, but the real DSH host run stopped before registration. The published bundle accessed ctx.baseDir. In the DSH host, an unknown context property is treated as an injection lookup, so the run failed with:

cannot get property "baseDir" without inject

The result came from an immutable published artifact, not a checkout. The failure was recorded with the exact DSH host, runner, package artifact, stage, and machine-readable evidence. It is an environment-bound compatibility finding, not a claim that the plugin is universally defective.

Source report and maintainer discussion: zoahdev/dsh-shelf#1. The original ecosystem report is also recorded in DeepSeek Harness discussion #2088.

Maintainer response

The maintainer confirmed the supported path contract:

config.profileDir ?? ctx.dshHomePath?.() ?? join(homedir(), '.dsh')

The source fix is on commit b5a34e8, with a regression test that never probes the uninjected baseDir service. The local shelf suite passed 16/16. The issue remains open until the fix is published as a new immutable package artifact and that exact artifact is rerun.

Why this matters

This is the useful lifecycle boundary in one sequence:

1. package installation and bundle assembly pass;
2. the real host catches a registration-time incompatibility;
3. the maintainer receives an actionable, reproducible report;
4. the fix is made against the host contract;
5. the release gate is rerun against the published fix, rather than trusting source-only tests.

The next rerun uses the current Testkit release, an explicit supported DSH version, and a package version higher than dsh-shelf@0.7.0 once it is available. The design-partner follow-up gate records the required package identity and prevents a source-only fix from being reported as a package pass.

Scope boundary

The case is intentionally narrow. It does not certify dsh-shelf, DSH, or any other plugin; it does not prove security properties; and it does not replace the maintainer's own test suite. It shows that testing a released bundle in a disposable real host can find a defect that install-time and source-local tests miss.