Verification Record

Updated: 2026-08-22 · Verified on Node 24 / pnpm 11 and dsh CLI 0.1.0-rc.6

1. TypeScript build

pnpm run build

Result: tsc -p tsconfig.json exits 0, emits lib/ with index.js, github.js, and type declarations.

2. Unit tests

pnpm test

Result: 4 test files, 52 tests, all passed. Coverage includes authenticated notification parsing and attention grouping, notification-token enforcement, community-profile parsing, transparent repository-health scoring, extended repo parsing, issue/PR filtering, contributors, commits, TTL caching, rate-limit/404 errors, the deep report + weekly digest, catalog completeness, generated-tool execution, and input validation.

In addition, every v2.3.0 tool passed a real-network smoke against the public GitHub API (scripts/v230-network-smoke.mjs): github_user_repositories, github_user_social_accounts, github_repo_releases, github_repo_issues, github_repo_pulls, github_repo_contributors, github_repo_subscribers, github_repo_collaborators, github_repo_git_refs, github_repo_punch_card (168 punches), github_repo_security_advisories, and github_search_repositories.

The v2.4.0 smoke (scripts/v240-network-smoke.mjs) covers all 27 v2.3.0 + v2.4.0 tools against their real public APIs (GitHub, GitLab, Gitee, npm, Stack Exchange, dev.to; Reddit skipped on networks that block it): 25/25 passed on this machine, including so_question_answers (5 real answers), so_top_tags (10 real tags), gitlab_project_* (5 each), npm_package_dependencies (real dependency list), and dev.to article/user. The smoke also verified the limit fix: GitHub list tools now return exactly the requested count instead of the API's default page.

The v2.5.0 smoke (scripts/v250-network-smoke.mjs) extends that to 30 tools: rubygems_search and rubygems_gem against the real RubyGems API, and nuget_search against the real NuGet search service. Bitbucket Cloud was probed but not shipped: its public API now returns 404/410 for anonymous access (probe-v240b-era finding, re-verified 2026-08-15).

The v2.6.0 smoke (scripts/v260-network-smoke.mjs) extends that to 35 tools: crates_crate_versions against crates.io, gitee_repo_contributors, gitlab_project_tags, and so_related_tags all passed against real APIs. go_module_latest was verified against the official Go module proxy via a urllib probe (response {Version, Time}), but Node fetch from this network intermittently cannot reach proxy.golang.org, so it is reported as SKIP here. Maven Central (repeated timeouts) and Hugging Face /api/tags (401) were probed and rejected.

The v2.7.0 github_weekly_digest was executed against the real GitHub API on deepseek-ai/deepseek-harness (14-day window): 30 commits returned, releases/issues/pulls surfaces tolerated (the repository has pull requests and issues disabled). A unit test covers the 404-tolerance path.

The v2.8.0 smoke (scripts/v280-network-smoke.mjs) extends that to 37 tools: npm_downloads_last_day and npm_downloads_range passed against the real npm downloads API (lodash, 8 daily points). Stack Exchange /search/answers (HTTP 400), the crates.io dependencies endpoint (unreachable from this network), and dev.to podcast episodes (unreachable) were probed and rejected.

3. Package and install into a dsh profile

pnpm pack
dsh plugin --profile web add ./dsh-github-intelligence-1.0.0.tgz

Result: package added to the web profile; dsh --profile web --dump-config shows the github-intelligence layer after @deepseek-ai/dsh-base.

4. Boot the web app with the plugin loaded

dsh web --port 4111

Result: dsh web: http://127.0.0.1:4111; GET / returns HTTP 200. No plugin load errors. All tools register during apply(); a schema/registration failure would abort boot.

Agent-visibility verification (2026-08-15)

scripts/visibility-check.mjs mounts a real Cordis context, the real @deepseek-ai/dsh-tools ToolRuntime, and a scoped agent context, then asserts github_repo_report, github_weekly_digest, github_notifications, github_repo_health, github_repo_languages, and github_help are visible in ctx.tools.schemas(scope) — 201 tools total. This closes the registry-level half of the dual-instance concern (discussions #1697/#1782); the remaining caveat is that a full interactive agent session is not exercised in CI.