Host execution boundaryPackage scripts execute during installation. Loaded Host plugins execute with the dsh process. The Agent tool sandbox contains neither boundary.

A green verdict needs an artifact identity.

A runtime-tested catalog is better discovery evidence than stars. It still cannot approve an install unless the verdict binds the exact bytes now selected.

Catalogsnapshot digest
+
Sourcerepository + full commit
+
Packageversion + integrity
+
Testrunner + suite + time
Discovered

An identity appeared in a source.

Installable

One exact transaction composed.

Runtime-compatible

Pinned bytes passed a declared matrix.

Security-reviewed

A scoped threat model was evaluated.

A marketplace is also a mutation control plane.

PackageInstall + update

Lifecycle code, dependency closure, Bundle membership, and partial transactions.

ProfileDisable + force-enable

Parsed patch edits, row authorization, revision conflicts, and atomic replacement.

IdentityPrincipal + grant

Same-origin blocks one CSRF class. It does not authorize an operator or profile.

RecoverySnapshot + inverse

Timeout, crash, cold restart, cleanup, and exact known-good restoration.

candidate = catalog digest + commit + version + integrity
approval  = principal + profile + action + candidate + expiry
result    = manifest/lock/patch revisions + verification + rollback

Pass six gates in order.

  1. 01Discover

    Use topics and lists to find candidates, not to approve them.

  2. 02Resolve

    Match repository, package, exact version, integrity, and maintainer.

  3. 03Inspect

    Read the published tarball and lifecycle scripts without executing them.

  4. 04Map

    Inventory services, tools, credentials, network, files, UI, and persistence.

  5. 05Isolate

    Install one exact candidate into a disposable profile and workspace.

  6. 06Decide

    Verify denial, restart, disposal, removal, and known-good restoration.

Read registry metadata first.

npm view <package>@<version> \
  name version dist.integrity dist.tarball \
  repository.url license scripts \
  dependencies peerDependencies --json

Inspect exact bytes without scripts.

audit_dir=$(mktemp -d)
npm pack --ignore-scripts --pack-destination "$audit_dir" \
  <package>@<version>
tar -tf "$audit_dir"/*.tgz
Repository reviewWhat the author shows
+
Tarball reviewWhat the registry ships
+
IntegrityWhich bytes you pinned

Map effects beyond the Tool schema.

HostFiles + processes

Module scope, apply lifecycle, subprocesses, timers, and cleanup.

SecretsCredentials + network

Sources, destinations, transmitted data, and failure logging.

RuntimeServices + tools

Required/provided services, names, schemas, policy hooks, and conflicts.

ProductUI + persistence

Replaced slots, settings, durable events, databases, and migrations.

A bundle can replace the Agent's world.

The inspected @struktoai/mirage-dsh@0.0.1 artifact intentionally disables five core rows and inserts alternate filesystem and shell providers. The patch documents that design; the install command does not present the resulting capability diff as an approval boundary.

Diff before the first boot.

new rowAdded effectService, tool, UI, process, or network
disabledCapability removedEvaluate per operating system
providerTrust domain changedSame tool, different world
configDefaults replacedExpressions may disappear
dsh --profile plugin-lab --dump-config > effective-before.yml
dsh plugin --profile plugin-lab add pkg@1.2.3
dsh --profile plugin-lab --dump-config > effective-after.yml
diff -u effective-before.yml effective-after.yml

Install one exact candidate.

BeforeKnown-good dumpdsh --profile plugin-lab --dump-config > before.yml
→
ChangeExact packagedsh plugin --profile plugin-lab add pkg@1.2.3
→
AfterDiff then bootdsh --profile plugin-lab --dump-config > after.yml

Discovery signals are not safety claims.

Stars

Attention, not artifact integrity.

Curated

Navigation, not a current code audit.

Install succeeds

pnpm completed, not that the graph boots.

Tool looks safe

The schema omits module-scope and lifecycle effects.

Stop on unexplained code.

A mismatched repository, hidden executable, unpinned download, broad credential access, dynamic network destination, or missing cleanup path ends the install review.

Primary evidence.

Audit the graph the Agent receives.

The canonical guide includes exact-artifact inspection, core-row tracking, platform-aware composition diffs, real workspace probes, cleanup tests, and a reusable evidence record.

Read the complete guide on GitHub