Showcase: an exact dependency alert reaches a real DSH Agent

[MicroMilo]

Upstream Radar is a DSH bundle for monitoring the dependencies that are actually installed inside a DSH plugin.

The reproducible proof in this repository starts a real DSH headless profile with the packed bundle and a deterministic local DeepSeek-compatible model stub. It verifies four things:

• the bundle is installed by DSH;
• a plugin-originated Radar task reaches the DSH Agent;
• the source attribution is preserved;
• the durable task is cleared after delivery.

Run it from a clone:

corepack enable
pnpm install --frozen-lockfile
pnpm run try:dsh

For a real profile, install the bundle and generate an inventory from the profile instead of hand-writing the dependency graph:

dsh plugin --profile web add upstream-radar@latest
pnpm dlx upstream-radar@latest init --profile web --project-name "My DSH project" --workspace "$PWD" --output ./upstream-radar.config.json

The model is used for project-specific judgment only. Exact versions, installed paths, vulnerability matches, and compatibility signals are calculated by code. If you are running DSH plugins, what dependency or release signal would you want Radar to explain first?