DSH Get Plugin v0.2.0

Installation evidence audit

/dshget install now produces a six-section post-install evidence report:

• exact installed package/version, Git commit, tarball, lock resolution, and registry dist.integrity when available;
• catalog repository versus installed package metadata comparison;
• selected-package lifecycle scripts, pnpm allowBuilds state, and the DSH Host permission boundary;
• dsh.bundle.patch rows added or overridden;
• redaction-safe before/after dsh --dump-config path diff and SHA-256 snapshots;
• exact removal command and a known-good local restoration record.

Audit JSON is written atomically with mode 0600 under $DSH_HOME/cache/dshget/install-audits/. Raw effective configuration values are not persisted.

This is evidence and visibility, not sandboxing or a security review. Catalog inclusion and audit output are not an endorsement. Packages may run lifecycle scripts during installation, and loaded Host plugins run with the permissions of the dsh process.

Verification

• 21 tests pass.
• Embedded catalog: 2,460 entries, 1,855 installable.
• CI passes on Node.js 22.19 and 24.
• Final tarball was installed into an isolated DSH Web profile and appeared in the effective configuration.