docs: record the dsh-wechat pilot reply

[rogerdigital]

Records the first external pilot reply: pan17/dsh-wechat#7 (comment).

• Zero-change result validated against release intent; the comparison saved a manual re-review.
• Per-PR summary would be used; all four requested properties match the diff's existing design.
• Action item recorded: surface "package-level static behavior only" on diff outputs and PR comparison sections.
• Verdict: used — validated; second release pending. M2 entry gate stays closed.

Docs only.

[github-actions]

dsh-vet report

Grade: A · coverage: unknown · audited dsh-vet · run · report uploaded as the dsh-vet-report artifact

critical	high	medium	low	info
0	1	0	1	2

Findings

• [H] egress.secret-adjacent — Network calls reachable from code that reads secrets (low confidence)
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
  • lib/index.mjs:2056 — ``${homedir()}/.dsh,
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
• [L] perm.undeclared-fs-write — Write/delete target is a runtime value — scope not statically verifiable (low confidence)
  • lib/index.mjs:843 — writeFileSync(abs, data);
  • lib/index.mjs:845 — if (mode & 73) chmodSync(abs, mode);
  • lib/index.mjs:921 — rmSync(dir, {

2 info findings (never affect the grade)

• perm.network-client — Opens network connections
• perm.subprocess-spawn — Spawns subprocesses

---

Findings are signals, not verdicts — a low-confidence finding never lowers a grade. A finding you believe is wrong? Open a public dispute.