chore: sanitize "com.decentraland.pulse.transport" from unity-unrelated stuff

[mikhail-dcl]

Move unity-unrelated files from the package folder

[github-actions]

🚦 CI Status

New build in progress, come back later!

No C# files changed — lint ratchet skipped.

All Unity tests passed ✅

TESTS SUITE	Result	Passed	Failed	Skipped
EditMode	✅ Passed	24971	0	13
PlayMode	✅ Passed	236	0	36

[claude]

Claude finished @mikhail-dcl's task in 2m 45s —— View job

---

Security-focused dependency review

• Gather context (PR diff vs origin/dev)
• Step 1 — identify all dependency changes
• Step 1.5 — registry / source-repo metadata lookup (network access not granted — see Limitations)
• Step 2 — assess provenance, capability, shipping impact, transitive risk
• Step 3/4 — classify and post verdict

---

Summary

Dependency / file	Version (before → after)	Source	Type	Scope	Risk	Evidence
com.decentraland.pulse.transport	…/DCLPulse.Transport.Shared#efe92879… → …/DCLPulse.Transport/Package (no ref)	git — github.com/decentraland/Pulse.git	source code (UPM package)	runtime, ships in retail client	HIGH	HIGH (manifest is explicit)
packages-lock.json hash	efe92879d9c… → 994b07ee161c63bf3d2508902ec77c4fad3d4009	git	—	—	MEDIUM	HIGH for the hash, LOW for its contents

No binaries added. No .asmdef changes. No editor/build/install scripts. No workflow or prompt files touched. "dependencies": {} on the lock entry — no new transitive dependencies.

---

HIGH — the commit pin was dropped

Explorer/Packages/manifest.json:14

-"com.decentraland.pulse.transport": "…/Pulse.git?path=src/DCLPulse.Transport.Shared#efe92879d9c6765421841fa67cf994500772fc6b",
+"com.decentraland.pulse.transport": "…/Pulse.git?path=src/DCLPulse.Transport/Package",

The path move is the stated intent of the PR and is fine. The #<sha> suffix disappearing alongside it looks unintended — the PR body only mentions moving files, and nothing about the folder rename requires dropping the revision.

[PR] This entry has carried an explicit SHA for its whole history; every prior bump was a deliberate two-line SHA edit (18e08a31f: 536d308a… → efe92879…). This is the first change to remove it.

[PR] After this change, the only thing standing between a fresh resolve and whatever Pulse's default branch happens to point at is packages-lock.json. Unity re-resolves a revision-less git dependency to HEAD whenever the lock entry is absent or stale — a lock regenerated on a Unity upgrade, a merge conflict resolved by dropping the entry, a packages-lock.json deleted to unstick a resolve. The manifest and the lock now disagree in kind: floating declaration, pinned lock.

[PR] This is not a theoretical concern in this repo — 9cd17c96f ("chore: pin the floating git dependencies to their locked commits", branch chore/pin-floating-git-deps) exists precisely to close this hole across eleven other entries. This PR moves one entry the other way. Every other https://github.com/decentraland/* dependency in the manifest keeps an explicit ref (livekit-sdk, rpc-csharp, rust-ethereum, renum.sourcegen, clearscript).

[Inference] Blast radius is not small. This package is the network transport behind PulseMultiplayerService / ENet in Explorer/Assets/DCL/Multiplayer/Connections/Pulse/ — network-facing code that ships in the end-user desktop client on all platforms. A floating ref means an upstream commit can land in a user build with no PR, no diff, and no CI signal.

Recommendation — one-line fix. Re-append the hash the lock already resolved to, so manifest and lock agree:

"com.decentraland.pulse.transport": "https://github.com/decentraland/Pulse.git?path=src/DCLPulse.Transport/Package#994b07ee161c63bf3d2508902ec77c4fad3d4009",

Fix this →

---

MEDIUM — the new upstream contents are not reviewable from this PR

[UNKNOWN] The new commit 994b07ee161c… and the new path src/DCLPulse.Transport/Package live in decentraland/Pulse, which this PR does not vendor. I could not fetch it (no network in this run), so I cannot confirm the claim that the change is only a removal of unity-unrelated files.

Because the PR bundles a path move with a commit bump with a pin removal, "sanitize the folder" and "pull in new upstream code" are indistinguishable from the diff. Worth a maintainer confirming, from the Pulse side:

• src/DCLPulse.Transport/Package at 994b07ee contains the same C# sources as src/DCLPulse.Transport.Shared at efe92879, minus non-Unity files only — no added sources, no added package.json dependencies, no added editor scripts.
• The old src/DCLPulse.Transport.Shared path is retired upstream, so nothing else still resolves against it.
• 994b07ee is on a protected/default branch and not a transient one.

[PR] The lock entry records "dependencies": {}, so no new transitive packages enter the graph either way — that part is clean.

---

Provenance / capability / shipping (per checklist)

• A. Provenance — publisher is decentraland itself (first-party, same org as this repo), fetched over HTTPS from GitHub, source-visible UPM package, no vendored binaries. Trust in the publisher is high; trust in the specific bytes is what the missing pin gives up.
• B. Capability — [Inference] a network transport is expected to open sockets and send/receive UDP; that is proportionate to its stated purpose. Nothing in this diff adds capability. [UNKNOWN] whether 994b07ee introduces reflection, dynamic assembly loading, native plugins, or platform/region-conditional behaviour — not inspectable here.
• C. Shipping impact — runtime, all desktop targets, retail client. Not editor- or test-only.
• D. Maintenance / advisories / license — [UNKNOWN], first-party repo, no registry listing applies (git dependency, not a registry package).
• E. Transitive risk — none introduced; lock entry declares no dependencies.

---

Limitations

WebFetch, gh api repos/decentraland/Pulse, and git ls-remote were all denied in this run, so Step 1.5 (registry/upstream metadata) could not be executed. Everything above is grounded in the PR diff and this repo's history only. To let me verify upstream on a re-run, add WebFetch and Bash(gh api:*) to --allowedTools.

---

One blocking item, and it is a one-line fix: restore #994b07ee161c63bf3d2508902ec77c4fad3d4009 on the manifest entry. The folder sanitization itself is a good change.

DEPENDENCY_REVIEW: BLOCK
· branch chore/pulse-shared-transport-sanitized

[decentraland-bot]

Review — PR #9750: Sanitize "com.decentraland.pulse.transport" from unity-unrelated stuff

STEP 2 — Root-cause check: PASS

The PR re-points the com.decentraland.pulse.transport Unity package from the old path (src/DCLPulse.Transport.Shared) to the new path (src/DCLPulse.Transport/Package) within the same Pulse repository. The corresponding upstream commit (994b07ee) confirms this is a structural refactoring: "scope UPM package to Transport/Package, drop 'Shared' suffix" — moving the .csproj, bin/obj, and server-only WebTransport framing outside the UPM package path so Unity no longer imports them as assets.

This directly addresses the stated goal. The fix targets the cause (wrong package boundary in the upstream repo), not a symptom.

STEP 3 — Design & integration: PASS

No new systems, plugins, managers, services, or long-lived units are introduced. This is a package reference update only — no design concerns.

STEP 4 — Member audit: N/A

No public members added or changed.

STEP 5 — Line-level review

See inline comment below.

Security review

No security issues found. The change only updates a git URL path within the same public GitHub repository (decentraland/Pulse). No secrets, credentials, or sensitive data in the diff.

CI status

• semantic / title-matches-convention — failed. The PR title does not follow the <type>: <summary> convention. The branch name chore/pulse-shared-transport-sanitized correctly uses the chore/ prefix, so the title should be e.g. chore: sanitize com.decentraland.pulse.transport from unity-unrelated stuff.
• Other checks are pending or in progress.

---

REVIEW_RESULT: PASS ✅
COMPLEXITY: SIMPLE
COMPLEXITY_REASON: Only package manifest reference changes (2 config files, 6 lines), no runtime code modified.
QA_REQUIRED: YES

---

Reviewed by Jarvis 🤖 · Requested by decentraland-bot via GitHub