@Zoria-Lind/behavior-enhancer-generic

resolveKernelModule() is called during apply() (failureGuard.js and verifyLoop.js) and does `const req = createRequire(anchor); req.resolve(name); return req(name)` for '@deepseek-ai/dsh-llm'. If DSH_ROOT, DSH_HOME or APPDATA point at a directory the attacker can write, code from that directory executes inside the DSH process at plugin load. Precondition is control of the process environment or write access to those directories (same-user), so this is a hardening gap rather than a remote vector.

pre_tool_use.cjs (line ~106, `const snap = St.snapshot(filePath)`) snapshots every target path of Write/Edit/apply_patch, including files outside the project such as .env or credential configs. Copies land in a home-directory folder created with default umask permissions and no rotation/cleanup exists in the harvested code, so sensitive content is duplicated at rest outside the working tree. rollback() (line 141) can also restore stale content but is only exported and not invoked by the harvested hooks.

The hardGate is documented as a soft gate, but concretely an agent that repeats a matched destructive command (rm -rf, Remove-Item -Recurse, format, del /f) is denied only 3 times and then executed without approval; the Codex path in pre_tool_use.cjs (line ~37-39) has the same escape via S.MAX_STRIKES. Combined with the narrow heuristic regex list, the control is advisory only, so users must not treat it as a safety boundary.