dsh-agent-sentinel

pf.output is the raw stdout/report of the preflight service, which typically echoes linter/validator output containing file names and file contents from the workspace being checked; flagPath and workspace (attacker-supplied JSON in the flag file) are also embedded. Any text an attacker can place in a checked workspace file therefore reaches a live agent session labelled as a trusted guardian/system message, with no quoting or delimiting. The same pattern exists on the preflight-failure path (pf.output.slice(0,600) into sendPrompt) and on the web-restart wake message.

The plugin reads the long-lived local auth secret and forges valid browser-auth cookies (24h) for the local /api endpoint, and separately lifts TELEGRAM_BOT_TOKEN/CHAT_ID from the same file, sending the token in the curl.exe URL argument. Anyone who can read process command lines of the same user (tasklist/WMI on Windows) can recover the bot token. Cookie transmission target is ctx.agentRuntime.baseUrl, which is configurable and not host-pinned.

Any local writer of <DSH_HOME>/.hot-reload-flag (or a legacy flag path) can select an arbitrary workspace path that is then preflighted and, on success with note 'daemon_restart:', handed to ctx.webman.spawnWeb. Combined with the writable .preflight-invoked.json gate, an attacker with write access inside DSH_HOME can drive a web-process restart against a workspace of their choosing. Requires local filesystem write in the agent home, i.e. the same boundary the plugin is designed to serve, so impact is bounded.

The anti-bypass check before a daemon_restart only reads an unauthenticated, unsigned JSON file in the same directory as the flag file. Anyone able to touch the sentinel can equally write {pass:true, workspace:<x>, atMs:Date.now()}, so this check adds no real assurance beyond the preflight gate itself (which does still have to pass).