dsh.so
EN
English中文
@liushQAQ/dsh-anywhere avatar

@liushQAQ/dsh-anywhere

专为 DSH iOS App 与多终端协同打造：多设备同时在线无缝切换、实时同屏收发、锁屏秒级自愈（Fast-Resume），支持局域网 3082/3083 隔离与三层通用稳定外网通道。

PluginTerminal / Shell
Verification
L5 · Run tested
Verified
Risk
LowRisk
Health
Active
Trust
Gold

Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →

Install verification badge dsh 0.2.1-rc.2

What it does

专为 DSH iOS App 与多终端协同打造：多设备同时在线无缝切换、实时同屏收发、锁屏秒级自愈（Fast-Resume），支持局域网 3082/3083 隔离与三层通用稳定外网通道。

Installation

dsh plugin --profile web add github:liushQAQ/dsh-anywhere
verified

Install method: GitHub · runtime verified (L5)

Verification & Compatibility

Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.

External credentials (plugin-level): none detected

Declared DSH compatibilityfrom package.json · peerDependencies
author declared no dsh version requirement

○ The author declares no dsh version requirement — install is not blocked by version.

Install compatibility matrix (rows = plugin versions〔latest 5〕, columns = dsh versions〔latest 5〕)
At-a-glance → evidence in the cards below
plugin ＼ dshdsh 0.2.1-rc.2
v1.0.8·
Install compatibility (by plugin version, dsh versions within)
Legend:✓ L5 runtime verified○ ecosystem plugin◼ ecosystem app✗ failed
v1.0.8github2026-10-21

https://github.com/liushQAQ/dsh-anywhere

No runtime install test for this version (static scan only) — compatibility unknown, never assumed.

Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-anywhere-2.svg)](https://www.dsh.so/artifact/dsh-anywhere-2/)`
dsh 0.2.1-rc.2 install verified
`[![dsh.so install · dsh 0.2.1-rc.2](https://www.dsh.so/badge/install/dsh-anywhere-2@0.2.1-rc.2.svg)](https://www.dsh.so/artifact/dsh-anywhere-2/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-anywhere-2Automated review · daily

Static low, dynamic medium — stricter wins → overall medium.

static low→dynamic medium→overall medium
0 critical·0 high
mediumoverall · medium
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin versionv1.0.9dsh manifest
scanned versionv1.0.9git2026-10-21
current versionv1.0.9same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (5)
  • warningnetIp · networkclient/anywhere-locales.js:94

    'namedHow': '在 Cloudflare Zero Trust → Networks → Tunnels 创建隧道并复制 Token；把域名的 Service 指向 http://127.0.0.1:3081（代理端口）。地址固定，重启不再变化。',

  • warningnetIp · networkclient/anywhere-locales.js:200

    'namedHow': 'Create a tunnel in Cloudflare Zero Trust → Networks → Tunnels and copy the token; point the hostname\'s Service at http://127.0

  • warningchildProcess · code-execlib/restart.js:69

    ' const child = spawn(file, args, { cwd, detached: true, stdio: ["ignore", out, err], env: process.env })',

  • warningfsWrite · fileslib/restart.js:72

    ' try { fs.appendFileSync(logErr, "restart helper failed: " + (ex && ex.message) + "\\n") } catch {}',

  • warningshellExec · shelllib/service.mjs:75

    execFile('ipconfig.exe', { timeout: 3000 }, (err, stdout) => {

2dynamic auditmodel reads redacted source context · never executes plugin code
highest grademedium
merged intooverall medium
audited at2026-10-19
findings0 critical·0 high1 medium / 2 low hidden
show 3 audit findings
  • mediumNetwork-reachable RPC lets an authenticated client read arbitrary host filesclient/api.js:20

    The shared client/host contract exposes a fileRead endpoint whose stated purpose is to return the body of a host file to the browser. client/mobile/fileGuard.ts feeds it paths scraped from DOM text (`const filePath = (el.textContent ?? '').trim(); const res = await readFile(filePath)`), i.e. an arbitrary absolute path string crosses the wire. Because the plugin also publishes that page through the 0.0.0.0:3083 LAN proxy and the public tunnel, anyone who passes the PIN gate (or any LAN device if the user turns the LAN PIN off, which the UI offers) can request e.g. ~/.dsh/dsh-anywhere/settings.j

  • lowRemote-triggerable host restart spawns a detached node helper and SIGTERMs the current processlib/restart.js:98

    restartHost() rebuilds the launch command from process.argv and spawns `node -e <generated script>` detached, then after 500ms kills its own PID; the exposed anywhere.restart RPC is callable by any PIN-authenticated remote client. The generated script only embeds JSON.stringify'd trusted argv/log paths, so there is no command injection, but a remote caller can repeatedly restart the host (availability) and if the helper fails DSH stays down.

  • lowProxy listens on 0.0.0.0 with LAN exposure enabled by defaultlib/service.mjs:180

    The proxy that fronts the code-executing DSH UI binds every interface and LAN access defaults to on (`getLanEnabled = () => true`, settings lanEnabled !== false), so the whole local network can reach it out of the box; the only barrier is the PIN check implemented in lib/proxy.mjs, which was not harvested, so its strength (brute-force protection, timing safety, enforcement when lanAccessEnabled() is false) cannot be verified.

PIN-gated LAN/public proxy plugin; the real residual risk is a network-reachable fileRead RPC, plus auth/proxy code that was not in the harvested source.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-10-21 · activity: Active

• Repo created: 2026-10-12

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/liushQAQ/dsh-anywhere

Was this page helpful?